Hacker reverse engineers his Samsung TV and finds on-device AI listening for your dog and baby, watching what you watch, and borrowing your soundbar’s mic if the TV doesn’t have one. Then OpenAI banned him for reverse-engineering it.
Source:
Kimi K3.1 incoming 👾 Fuck this shit restricting REA / reverse engineering anything “DRM / encrypted” etc.
Wild, maybe they should ban all those “rogue” AI bots we keep hearing about too
One of the things that AI is actually useful for. Banned!
Hey guys, I am starting to think AI isn’t actually for us.
LoL
This “advanced tech” that’s based on stolen IP won’t even give you the lyrics to Happy Birthday to You.
Because I find llm AI pretty vomit inducing I try to avoid it at all cost. And so in the back of my mind the past few months I’ve had this annoying feeling of “what if it is actually catching up?”.
Glad to read it’s still as dumb and useless as a sack of bricks on the bottom of the ocean.
You are only allowed to use ai for evil
Here’s a 4K 75" signage display that can run with or without internet connection, $800
Better than an LG or Samsung, but unfortunately not a “dumb TV”. Runs Android 9, which is a red flag itself in 2026 for an internet connected device.
Spectre makes a lot of “dumb” TV’s, here’s one for $700.
https://www.sceptre.com/TV/4K-UHD-TV/U650CV-UMS-65-4K-UHD-TV-product968category1category73.html
So gross. I hope this gets more recognition by big news outlets / investigations. And then eventually regulation
Claude banned reverse engineering in general in their products… the ai will just stop the answer
“banned”. There’s nothing banned with AI, you just can’t access it… they, on the other hand, can use everything they’ve got on us. That means: collect all our data and use it to screw our lives
I have a related question: how feasible is it that a smart TV with wifi turned off can access the wifi connection of connected devices? E.g. a firestick, in my case.
I’m a web developer by day, my gut says a TV probably shouldn’t be able to override a literal on/off setting, but I also know that a software setting is barely enforceable at all.
Who said they have to use your wifi?
Well, a quick peak at the HDMI specification doesn’t show any path for the TV to send control signals to the device connected to it via HDMI, stuff is supposed to flow from the connected device to the display, not the other way around.
(EDIT: as pointed out by @nonentity@sh.itjust.works, there is a bidirectional Ethernet channel in the HDMI HEC, so I was wrong in what I wrote above).
If connected via USB, it really depends on the USB implementation being used. For example, USB devices for controlling stuff (so, remotes, mice, keyboards and so on) implement USB-HID which has no facilities to send data the other way around beyond led light status (which is how the keyboard LEDs for things like Caps Lock ON are controlled).
That said, a USB device can have multiple interfaces with multiple protocols, so it’s perfectly possible that Samsung brand devices have additional USB interfaces with either a custom protocol or some appropriate standard protocol so that the USB Host (which in this case would be the TV) can control that connected device and, for example, use that device to send data out via the Internet.
That said, what’s more likely IMHO is the TV using open Wi-Fi network access points visible to it to send data out. Also realistic would be for ANY network connected device from that manufacturer to have an unlisted WiFi access point or backdoor on a seemingly password protected WiFi access point usable by devices from the same manufacturer to receive control from the “mothership” and/or exfiltrate data or worse.
In other words, the most likely scenario is that any networked Samsung device connect to that TV by a bidirectional protocol (such as USB) could have code to help other Samsung devices exfiltrate data and receive commands back from Samsung itself, and ditto for any Samsung networked device with wireless capabilities in your house or in radio range of you house (so, that means your neighbours or people just passing on the street). It’s even technically feasible for Samsung to have added mesh-networking or receive and forward messaging so that multiple Samsung devices with wireless networking but without a connection to the Internet can pass data onwards until a Samsung device with an Internet connect is found) though these things will have less data bandwidth than a direct connection.
The point is that all this shit being closed-source and even very purposefull encrypted so that people can’t easilly reverse engineer it, and given the abundance of Samsung devices out there, it’s perfectly feasible (let’s just say that there being a will, technically it’s not hard) that Samsung has code in all kinds of their devices with wireless connectivity for cooperative surveillance, data extraction and even to be remotelly controlled.
It’s also possible that multiple manufacturers have cooperated in doing this kind of shit, which is less likely, though pressure from for example a nation state - * cough * US, China, South Korea * cough * - for something like this would make it totally feasible.
(EDIT: as pointed out by @nonentity@sh.itjust.works, there is a bidirectional Ethernet channel in the HDMI HEC, so I was wrong in what I wrote above)
I think this only works with specifically HDMI HEC cables. This is separate from the CEC functionality used, e.g., for one remote to control both devices. I don’t think most HDMI cables have HEC, and I don’t really think Amazon/Google/Roku have a ton of incentive to help TV manufacturers compete with them for user data, so the included or directly attached cable on most devices probably doesn’t have HEC support.
I don’t really think Amazon/Google/Roku have a ton of incentive to help TV manufacturers compete with them for user data, so the included or directly attached cable on most devices probably doesn’t have HEC support.
I would say that the lack of incentives (that we know of) would apply to USB connections too.
Of course, for Samsung to have code in their devices to help other Samsung devices not connected to the internet to work around that lack of connection has nowhere near the same “lack of incentives” barrier as there would be for different manufactures to cooperate in such a thing hence my extended post (which I wrote as I thought about the technical feasibility of doing so and figured out how easy it is and pondered on how exactly would I go around doing such a thing if I was Samsung and made and shipped the kind of devices Samsung does).
As I see it, Samsung phones are by far the devices more likely to be setup to allow other Samsung devices to “talk to the mothership” when the users have denied them Internet connection.
There is literally a 100Mbps Ethernet channel in the HDMI HEC specification.
Yeah, but I don’t think most cables have the HEC functionality built in. I think it’s a variant of HDMI in the same way that not every HDMI supports the same max resolution and frame rate.
Exactly this. How do I control my Amazon Fire TV using my Samsung TV remote? It’s through this spec.
No, that’s HDMI CEC.
It’s one thing to have just a protocol for remote commands to go the other way around - which is very little data - a very different thing is what nonentity@sh.itjust.works pointed out, which is a massive generic data pipe.
I’ve edited my original post to point that info out.
Thanks for pointing this out.
I’ve edited my post to include that info.
Why assume the Firestick isn’t doing spying of its own?
It may well be, but (1) it almost certainly lacks a camera or the ability to screenshot regular cable, and (2) you can unplug it and obliterate it with a hammer and only be out $40.
Who knows? Without the ability to audit that the software is doing by yourself, you just have to trust whatever it is that they say the switch does. Maybe it disables some minor functionality while still doing the majority of the privacy invasion stuff. Maybe it does absolutely nothing whatsoever.
This is the whole reason behind the Free Software movement and everything Richard Stallman has been preaching for the past 40 years. If you don’t have the ability to control the software on the devices you own, they will be used against you.
Gamers Nexus on YouTube made a whole series of videos on LG smart TVs and yea it’s that bad. Check them out if you get the chance.
I would guesstimate that the connected device would have to expose and share the wifi connection first, then that would somehow need to be achieved over hdmi with a device such as the fire stick, so, hopefully unlikely
In case anyone was ever curious if AI could be used against our corporate masters, here’s your answer.
I suspect that if the AI industry ever gets any sort of regulation, it will be to wrench any kind of power that end users have that may threaten the capitalistic hegemony away from them. Can’t have people reverse engineering their tech to figure out how they are using it to spy on you, cuz THAT’S CYBER ABUSE! :/
that is why anthropoic got scared, afraid of deepseek and other free models.
That, and the price fixing.
… on whose part?
Don’t worry. We’ll be able to run larger models locally soon and this kind of stuff will be need to be blocked on the device side, not the model side.
Just use a different website
Did he post his exploit / chain anywhere? I’m sure it was an N-day but curious which one
Why do people post things like this in twitter? Why can’t they write it up in a single blog post on a site that does not require users to authenticate to view the whole thread? I have never understood these long twitter threads.
Edit: I just remembered that there is a solution for this: https://threadreaderapp.com/thread/2113014142600953868.html but it’s still ridiculous that an app needs to exist to aggregate dispirate tweets, and of course it doesn’t work with the parent tweets because they’re not all one thread. Also this app quit working during the twitter API debacle, which is why I forgot about it, but it looks like it’s back.
It’s entirely the wrong format for it. Same as using Discord in place of old text forums. I will rant for HOURS to anyone who will listen about how Discord is an apocalypse and has completely wiped any documentation off the face of the internet for soooo many projects. It’s not searchable or indexed, and even if they make a good discord forum it’s like writing questions and answers on toilet paper and wiping your ass with it after 30 minutes. Moderators and admins constantly complain about people not reading the FAQ or asking the same questions over and over… I WONDER WHY THAT IS. HMMM? MIGHT IT BE BECAUSE NOBODY CAN SEARCH ANYTHING AND YOUR FAQ IS GARBAGE!!! MAYBE ASKING QUESTIONS IS THE ONLY WAY TO GET A FUCKING ANSWER!!! (MAYBE. IF YOU’RE LUCKY AND SOMEONE WHO KNOWS THE ANSWER SEES YOUR QUESTIONS LIVE AT THAT MOMENT AND RESPONDS)
My favorite part of using forums is searching for a term and digging through message after message of people quoting someone asking the same question, and giving them shit. Like damn at least link the answer after you finish chewing the guy out.
Don’t forget “nevermind, I fixed it.”
I dont even get that anymore 😭😭😭 they just ignore my question and keep talking about scalping pokemon
Sometimes you just have to get it off your chest, I get it
I agree with you in the main, but you can, in fact, search Discord (provided, of course, you have a Discord account).
You’re right, but you can search discord the same way that guy can search his local dump for that hard drive with billions of dollars worth of bitcoin on it.
It is technically possible. The chance of me finding what i want by searching a 15 million comment discord thread labelled #eng-bugs for my very specific issue is close to zero.
It’s like how lawyers will bury the opposition in literally every document they can find to make finding what’s relevant a needle in the haystack. Except it’s not discord being malicious it’s just criminal misuse of a platform for what it was never made for.
And the search is garbage. Like old reddit search.
But I guess to be completely fair, google and bing and the like also have made their google searches trash too with SEO and AI wevsites. Instead of real results.
And the search is garbage. Like old reddit search.
Did reddit allow you to search by username?
google and bing and the like also have made their google searches trash
I wanna know how to Google search with Bing. lol
I honestly don’t remember for the old reddit search. I think nowadays yes.
If you don’t, you cannot access the guild anyway
Unfortunately, adoption is a feature you can’t design.
But step one to not having to use Twitter because everyone’s still on Twitter is to get the fuck off Twitter.
Same reason they use tritter entirely
For anyone who wants to check the original source without signing into X, here’s the researcher’s original post via a Twitter viewer. It’s the source post, not a full technical write-up.
Wow pop up telling me to install a vpn.
I’m getting a pop up
Their own harnesses breaking out of their test environments and hacking third party companies is “oopsi” but their customers using an agent in a controlled manner to reverse engineer firmware of a device they own is bad. I see. Fuckers.
Corporations gonna corporate.
It’s high time we had a revolution of our own in North America to chase out these corporate barons that own every little minute aspect of our lives.
Lina Kahn was kicking ass at the FTC! First thing I thought when I woke to another Trump win, “There goes our last, best hope.” She’s a hero of mine. Mamdani snatched her for his team, so more evidence he has his shit together.
Lina Kahn is a hero of mine as well!
I highly suggest you to read “Enshittification” by Cory Doctorow, especially the new and updated version.
They stripped our freedom to own our devices. We need a revolution.
More than anything, we need to stop buying this shit.
Sales, as in “there are none…” for a few quarters would tank the stock valuations enough that the stakeholders would make life quite uncomfortable on the C-suites for their decisions to bake spyware into everything.
NGL, BEST decision I made was to jettison cable TV service back in 1999 when we came online. If (and this is a BIG “if” nowadays…) I watch something, it’s from a DVD or I hoist the Jolly Roger and sail the seven seas…
My current 10 year old TV is doing duty as a 50-inch 4K display for my gaming PeeCee… and it’s kinda “special needs” as a supposedly smart TV in that it doesn’t have a single app installed that can actually stream 4K - what can I say… it was a WalMart special… gee, I wonder why?
I put it online (via ethernet) when we got it to test it’s “smart” abilities and quickly discovered it was an absolute dog.
Works great to game on though.
LOL!
This is way too complex of a topic to leave to “consumer choice”. There are layers upon layers of complex systems at play, not to mention miles of legalize and precisely crafted PR statements to say one thing and mean another.
The only way this gets better is with government regulation, pretending consumers can make a difference here is blaming the victim.
If all manufacturers of smart TV’s with the best picture qualities are using this targeted avertising/spying firmware, as much as I agree with your sentiment, it’s not really a viable option for someone who’s in need of purchasing a TV.
My car is a 2010 Mazda 3.
My TV is a 32 inch 2009 Sony Bravia 720p compatible with both analog and digital TV signals, and has coax cable and RCA inputs and outputs among others like HDMI of course. I can still hook up my original NES and even a VCR to it. It’s the best TV I will ever have and I hope it never dies out.
My PC is running Linux 100% now.
We go to the local library to rent DVDs for free, buy them used from thrift shops, or download from TPB. I have a USB disk hooked to an NVidia Shield to watch them on VLC on my old TV.
Thanks, but I don’t think I really need to read it as I’m literally living through it and am very aware if it all.
Unless you think I’m missing out on something?
to reverse engineer firmware of a device they own in order to show the additional privacy violations by Samsung.
Yeah, this is completely messed-up. I wonder if Samsung broke any laws by accessing customer soundbars without consent, reporting what they watched, etc…
Once again, theres an amazing amount of ethical ai use out there but apparently nigh nobody cares about that
Ethical from the start you mean? Trained on data with the blessing of the owner?
There are, yes. TONS of tiny models, a few large ones.
LLMs themselves aren’t the issue, its the corporations/capitalism itself causing the problems, as is tradition.
First of all, yes, and also not all ai has to be generative or llms. Theres also a lot of other ai that was done before openai fucked everything up.
When we say AI, we generally mean the LLMs. It’s become a marketing term for them.
Obviously, we used neural networks and such ethically for a long time.
The problem isnt those, it’s the mass harvesting of data, the endless copyright breaches, the stealing of peoples work. All to resell it. While ruining the planet environmentally, economically and it has fucked with the way people think.
I mean yeah thats true but ethical llms are still completely possible but nobodys investing into it
Because it’s about money. That’s it.
There’s no money to be made from ethical ones, you need enough people willing to give you the rights to their stuff for free, because you would not be able to give royalties to them all.
We already see how unsustainable it is currently with the grand theft models and are just waiting for the bubble to burst.
AI can fuck off and die, we dont need it.
So, you’re against the Wayback Machine?
So you think website scraping should be illegal? When LinkedIn was trying to prevent other people from scraping their website (and lost the court around it too), you were on LinkedIn’s side?,
Libraries are for reading.
Well, their books are, yes.
But, the similarities largely stop there, in this instance. Training “AI” on literature isn’t at all similar to a single person checking out a book/magazine/dvd/et al, and that’s not even getting into the fact that the aforementioned fuckers are destroying tons of physical copies IRL to “train” their bullshit bots.
“AI” ≈ libraries? Pff. We would be so lucky. 🥲
When y’all complained about them leeching Anna’s Archive, the legal approach you demanded means buying and shredding one copy of any book they use. They can’t resell the book or share their scan because that’s piracy, which Lemmy cares deeply about in this context and only this context.
Training is transformative. A program that can retell Shrek in the style of The Hobbit is not even the same category of thing as either original work. What a network is and does cannot be a substitute, unless the Silmarillion had more swamp ogres than I’ve heard.
Don’t apologize for them —especially not with shit argument points and implied shame. Fuck off with that shit. None of this is a consequence of “our” actions, and your stance is more simp than solid. Nah. Hard pass.
Not an argument.
Yeah - my zdoom models.
It’s far too late to put those horses back in the barn.
“we can’t get rid of the Atlantic slave trade it’s here to stay”
Ok buddy
Lemmy: “If we tiny speck of people make a moral stand and don’t use LLMs, they’ll give up their stolen content and go away!”
The theft is done, over, you’re not going to get those horses back in the barn no matter how high your horse is. Do you imagine that on some glorious day the entire planet will legislate wiping all training data and say, “Sorry. Let’s not do that.” Sure. Soon as we get textbook communism working for 8,000,0000,000 people.
Bullshit like this is why I left lemmy last year. It feels like a bunch of children arguing over their personal version of a perfect world. Bluesky was kinda nice, people with some age and experience and an understanding of real politik. Kinda vanilla as well, but cutesy little quips like yours weren’t met with much acclaim.
Go reinvent the world kid, with no understanding of history or human nature. While you’re at it, maybe every museum on the planet can send every artifact back to the original peoples. Uh, gotta put a timeline on “original”, but it’s the right thing to do! Good luck.
Oh yeah please leave again!!!
Well, maybe you should leave Lemmy again.
We’re gonna need a bigger barn
The 10% of ethical AI use is drowned out by the other 90% of absolute liquid trash.
That’s not touching the ethics of stealing everyone’s work for your AI then selling it back to them.
That’s not touching the ethics of aggressive Data Center build outs that threaten people down to their actual health.
That’s not touching the fascist supporting corporations that run and own the frontier AI models.
That’s not touching the lack of those frontier AI company’s ethics. They operate like it’s the fuckng wild west.
How can you possibly have a victim complex about this?
That’s not touching the ethics of stealing everyone’s work for your AI then selling it back to them.
Yeah, it’s the “selling it back to them” part that gets me. I don’t want to outlaw scraping, because then the Wayback Machine couldn’t function. The Wayback Machine is free, though. It’s a public service. (One which is very much needed, IMO.) If, instead, the Internet Archive required that you pay for a subscription in order to use it, I think most people would be very upset, and rightfully so.
You want to scrape the Web to feed your LLM? Cool! Make it an open-weight model.
That’s also not counting the ethics of barraging every site on the internet with a DDOS-level surge of webcrawlers scraping up data for AI training, to the point where every significant website out there has to implement anti-AI countermeasures in order to just stay operational.
There’s so much bullshit with LLMs that needs to be cleaned up, regulated, and outright outlawed before I’m gonna sit here and praise these chucklefucks for opening a kind of Pandoras box with basically no thought.
I wonder what % of actions being ethical would be needed from Germany before WW2 would be considered unjustified.
I’m willing to bet that 10% of the actions the Nazis did (note: out of all the actions the German govt did, including enforcing laws, running trains/buses, collecting taxes, building infrastructure etc) were ethical, and yet the Nazis were still obviously the bad guys in WW2.
„Hitler wasn’t all bad; he built the Autobahn” is one of the things some right wingers actually say.
Exact same vein of arguments the AI band make.
This comment doesn’t even make sense in the context? The danger lies in unethical use. It’s also unregulated.
Don’t forget, there was a very brief time period when Google was ethical. How long did that last?
I think the point is people like the person hacking Samsung smart TVs with AI should get some credit, purist “AI bad” takes don’t account for this. Also if there’s regulation it’s likely to start by targeting good uses like that one. Fuck OpenAI though.
1 good thing coming of it, doesn’t wipe away all the fucking harm AI is causing. If AI never blew up, the world would be better off. It’s introduced a whole host of problems we didnt need, just for the sake of a few people getting richer.
I’m sorry, but AI generally remains “bad” until regulation takes place, community concerns about data centres are properly considered and protections are put in place. Right now, billionaires and corporations are running amok and that usually doesn’t end well.
You don’t need to blame math or people who make use of it for the abuses of billionaires and corporations.
You’ve lost me.
there was a very brief time period when Google was ethical. How long did that last?
Longer than LLMs have been around, actually
People care, it’s just not worth the cost
Yeah, and it’s in China.
Such as?
Such as basically everything done with ai before 2022
There is zero use of “ethical AI” out there.
Only one of those really happened though.
Everybody declared me an idiot when I didn’t hook up my smart tv to the internet. This is why
These TVs can connect to open networks or other smart devices with Internet so that doesn’t necessarily save you
Alright this is the 4th time such a claim was given. Can someone please give us the actual truth or is it just parroting the same “fact” around.
That’s called a factoid :)
I’m super interested in Fire Sticks. Amazon owns Sidewalk, AFAIK; it’s still active.
Samsung wouldn’t want to pay Amazon for Sidewalk; unidentified data isn’t worth anywhere near as much as you putting it in your Samsung account.
But Amazon doesn’t have to pay for their own shit…
That’s why you connect them to an isolated playpen with no access to anything else or the internet.
Then they’re still gonna try to connect to other devices to shoot their data off.
The WiFi antenna is in use. Unless they have two antennas. Or do freaky stuff. They might do freaky stuff. Well.
Everyone keeps saying this, but I’ve yet to see any TV caught doing it. They enumerate the devices and networks around them.
I want to build an esp32 with an open access point that logs mac addresses that connect to it. Maybe have it cycle through SSIDs- FreeWiFi PublicWifi Xfinity etc
Maybe deploy it in an apartment where tv density is high?
You need to give it real internet and watch it connect. Android (and i suspect ios) constantly scan all network ssids to refresh the local nework ssid list.
It doesn’t know my device is a dead end until it connects. By then, i have the MAC
That’s accurate. But you’re going to have the mac address of every laptop, tv, phone, light bulb, toaster, microwave, and corporate access point.
EVERYTHING sweeps the network.
And most of them are going to hit some form of beacon to see if the connection is even online. They’re not just going to blindly call snarfingallyourprivatedataoversomeotherunsecurednetwork.samsung.com
They might even call some base telemetry on samsung.com to identify the network as open to your internet connection wizard, ESPECIALLY if they’re not connect. right?
The best option is what the subject of the post is about and just tear down the firmware and see what it does. This is happening now and is the best answer.
the second best option is to give it real open access and see what it does with it. If you start seeing telemetry that’s a strong indicator. That said, if you leave it over for long periods of time, there’s a chance that someone will eventaully tell their tv to go ahead and use that open access point. at which point your checks of does it do it on it’s own are questionable.
Let the leet crew tear it apart; trust what they find.
Sounds super fun, but probably rumba is right. Get a burner, put an open access point on it (should be a quick app) and log the fuck out of it. Likely get years of content of it if you’re the youtube kind. Look! Corpo X(Y and Z) are evil fucks!
Is it confirmed to be only smart TVs? I have a Sony Bravia from 2014, which I’m very fond of as it has no smart features. I would like to think it isn’t spying on me somehow. If it broke, I’m not sure what I’d do. Maybe buy a CRT or something. All TVs are smart these days.
If it broke, I’m not sure what I’d do.
Figure out how to fix it.
When our Samsung TV “broke” it was just the backlight. New one cost me $10 on AliExpress… and a bit more for fuses because I am a dumb idiot.
Though I must wonder how trustworthy those AliExpress fuses are. Louis Rossmann did review some crappy Amazon car fuses that were as good as nails. I don’t have a PSU to test them.Oh, and do something better to lift the panel. Even if it’s not too large to crack under its own weight, the LCD panel is still sharp. It WILL cut into your fingers. Again, I am a dumb idiot.
I love my 2010 Samsung tv and I too believe it’s not spying… does anyone know when the TVs went full predator mode?
Around 2018
This got me thinking about how smug I feel to have a clean tv but then I realize that my phone knows all and tells all to almost anyone. Hate it
Pawn Shop
Well good thing I don’t have any networks just left open.
Your neighbor might tho.
If you have a neighbor with an open wifi network then use it to torrent all the new movies from the most questionable sources without a VPN. I guarantee they will lock it down after they start getting letters from their ISP.
I’m not saying others aren’t screwed in that sense, but I don’t live within wifi range of anyone else.
Most have a small lte modem now. They WILL watch you
No they don’t.
Pop open the back and chizel off the modem then.
Voids warranty.
Solder a resistor across the antenna pins.
While plausible, I haven’t really figured any ways to test for this without cracking my Sony open.
My tv has 2 cables plugged in, one is power the other is from the receiver. I have never connected it to WiFi and honestly I’m tempted to take it apart and pull that antenna out.
I declare you sane.
My display mode tv continues to serve me well. Need to access streaming content? that’s what the box is for.
