Slashdot Mirror
About 90% of Smart TVs Vulnerable To Remote Hacking Via Rogue TV Signals (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: A new attack on smart TVs allows a malicious actor to take over devices using rogue DVB-T (Digital Video Broadcasting -- Terrestrial) signals, get root access on the smart TV, and use the device for all sorts of nasty actions, ranging from DDoS attacks to spying on end users. The attack, developed by Rafael Scheel, a security researcher working for Swiss cyber security consulting company Oneconsult, is unique and much more dangerous than previous smart TV hacks. Scheel's method, which he recently presented at a security conference, is different because the attacker can execute it from a remote location, without user interaction, and runs in the TV's background processes, meaning users won't notice when an attacker compromises their TVs. The researcher told Bleeping Computer via email that he developed this technique without knowing about the CIA's Weeping Angel toolkit, which makes his work even more impressing. Furthermore, Scheel says that "about 90% of the TVs sold in the last years are potential victims of similar attacks," highlighting a major flaw in the infrastructure surrounding smart TVs all over the globe. At the center of Scheel's attack is Hybrid Broadcast Broadband TV (HbbTV), an industry standard supported by most cable providers and smart TV makers that "harmonizes" classic broadcast, IPTV, and broadband delivery systems. TV transmission signal technologies like DVB-T, DVB-C, or IPTV all support HbbTV. Scheel says that anyone can set up a custom DVB-T transmitter with equipment priced between $50-$150, and start broadcasting a DVB-T signal.
the TV is watching you
And almost as if the actual people who created the Internet had told you it was a bad idea, but you ignored them.
Are you happy now?
-- Tigger warning: This post may contain tiggers! --
When someone wants to put an always on microphone in your home, the proper response is "How much will you pay me for the privilege of spying on me?"
Any other response is just stupid.
excitingthingstodo.blogspot.com
I am certainly not advocating that anyone do this, because it would be illegal! But in _theory_ could you use this hack to brick susceptible TVs or in some other way interfere with their normal functionality rather than secretly using it to spy on the owner or add it to a botnet?
And if you (in theory!) did that, would the manufacturer then have to "repair" the suddenly "malfunctioning" TV under the standard warranty since the issue wasn't due to anything the consumer did?
And if this happened (hypothetically!) to enough TVs, between the repair costs and the bad publicity wouldn't the TV manufacturers have to start taking security seriously instead of fobbing the risks of insecure devices off onto the commons as they currently do?
This Space Intentionally Left Blank
I don't think that's quite true. As alternatives, keelhauling and/or drawing and quartering spring to mind.
I'm not saying US sold tvs are safe, but this is 90 percent of european DVB-T/C based sets. So not really 90 percent of the 'smart tv' market. The summary also adds the advertisers' delightful 'potential' qualifier. So basically it's like the 'save up to 90 percent' type lie^^^^^h logic.
so this hack only works when the hacker spends a lot of his own money for no payback? how do i make money off this?
Is there a list of what's compromised by this attack? Or perhaps, a list of things known to be unaffected?
Only members of the Inner Party can turn their telescreens off.
Have gnu, will travel.
We have built your Telescreen! You failed, however, to predict that people would willingly PAY for them.
I'm not saying US sold tvs are safe
US TVs are protected by US TV stations which are so appallingly bad the only way to use TVs there is via Netflix or an equivalent service.
Translation: About 90% of smart TVs can be reclaimed by their owners. There's a way to get root and remove the vendor-installed malware.
I wonder if this can be leveraged to somehow update the OS in my now abanndonware TV
We don't subscribe to cable TV, so ours is connected to the antenna.
But it's not connected to the Internet. That seemed like a terrible idea.
Do not look into laser with remaining eye.
Every time I see some new report about smart TVs being hacked or spying on people or otherwise having problems, it makes me glad that my TV is a nice dumb 32" Samsung LCD.
FTFS:
...which makes his work even more impressive.
Slashdot, would you people please hire someone competent to write/edit English summaries?
Thank you.
I've fallen off your lawn, and I can't get up.
Come on now. We can drive large screens & run entirely off of an Internet connection.
We know computers can be hacked, but they can also be turned off & various tools can tell us if suspicious data is going out of our computer and stop it.
Seems like we need to simplify our data devices.
While the article is a little short of details (Did I miss a link to the whitepaper?), the 90% seems like misleading sensationalism. TFA mentioned that the attack is carried out via HbbTV signals and I think the intent was that 90% of TVs sold in recent history support this method of data transmission, hence the '90% vulnerable' claim. Of course, the author is probably aware that inflated and hysterical claims generate more traffic.
That doesn't mean that 90% of tvs are carrying 0 day vulnerabilities, but given the state of IoT security, I wouldn't be surprised if they all had some forms of bugs that could be exploited. I would think that this problem could be mitigated by simply disabling HbbTV capabilities and plugging into coax. I am not a TV technician, if you are, please jump all over this post and call me stupid for suggestion such a silly idea.
HA! I just wasted some of your bandwidth with a frivolous sig!
The CIA and the TV manufacturers are already watching you fap, why not open the priviledge to others?
So I bought a Chromecast, and plugged it into a spare HDMI socket. So for an extra $50, I had a true smart TV, one that works on WiFi leaving my ethernet cables I pulled through the walls obsolete. Now it looks like I dodged a bullet with respect to this security vulnerability.
Chromecast is not the only option - there's a variety of similar products around. And if one gets dropped by it manufacturer and has a security vulnerability, its simple and cheap to replace with a competing product. No need to lay out big bucks buying another "smart" TV.
My guess is this is done on purpose. It would of been a nice backdoor for some spy agency. I mean, who would think of using Digital Air TV to gain access to a tv? Well, besides the person who found it and shared it with the rest of us.
Be seeing you...
This "super hack" was already demonstrated two years ago ... Look like someone is looking for fame here.
DVB already finished and is on the way of publishing some specifications to mitigate this risk by signing all signalization tables and make this kind of "drive-by" attack via cheap devices impossible.
Just have to convince TV maker to implement it now ...
10%er here. My Samsung TV isn't connected to cable nor DVB-T nor the internet, just to my uTorrent machine.
It's built inside of the TV. Just like Mobile Phones have their Antenna on the inside now.
I am thinking that there may be nothing I can do to prevent the "smart" television's tuner from accepting a broadcast signal, but what about these ideas for mitigation:
1. Uninstall web browser app if possible
2. Whitelist Netflix or whatever streaming services and block all other web traffic to television
3. Keep television unplugged from ethernet, don't configure wifi and just use an external streaming device
My eyes reflect the stars and a smile lights up my face.
.
Honestly, if Trump wants to know what I am saying about his performance he doesn't need to go talk to the Koreans (LG), he can just call me direct. I'm sure he has my number by now, due to the TV still sitting in my living room. I suspect the Government doesn't care about any EULA with the Koreans, and since my TV contacts LG periodically (over seas network connection) for updates, theoretically I'm already on the Government radar despite saying "no" to that EULA. Black tape over the lens, and epoxy in the microphone is all they will see and hear now days. If they want me to turn their "entertainment channel" again they will just need to ask nicely. Maybe I'll trade for one of those Russian channels they've got.
If the TV isn't connected to the Internet then it doesn't matter because there's no way to get the private data off the TV. Another reason to disconnect your smart TV.