Samsung Smart TVs Don't Encrypt the Voice Data They Collect

itwbennett writes A week ago, the revelation that Samsung collects words spoken by consumers when they use the voice recognition feature in their smart TVs enraged privacy advocates, since according to Samsung's own privacy policy those words can in some cases include personal or sensitive information. Following the incident, David Lodge, a researcher with a U.K.-based security firm called Pen Test Partners, intercepted and analyzed the Internet traffic generated by a Samsung smart TV and found that Samsung does send captured voice data to a remote server using a connection on port 443, a port typically associated with encrypted HTTPS, but that the data was not encrypted. "It's not even HTTP data, it's a mix of XML and some custom binary data packet," said Lodge in a blog post.

Comments

Re:... and this is surprising how?

[Dutch Gun]

Yeah, same here... pretty much called it in the last article about this. It's sort of unbelievable, though, in some way, that no one stops to think of security and privacy ramifications of these things though. Yet it happens time after time after time.

I wonder if it's perhaps an engineer-type mentality that gets so focused on building cool new things, they just don't stop to think about how those new things can be abused or exploited to do bad things. Like when Microsoft decided to embed scripting-type functionality in all their Office documents, and now *whee*, we've got document-based trojans. Then they had to clamp down on all that scripting. Or how Adobe turned on scripting functionality by default in PDFs, giving us a crapload of exploits for a feature very few people ever used. Result - you have to turn off scripting to stay safe when reading PDFs, and eventually browsers took it upon themselves to do it safely for you. I guess engineers don't typically think like baddies, figuring out how to use technology to hurt people or steal from them.

This is not privacy-related data they're exploiting on purpose, because it doesn't do any good from a marketing standpoint. The only other explanation is that it's just an oversight. It's not the first time, and it probably won't be the last. On the other hand, given the fact that the NSA still collects all of our traffic, and US Citizens aren't up in arms about it, maybe they're correct in calculating that most people just don't give a damn about that sort of thing outside of a vocal minority.

Oh for fucks sake, people.

[wiredog]

The microphone on the TV stays off until you command it to listen. You do that by pressing a large VOICE button on the remote.