Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Television Communications Network Networking Software The Internet

About 90% of Smart TVs Vulnerable To Remote Hacking Via Rogue TV Signals (bleepingcomputer.com) 76

Posted by BeauHD from the remote-control dept.
An anonymous reader quotes a report from Bleeping Computer: A new attack on smart TVs allows a malicious actor to take over devices using rogue DVB-T (Digital Video Broadcasting -- Terrestrial) signals, get root access on the smart TV, and use the device for all sorts of nasty actions, ranging from DDoS attacks to spying on end users. The attack, developed by Rafael Scheel, a security researcher working for Swiss cyber security consulting company Oneconsult, is unique and much more dangerous than previous smart TV hacks. Scheel's method, which he recently presented at a security conference, is different because the attacker can execute it from a remote location, without user interaction, and runs in the TV's background processes, meaning users won't notice when an attacker compromises their TVs. The researcher told Bleeping Computer via email that he developed this technique without knowing about the CIA's Weeping Angel toolkit, which makes his work even more impressing. Furthermore, Scheel says that "about 90% of the TVs sold in the last years are potential victims of similar attacks," highlighting a major flaw in the infrastructure surrounding smart TVs all over the globe. At the center of Scheel's attack is Hybrid Broadcast Broadband TV (HbbTV), an industry standard supported by most cable providers and smart TV makers that "harmonizes" classic broadcast, IPTV, and broadband delivery systems. TV transmission signal technologies like DVB-T, DVB-C, or IPTV all support HbbTV. Scheel says that anyone can set up a custom DVB-T transmitter with equipment priced between $50-$150, and start broadcasting a DVB-T signal.
This discussion has been archived. No new comments can be posted.

About 90% of Smart TVs Vulnerable To Remote Hacking Via Rogue TV Signals More

About 90% of Smart TVs Vulnerable To Remote Hacking Via Rogue TV Signals

Comments Filter:

  • Daddy was Right (Score:4, Insightful)

    by turkeydance ( 1266624 ) on Wednesday March 29, 2017 @05:05PM (#54138455)
    the TV is watching you

    • Re: (Score:1)

      by Tablizer ( 95088 )

      the TV is watching you

      "1984"

  • And almost as if the actual people who created the Internet had told you it was a bad idea, but you ignored them.

    Are you happy now?

    • Re: (Score:2)

      by irving47 ( 73147 )

      This is worse than that... Just because I bought a smart tv didn't mean I had to have it hooked to the internet via ethernet or wifi...

  • 100% are vunerable to the shmucks that sold them (Score:5, Insightful)

    by gurps_npc ( 621217 ) on Wednesday March 29, 2017 @05:07PM (#54138475) Homepage

    When someone wants to put an always on microphone in your home, the proper response is "How much will you pay me for the privilege of spying on me?"

    Any other response is just stupid.

  • Hypothetically speaking... (Score:5, Interesting)

    by Daetrin ( 576516 ) on Wednesday March 29, 2017 @05:15PM (#54138529)
    I am certainly not advocating that anyone do this, because it would be illegal! But in _theory_ could you use this hack to brick susceptible TVs or in some other way interfere with their normal functionality rather than secretly using it to spy on the owner or add it to a botnet?

    And if you (in theory!) did that, would the manufacturer then have to "repair" the suddenly "malfunctioning" TV under the standard warranty since the issue wasn't due to anything the consumer did?

    And if this happened (hypothetically!) to enough TVs, between the repair costs and the bad publicity wouldn't the TV manufacturers have to start taking security seriously instead of fobbing the risks of insecure devices off onto the commons as they currently do?

    • Good questions. Based on prior experience, the answers are:

      1,. YES, you can use this vulnerability to brick a TV
      2. YES, the manufacturer is legally liable
      3. NO, the manufacturers will not have to take security seriously. There is no force in the known universe capable of forcing a typical IOT vendor to take security seriously.

      • Re: (Score:2)

        by vlad30 ( 44644 )

        There is no force in the known universe capable of forcing a typical IOT vendor to take security seriously.

        Except the bottom line companies will do anything to keep those numbers positive even start testing their products e.g. samsung

  • I'm not saying US sold tvs are safe, but this is 90 percent of european DVB-T/C based sets. So not really 90 percent of the 'smart tv' market. The summary also adds the advertisers' delightful 'potential' qualifier. So basically it's like the 'save up to 90 percent' type lie^^^^^h logic.

    • US TVs protected (Score:4, Funny)

      by Roger W Moore ( 538166 ) on Wednesday March 29, 2017 @05:55PM (#54138767) Journal

      I'm not saying US sold tvs are safe

      US TVs are protected by US TV stations which are so appallingly bad the only way to use TVs there is via Netflix or an equivalent service.

    • Re:No mention of ATSC (Score:5, Informative)

      by DewDude ( 537374 ) on Wednesday March 29, 2017 @07:37PM (#54139429) Homepage
      Nope. This attack relies on some functions in the "Hybrid Broadcast Broadband TV" standard; which I don't think we're going to adopt. I don't see anything in ATSC 3.0 that seems like similar features. Not to mention I've not seen (or really looked) for ATSC transmission equipment; and the technology is new enough that decommissioned stuff isn't "out there" yet. When 3.0 goes live...there's a chance of seeing some of that stuff come out; but even then this type of attack wouldn't be possible. Plus the people who live in locations where the 8VSB signals perform very poorly would have an external signal source, being immune anyway.
  • Is there a list of what's compromised by this attack? Or perhaps, a list of things known to be unaffected?
    • Well if his claims are true, a shorter list would be TVs that aren't vulnerable. This attack is through the digital TV signal if I read it right which mean almost all TVs sold in the last 5 years. Older analog TVs should not be affected.

      • A list of TV's that are known not to be vulnerable, or a list of TVs whose vulnerability is not yet known? The first list is pretty easy. The Smart TVs that are definitely not vulnerable to hacking:

      • Re: (Score:2)

        by green1 ( 322787 )

        Well that makes those TVs perfectly safe around here, because it's been at least 10 years since I've met someone who used the tuner function of their TV. If you're lucky, you'll pick up 3 stations over the air, and if you're using cable of any form you're using their box fed in to your HDMI or Component connections.

  • We have built your Telescreen! You failed, however, to predict that people would willingly PAY for them.

  • Translation (Score:2, Insightful)

    by Anonymous Coward

    Translation: About 90% of smart TVs can be reclaimed by their owners. There's a way to get root and remove the vendor-installed malware.

  • I wonder if this can be leveraged to somehow update the OS in my now abanndonware TV

  • Every time I see some new report about smart TVs being hacked or spying on people or otherwise having problems, it makes me glad that my TV is a nice dumb 32" Samsung LCD.

  • Come on now. We can drive large screens & run entirely off of an Internet connection.

    We know computers can be hacked, but they can also be turned off & various tools can tell us if suspicious data is going out of our computer and stop it.

    Seems like we need to simplify our data devices.

    • Re: (Score:2)

      by AHuxley ( 892839 )
      The CIA likes the idea.
      A smart TV that did not need network access to place the code.
      Re "suspicious data is going out of our computer"
      A person would have to enter the room, access and alter the smart TV, wait for a recoding, a person to collect the data later. No need for the data collected to be networked out later. No network code litter to alter the smart TV, no code litter left in the smart tv later, no changes to any network.
      The idea been no network had to be entered to alter the smart TV. No

  • The CIA and the TV manufacturers are already watching you fap, why not open the priviledge to others?

  • My smart TV was connected to the internet only during the first months of its operation. The manufacturer did not update any of the apps, and the ones supplied were not interesting. So I have now left the TV unplugged.

    So I bought a Chromecast, and plugged it into a spare HDMI socket. So for an extra $50, I had a true smart TV, one that works on WiFi leaving my ethernet cables I pulled through the walls obsolete. Now it looks like I dodged a bullet with respect to this security vulnerability.

    Chromecast i

    • Pretty cool. Except now Google is spying on you and selling all your information. You only paid an extra $50 to get all that.

    • Re: (Score:1)

      by Cramer ( 69040 )

      I keep mine disconnected because the idiots at Visio give you zero control over system updates. There's no way to check for an update. There's no way to say no to an update. You'll be watching TV and *poof* the TV reboots and takes for bloody ever to return to action.

  • My guess is this is done on purpose. It would of been a nice backdoor for some spy agency. I mean, who would think of using Digital Air TV to gain access to a tv? Well, besides the person who found it and shared it with the rest of us.

  • This "super hack" was already demonstrated two years ago ... Look like someone is looking for fame here. DVB already finished and is on the way of publishing some specifications to mitigate this risk by signing all signalization tables and make this kind of "drive-by" attack via cheap devices impossible. Just have to convince TV maker to implement it now ...

  • 10%er here. My Samsung TV isn't connected to cable nor DVB-T nor the internet, just to my uTorrent machine.

  • I am thinking that there may be nothing I can do to prevent the "smart" television's tuner from accepting a broadcast signal, but what about these ideas for mitigation:

    1. Uninstall web browser app if possible
    2. Whitelist Netflix or whatever streaming services and block all other web traffic to television
    3. Keep television unplugged from ethernet, don't configure wifi and just use an external streaming device

  • I bought a LG TV a number of years ago and during a firmware upgrade I was presented with a EULA. Being curious as to why I needed to click-yes for anything I read through the "agreement" which was quickly rejected hands down. The wanted me to agree that they could watch and listen to us in the room and provide aggregated information back to companies collecting/compiling the ratings for shows. The TV has the ability to load programs for games and additional internet content which can not be used unless you

    • They asked, I guess.
      What if a household member or a random friend "accepts" the EULA, are you hosed forever? Can you take the consent back? (What if the TV was pre-owned?)
      Seen that happen with youtube sometimes asking you to "consent" to vague stuff, people will click through it even though they're not using their own computer, desktop session or internet.
      You can avoid or remove that consent window and still access videos, I don't know if anything different happens then.

      Your TV might be at the danger of "at

      • Re: (Score:2)

        by hAckz0r ( 989977 )

        What if a household member or a random friend "accepts" the EULA, are you hosed forever? Can you take the consent back? (What if the TV was pre-owned?)

        There is no telling if they even pay attention to whether you clicked through the EULA or not. The thing is, in order for their surveillance "feature" to work the TV needs access to the Internet. They need to stream the video and audio back to the mother ship for any voice-to-text or image recognition to figure out what you are doing during those commercials, etc. So the traffic would be quite evident on your network. Checking for software updates only takes a split second so the difference is many orders o

  • If the TV isn't connected to the Internet then it doesn't matter because there's no way to get the private data off the TV. Another reason to disconnect your smart TV.

    • You could be using a TV offline with the "old fashioned" broadcasts and USB media (drives and HDDs). This is pretty common, even on supposedly dumb TV - a dumb TV with H264 playback and recording etc. is a computer as well, see the original Raspberry Pi A for how their main chip might look like in terms of abilities.
      You might even use a 50-year-old TV if you wish, with a small receiver for the latest DVB-T or similar, that also has a USB port for file playback.

      Any of these might be hosed by broadcasts and

Slashdot Top Deals

The 11 is for people with the pride of a 10 and the pocketbook of an 8. -- R.B. Greenberg [referring to PDPs?]

Close