Gadgets

Google sat on a Chromecast bug for years, now hackers could wreak havoc – TechCrunch

Published

4 years ago

January 3, 2019

Google was warned of a bug in its Chromecast media streaming stick years ago, but did not fix it. Now, hackers are exploiting the bug — and security researchers say things could get even worse.

A hacker, known as Hacker Giraffe, has become the latest person to figure out how to trick Google’s media streamer into playing any YouTube video they want — including videos that are custom-made. This time around, the hacker hijacked thousands of Chromecasts, forcing them to display a pop-up notice that’s viewable on the connected TV, warning the user that their misconfigured router is exposing their Chromecast and smart TV to hackers like himself.

Not one to waste an opportunity, the hacker also asks that you subscribe to PewDiePie, an awful internet person with a popular YouTube following. (He’s the same hacker who tricked thousands of exposed printers into printing support for PewDiePie.)

The bug, dubbed CastHack, exploits a weakness in both Chromecast and the router it connects to. Some home routers have enabled Universal Plug and Play (UPnP), a networking standard that can be exploited in many ways. UPnP forwards ports from the internal network to the internet, making Chromecasts and other devices viewable and accessible from anywhere on the internet.

As Hacker Giraffe says, disabling UPnP should fix the problem.

“We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device,” a Google spokesperson told TechCrunch. “This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable,” the spokesperson said.

That’s true on one hand, but it doesn’t address the years-old bug that gives anyone with access to a Chromecast the ability to hijack the media stream and display whatever they want, because Chromecast doesn’t check to see if someone is authorized to change the video stream.

Hacker Giraffe sent this YouTube video to thousands of exposed Chromecast devices, warning that their streams could be easily hijacked. (Screenshot: TechCrunch)

Bishop Fox, a security consultancy firm, first found the bug in 2014, not long after the Chromecast debuted. The researchers found that they could conduct a “deauth” attack that disconnects the Chromecast from the Wi-Fi network it was connected to, causing it to revert back to its out-of-the-box state, waiting for a device to tell it where to connect and what to stream. That’s when it can be hijacked and forced to stream whatever the hijacker wants. All of this can be done in an instant — as they did — with a touch of a button on a custom-built handheld remote.

Two years later, U.K. cybersecurity firm Pen Test Partners discovered that the Chromecast was still vulnerable to “deauth” attacks, making it easy to play content on a neighbor’s Chromecasts in just a few minutes.

Ken Munro, who founded Pen Test Partners, says there’s “no surprise that somebody else stumbled on to it,” given both Bishop Fix found it in 2014 and his company tested it in 2016.

“In fairness, we never thought that the service would be exposed on the public internet, so that is a very valid finding of his, full credit to him for that,” Munro told TechCrunch. (Google said in a follow-up email that it’s working to fix the deauth bug.)

He said the way the attack is conducted is different, but the method of exploitation is the same. CastHack can be exploited over the internet, while Bishop Fox and his “deauth” attacks can be carried out within range of the Wi-Fi network — yet, both attacks let the hacker control what’s displayed on the TV from the Chromecast, he said.

Munro said Google should have fixed its bug in 2014 when it first had the chance.

“Allowing control over a local network without authentication is a really silly idea on [Google’s] part,” he said. “Because users do silly things, like expose their TVs on the internet, and hackers find bugs in services that can be exploited.”

Hacker Giraffe is the latest to resort to “Good Samaritan security,” by warning users of the issues and providing advice on how to fix them before malicious hackers take over, where tech companies and device makers have largely failed.

But Munro said that these kinds of attacks — although obnoxious and intrusive on the face of it — could be exploited to have far more malicious consequences.

In a blog post Wednesday, Munro said it was easy to exploit other smart home devices — like an Amazon Echo — by hijacking a Chromecast and forcing it to play commands that are loud enough to be picked up by its microphone. That’s happened before, when smart assistants get confused when they overhear words on the television or radio, and suddenly and without warning purchase items from Amazon. (You can and should turn on a PIN for ordering through Amazon.)

To name a few, Munro said it’s possible to force a Chromecast into loading a YouTube video created by an attacker to trick an Echo to: “Alexa, order an iPad,” or, “Alexa, turn off the house alarm,” or, “Alexa, set an alarm every day at 3am.”

Amazon Echos and other smart devices are widely considered to be secure, even if they’re prone to overhearing things they shouldn’t. Often, the weakest link are humans. Second to that, it’s the other devices around smart home assistants that pose the biggest risk, said Munro in his blog post. That was demonstrated recently when Canadian security researcher Render Man showed how using a sound transducer against a window can trick a nearby Amazon Echo into unlocking a network-connected smart lock on the front door of a house.

“Google needs to properly fix the Chromecast deauth bug that allows casting of YouTube traffic,” said Munro.

Source link

Gadgets

Apple rolls out iOS 16.4 and macOS Ventura 13.3 with new emoji and features

Published

2 hours ago

March 27, 2023

Francisco Peguero

Enlarge / The 2021, 24-inch iMac with Apple’s M1.

Samuel Axon

Apple released new updates for most of its software platforms today, including macOS Ventura 13.3, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4.

These are all feature updates, meaning they actually add new functionality in addition to fixing bugs or addressing security vulnerabilities.

iOS and iPadOS 16.4 add a number of minor features. The headliner is (of course) 21 new emojis, like new heart colors, additional animals, and a shaking head. Beyond that, though, Apple says you’ll see improved voice isolation on phone calls, support for notifications from web apps that have been added to your phone’s home screen, new ways to weed out duplicates in your Photos library, and a number of bug fixes.

As far as accessibility goes, iOS and iPadOS can now automatically dim the screen when a video with flashing lights is playing, and VoiceOver is now supported in the maps found inside the Weather app.

tvOS 16.4 has only one listed change: the flashing lights protection feature we just mentioned for iOS and iPadOS.

On the Apple Watch side, watchOS 9.4 is mostly about bringing features to new regions. Cycle Tracking is now supported in Moldova and Ukraine, and AFib history has made it to those two regions as well, plus Colombia, Malaysia, and Thailand.

Then there’s the other big one: macOS Ventura 13.3. It includes several of the same features as iOS 16.4, including the new emoji, Photos duplicate album, and accessibility features. It also adds a “move background” feature in Apple’s visual note-taking app Freeform, which “isolates the subject in your image.” There are also some macOS-specific bug fixes, and you’ll find expanded language support for the keyboard.

iOS 16.4 release notes

This update includes the following enhancements and bug fixes:

21 new emoji including animals, hand gestures, and objects are now available in emoji keyboard

Notifications for web apps added to the Home Screen

Voice Isolation for cellular calls prioritizes your voice and blocks out ambient noise around you

Duplicates album in Photos expands support to detect duplicate photos and videos in an iCloud Shared Photo Library

VoiceOver support for maps in the Weather app

Accessibility setting to automatically dim video when flashes of light or strobe effects are detected

Fixes an issue where Ask to Buy requests from children may fail to appear on the parent’s device

Addresses issues where Matter-compatible thermostats could become unresponsive when paired to Apple Home

Crash Detection optimizations on iPhone 14 and iPhone 14 Pro models

macOS Ventura 13.3 release notes

This update includes new emoji along with other enhancements, bug fixes, and security updates for your Mac.

21 new emoji including animals, hand gestures, and objects are now available in emoji keyboard

Remove background option in Freeform automatically isolates the subject in your image

Photos duplicates album expands support to detect duplicate photos and videos in an iCloud Shared Photo Library

Transliteration support for Gujarati, Punjabi and Urdu keyboards

New keyboard layouts for Choctaw, Chickasaw, Akan, Hausa, and Yoruba

Accessibility setting to automatically dim video when flashes of light or strobe effects are detected

VoiceOver support for maps in the Weather app

Resolves an issue where Trackpad gestures may occasionally stop responding

Fixes an issue where Ask to Buy requests from children may fail to appear on the parent’s device

Addresses an issue where VoiceOver may be unresponsive after using Finder

Gadgets

Dealmaster: 1-day-only Nintendo Switch, Microsoft 365 deals; plus PS5 and AirTags

Published

3 hours ago

March 27, 2023

Francisco Peguero

Enlarge / The new OLED Switch above its predecessor.

Sam Machkovech

Kicking off the week, we have a couple of today-only sales, including a rare discount on Nintendo’s Switch OLED and a free $50 Amazon gift card deal on Microsoft’s 365 Family office software. There are also price cuts on the PS5 God of War Ragnarök bundle and Apple’s four-pack of AirTags.

Nintendo Switch OLED for $310 ($350)

Nintendo’s Switch OLED is the best Switch console that money can buy. In our review, we praised the larger, upgraded display’s completely blacked-out pixels and infinite contrast ratio whether gaming before bed or during the day. We also appreciated the bigger, sturdier hinge, ethernet-toting dock, and 64GB standard storage, as opposed to 32GB on other Switch models.

We still think the Switch Lite is an unbeatable deal in portable gaming for $200, but for those among us who like the best of the best, the Switch OLED is the ultimate portable gaming device. With today’s one-day-only $40 discount, it’s a bit more affordable now, too. Samsung’s 256 GB microSD Evo Select is also on sale for $20, which pairs well with the Switch for game storage.

PS5 God of War Ragnarök bundle for $510 ($560)

There’s not a lot we can say about the powerful, at times elusive PS5 that hasn’t already been said. Games load quickly thanks to built-in NVMe storage; it also includes an innovative controller; and the cooling fans are quieter and more efficient than on the PS4. The new DualSense controller also combines haptics and audio for a truly unique and immersive gaming experience, while also offering headset-free chat with a built-in speaker. As more legacy games migrate to PS5 and newer titles emerge, the value of PS5 only grows, making it a more enticing upgrade for PS4 owners since its launch. The God of War Ragnarök bundle is $50 off, which is the lowest we’ve seen for this bundle.

AirTags are the best way to find your lost stuff, if you're an iPhone user. — Enlarge / AirTags are the best way to find your lost stuff, if you’re an iPhone user.

Samuel Axon

Apple AirTags four-pack for $90 ($100)

AirTags are arguably the most capable item trackers on the market. The main reason for that is the theoretically endless range. Essentially, wherever there’s an iPhone or capable iDevice, there’s hope to find your lost item. The more devices in the area the better, so AirTags are ideal for densely to moderately populated areas. Without iDevices in the vicinity, they won’t do much for you, so they may not be the best pick if you’re more concerned with losing something on a mountain hike or romp through the forest. This deal gives you four AirTag trackers at a $10 discount from their typical price.

Enlarge / Microsoft 365 encompasses Teams, OneDrive, and the suite of productivity apps formerly known as Office. The Family version also offers 1TB of cloud storage per user.

Microsoft

Microsoft 365 Family office suite and $50 Amazon gift card for $100 ($150)

Work applications and deployments for Microsoft’s suite aside, if you and your family prefer creating and editing documents offline but also value vast online storage amounts, then this deal on Microsoft 365 Family is just for you. Today only, the gold standard of office software is on sale for $100 right now on Amazon with a free $50 Amazon gift card. That gives you six installations of Microsoft Word, PowerPoint, Excel, Outlook, OneNote, Skype, and Teams, along with six separate 1TB cloud storage spaces on OneDrive, and a $50 Amazon gift card. If you’re already a subscriber, you can stack years and pocket a nice $50 bonus.

Gadgets

Google is killing most of Fitbit’s social features today

Published

4 hours ago

March 27, 2023

Francisco Peguero

Enlarge / Fitbit’s now-dead Challenges feature.

Today’s the day for Google’s biggest change yet to Fitbit: It’s shutting down some more features. As Google announced in February, the popular fitness gamification features, Fitbit “Challenges” and “Adventures,” are being shut down today. Google is also removing the “Open Group” social networking feature.

Getting motivated to work out is tough for some people, so Fitbit’s software included a few ways to gamify fitness to keep people interested. Challenges were introduced in 2014 as a way to share and compare your step counts with friends, hopefully motivating both of you to get more exercise. The feature came with badges that could be earned for specific tasks and trophies for winning a battle. Adventures were announced in 2017 as location-specific challenges that highlighted local places that were good for exercise and hiking, like national parks and landmarks. You could tackle these areas solo at your own pace or participate in multiplayer “Adventure Races” where you could track your hiking speed or progress against other Fitbit users. This seems like something that would only get better with Google Maps integration. Oh, well.

Adventures, Challenges, and all player-earned trophies and badges are going away today. The Fitbit community on Reddit has been furious over the feature removals, with the most popular post of the past year being a call to cancel your Fitbit Premium subscription over the changes. On Twitter, Fitbit tried celebrating the company’s birthday yesterday, but nearly all the replies were about the feature shutdown and what other services people should switch to. Several users have confirmed today that the features are dead.

Enlarge / Adventures would have people battle it out in real-life hiking locations.

Fitbit

Google announced it would be acquiring Fitbit in 2019, and at the time, it described the deal by saying, “We see an opportunity to invest even more in Wear OS as well as introduce Made by Google wearable devices into the market.” Google’s blog post did not make any mention of continuing to produce or support Fitbit’s existing products and services, and rather than some kind of promise to supercharge Fitbit with Google technology, the blog post made it sound like Fitbit would be stripped for parts.

So far, we haven’t seen anything from Google to dissuade us from the initial impression that Fitbit will be slowly killed. Google announced plans to shut down the Fitbit account system sometime this year and move existing users to Google accounts. Google killed Fitbit’s PC and Mac syncing last year, so it’s no longer possible to load music onto the wearables. Fitbit Studio, a browser-based SDK for developing Fitbit apps, was given an April 20 shutdown date last month. Fitbit’s latest product launch, the Fitbit Sense 2 and Versa 4, brought big feature regressions compared to the old models. They were stripped of the Fitbit app store, Google Assistant, Wi-Fi support, and music controls.

The only non-shutdown action we’ve seen Google do with Fitbit is rush a half-baked Fitbit app out the door exclusively for the Pixel Watch. That Fitbit app is both worse than a real Fitbit and worse than Wear OS’ previous Google Fit app, before Google stripped out the advanced weight training options in 2020. There’s also Fitbit Premium on the Pixel Watch, a $10-a-month subscription service that enables some sleep-tracking features and new statistics. Is this the future of Fitbit? Some software? An app that replaces Google Fit? It’s still hard to say. Whatever Google’s plans for the future are, we can’t imagine that stripping all the key social features away from the existing community will earn it many repeat customers.