Spoiler Alert: Your TV Will Be Hacked 211
snydeq writes "With rising popularity of Internet-enabled TVs, the usual array of attacks and exploits will soon be coming to a screen near you. 'Will Internet TVs will be hacked as successfully as previous generations of digital devices? Of course they will. Nothing in a computer built into a TV makes it less attackable than a PC. ... Can we make Internet TVs more secure than regular computers? Yes. Will we? Probably not. We never do the right things proactively. Instead, we as a global society appear inclined to accept half-baked security solutions that are more like Band-Aids than real protection.'"
Heh (Score:5, Funny)
Re:Heh (Score:5, Interesting)
I recently got a Panasonic smart TV. There is an Android app that lets you control it from your phone/tablet, and you can push photos and video directly from the device onto the TV screen. It works over wifi and there isn't any kind of authentication or code. In other words if your neighbours have insecure wifi and a Panasonic TV you and display whatever you like on their screen.
I'm sure many other smart TV platforms are similarly insecure, in that they assume your wifi network is a secure environment.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Surprisingly, it will probably be easier to hack a future TV appliance than to actually have multiple vendors agree on a common protocol to share media.
I'm still waiting for DLNA to support more than the 3-4 codec formats with which it works.
Re: (Score:2)
Re: (Score:2)
Re:Heh (Score:5, Interesting)
My ten year old analog TV does that -- I have a computer plugged into it. The only difference is the computer isn't inside the TV. I can bluetooth pictures from my phone, wifi files to it from my notebook, and I use a wireless mouse as a remote control and the internet for "cable".
But nobody's hacked it yet. In fact, in 30 years of computing I've only been hit three times (my house has been broken into more often), none with any permanent damage. The first was the Michelangelo virus I got by putting one of my own floppies (five inch variety) in a computer at work, and learned that being smart is no defense against viruses -- the woman who infected the work computer held a PhD, but she was pretty clueless about computers.
The second time was a targeted attack by a bunch of young people I'd made fun of on my web site (I made fun of everyone, I was the Don Rickles of the Quake world). All they did was replace a picture of a bunch of down's syndrome kids with a basketball team. I wonder of those guys are now lulzsec? It was over 15 years ago.
The third time was when Sony rooted my box with their goddamned XCP trojan. That one really fucked up my computer BAD, took quite a while to repair the damage Sony's vandalism had done.
So judging from my own (admittedly limited) experience with being cracked, I worry far more about some big international corporation that has no fear of law enforcement than I am some Russian cyberburglar or teenage cybervandal.
And hey, this is only tengentally on topic but can we take our verbage back that was stolen and twisted by the muggles? Don't call them "hackers" unless they wrote the malware. Call them cybervandals or cyberburglars instead. Lets (at least among ourselves) reserve the word "hacker" for someone who writes quick and dirty one time use code and folks who modify hardware. I mean, come on, I've been both a hardware hacker and a code hacker, but I've never broken into someone's computer without their begging me to (working of a bios password on an old laptop now, have to take the whole damned thing apart to do it).
Re:Heh (Score:5, Funny)
Re: (Score:2)
I have found that PhD means you are very focused, not necessarily smart. You just happen to know way more about one thing than most anyone else at the expense of being well rounded.
Just my anecdotal observation YMMV.
Re: (Score:2)
Unless of course you are very smart. In that case you can have a focused area of knowledge that you know incredible amounts about and still be well rounded.
Re: (Score:3)
She wasn't the brightest bulb on the tree, but she knew her stuff. There's another guy with a PhD who's dumb as a box of rocks, but everyone else I ever knew with one was very intelligent.
I found out how to tell the smart ones from the dumb ones -- the dumb ones always add the "PhD" to correspondence and want everyone to call them "doctor". I knew the smart ones for years before I knew they had the degree.
Re: (Score:2)
Re: (Score:2)
I have probably a first generation of these "smart TVs". I played with it for all of 5 minutes before I got bored and unplugged the network connection.
Faee it - even if the vast majority of TVs sported WiFi adapters and Ethernet ports, a good majority wouldn't be connected either out of sheer laxiness or incompetence, or users not caring at all (they wanted a TV first).
So the attack surface is huge, but it's a lot smaller in that most won't be network connected anyways - people would do their Netflix and su
Non-functional requirements (Score:5, Insightful)
These are often forgotten by engineers. Usually they are formulated as thing you do not want your TV to do:
- not damage your furniture
- not start a fire
- not weight a ton
- not hack your network
You would think these are simple and logical expectations. The problem is, they are hardly good marketing, so they may not receive the necessary priority. But they can be very bad marketing if a story hits...
Re:Non-functional requirements (Score:5, Insightful)
Why blame the engineers for that? The engineers that I know are trying to make things the best they can be, but they're prevented by short-sighted penny pinchers that make constricting demands.
Re: (Score:2)
That's the hell I live in! MOD PARENT UP!
Re: (Score:2)
"Not weigh a ton" is only a benefit for portable devices, or when you're moving. If my 215 pound forty two inch flat CRT were forty pounds, it would have been missing with the guitars and other stuff that got taken when my house was broken into last year.
Barney (Score:3, Funny)
Re: (Score:3)
One day, our TVs shall be hacked, and they shall show nothing but that damned purple Dinosaur.
The new goatse...only much more offensive.
Re: (Score:2)
OpenBSD (Score:2)
Or even NetBSD?
Re: (Score:3)
Why not yet ? (Score:5, Interesting)
I'm wondering why my tv hasn't been hacked with air waves : one morning, I switched it on and it told me a firmware update had been uploaded over the air during the night.
What can stop hackers to send rogue fw updates over the air ?
Also, is it possible to exploit mpeg2 video decoder bugs to takecontrol of tv ?
Any info of previously discovered hacks of this kind ?
Re: (Score:3)
Appliances with heavy compute loads typically have dedicated hardware (or at least an FPGA) to do their primary task -- your TV almost certainly does demuxing, MPEG decoding, and AC3 decoding outside the main CPU. So even assuming a poorly written software the hardware design does quite a bit to protect you from inline attacks.
You'd probably have better luck attacking something like the closed-caption system, or the virtual channel number or the like. That stuff is low-bandwidth enough that it may happen on
Re: (Score:3)
What can stop hackers to send rogue fw updates over the air ?
They are required to be cryptographically signed in most places. Of course if the master key leaks you are screwed.
Also, is it possible to exploit mpeg2 video decoder bugs to takecontrol of tv ?
Probably not because it is decoded by a dedicated DSP that is separate from the CPU, and is not capable of executing code in the same way.
Re: (Score:2)
Also, is it possible to exploit mpeg2 video decoder bugs to takecontrol of tv ?
Probably not because it is decoded by a dedicated DSP that is separate from the CPU, and is not capable of executing code in the same way.
MAYBE. Could use an integrated CPU+GPU. Could be that MPEG2 is handled in software while MPEG4 is handled in hardware, this is not unusual today.
Re: (Score:2)
You didn't switch it on. It was never off.
Modern appliances can only be turned off if you attach them to a power strip.
Drill, baby, drill!
Re: (Score:2)
What can stop hackers to send rogue fw updates over the air ?
One would hope that the update process includes some kind of authentication and cryptographic verification. However, you and I know the reality is that some manager thought this wasn't cost effective to implement.
Also, is it possible to exploit mpeg2 video decoder bugs to take control of tv?
Probably, but I believe it's like writing Mac viruses a decade ago - too specific of a platform with too small of a footprint to monetize by creating exploits. Given the proprietary nature of the hardware and software, you're probably only going see proof of concept exploits, possibly some exploi
Never gonna give you up. (Score:5, Funny)
Bonus points for the first ones to rickroll on every channel at once.
And... go
Dumb displays (Score:5, Insightful)
They should be limited to take video in, modify resolution/contrast/etc as per settings and display it on the screen, and provide a control interface
IF I want to play media on it, I will use a device for that
Modularity is better
Re:Dumb displays (Score:5, Funny)
I prefer my TV's to be dumb displays
... Like your women?
Re: (Score:2)
Re:Dumb displays (Score:5, Insightful)
The more functionality that becomes "built-in", the quicker that "display device" will become obsolete. Is it any wonder why the manufacturers are pushing smart TV's so hard?
First, there was TV!
Then widescreen!
Then HD Ready!
Then Full HD!
Then LED!
Then 3D!
Now Smart TV!
The rate of obsolescence has really increased in the past 15 years or so with TV's. That's why I waited for Full HD to drop into my price range, and I bought a good, high-end LCD of a decent size with HDMI inputs. I can plug anything into it. I do not miss LED, 3D or smart TV. I can play back blu-ray at full quality, which is enough. I have an HTPC connected to it for browsing and media playback.
I prefer to keep my displays dumb and put the smarts elsewhere. That is unless you want to buy a new TV every few years... (I certainly have better things to spend my money on)
Re: (Score:3)
I prefer to keep my displays dumb and put the smarts elsewhere.
The problem is that, for much of the viewing audience, there is no 'elsewhere'.
Re: (Score:2)
And, the demographic that pays the premium for a "Smart TV" probably already has multiple computing devices: most of which would be TV compatible which can host the smarts
Some features like onscreen widgets may be missed, but thats a small compromise for a much longer lifespan
Re: (Score:2)
Re: (Score:3)
Meh... I want a server somewhere in my house, a TV sized screen in the living room, a tablet screen and a desktop screen.
All data Plan9 from Bell Labs style on the server (removeable harddrive slots with clone functionality for backup storing purposes when they get full and content goes on newer, larger and faster harddrive).
Apps in the form of GTK3/Qt HTMLv5 style, steamed over the home network/VPN and all local apps via Java/GNU Smalltalk (platform abstracted code, platform abstracted packages, Op
Re: (Score:2)
I prefer my TV's to be dumb displays
They should be limited to take video in, modify resolution/contrast/etc as per settings and display it on the screen, and provide a control interface
IF I want to play media on it, I will use a device for that
Modularity is better
I hear you, but this (the current) approach has some serious drawbacks, including cable mess and multiple remotes (or one poor universal), power extensions when you only have two sockets, etc.
The right approach would be for each TV to come with a hidden and swappable "smart" unit (or bought "naked" if you wish), controlled by the main TV's remote control, powered by the TV and with a standardised interface. This way, you'd have the best of both worlds, you'd be rid of the cable and remote control mess and i
I must have been hacked (Score:2)
I have a challenge to all hackers out there (Score:5, Funny)
The ultimate TV hack, one that will make you the most infamous hacker in the US. Make it so that during the last quarter of the superbowl, the entire country gets rickrolled and are unable to return to the game. If it's a close game, wait til the very end (last year doing it on Brady's last drive would be perfect).
Re: (Score:2)
Comment removed (Score:5, Funny)
More concerned by the TV companies than hackers (Score:5, Insightful)
Re: (Score:2)
I was thinking along the same lines. In the near future you will probably be labled a thief if you don't sit out the commercials and zap to other channels. The content delivery program will also offer you a rebate if the camera on top of the TV detects that you are intently watching the commercial breaks..... and smiling.
Re: (Score:2)
See http://www.imdb.com/title/tt2089049/ [imdb.com] "Black Mirror: Fifteen Million Merits"
Spoiler Indeed (Score:2)
No, not really.... (Score:2)
I dont care what any of this hype says, if your TV is gonna get hacked then why are we not seeing all the BluRay players from all these same companies that are running Linux and the interactive services getting hacked?
Every single BLuRay player sold runs linux and most have ethernet on them for interactive services on the disc or built into the player. Panasonic has one that has hulu, netflix, and an app store + video skype. These are not getting hacked.
And I WISH they would get hacked, cracked, and s
Amazing (Score:3)
I wonder how they intend to hack my TV when it's not plugged into either Ethernet or wireless networks. Because even if I did have an "Internet TV", it wouldn't be plugged in.
If it was, it would be behind my firewall/router. If they were relying on me to visit a malicious website to "infect" my TV, they'd be sadly disappointed - I can't imagine that many people use their TV like that given that every year or so the requirements change. If you can see a modern Internet site (e.g. Flash, Silverlight, etc.), then chances are that your software is pretty up-to-date and no worse than a PC that was similarly updated.
Of those that don't handle interactive content directly, it's either not a risk (it's pretty hard to crash AND compromise an embedded browser with just a badly formed HTML page or similar), or it goes through some sort of remote proxy (e.g. Opera Mini) that will probably be working to stamp out the problem for you.
Above all that, beyond playing tricks and crashing my browser, I'd be interested to know what incentive they would have to do that? I don't plug credit card numbers into my TV. I watch TV on it. If you're silly enough to plug in things like Facebook, Twitter, etc. passwords into your TV, then maybe they could cause a little havoc ("Guess what John watched last night on the Adult Channel?") but that's about it.
Or is this just a ruse to sell "Antivirus for your TV"?
These devices are pretty passive, unless you make them do something. You're pretty safe while your internal network is clean (and if it isn't, your TV is the least of your worries). To infect would require some kind of active participation (same as any well-managed PC) that, maybe, possibly, it wouldn't be able to handle safely. But, chances are, the havoc it could wreak would be nothing compared to that same user on their laptop.
Of course it's something to think about but I don't think such a big fuss should be made. Hell, people still haven't worked out that a smartphone is yet-another-computer that they have to manage properly, with bad consequences if they don't (run up enormous bills, etc.). But even they aren't that much of a problem. I've never had anyone come to me about fixing their smartphone because of things like this, but I get 2-3 a week about their laptops etc. I've certainly never had anyone ask about their TV unless it was a dumb TV or literally how to wire it to their Internet connection / Wii / whatever.
I think infinitely more dangerous than a TV would be:
- smartphones
- gaming consoles with internet access / wireless
- smart meters with internet access / wireless
- Skype phones
- Internet connected printers
- etc.
And a lot of those have been running around people's houses (some targetted at non-techy users) for years. Yes, it's almost certainly possible to "attack" my printer / TV / Skype phone. But it's almost certainly not worth the effort to a) discover what model I use, b) link that to an IP address, c) somehow enter my network and intercept communications to it, d) figure out how to do something clever on that device when actions that are much easier to do and hide mean you can compromise similar people anyway.
Worst case scenario is that your TV web browsing is an "insecure" as your laptop web browsing. But with much less potential impact.
Re:Amazing (Score:4, Informative)
Long-term botnet. Good for spamming, ad-fraud, DDoSing, that sort of thing.
we do when there's money behind it (Score:2)
There seem to be plenty of efforts to ensure security when other peoples' money is at stake. Last time I checked, HDMI is the new cable standard and that has absolutely NOTHING to do with signal quality, it's a hardware-enforced "copy prevention" scheme.
I was going to say "other peoples' money (particularly not the customer's)" but then I remembered - in the free TV equation I'm NOT the customer. I'm the product (well, my eyes). In that sense, I concede their need to 'protect' their baited hook...they NE
Mine won't (Score:3)
Because I won't put it on the Internet. That's what I have an HTPC for. And I know how to secure that. It's looking likely I will still have an HTPC in 10 years time, and nothing except standalone computers and perhaps a smartphone connected to the Internet.
Short-sighted you say? No, I've merely learned my lessons.
Reactive cheaper than Proactive (Score:2)
Why is this news? Being reactive has ALWAYS been cheaper than being proactive, in any field, not just technology.
Companies/government/etc. will go proactive to avoid accidents/hacks/RRODs/etc. if you're willing to pay more. Are you?
Improved security or more BS laws (Score:3)
Improving security cost more and does more than a BS laws, but Bad Security (BS) laws only cost a few politicians and will exempt TV makers and Cable/Sat providers from all liability. Corporate-Welfare is best for the Plutocrat Republic, never good for US.
Hack2Secure
What??? (Score:2)
They're making Windows TVs now?!? ;-)
Re: (Score:2)
Android proof (Score:2)
Having just finished reading this reminder [phys.org] gives me an even worse feeling that science will die to profit seekers. Especially with the ad potential.
Thoughts (Score:2)
Just don't connect it to any public network. (Score:2)
Why would you want a display connected to the internet? It makes no sense. Just don't connect it the internet and you're done.
Hell, do you actually *need* it connected to your private network at all? Will it make movies look better, or have *any* advantage?
It's just crap that people want because of good marketing, not anything that they really need anyway.
Re: (Score:2)
Personally, I got a smart TV so Netflix would be built in. No cable TV subscription now. An accessory box would have worked, but it adds an extra remote to the mix. It needs to sit on a DMZ (in retrospect), but that isn't too big of a hassle. There are much better targets for hackers than my TV, and LG's insight that I browse /. from my TV is of pretty limited value.
A few basic design rules will help (Score:2)
1. No unencrypted incoming connections. The only incoming connection possibly allowed is a limited function remote control (turn off, if it has DVR capabilities, allow changes to the recording schedule). Why does a device for viewing content need incoming connections or a web server?
2. No OTA updates. Firmware updates must be cryptographically signed, and the update must be initiated by the device itself, not "pushed". Signed updates can also be installed from a USB flash drive, no network required.
3. Built
NAS, certs, Nintendo DS, and tablets (Score:2)
Why does a device for viewing content need incoming connections or a web server?
Because it's acting as a NAS to which the authorized user can upload video to a connected USB hard drive.
Firmware updates must be cryptographically signed
With what certificate? All Android apps are cryptographically signed, but almost all devices allow use of applications signed with a self-signed certificate because much of Android security relies on key continuity management. And what's the key difference between a "firmware update" and an "app" anyway?
If it supports Wi-Fi, Require WPA/WPA2 connections. Do not allow use of WEP
In other words, do not allow use of a Nintendo DS on the same AP. It's a very popular device that supp
Do you hate people who communicate in... (Score:2)
a serious of questions and answers to themselves? Yes, yes I do.
Bring it on (Score:2)
Can You Get a Plain Monitor? (Score:2)
Re: (Score:2)
I do not think it can be even sued properly, so many layers between you and the potential attacker... I am in the sector and so many (naive??) developers believe that the platform OS being Unix, mostly Linux, makes the device secure enough. This is due to the fact that most developers are from household appliance backgrounds, not from the jungle called Internet...
Re: (Score:3)
"Here goes your facebook ID, oops so bad, you had a bank account interconnected to it...."
That would be Paypal ID, not facebook, and it's not as if nobody had told you so already one million times [paypalsucks.com]
Re: (Score:2)
Read only for now thankfully
Re: (Score:3)
As long as the h4ckZ0rs only switch my channel from NatGeo to CNN I do not really care much,
Na, they'll switch your channel from Disney Channel to Playboy instead, and then you will care...
Re: (Score:3)
Why would you care about that ?
Re:Shopping channels (Score:5, Funny)
I'd care. Huge improvement. Have you seen the shit they throw out on Disney? You can at least expect a tolerable plot from Playboy.
Re: (Score:2)
"You can at least expect a tolerable plot from Playboy."
I work in a porn shop, this statement is about as far from the truth as one could possibly get.
Everyone knows you get Playboy for the commentary/articles, not the plot or girls.
FFS their Jan/Feb 2012 issue was of Lindsey Lohan, photoshopped to hell and back.
Re:Shopping channels (Score:4, Funny)
FFS their Jan/Feb 2012 issue was of Lindsey Lohan, photoshopped to hell and back.
And I thought photoshopping was used to to improve pictures...
just HAD to bring it back around to Disney... (Score:2)
Lindsey(sic) Lohan
I see what you did there.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Sadly, it's more like they would switch your TV to a cycle of shock images such as goatse, tubgirl and lemonparty.
Re: (Score:2)
These monitors are all-in-one computers.
The extent to which they're secure depends on the manufacturer providing firmware updates.
Bonus points to any manufacturer that bases its firmware on Linux in a non-tivoized manner to attract a cult following as has occcured with embedded wifi routers and plug computers.
e.g. ship a default firmware with a drm-infested userspace but allow those that care to replace components with foss equivalents.
Re: (Score:2)
bases its firmware on Linux in a non-tivoized manner
Has any manufacturer ever done this?
Re: (Score:2)
Think! (Score:4, Interesting)
Think once,
Think twice,
Think don't watch television. It was never beneficial. It soaks up valuable internet/gaming time. Pay t.v. is never worth the cost.
Just another screen to clean.It encourages relatives/loafers to hang around your place eating your food for longer than normal.
Whatever is on will just piss you off / bore you. It's just re-runs anyway. Just take it to Salvation Army and get a donation receipt for tax purposes.
Re: (Score:2)
You can't do gaming on a TV? Which universe is this again?
I don't know about this screen cleaning thing, I've not needed to clean my screen in a while. Maybe the ones I own have an anti-static coating on them.
Re:Think! (Score:4, Funny)
Oh hey, it's you:
http://www.theonion.com/articles/area-man-constantly-mentioning-he-doesnt-own-a-tel,429/
Get off your high horse. There are plenty of good, informative shows for intelligent people to watch. And despite the popular meme, there actally are shows that are pretty well done. Not everything on TV is lowest-common-denominator crap.
Re: (Score:3)
Yip. I watch pretty much nothing but documentaries. Of course, because cable companies are retarded (or smart actually), I have to pay a lot more than I should for the privilege. I had to upgrade to the digital package with a bunch of silly channels that I've never watched just to get BBC America, The Military Channel, Planet Green, The Science Channel, and History International (H2 now).
Re: (Score:3)
You can get most, if not all, of those on the internet. I cut cable years ago, now it's antenna, internet, DVDs and hard drives. I've had my computer connected to my TV for the last ten years. Seems folks are finally catching up to me.
Re: (Score:2)
I could pirate much of it. I opt not to. I can't get what I like, in the manner that I like it, online for a more affordable price. (I watch a lot online too, paying for both Netflix and Hulu+. There is a lot lacking.)
Re: (Score:3)
Get off your high horse. There are plenty of good, informative shows for intelligent people to watch. And despite the popular meme, there actally are shows that are pretty well done.
Speaking of which, when is the next season of Breaking Bad supposed to start? Not that it really needs it. Walter White saying "I won" was enough of a closer for me.
Re: (Score:2)
Well, I'm certainly not ditching my TV. I like watching movies. And although there is comparatively little on TV worth watching (for every History Channel there's four sports channels) and it's getting worse (Discovery Channel used to be full of science and technology, now it's all "trick my truck" and the only show on it worth watching is MythBusters, and even the History channel is going downhill) there are still a few good shows. Big Bang Theory, anyone?
That said, I no more want a computer inside my TV t
Re: (Score:2)
Re: (Score:2)
I don't have a TV either. I have a 46" monitor. Problem solved.
Re: (Score:3)
" It was never beneficial."
Those conversations I started about astronomy after watching Cosmos wasn't beneficial?
The humor of Monty Python wasn't beneficial?
The conversation I had with my 11 year old daughter about the Speed of light after watching Niel deGrasse Tyson wasn't beneficial?
It's the content, not the medium that matters.
And what benefit does gaming provide?
If you have a loafer problem, get better friends.
A Mere Decade? (Score:2)
I gave up watching commercial tv 2 decades ago as there wasn't anything worthwhile/inteligent on. Got tired of Giligan's Island, the damn 2 Hr Slow Speed chase of O.J. Simpson down the freeway and other shit like that. Of course it helped that I had access to the local library and was able to read damn near everything in the system that I was interested in.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Can't hack what you don't have (Score:4, Funny)
I gotta ask, do you have the same beard as the guy in the article?
Re: (Score:3)
Re: (Score:2)
that was the first thing i thought when i saw this artical.
Re: (Score:3)
To upgrade the firmware enabling a Just Scan mode that the (lazy / incompetent / brain-damaged - take your pick) engineers at Samsung neglected to include in the default set of aspect ratios. It beggared belief that an aspect ratio that just displays the picture without adjustment wasn't included in the first place. Especially considering the damn thing has a VGA port and it was obviously meant to support input from a PC. A massive pain in the arse it was too - it needed a custom serial cable I had to put together myself from iffy specs I found online, with the (actually official) firmware update from another hobbyist site as Samsung didn't host it. Then there was the 30s or so sweating bullets as I thought I'd bricked my telly before the new firmware started running. I don't recommend it.
Hmm - never meant to post that as AC. I wondered why I was asked for a CAPTCHA...
Re: (Score:2)
Anyway, there's no way you'll be able to hack into my TV directly. You'll have to hack into my content provider. And if you're good enough to do that, there's an endless supply of other things you can hack into.