This computer screen hack that can manipulate pixels for malicious effect has raised security concerns.
Did you know that your computer screen can be hacked? A team of researchers demonstrated this at the DEFCON hacking conference in Las Vegas on Friday by directly hacking into the tiny computer that controls the screen without actually getting into the actual computer. They showed a way to exploit the malicious tiny pixels found on a computer screen.
"Since we can hack the screen in general, you shouldn't blindly trust the pixels coming out of your own screen," Ang Cui, lead researcher on this creative hack, told Motherboard.
Cui, the chief scientist at Red Balloon Security and a recent PhD graduate from Columbia University, along with Jatin Kataria were curious to learn how Dell monitors worked. Somewhere along the way, their curiosity led them to reverse-engineer one of the Dell monitors.
For their research, a Dell U2410 monitor was selected and it was discovered that the display controller inside can be used to change and record the pixels of the screen.
During their DEFCON presentation, they showed how, by getting the user to visit a malicious website or click on a phishing, they could hack the screen and apparently make changes to the details of a website, specifically the firmware. This computer is what controls the menu for brightness settings and other simple settings on the screen.
For example, they were able to change a PayPal account balance from $0 to $1,000,000, with the only thing that had actually changed being that the pixels on the screen had been reconfigured.
Both Cui and Kataria spent over two years of their free time discovering this vulnerability with a not-so-simple hack. During that time, they did research to understand the technology behind the Dell monitor.
However, they found that it was theoretically possible to hack displays from other brands, such as Hewlett Packard, Samsung , and Acer, as most well-known brands have processors that are vulnerable.
The main security issue lies in the software of the displays, or the firmware that goes inside. “There is no security in the way their firmware is updated, and that is very general,” Cui said.
The exploit requires an HDMI or USB port to access the display. Once the exploit is complete, the hack could open the way for more malicious attacks, including even ransomware.
“Cybercriminals could create a permanent message on the screen, demanding a fee to remove it,” Kataria said. “Or they could even spy on users’ screens, recording the pixels that are generated,” he added.
However, the presentation given by the researchers was to raise awareness about computer screen security. They also wanted to show that it is possible to hack a computer screen and that we should not take them for granted and as unhackable equipment. The hacking code has been posted in their research online.
“Is screen security important? I think so!” Cui said. “We live in a world where we can’t even trust our screen,” he concluded.
