Slashdot Mirror
Samsung Smart TV: Basically a Linux Box Running Vulnerable Web Apps
chicksdaddy writes "Two researchers at the Black Hat Briefings security conference Thursday said Smart TVs from electronics giant Samsung are rife with vulnerabilities in the underlying operating system and Java-based applications. Those vulnerabilities could be used to steal sensitive information on the device owner, or even spy on the television's surroundings using an integrated webcam. Speaking in Las Vegas, Aaron Grattafiori and Josh Yavor, both security engineers at the firm ISEC Partners, described Smart TVs as Linux boxes outfitted with a Webkit-based browser. They demonstrated how vulnerabilities in SmartHub, the Java-based application that is responsible for many of the Smart TV's interactive features, could be exploited by a local or remote attacker to surreptitiously activate and control an embedded webcam on the SmartTV, launch drive-by download attacks and steal local user credentials and those of connected devices, browser history, cache and cookies as well as credentials for the local wireless network. Samsung has issued patches for many of the affected devices and promises more changes in its next version of the Smart TV. This isn't the first time Smart TVs have been shown to be vulnerable. In December, researchers at the firm ReVuln also disclosed a vulnerability in the Smart TV's firmware that could be used to launch remote attacks."
Samsung isn't stupid....either worry about seminar hack-trolls or patent trolls. In the end, what counts is staying in the public's mind. Mission accomplished, I'd say. Wash, rinse, repeat.
steal sensitive information on the device owner, or even spy on the television's surroundings using an integrated webcam
That's how the NSA likes them.
... the telescreen watches you.
I have two Sam'sDung SmartTVs. Yes, all these TVs are glorified Linux boxes running a badly collected series of apps. There is little to integration. Some won't accept keyboard input while other do. You either watch TV or run an App. Most apps are poor. The browser won't run most web pages and crashes. Yes, crashes. In this day in age it is hard to believe in your browser crashing nearly every time you try to use it.
As for security, I no longer use any of the apps as none are worth anything. Netflix is okay but not great but since I've gone back to DVDs from streaming I am blocking the ports (6000 mainly and I forget if another is in use) to stop the TV from phoning home every time it is turned on.
I blocked the ports because my firewall was showing connections to my LAN from very strange locations; Brazil, Japan, Russia. The problem is that Samsung's 'partners' are unknown to me and I'm sure it is these apps that doing the calling out. Who knows who wrote them, what is in them, and what they can really do.
The TV isn't bad when hooked up to my modified version of the PS3 media server project.
All I have to say.....
People once told me 68K ram was all we needed,
I think it was supposed to output Personal Media Center > Samsung TV
People once told me 68K ram was all we needed,
Never let hardware vendors deliver software.
To bad cable card failed and there has been little to replace it.
tru2way and RVU are there in small numbers but you are still stuck with the cable or sat GUI that kills off most of real use of an smart tv.
Thanks to bad headline choices you all missed the point. Samsung provided a ripe platform for hacking and development by making root easy (just like with their smart phones).
Shut up and get to work porting XBMC to it already.
Slashdot up again after being down for 10 hours
My Win7, 6 tuner CableCARD setup says LOL
Good-bye
Since they have a range of voip phones that crash if you do a simple portscan and they still sell phone switchboard systems that by default can be accessed by telnet with no password I disagree.
There are enough people in that place that do not care about computer security that it comes as no surprise that another wide open box has come out of there. Don't get me wrong, they do have some good stuff, but there's a lack of oversight and if the guys at the bottom of the tree don't care about something there's nobody giving them orders to care.
This description is not specific to just Samsung. Other manufacturers follow the same pattern with their smart TVs
well maybe your cable system works goods others have to dealt with lot's of people at the cable co with know little about cable card or needed to call up and say I need to be in the Lsports pack and not the sports pack to get the HD channels in it.
I own both LG(2013) and Samsung(2012) Tvs. I bought it on purpose w/o camera ;-)
However Samsung is still the king, apps are much more polished,DLNA works MUCH better. However you realize that after you buy something different from Samsung. If you use DLNA a lot, Samsung is the only way to go.
Have they ever written a secure piece of software? Their layer of apps they force on phones is full of holes too.
"Smart" is undergoing a semantic evolution similar to that of nice
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Pay cable TV? People still do that?
Help stamp out iliturcy.
And this surprises anybody, how?
As the saying goes and still holds true, if you can't do it, do it in Java/Javascript.
Including critical security vulnerabilities like that, which you wouldn't get in ASM or C/C+/C++/C#/#! without being a complete fucking idiot even BEFORE Java.
Fucking idiots.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I got the same 60" tv for $500 less because it was the older "dumb" version. A RaspberryPi later and I have a smart TV that doesn't spy on me.
Protip: Any device that has a web cam, put a piece of tape over the lens until you are ready to use it.
...they'll put Windows 8 on it
Table-ized A.I.
Hahahahaha....
DLNA works on samsung... hahaha.... but you get no SEEKING in files or did they ""fix"" that in the 2012 model?. Ever watch the half of the movie again because samsung could not even seek in an movie file.. even airplay works better.......and you never been to the samygo website did you... you can root out a lot of samsungtv just by inserting a usb stick and running the right scripts.... for YEARS....
The only smart TV will be one with iOS or Android... the rest is like having a ipaq vs ipad.
I found some hacker code here. http://forum.samygo.tv/viewtopic.php?f=12&t=5794 When my mother is watching here favorite soap, I repeatedly send soap spam messages to here screen. denying here access to her soap service on screen with a nice text popup... I do not even have to root the damn thing...
Who leaves a usb stick in their tv with sensitive information anyway... and who does connect his tv to the internet and why? Ever tried to use any of the apps with a remote control? I mean talk about bad usability...
with half a brain would never buy a TV set with a camera and microphone, as the potential for violating privacy is practically limitless. The best TV is one that can only display the signals that are input to it.
So here is my question... If someone hooks up a TV to their home network, and its ports are available for the entire world to see, they get what they deserve. If their TV is connected in this way, I will bet their PC's / Laptops / tablets etc is connected in the same way and susceptible to the same drive-by attacks.
Why is this news to anyone. This is implied. If you connect something to an insecure network, you will get the crap hacked out of it. Why is everyone so quick to blame the manufacturers for this crap. Yeah, things should be made better, but you should make sure your network is not accessible from the outside. If that means getting rid of our ISP's modem / router then so be it. This is the same as blaming the ISP's for people downloading music.
I own several samsung devices and i am extremly happy with the hw quality/price ratio.
But: Samsung, your software sucks. Deeply.
-Updates are late, incomplete and appear only until 1y after the products release (recently flashed my 1st gen galaxy tab to cyanogenmod and yeah - it runs better now)
-The crapware bundled on the device looks like it was specified by some management monkey and implemented by a intern. It suck the battery empty is most likely riddled with security holes
-Even talking to the devices (remeber that their camera device driver requres a writable system memory for everybody) seems to be implemented by a bunch of idiots
Netflix dropped support of my samsung device after two years. So I paid $20 extra a month for Netflix access.
Buyer beware of devices and their free apps.
This is reserved for Apple and Microsoft.
Why there are no web-cameras with a lid? It is so obvious and inexpensive to install a small light lid on a web-camera and microphone to control them physically. Still it is never done.
When something is closed with a physical lid, it is closed 100%. No way to open it for eavesdropping from network.
This is what happens when companies do stuff outside of their core competencies. They tend to do things half-assed (knowingly or unknowingly). There are better devices out there that are specifically built to do what "smart" TVs are poorly attempting.
As usual, you get what you pay for.
Keep the Classic Slashdot.
Friendly as in NSA friendly that is :-(
In a lot of households, the geek/nerd doesn't control the entertainment purse strings. So the geek has to build what amounts to a business case as to how it would serve others in the household, even while the geek isn't present for training others in the use of the system (and inevitable retraining when the non-geek forgets how to operate a feature).
Or just run a HDMI cable across the hall from their real PC.
Which can be a pain when someone in the household wants to use PC while someone else wants to watch TV. Or when the PC and TV are separated by two or more doorways. Or when one fears ground loops, as in adolf's comment: "I'm not lugging my desktop between rooms or stringing destructive ground-loop-ridden HDMI cables around the house so I can [use] my PC on my BFT in my living room."
Real nerds would build a HTPC.
Unfortunately, real nerds are vastly outnumbered by non-nerds who prefer a conveniently curated experience to an open one with more selection (and thus more 90% crap), and the resulting lack of economies of scale is why HTPC kits are hard to find in national chains.
As long as major professional and collegiate sporting leagues sell broadcast rights to an event exclusively to a cable channel, people will still pay for cable.
A tablet is fine for single-person-to-single-person chat, but it's sort of hard to use a tablet for family-to-family chat because the built-in display is so small. Besides, if the only thing one would do on the tablet is video chat, a TV with a camera is probably cheaper than a dumb TV and an iPad.
I just got a smart TV, but I've left it entirely disconnected from the network. I connected a Debian box running XBMC to it. I trust that machine far more than whatever is running on the smart TV. The rule for my trusted network is: if I don't have root, it's not trusted. And root is a necessary, but not sufficient condition for trust. For example, my Kindle is rooted, but I still don't entirely trust it since Amazon still has remote control over it.
-Updates are late, incomplete and appear only until 1y after the products release (recently flashed my 1st gen galaxy tab to cyanogenmod and yeah - it runs better now)
Yup, and actually Cyanogen is part of the answer.
What we definitely need is a very good quality 3rd party opensource firmware suite for "glorified linux set top box" WebTVs.
We have CyanogenMod for Linux/Android phone (and look how successfull and what good quality the results are. You're far from the only person with a "Got fed up with the delay/absence of firmware from my hw manufacturer, so I switched to CyanogenMod and my life is now full with rainbows"). Some hw manufacturer are even jumping aboard the ship (HTC, Motorola and Samsung are all collaborating to some various degree).
It takes some time for manufacturer to going from "I don't want to open *MY OWN STUFF*/I'm afraid of revealing some 3rd party stuff I'm not allowed" or other like "This voids warranty and I'm afraid of the risk of increased support costs because of idiots bricking their phone with that" to all the way to "Well, actually it's not a bad idea: it reduces long term support cost as the community takes care of older machine which aren't very cost effective for us to support now", and maybe even "Actually, it will be good to leverage some of these efforts and reduce the amount of work we put into newer devices".
Same is also underway in the router/modem world. Virtually all the home modem/routers are running some Linux/Busybox mix. Now we start to have very good quality 3rd party firmware like OpenWRT and DD-WRT. And even some hw manufacturer are starting to pick these up (Buffalo, among other).
We need the same stuff for set-top boxes and other media boxes. Google's android-based Google TV might be a starting point, LG's recent acquisition of Palm's/HP's WebOS might be another, as all the various other Linux based TV oriented software (MythTV, XBMC, LinuxVDR, and the like).
The whole story is a bad by product of the whole "internet of things" phenomenon. As manufacturer try to put internet connectivity on absolutely every last gizmo up to the mythical "internet enabled fridge", the surface attack to hack into one's private life dramatically increase.
Far beyond the capacities (specially regarding cyber security) of companies like Samsung which are basically *hardware* companies, good at making nice-looking gizmos, but to whom software is only a small by product used to enable a few extra feature of their hardware masterpiece.
They'll quickly hack something out of whatever they can pick-up (and thankfully, the opensource world feature more than enough components: Linux kernel, Busybox user space, Webkit browser, etc.), slap this on the device and call it a day (it does add the feature they wanted). And never come back to that again (no much bug fixes beyond repairing missing/broken functionnality. They won't necessarily rush to fix security bugs - they might not even understand them. They won't rush to make software upgrade to update compromised version. Usually, if they make a new build of the firmware, that would be for a newer piece of hardware that they will start selling soon). And if they remove the hardware from their line up and move to something newer, do not expect them to ever touch back the old device' firmware.
The hardware companies need to understand that they are exactly this: *hardware* companies. They distinguishes themselves among other with the hardware they produce. (and maybe the user experience provided by the thin uppermost layer of the software stack: basically the skin and a hand few apps). The software stack underneath doesn't play such a critically commercial role that it needs absolutely to be produced in house. Better move this to a common community-driven, corporate-sponsored/paid, development model. And do this in collaboration with other player in the same field. They aren't losing much by collaborating with concurrents (innards and lowlevel of the software stack aren
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Well then, we are all fucked. You can't even be bothered with putting an apostrophe in your statement- you're one of the smarter posters around here! Hoping for people to do the right thing, whether they are stupid or not, is the wet dream that'll never happen.
So basically nothing this guy says is gonna change your mind. Every time a suitable solution is proposed, you move your goalposts and fall back to punt again. You know if you move the goalposts closer to you than further away, you'll eventually score right? Eh nevermind.
Trying again, with the goalposts in the correct places in the direct reply:
What solution do you recommend instead for a living roomful of relatives to video chat with another living roomful of relatives? In my case, one end lives in Indiana and the other end in Arizona or Florida. People would choose a smart TV with a webcam for this because most people are unwilling to put a PC in the living room and use a TV as its monitor.
This is scary to me, because I recently ordered Dish Network for my family. When the tech was finished installing everything, I noticed a little black box connected to the wall (about the size of my wallet) with a CAT cable connected to it. No noise or anything, but there was a blinking green light (which I assume is "traffic"). Now couple something like that with shoddy Samsung TV apps and you have one helluva NSA gangbang waiting to happen.