Analyzing Computer and Network Security Flaws in Unfriended - Jonathan Hsu
Throughout the plot points of Unfriend: Dark Web, there are many instances of computer and network security, or lack thereof, being exploited in order for the antagonist to gain information about their victims, as well as directly threaten and interact with them. In this section, we will explore how some of these same exploits have been utilized using computing technologies found in the real-world.
On February 5th of 2020, a mouse cursor moving on its own across the monitor of a control terminal alerted attendants that their systems at the Oldsmar water treatment plant had been infiltrated by an outside attacker. This real-world example of computer infiltration happened due to the treatment plant's computers having Teamviewer installed on them, allowing the attacker to take remote control of these computers and interact with the applications that controlled water parameters for the town of Oldsmar. [1] In the movie Unfriended, Charon is able to remotely upload files to the laptop that Matias finds at the cafe, uploading video files as week as joining an ongoing Skype call on the device. If this were to be viewed from a real-world perspective, the antagonist is most likely able to achieve this by leaving a program similar to TeamViewer running in the background before leaving the laptop in the cafe's lost and found. Through this, he would be able to control the laptop remotely, which includes accessing the files located on the device. This would explain how Charon gained access to the video footage of A.J. in order to then alter the clips in order to frame Matias as a threat.
In late 2019, multiple users of the Ring home security ecosystem reported accounts of hackers being able to access their in-home security cameras, using them to spy on their families without their knowledge. While representatives at Ring eventually revealed that no data breach had occurred, and that the hackers had retrieved login credentials of these users from third-party applications, this example highlights how in-home security cameras can be utilized in a way that causes harm to the homeowner. Networked cameras were similarly used by Charon in the movie in order to monitor their victims. Through the use of these cameras, and presumably other recording devices not directly shown on-screen, Charon was also able to doctor a video showing A.J. planning an attack. He is also able to play audio through the victim's laptop, forcing police to view him as a direct threat armed with a weapon. Similarly, the hacked Ring cameras were used to broadcast audio into the homes of the camera owners. The audio played included threats, as well as disturbing message asking child victims to divulge information about their location.
Throughout 2019 and going into 2022, the popular internet message application Discord has gone through a few security flaws. These so-called "one-click" exploits were made possible due to vulnerabilities in the Electron framework that the application was built upon, and it highlights a broader issue with developers lacking an understanding of the frameworks with which they are building their software. [3] Charon IV is able to utilize similar exploits against Matias by sending messages to Amaya in order to mislead her into thinking that the messages were from Matias, and directing her to a location where she could be attacked by Charon. Security loopholes in Electron have cause there to be similar possibilities with hacking in Discord, primarily through uses interacting with links and embedded content sent by other users. These embeds allow malware to be delivered directly to the victim's device, giving attackers an avenue for exploiting data and sensitive information found on the device, as well as accessing accounts and services the end user may be logged into.
Informational Citations:
[1] "Florida Hack Exposes Danger To Water Systems". Pewtrusts.Org, 2021, https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2021/03/10/florida-hack-exposes-danger-to-water-systems.
[2] "Ring’S Services Have Not Been Compromised - Here’S What You Need To Know - The Ring Blog". The Ring Blog, 2019, https://blog.ring.com/2019/12/12/rings-services-have-not-been-compromised-heres-what-you-need-to-know/. Accessed 10 Oct 2022.
[3] "Researchers Found One-Click Exploits In Discord And Teams". Malwarebytes, 2022, https://www.malwarebytes.com/blog/news/2022/08/researchers-found-one-click-exploits-in-discord-and-teams. Accessed 11 Oct 2022.