Slashdot Mirror
Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds (consumerreports.org)
An anonymous reader quotes a report from Consumer Reports: Consumer Reports has found that millions of smart TVs can be controlled by hackers exploiting easy-to-find security flaws. The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra. We found that a relatively unsophisticated hacker could change channels, play offensive content, or crank up the volume, which might be deeply unsettling to someone who didn't understand what was happening. This could be done over the web, from thousands of miles away. (These vulnerabilities would not allow a hacker to spy on the user or steal information.) The findings were part of a broad privacy and security evaluation, led by Consumer Reports, of smart TVs from top brands that also included LG, Sony, and Vizio. The testing also found that all these TVs raised privacy concerns by collecting very detailed information on their users. Consumers can limit the data collection. But they have to give up a lot of the TVs' functionality -- and know the right buttons to click and settings to look for.
In fact, one TV requires that you accept a broad privacy policy during setup before you can use the most basic, internet-free functions, such as watching TV using an antenna.
This is exactly the kind of stuff many of us have expected to happen and it'll most likely happen more and more in the future; companies see you as a product and whatever they sell you is still their property in their view, not yours. Don't want to be spied on? Tough shit, it's not your decision!
If in doubt about a device that suggests it needs network, don't connect the network.
Collect media to play back on a secure network.
Use a sneaker net https://en.wikipedia.org/wiki/... to bring data to the smart display. Select the media and play.
Domestic spying is now "Benign Information Gathering"
https://blog.roku.com/consumer-reports-got-wrong
Gary Ellison - February 7, 2018
Consumer Reports issued a report saying that Roku TVs and players are vulnerable to hacking. This is a mischaracterization of a feature. It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.
Roku enables third-party developers to create remote control applications that consumers can use to control their Roku products. This is achieved through the use of an open interface that Roku designed and published. There is no security risk to our customers’ accounts or the Roku platform with the use of this API. In addition, consumers can turn off this feature on their Roku player or Roku TV by going to Settings>System>Advanced System Settings>External Control>Disabled.
In addition the article discusses the use of ACR (Automatic Content Recognition). We took a different approach from other companies to ensure consumers have the choice to opt-in. ACR is not enabled by default on Roku TVs. Consumers must activate it. And if they choose to use the feature it can be disabled at any time. To disable consumers have to uncheck Settings > Privacy > Smart TV experience > Use info from TV inputs.
We take the security of our platform and the privacy of our users very seriously.
Happy Streaming!
in order to control the Roku TV....if you are already in my WiFi network I'm sure that turning up the volume on the tv is not what im worry about..
They're like lots of IOT devices - wide open on the local network for nefarious things like cranking up the volume. Not so much for the exaggerated claim that it can be done from the Internet. That's not happening unless you went out of your way to specifically configure your NAT gateway to allow incoming connections to your TV, in which case it's your own damn fault.
Sure, Roku and some others (a number of AVRs come to mind) and have no security, but in practical terms, it's only a matter of annoyance.
Reminds me on the time Consumer's Report dinged VW for only having a single turn signal "blinker" indicator on the dashboard, instead of two (showing left/right). Only an idiot CR reviewer wouldn't remember which way they wanted to turn and need a reminder.
"National Security is the chief cause of national insecurity." - Celine's First Law
that my (bought for lack of smart features) dumb TV continues to not have any of these issues.
I have a TCL Roku TV, and if you have so much time on your hands that you want to track it down change the volume on me, have at it. I have a great TV that was a true bargain, and there's nothing sensitive stored on it, so I'm happy.
This is a hacked account, for which the owner can not be held responsible.
From the Slashdot summary: "... all these TVs raised privacy concerns by collecting very detailed information on their users."
It seems to me that the long-term effect will be to do severe damage to the reputation of both Samsung and Roku.
Hook it to a streaming device like a Amazon Fire.
Disable voice, and tape over the microphones with duct tape.
Put a dedicated NAT router between the streaming device and the main home router.
Disable wireless and run wired.
Got to get 3 levels deep to get to the TV, the most expensive part on that chain of devices.
The attacker has to have a presence on my LAN and then they can adjust the volume of a TV ..... wow. I really think that's low on the list of things to worry about if they are on my subnet. I don't own one of these sets but this isn't a big deal IMO.
Universal remote.
I dunno about Roku, but you know... water is wet, smart TVs are vulnerable to hacking.
Some time ago, I found that Samsung had stopped updating software on my blueray player( which killed new blueray ), so I started playing with the TV. Sure enough it was obvious that our TV has holes in it.
I never tested Roku, but assumed that staying up was going to be hard because they have lots of capabilities, i.e. lots and lots of code. The only ones I trust are those backed by large software companies, which is apple tv, Android TV, and Chromecast. Out of these, only Chromecast is a minimalist approach, a kind of x-terminal, which should mean small code, small numbers of holes, and easy to back.
As such our next tv is going to be a Vizio E-series. No tuner. Solely based on Chromecast. The only thing wrong with them is complexity of hook-ups. If they were smart, they would skip it all, and just go with 5-7 HDMI and Ethernet. U need rgb/audio hookup? Get a converter. Need a tuner? Get one that has HDMI OR better yet, hd home run combined with Plex. Chromecast too complex? Fine plug-in a Roku stick. Basically, we need a thin tv and ability to add to it. I would even suggest that 1 of HDMI be an audio output.
I prefer the "u" in honour as it seems to be missing these days.
So did they publish it so we can take control of our own TVs?
I've seen that Samsung has Android apps available that work only on Samsung phones. And a bunch of other guys have advertising laden apps that ask for far too many permissions just like the Samsung one. What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).
Best thing to do is return the product.
A) That will never happen in any meaningful scale.
B) A better thing to do is to simply not connect the device to a network if you don't have a compelling need to do so. Can't be hacked if it can't be reached.
C) Another better thing to do is for some enterprising lawyer(s) to sue them until they get the message. EULA be damned lawsuits will cost them money even if they win so eventually it becomes cheaper to actually provide real security.
D) EULA that you don't agree to prior to purchase are on thin legal ground. There is plenty of precedent for holding such agreements invalid when they cannot be examined prior to handing over money. Expecting someone to bear the cost of returning a large TV is arguably unreasonable when the terms of purchase/use weren't available prior to purchase.
Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.
And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.
but there's nothing you can do with my TV that concerns me.
If you honestly believe that then you don't understand the problem or what some clever asshat might do with it.
And I like what the Roku interface can do.
That's nice but not of concern here.
....don't buy a "smart" TV. See how easy that is?!
This is why my TV is a 1953 Crosley model EU-21COLBe. No one is hacking it from the internet.
I used to be jealous of all of my friends with their fancy solid state color TVs because they would turn on without having to warm up the tubes first. But with modern smart TV's my trusty old EU-21 actually shows a picture faster than their newfangled televisions. And even then, they still have to wait for it to finish booting until they can actually change the channel.
Plus I've never once lost the remote. Granted I'm going to have to get a new remote once my kid goes off to college, but at least my remote never needs batteries. I have noted that the voice command for the remote doens't work as well as it used to though.
How is this news? Any device reachable through the Internet is vulnerable to hacking. Period.
Bad software, out of sync audio, updates that broke more than they fixed and a forum staffed by people that ignored major problems while criticizing users for minor forum etiquette. Returned as defective after only a few weeks of frustration.
And old Satan Claus, Jimmy, he's out there. And he's just getting stronger.
Hmmm. Your ideas are intriguing to me and I wish to subscribe to your newsletter.