Slashdot Mirror
Samsung TVs Can Be Hacked Into Endless Restart Loop
Gunkerty Jeb writes "Italian security researcher Luigi Auriemma was trying to play a trick on his brother when he accidentally discovered two vulnerabilities in all current versions of Samsung TVs and Blu-Ray systems that could allow an attacker to gain remote access to those devices. Auriemma claims that the vulnerabilities will affect all Samsung devices with support for remote controllers, and that the vulnerable protocol is on both TVs and Blu-Ray enabled devices. One of the bugs leads to a loop of endless restarts while the other could cause a potential buffer overflow."
My parents recently got a 52" Internet connected Samsung TV. Any way I could use this to replace the crap Samsung apps with something better?
On the up side you can't be inundated with endless commercials if your TV is in an endless restart loop ;-)
I throw it from the top of a building.
The buffer overflow is worrisome . A lot of the newer BluRay Players have additional features like netflix over wifi/homenetwork. The basic consumer may put in their credit card (or ____ forbid their debit card) info to start their netflix account.
Beware of those who profit off the docile and persecute the unbelievers.
So the hack just tunes the TV to Dave, then? :)
Where we had dumped carburetors for computer-controlled engines, but they didn't need to get updates, and those updates weren't wirelessly and remotely pushed?
Where we had dumped cathode ray tubes for flat, liquid crystal displays, but hadn't put the tubes back into TV by stuffing the Internet (and viruses) into them?
Where we had dumped both rotary and touch tone land line phones for cellular phones that could do most anything you'd want them to, and you carry it whereever you went, but you didn't have to have an antivirus running on the phone and didn't have to worry about your contact details being sent to Nigeria?
I'm not a lawyer, but I play one on the Internet. Blog
So now that TVs restart, I'm guessing malware isn't far behind?
After all, if you expect to turn every household device into a typical computer, you're also gonna drag the bad things computers have.
Can we 'regedit' tvs so we can use our own splash logos?
All glory to Arstotzka!
TV's will eventually have cameras in the front, could be a good method of surveillance.
In Soviet Russia, TV watches you!
Hey, speaking of which, anybody know how to boot to a vterm in Ubuntu?
Used to be you could do that in Redhat by going to a different runlevel. Not sure the recommended way for that in Ubuntu and friends.
(Also, anybody remember running "win" to start Windows from DOS and getting looks from the old-timers in the office when you started that new-fangled graphical thing?)
I'm not a lawyer, but I play one on the Internet. Blog
The vulnerability is originally disclosed here, not in the posted link.
This vulnerability only works from the same broadcast domain where the TV is, since the remote control protocol relies on broadcast messages to announce the service. This means that your TV cannot be cracked from the Internet. Let's hope that Samsung apply a fix soon, in any case.
Not really, considering the TVs run Linux: http://www.samygo.tv/
I own two Samsung Blu-Ray players. I'm not surprised by this in the slightest. You can usually judge the security of an app by how reliably it does its intended function, and their Blu-Ray players are anything but reliable. (Their older TVs work well, but I've never used one of their newer, networked TVs, which I'm assuming are as buggy as their Blu-Ray players.)
For example:
And so on. In short, Samsung's software quality control appears to be utterly awful. So hearing that they have security holes is almost as surprising as hearing that Flash has security holes....
Check out my sci-fi/humor trilogy at PatriotsBooks.
This does eliminate the age old IT question, "Did you try turning it off and on again?"
Why is this such big news? Did you know you can replace the entire firmware inside your TV too? There's already a group working on getting something usable onto Samsung TVs like these: http://www.samygo.tv/
What? Relevance to this story?
Init level 6 is "Reboot", so the system was configured to boot up ... and then reboot ... and reboot ... and reboot... This is relevant to the story because the story is also about an "endless restart loop"!
Runlevel 5 is the typical X level. You switch to runlevel 6 to reboot the system.
So you set inittab to default to level 6 when you want to incur general rage and butthurt with a restart loop. :D
You can hold down the "B" button for continuous firing.
I was working for a company that was trying to develop an App for Samsung's Internet@TV. Twice we had to get the TV RMAd because we bricked it while messing around with the remote control protocol.
fscking reruns
Table-ized A.I.
Hey! Deja Vu,
I think I've seen this movie before...
Hey! Deja Vu,
I think I've seen this movie before...
Hey! Deja Vu,
I think I've seen this movie before...
Hey!
"Flyin' in just a sweet place,
Never been known to fail..."
(or ____ forbid their debit card)
And?
Unless you have a very terrible bank and/or don't bother checking your account ever, this isn't exactly a big deal. I just went through this a few weeks ago, when yonder random payment processor got owned hardcore.
Checked my account - like I do regularly, and found a weird charge. Called up my bank, said, "What is this I don't even?" Bam. Charge killed, money returned, new card in the mail, before I could even say, "Wow, you guys aren't nearly as evil as the Internet led me to believe."
Of course, I suppose the fact that I actually bother checking my account activity regularly makes me some sort of Fiscal Wizard compared to your average person. :p
include a reduction in empty consumerism, more time spent with families, a decrease in childhood obesity and a more rational approach to politics.
Good people go to bed earlier.
Just shouldn't be connected to the internet. There is really no good cause to connect your TV or Blu-ray to the internet. Instead, use a purpose built device like an AppleTV. I'll admit, the remote exploit is funny
He's just an old 6502 cpu. Not much memory space. I can understand how the story topic would FIFO out...
Consider:
Similarly, a computer monitor should not have a built in computer (or vice versa), unless the computer is a replaceable module. The TV or Monitor still have a lot of lifetime (and economic value) long after the computer is hopelessly obsolete. (Yes, I'm looking at you, iMac integrated computer and monitor. But then Apple products seem to be for people with more money then sense.)
- - - - - - -
All that is necessary for Apple to triumph is for Google men to do nothing.
I'll see your senator, and I'll raise you two judges.
That depends on how they implement it. For my bluray player netflix setup, they put a unique ID on the screen and told me to authenticate it on my account using my computer. So the bluray player never accessed any information about my account. My bluray doesn't have a web browser built-in only Internet access.
Well, there's spam egg sausage and spam, that's not got much spam in it.
This trick will be great for watching Groundhog Day!
- For the complete works of Shakespeare: cat
Because he set the config file to INIT 6, and the system was stuck in permanent reboot.
My sister opened a computer store in Hawaii. She sells C shells by the seashore.
Some banks have very good fraud detection systems and it is in their interest to have them. The sooner they detect it, the less headache they have to deal with. One of my banks froze my card after I made several unexpected large purchases in one day. Another one called me when they noticed suspicious charges to confirm that I did make them. Someone got my card number, but I still had my card so I would not have reported it stolen or lost.
Well, there's spam egg sausage and spam, that's not got much spam in it.
This or this or this or this or this?
All TVs with a remote control are exploitable. ;-)
http://www.tvbgone.com/
Samsung Means To Come
(Sound Recommended)
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
It's deja vu all over again.
This has Gary Larson written all over it.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
What the GP is saying is that many banks will issue refunds immediately for fraudulent purchases, and will remove any overdrafts fees if any occurred. In my experience that is how banks work, legally they are not obligated to do so but do so to keep their customers happy. I don't use my debt card for purchases due to the risks but have not heard of any body getting told by the bank that it's not the banks responsibility. Further any overdrafts that occurred from the fraudulent charges will not be assessed because of how they occurred.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
Any issues I've had from debit card or credit card fraud from my bank, has had the money fixed/cleared in under 24 hours.
Some people have faster / more responsive banks. That doesn't make them clueless. You however...
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
You know you pay for that, right? The service charges your bank and/or credit card processor charge the vendors take into account their work to prevent fraud. I believe they pass all fraudulent charges back to the merchant who rang them, so in this case wherever the thieves used your card will lose the funds. All of that is passed back to the consumer in the form of higher prices.
So no, it's not a tragedy if a card is occasionally misplaced and misused, but it's still a leech on the system - EVERYONE's system - to allow it to happen systemically.
It doesn't hurt to be nice.
If you wait a few months, you'll probably have a capacitor die in the power supply and it'll stop rebooting.
Supply and demand means that TVs will be cheaper than monitors even if you don't use the extra stuff. If you want higher resolution, then you can look at big computer monitors but they're going to be more expensive than a TV of the same size.
I'd love to get a Dell U3011:
30" monitor, IPS, 2560 x 1600
2 HDMI, 2 DVI-D, 1 DisplayPort, 1 VGA, builtin 4-port USB hub and card reader.
Roughly $1000.
The last banking error I had to deal with took less than 48 hours to fix.
But Canadian banks aren't allowed to delay the repair process so they can keep lending out YOUR money while they "fix" the problem as they do in the US.
The last US based bank problem I had took a month to fix; it was the same problem I had here in Canada -- an incomplete/invalid transaction that "withdrew" money from my account but didn't properly "deposit" it with the retail store, leaving insufficient funds to retry the transaction.
I do not fail; I succeed at finding out what does not work.
They want to be able to advertise "with builtin netflix support!". Combine that with the fact that most people can't hook up their own cable box, and you have answered your own question.
Unless you have a very terrible bank and/or don't bother checking your account ever, this isn't exactly a big deal. I just went through this a few weeks ago, when yonder random payment processor got owned hardcore.
Problem is they don't have to. The behavior will vary bank to bank, and running into such issue is how you learn. A bank might also say "sorry, the money is gone - transfer credentials were legitimate". And there will be nothing you can do.
Credit cards, on the other hand, provide chargeback as one of the services (often by screwing the vendor always assuming their fault, but that's another story and doesn't typically concern the buyer).
Then after another five seconds, he claims, the TV automaticall restarts. Then the process repeats itself forever, even after unplugging the TV. Eventually, Auriemma managed to reset the TV in service mode.
Boot loops even when disconnected from power?
Either Samsung has secretly perfected OTA power transmission, or this is a load of crap. Then again, the writer refers to a punk kid dicking with his brother's TV as an "Italian security researcher," so I guess I shouldn't be all that surprised.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Can name one Netflix device that takes CC number? I never seen that. They all either take your Netflix username/password pair or like the Wii give you number you then enter on the website with your PC.
Not that Joe Sixpack's un-patched, allow all outbound firewall or not firewalled, Windows PC logged on as 'Administrator' is much safer to type a CC number on but still.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Of course, I suppose the fact that I actually bother checking my account activity regularly makes me some sort of Fiscal Wizard compared to your average person. :p
I checked my account and noticed strange transactions once too. After calling my bank to see if they were fraudulent, they asked if I actually wanted to cancel the card since the card thieves were actually spending LESS money than my wife. /rimshot
Some banks are so good at fraud detection, they shut down your bank account when you make a purchase overseas even after telling them a week in advance exactly where you were going, leaving you in a foreign country with no money.
To be fair, any large organization is going to make clerical errors, and it's better that they err on that side, since it happens a lot less frequently.
Of course, I suppose the fact that I actually bother checking my account activity regularly makes me some sort of Fiscal Wizard compared to your average person. :p
Not bad. Now proceed to that hole in the ground for proctology class.
Oh, the beautiful gloss of greality!
For those who didn't RTFA, each IP based remote has a name string included in the message. If that name contains a linefeed or other invalid character, the TV will go into the endless loop.
It can be recovered by going into "service mode", but apparently Samsung doesn't consider that to be an end-user procedure sinmce incorrect settings enetred there will brick the TV.
the "internet enabled TV" is another case of "feature phone syndrome." there are no "features" because it's all a walled garden of the Telco's choosing, and everything is another ten bucks a month, forever.
my year-old Samsung LCD is slaved to Yahoo TV streaming. hooo-kay, and if it would have said "Won Hyuk Yuk Yuk" it would make no difference. generic Brand X, forget it.
I haven't plugged into the router because if there are no updates per the web site, and no streaming services to be using, the only thing left for the TV to become is a bot for some murderous spam king. and I want to watch TV on it.
pah. stupid marketers.
if this is supposed to be a new economy, how come they still want my old fashioned money?
You and those Moderators who modded it as off topic. Needs to turn in you geek card.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
So, it's not a little problem, and it's not a big problem ; it's that best of classes of problem, Someone Else's Problem.
Unless, of course, you've got a TV with WiFi.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"