Of Roku Breaches and CIA-Hacked Samsung TVs...
So what does the recent Roku data breach of user credentials breach have
to do with the CIA hacking into Samsung TVs and using their voice command software to surveil unwitting citizens back in 2017?
On the surface, not much. The two events are seven years apart, there are different approaches on the attack, and different amounts and/or types of information were obtained.
But if we look deeper, they reveal a common thread – the vulnerability of Internet of Things (IoT), and how it can be exploited.
Roku Data Breach
Let’s take the Roku data breach. More than half a million accounts, 576,000 to be precise, were compromised in a recent breach. This is on top of the 15,000 accounts already compromised earlier this year – which makes 591,000 compromised accounts total for 2024 so far. The strategy for this most recent attack is not new, but not something we’ve covered on our site before: credential stuffing.
(You can learn more about other types of attack here.)
In a credential stuffing attack, the threat actor takes a database consisting of usernames, usually emails, and passwords, to seek out any other accounts using the same username and password. Here, they targeted Roku accounts. So, just like you could import your contact list from Outlook to an Excel spreadsheet, the threat actor imports both the email or username and the password for an account, then deploys it against a platform like Roku.
The data does the dirty work, not the hacker, because all the data is looking for is a match – one username matched to one password, and viola, you’re in.
Roku denies being the source of the data breach, claiming the compromised accounts were from a different site.
Here are the ramifications for Roku.
-
- In less than 400 cases, hackers used Roku accounts to make purchases. Roku is in the midst of identifying and refunding these purchases, representing a loss in revenue
-
- For the nearly 600,00 total compromised accounts, Roku may have to provide complimentary identity theft monitoring and protection for a year, per user, which is a standard industry practice.
-
- While Roku denies hackers could access payment information, they are shifting to implementing two-factor authentication for their more than 80 million users.
CIA Hacks Samsung TVs
This brings us back to the hacking by the CIA on Samsung TVs back in 2017. The CIA claims no data or information was collected from general American citizens, only suspects currently under investigation.
Regardless of what the CIA actually did or did not gain, both breaches were the result of assumptions on the part of users.
Assumption #1: It’s never going to happen to me.
Even though everyone who has ever sat through any kind of IT security training knows to use a unique password (something that, pretty pretty please, isn’t password123) we get lazy trying to remember all of them. That’s why we suggest using a password vault like Bitwarden. In addition to securely storing your passwords and payment information behind multiple firewalls, can also generate nearly uncrackable, 26-character passwords for you. You don’t have to remember them, because Bitwarden will. This includes passwords on IoT devices like your smart TVs, assistant hardware like Google and Alexa, and gaming systems. We strongly recommend NOT storing your passwords on your browser, as it can be easily compromised.
Assumption #2: Account setups and passwords are optional
Every place, every device you are suggested to set a username and password, do it. Yes, even for your smart TVs, your Playstation, your Google Nest or Alexa, anything in your home that is an IoT device that requires or is optimized by the internet. When you’re doing a setup on a new device, and it asks you to set a username and password, don’t hit skip. Do your due diligence and secure it, for you and your family.
Because you never know who’s watching or listening, just waiting for you to slip up.
Interested in how other IoT devices have been hacked?
Read more about hacked baby monitors here.
Read more about hacked gaming consoles here.
Read more about hacked home devices, like Google Nest or Alexa, here.