Slashdot Mirror
Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds (consumerreports.org)
An anonymous reader quotes a report from Consumer Reports: Consumer Reports has found that millions of smart TVs can be controlled by hackers exploiting easy-to-find security flaws. The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra. We found that a relatively unsophisticated hacker could change channels, play offensive content, or crank up the volume, which might be deeply unsettling to someone who didn't understand what was happening. This could be done over the web, from thousands of miles away. (These vulnerabilities would not allow a hacker to spy on the user or steal information.) The findings were part of a broad privacy and security evaluation, led by Consumer Reports, of smart TVs from top brands that also included LG, Sony, and Vizio. The testing also found that all these TVs raised privacy concerns by collecting very detailed information on their users. Consumers can limit the data collection. But they have to give up a lot of the TVs' functionality -- and know the right buttons to click and settings to look for.
In fact, one TV requires that you accept a broad privacy policy during setup before you can use the most basic, internet-free functions, such as watching TV using an antenna.
This is exactly the kind of stuff many of us have expected to happen and it'll most likely happen more and more in the future; companies see you as a product and whatever they sell you is still their property in their view, not yours. Don't want to be spied on? Tough shit, it's not your decision!
https://blog.roku.com/consumer-reports-got-wrong
Gary Ellison - February 7, 2018
Consumer Reports issued a report saying that Roku TVs and players are vulnerable to hacking. This is a mischaracterization of a feature. It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.
Roku enables third-party developers to create remote control applications that consumers can use to control their Roku products. This is achieved through the use of an open interface that Roku designed and published. There is no security risk to our customers’ accounts or the Roku platform with the use of this API. In addition, consumers can turn off this feature on their Roku player or Roku TV by going to Settings>System>Advanced System Settings>External Control>Disabled.
In addition the article discusses the use of ACR (Automatic Content Recognition). We took a different approach from other companies to ensure consumers have the choice to opt-in. ACR is not enabled by default on Roku TVs. Consumers must activate it. And if they choose to use the feature it can be disabled at any time. To disable consumers have to uncheck Settings > Privacy > Smart TV experience > Use info from TV inputs.
We take the security of our platform and the privacy of our users very seriously.
Happy Streaming!
in order to control the Roku TV....if you are already in my WiFi network I'm sure that turning up the volume on the tv is not what im worry about..
They're like lots of IOT devices - wide open on the local network for nefarious things like cranking up the volume. Not so much for the exaggerated claim that it can be done from the Internet. That's not happening unless you went out of your way to specifically configure your NAT gateway to allow incoming connections to your TV, in which case it's your own damn fault.
Sure, Roku and some others (a number of AVRs come to mind) and have no security, but in practical terms, it's only a matter of annoyance.
Reminds me on the time Consumer's Report dinged VW for only having a single turn signal "blinker" indicator on the dashboard, instead of two (showing left/right). Only an idiot CR reviewer wouldn't remember which way they wanted to turn and need a reminder.
"National Security is the chief cause of national insecurity." - Celine's First Law
that my (bought for lack of smart features) dumb TV continues to not have any of these issues.
If in doubt about a device that suggests it needs network, don't connect the network.
Wait, do you have one of those new-fangled magic smart TVs that can access DirecTV NOW, Netflix, and Amazon without connecting to a network? Good for you, but I'm more than happy to connect my vulnerable TCL to my home network. I mean, I wouldn't connect my refrigerator or my sewing machine, but there's nothing you can do with my TV that concerns me. And I like what the Roku interface can do.
This is a hacked account, for which the owner can not be held responsible.
Or you can go to someone who knows what the fuck they are doing and skip all that. Was waiting for your tin foil step.
Good luck, The problem isn't hackers turning your TV on and off or controlling the channel or volume. It is when one of these exploits lets them use the TV or other IoT device as a jumping off point to the more sensitive points within your network.
Good luck when someone finds a way to inject malware into your network though one of these devices that manages to infect every desktop on the network. Why would someone want to do this you say? Have you ever heard of crypto paid ransomware? Now you know!
If someone can get to your smart TV behind your LAN what stops them from getting to whatever other shit exists behind same LAN? Why is it necessary to hack TV as a jumping off point?
For example say someone with your home WiFi password installs Mr Clean's malware app on their smart phone. What prevents the app from attacking your systems directly without the smart TV foothold?
What access scenario in TFA is necessarily limited to smart TV?
Please don't misunderstand. I'm not arguing rooting televisions is harmless or that your point isn't worth considering. It's just your point assumes a level of selectivity that does not seem credible.
So did they publish it so we can take control of our own TVs?
I've seen that Samsung has Android apps available that work only on Samsung phones. And a bunch of other guys have advertising laden apps that ask for far too many permissions just like the Samsung one. What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).
The problem is that a Sumsung smart TV has WiFi. It is reaching out to any Access Point it can find in its desparate attempt to phone home.
227-3517
I'm surprised no-one has done a Kickstarter for a firewall appliance dedicated to TVs and other IoT devices. It would block all incoming connections and only allow outgoing ones to a whitelist of approved domains. You could have an app that lets you enable specific services like YouTube and Netflix, but nothing else.
As an added bonus it could block ads on services like YouTube.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Best thing to do is return the product.
A) That will never happen in any meaningful scale.
B) A better thing to do is to simply not connect the device to a network if you don't have a compelling need to do so. Can't be hacked if it can't be reached.
C) Another better thing to do is for some enterprising lawyer(s) to sue them until they get the message. EULA be damned lawsuits will cost them money even if they win so eventually it becomes cheaper to actually provide real security.
D) EULA that you don't agree to prior to purchase are on thin legal ground. There is plenty of precedent for holding such agreements invalid when they cannot be examined prior to handing over money. Expecting someone to bear the cost of returning a large TV is arguably unreasonable when the terms of purchase/use weren't available prior to purchase.
Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.
And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.
If you've owned someones router sufficiently to get onto their LAN, why would you bother with their TV? There are way richer targets on the average home network.
To quote the article:
Yeah, if you can get someone to do that, you've already compromised the device they installed the application on and have full access to their LAN. Why bother futzing with their TV volume: start harvesting passwords from network traffic or trying to exploit other PCs on the LAN.
This looks like it is going after the unsecured API that lets you send YouTube videos from your phone to Rokus on the the same LAN segment. Unless you are hanging your streaming devices out on the public internet with routable IPs and no firewall it's not a huge issue.