Crossposted from https://infosec.pub/post/52518361
The TV world has been a pot of controversy thanks to a two-hour-and-15-minute video from Gamers Nexus claiming LG TVs are nefariously spying on everything you do. They can record and store audio even when they seem to be off, track everything you watch, and could even be hacked remotely and turned into covert surveillance […]
Oh the irony
Samsung Privacy. Download or Delete your data and opt out for all Samsung apps and Services.
My request is processing for the last 6 hours…
Sigh… it never ends.
This article is utter bullshit normalizing this invasion of privacy by entertainment hardware vendors. “Everyone is doing it” is not a valid defense, it only shows that no one should be doing it and that the laws are too lax and not protecting people as they should.
Entertainment hardware vendors? Dude, it is just a monitor. I don’t agree with their practices, but I also don’t understand why someone would connect a TV to the internet.
But hey: some people want to play Doom on their fridge. shrug
the big mistake is buying a smart tv in the firs tplace.
It’s hard to find dumb TV. But you can just use a smart TV without connecting it to the internet.
That’s a bit of a misconception, TV’s have other potential paths to try and get themselves connected. Say connecting itself to an unsecured network or uploading through a data stream over HDMI. Or you sell the TV and the next person connects it to the internet (TV’s can store a lot of data too).
The only real ways to cripple a Smart TV is to either destroy the ability to spy (disconnect mics etc.) or properly contain it in a firewall.
Is there any evidence this happens? Why would manufactures go to the trouble of making a nefarious hacker TV when 99.9% of buyers are just going to type in their wifi credentials when prompted?
You should watch the gamers nexus video. The LG TVs they tested automatically look for open wifi networks to connect to and once connected to a network scan for all devices on the same network and send that back to the mothership.
Glad mine is maybe 10 years old at this point.
This is sort of a solvable problem is the thing. If you just check there’s no open networks in/near your home, and do a factory reset when you sell it, you’re covering both of the hypotheticals you mentioned.
If the TV can’t talk to anyone, it can’t talk to anyone. It’s too expensive to insert complements into millions of units for edge cases when so many people connect their TVs anyway.
you’re assuming a factory reset wipes rhe stores surveillance data. which I’m pretty sure the GN video touched on. you CANNOT assume this.
Sure, but you’re selling a TV to someone else. What better way to obfuscate your own data then letting someone else have their “Bob Jones TV” connected to Bob_JonesWifi, and wow, we got 3 years of data? It’s not exactly going to catch you.
I don’t want a backlog of transcripts of my private conversations I’ve had inside my home get uploaded once the next owner connects it to their wifi.
But the TV will think it’s their conversations, that Bob Jones. It has no way to know it moved houses. It will attribute it all to someone else.
Also, just get power strip with an off switch and cut power to the TV when not in use. No power, no data collection.
Once again, a solvable problem if you just think it through.
Need to put them in a faraday cage.
In fact, maybe your entire house should be a faraday cage
How to tell if something is possibly spying on you:
- Can it connect to the internet?
- Is the firmware/software controlled by a corporation?
- Does it have sensors capable of surveillance, like a microphone or camera?
I’m concerned you may not even need to connect it to the internet. It may be enough for a neighbor to leave their WiFi unsecured. The TV may very well watch for one and use it to upload.
So what i’m hearing is I should spin up an open ssid and black hole the traffic
It can be even worse than that. It can use other TVs in the neighborhood that are connected to the internet and just proxy it through them. It’s called a mesh network.
Is there evidence of that? Or is this also like saying an unconnected TV might be slipped the WiFi password by a connected dishwasher through a series of ultrasonic beeps? Sure, not impossible, but also not likely in every home.
I recall seeing an article about it a while ago but I couldn’t find anything via a google search so I guess take it with a big grain of salt.
Right. So, I’m a privacy advocate, and there’s a looooooot of conspiracy theory stuff like this out there. Yes, there are real versions of this, but companies are also notoriously cheap. There’s a point of diminishing returns on how many components they’re going to slap on a board in hopes of netting data on 1000 more users. Something that costs 2 cents more per board will go into millions of devices and cost hundreds of thousands over a production run… To net $30,000 of data? Experiments usually fizzle based on that math. They’re very often glad to have the fools that connect the TV themselves, which is an increasing proportion of consumers, I think about 65%+ of them last I checked. They’re already eating well without getting overly silly and crazy about how these things work.
Bro you’re researching privacy with Google wyd
I used google as the generic search term. I personally use no aI DuckDuckGo
May be. I’m still waiting for someone to show me a case of that happening, because I’ve been unable to find one.
I’ve never seen proof it happens, so it might not, but I sure as shit wouldn’t suggest it to them if they haven’t thought of it yet.
Cellular modems are getting cheaper. Maybe in a few years they’re looking for Meshtastic nodes.
True, updated above.
Wdym by unsecured? No password?
Yeah, fully broadcast SSID with no password, blatantly obvious to any who look and free to access for any who try.
Anytime a company gets caught spying, it’s pretty safe to assume they all do it but that company was just the first to get caught.
A bit beyond that, though, if pressed, they’ll say they NEED to do it to remain competitive. That’s their reasoning behind every evil thing they do. On the rare occasion they call for some law to restrict the industry, it’s because their company is having trouble competing.
They’ll do anything to profit that isn’t explicitly against the law in whatever country they operate in. But they will also do things against the law if the penalty isn’t high enough to stop them. They will take into account the social penalty, but if the profit is high, and they run a virtual monopoly, then the social costs are almost always outweighed.
They take everything into consideration but have zero empathy or morals, so that never enters the equation. Profit is all that matters.
Gamers Nexus said that they assume other brands are just as bad but they only wanted to spend the funds for the one company
Not wanted, had. They would love to do more. And in fact part of the fundraising around this is for that. GN and gamer jesus’s only recently turned to heavy investigative journalism. But they don’t have a sugar daddy to fund them or dedicated viewing area to sell advertising to. Their situation with alphabet and YouTube is very adversarial as well.
100%
Until there is real regulation (which in this case, may actually happen) that is what you should be assuming.
This is why I thought the “talk to your TV remote” things were all garbage…Involving a fucking microphone and a speech to text algorithm and potentially cloud bullshit just to fucking change a channel? Change the volume level? STUPID. It’s much worse than just pressing a fucking button and having the volume / channel change immediately, as well as a needless sacrifice of what little remains of your privacy.
I don’t get it with smart switches / smart fans and shit either. Like a light switch already works completely fine guys. I don’t know why we need to be able to talk to this shit.
There are smart switches and fans and other switchable devices that are controlled through schedule and manual BT switches and ir sensors - rather than voice. I can use voice to control things but I prefer the lights to match my day without my interactions being necessary.
Typing on a TV remote is a miserable experience but we’ve already solved that problem just put a damn keyboard on the remote already
-
Build a cheap PC or buy an NVidia Shield to be your media center. (I actually use a SteamLink to my desktop PC.)
-
Never tell your TV your Wi-Fi password.
-
Use a wireless keyboard with touch-pad as your remote.
(4. Pirate stuff over a VPN.)
-
100%
Personally I have a smart litter box triggering an exhaust fan for 10 minutes every time it cycles.
My A/C turns off if you leave the patio door open for a couple minutes.
I have a light upstairs that I turn red when I’m in an important meeting, like an On Air button.
The foyer light turns on when you open the front door at night.
There are useful things to be done, and most of my info doesn’t leave the house.
None of these use cases require modern “smart” things.
Sure, you can tie a string to one end, and, uh…
Sensors, timers, and other tons of non-ip networked solutions exist. I have lights that automatically turn on with bulb sensors and it does not require that they be IP networked with each other. Your red light could be wirelessly triggered on a lamp in another room if you wanted without IP networked devices. Many of the “dumb”, working solutions for these problems are cheaper and less complicated than using their networked equivalents.
I have motion sensing, magnetically attached wireless lights that turn on when I go down the stairs. I even have things that can use a single light switch to trigger multiple lamps without rewiring that required zero IP networking.
There are wireless light switches that have no battery because the switch sends a signal using the power from the force exerted on it. There are many types of automation that do not require IP networks.
Link to these devices? Sounds neat
I like to be able to turn the fan/AC/heat on and off without getting out of bed, or when I’m on my way home.
Right now they’re all just on isolated smart plugs, but if I was to set up more then I’d use homeassistant or something.
Matter over Thread with Home Assistant is the smarthome tech I’d recommend.
With that setup it all stays local. You can even block everything from the internet, unless you want to do an update.
It will work with Google/Apple/Alexa, but of course as soon as you do that… well, that’s the point of running Home Assistant instead.
Zigbee for me, but on the apple front you can integrate homekit and control what’s exposed. As far as apple is concerned there’s just a webhook “basement light” that has an on or off command i can say
people are stupid and lazy. that’s it. they want the easiest way to do anything because their ‘time is valuable’ apparently… like cooking… people use Uber for some dumb ass reason, then wonder why they are always broke. but ya know… they saved 30 minutes which was wasted doing fuckall but doom scrolling shitty websites
Solid article. Definitely recommend the read.
Here’s the video by Gamers Nexus the article is talking about. It’s 2 hours and 15 minutes long.
Oh shit I accidentally clicked accept on the terms for voice and I’m incredibly inebriated.
Wendell was having a blast for sure. 🤣
Well worth watching the whole thing.
For people thinking about opening up their remotes and removing the microphone. You’re free to do so as you please, but also note there has been zero evidence of any remotes doing any sort of recording unless the button is pressed.
Now this isn’t to say the recording isn’t forwarded to the mother ship once you do press that button, but the main concern has been the mic inside the TV. The remote has pretty limited batteries, if it were to record all the time it would run flat in a matter of hours. So if your remote does a year or so on the batteries, it’s not recording anything unless you press the button to do so.
Yeah. I think that is overkill. They leave the voice tied to a button so they don’t have to filter out background for a command. This is just cost driven and so far cost of manufacture still drives companies … Not data gained through background monitoring. Your data is valuable but not THAT valuable yet
My Samsung tv literally phones home and Netflix 24/7 even when it is off. My “Sniffet” app screams with nothing but Samsung and Netflix garbage URLs. So does my pi-hole. It’s insane how any of this is actually even legal.
See the same on my pi-hole. Chromecast is especially evil.
They can get around your Pi Hole with DNS over HTTPS these days. I don’t have one. Do you find yours still works well?
I’ve censored so much traffic that it has issues with certain things. If there wasn’t a price crisis I had planned to build my own Android TV box with an old Intel NUC or such but not at these prices. I’ve not looked into anything about DNS over https. I am behind a VPN at the router though not sure if that helps.
FYI the default blocklist included with PiHole does not block smart TVs. Strongly recommend Perflyst SmartTV List:
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
I don’t use the default one from pihole, I had to dig around to find the ones that actually did block all the ads and other garbage. But I’ll definitely dig into the link you have provided. Much appreciated, fellow great human being <3
Make sure to also use the extra RegEx list at https://perflyst.github.io/PiHoleBlocklist/regex.list, which helps remove regional LG ad domains among other things.
——-
But hasn’t been updated since 2023. Oof.
Can they be rooted? I’m honestly about to throw them out.
I know LG TVs can rooted, but I don’t know about Samsung. It actually won’t matter anymore until the government legislates something to make this shit illegal. All of this actually go against the 4th amendment in the US. I that LG has been talking about putting a little modem in their displays that gets its internet from the whole neighborhood’s routers after some deals with AT&T (I think). So then disconnecting the tv from your home network won’t matter.
The fourth amendment only binds the government, not private individuals or companies.
True, but how many of these companies don’t actually give that data to the government?
Doesn’t the fourth amendment apply to the government, much like the first?
It does, but all these companies are willing to hand out data to the government easily.
I was thinking of taking the Wi-Fi board out entirely
That won’t matter in the future. You’ll need to think of taking the future modem they’ll put there.
Not if you still have a 1080p dumb TV from 10-12 years ago (I forget exactly its so old).
Or a cheap Chinese projector and a Linux laptop.
Back in the day, that would be hooked up to a cable box. Those allllll had microphones in them. (They may have even had cameras and thats why they always wanted to use line of sight remotes so they wouldnt be blocked behind something)
A very common myth. Cable boxes, at least from my local cable company didn’t have microphones or cameras. I’ve taken apart a number of them and found the absolute cheapest, bottom shelf, minimal viable components in them, which is why they broke all the time, but never once found a microphone or camera.
There weren’t cameras. Source old tech from the day.
So come back to this day, you basically hook it up to a linux pc
It’s not just LG. Every
TVcompany is spying on youthere, I fixed it.
Duh… it’s pretty much like how the news only covered that one auto maker about how they track your activity but the reality is, they’re all doing it.
If it has a mic or GPS, you better believe they’ll have a way to track you. Don’t matter if Android or iPhone, Kia, Niisan, whatever. Tech bros and the state are all in cahoots.
My car is pretty old, so this may not work for everyone, but I can pull the fuse that powers the modem, then program the carnet or whatever VW calls it so it doesn’t expect to find a modem. All you need is an ELM327 dongle and one of the apps. (Car Scanner Pro is like $8 and a single payment.)
