Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Television Privacy Security Software Hardware

Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds (consumerreports.org) 102

Posted by BeauHD from the heads-up dept.
An anonymous reader quotes a report from Consumer Reports: Consumer Reports has found that millions of smart TVs can be controlled by hackers exploiting easy-to-find security flaws. The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra. We found that a relatively unsophisticated hacker could change channels, play offensive content, or crank up the volume, which might be deeply unsettling to someone who didn't understand what was happening. This could be done over the web, from thousands of miles away. (These vulnerabilities would not allow a hacker to spy on the user or steal information.) The findings were part of a broad privacy and security evaluation, led by Consumer Reports, of smart TVs from top brands that also included LG, Sony, and Vizio. The testing also found that all these TVs raised privacy concerns by collecting very detailed information on their users. Consumers can limit the data collection. But they have to give up a lot of the TVs' functionality -- and know the right buttons to click and settings to look for.
This discussion has been archived. No new comments can be posted.

Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds More

Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds

Comments Filter:

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Wednesday February 07, 2018 @10:43PM (#56087513)
    Comment removed based on user account deletion

    • Re: What we've been saying (Score:1)

      by Anonymous Coward

      Itâ(TM)s called USE A FIREWALL.

      FIlter our the traffic. Or as two smart TVs in my house. What network connection.

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Best thing to do is return the product. Manufacturers keep data on returns, and if they see a significant number coming back because "user rejected EULA" they will do something about it.

      Check your local laws too. In the UK you don't have to return the original packaging at all, or you can just wrap it in parcel tape for transport so that it can't be re-used. Make sure that the return costs them as much as possible and they can't just throw it back on the shelf.

      • Re:What we've been saying (Score:4, Interesting)

        by msauve ( 701917 ) on Thursday February 08, 2018 @04:42AM (#56088219)
        "Best thing to do is return the product."

        No, best thing is some people bind together and sue their asses. Software shrinkwrap licenses are at least based on the belief that copyright prevents a user from installing the software without agreement.

        Not so much with a phone or IoT device - the user isn't copying anything, and has no need to agree to anything. There is no "consideration" to create a contract. There's nothing which legally prevents a purchaser from using a device without accepting terms. If you're sold a phone or IoT for some function, and they want you to agree to some terms before using it, after you've already bought it, that seems a perfect example of an attempt to create an unconscionable contract of adhesion. Same with, say, GM and OnStar tracking (they never explain how they know if a car has been sold, or what allows them to track the second purchaser).

        When one of those things comes up on the screen, cover it with a sticky note saying "This is my device, and I'll use it as I please. By clicking continue, I retain all rights."

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          I remember AMD graphics cards always had a note at the top of the EULA stating that if you didn't agree to it you should return the card to the retailer for a full refund.

          That text was in a little text file you could edit. You could make the EULA say anything you wanted, then click "I agree". Be interesting to know what the legal status of editing the EULA in that manner would be, and if the software accepting you "I agree" click counted as AMD accepting your terms.

      • Best thing to do is return the product.

        A) That will never happen in any meaningful scale.
        B) A better thing to do is to simply not connect the device to a network if you don't have a compelling need to do so. Can't be hacked if it can't be reached.
        C) Another better thing to do is for some enterprising lawyer(s) to sue them until they get the message. EULA be damned lawsuits will cost them money even if they win so eventually it becomes cheaper to actually provide real security.
        D) EULA that you don't agree to prior to purchase are on thin legal

    • Re: (Score:1)

      by Anonymous Coward

      LG, Sony and Samsung cripple their devices unless you agree to the T&C as part of the setting procedure, and they all report back to base with regular network traffic. They will not operate on your LAN without external net access, if you block the mothership domains at the firewall, you'll be locked out of third party services like, Netflix, Hulu, etc, in addition to denying access to your local NAS media with lying network errors.

    • Two or three things:

      1. Don't buy a so-called 'smart TV' in the first place. They're still out there.
      2. If you must buy a 'smart TV', only connect it to the Internet long enough to get through their shitty 'agreement', then disconnect it.
      2a. If it insists on being connected: block it's IP address on your router. 3. Alternately: Call the manufacturer help line. Tell them you have no Internet at home. There has to be a way to 'activate' the TV without the internet.

      Everyone: There are some cases where t
  • If in doubt about a device that suggests it needs network, don't connect the network.
    Collect media to play back on a secure network.
    Use a sneaker net https://en.wikipedia.org/wiki/... [wikipedia.org] to bring data to the smart display. Select the media and play.

    • Re:Dont network (Score:4, Insightful)

      by uvajed_ekil ( 914487 ) on Wednesday February 07, 2018 @11:47PM (#56087681)

      If in doubt about a device that suggests it needs network, don't connect the network.

      Wait, do you have one of those new-fangled magic smart TVs that can access DirecTV NOW, Netflix, and Amazon without connecting to a network? Good for you, but I'm more than happy to connect my vulnerable TCL to my home network. I mean, I wouldn't connect my refrigerator or my sewing machine, but there's nothing you can do with my TV that concerns me. And I like what the Roku interface can do.

      • but there's nothing you can do with my TV that concerns me

        what if it has a microphone?

      • Re: (Score:3)

        by AmiMoJo ( 196126 )

        I'm surprised no-one has done a Kickstarter for a firewall appliance dedicated to TVs and other IoT devices. It would block all incoming connections and only allow outgoing ones to a whitelist of approved domains. You could have an app that lets you enable specific services like YouTube and Netflix, but nothing else.

        As an added bonus it could block ads on services like YouTube.

        • You can do that from your router already.

          If you are talking about an app you can install on your TV to do this, most smart TVs don't let you sideload apps and would probably never allow such an app in their official app store

      • Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.

        And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.

        but there's nothing you can do with my TV that concerns me.

        If you honestly believe that then you don't understand the problem or what some clever asshat might do with it.

        And I like what the Roku interface can do.

        That's nice but not of concern here.

        • Re: (Score:3)

          by flink ( 18449 )

          Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.

          And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.

          If you've owned someones router sufficiently to get onto their LAN, why would you bother with their TV? There are way richer targets on the average home network.

          To quote the article:

          To become a victim of a real-world attack, a TV user would need to be using a phone or laptop running on the same WiFi network as the television, and then visit a site or download a mobile app with malicious code.

          Yeah, if you can get someone to do that, you've already compromised the device they installed the application on and

          • Re: (Score:2)

            by Rakarra ( 112805 )

            If you've owned someones router sufficiently to get onto their LAN, why would you bother with their TV? There are way richer targets on the average home network.

            The TV is harder for the user to secure, and it's unlikely to change much for years.
            If someone owns a PC, chances are the user will notice -- degraded performance, anti-virus or other product sending out warnings, more computer-savvy relative running tests. It's more likely to be wiped or replaced. Almost no one thinks of checking the TV for something it might be doing behind the scenes. It's a tempting target because it's less likely to get fixed unless your rootkit thing is sloppy enough to affect the wa

      • but there's nothing you can do with my TV that concerns me

        So you're saying you have a Smart TV, and you don't care if it's got a camera and microphone and is literally allowing undisclosed 3rd parties to watch and listen to you and everything that goes on in your house? Even when it's ostensibly turned off? Are you an exhibitionist, or do you just not understand what's going on here? Do you not understand that by 'not caring' you're helping create a precedent that spying on people in their homes is okay? Does that really not bother you at all? What if it's your ki

    • The problem is that a Sumsung smart TV has WiFi. It is reaching out to any Access Point it can find in its desparate attempt to phone home.

    • They'll just imbed some 3G radios in there and have it phone home on some low bandwidth connection paid for by the advertising research money without telling you next. You'll probably have to watch from inside a faraday cage.

  • From Roku (Score:5, Informative)

    by Anonymous Coward on Wednesday February 07, 2018 @11:08PM (#56087579)

    https://blog.roku.com/consumer-reports-got-wrong

    Gary Ellison - February 7, 2018

    Consumer Reports issued a report saying that Roku TVs and players are vulnerable to hacking. This is a mischaracterization of a feature. It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.

    Roku enables third-party developers to create remote control applications that consumers can use to control their Roku products. This is achieved through the use of an open interface that Roku designed and published. There is no security risk to our customers’ accounts or the Roku platform with the use of this API. In addition, consumers can turn off this feature on their Roku player or Roku TV by going to Settings>System>Advanced System Settings>External Control>Disabled.

    In addition the article discusses the use of ACR (Automatic Content Recognition). We took a different approach from other companies to ensure consumers have the choice to opt-in. ACR is not enabled by default on Roku TVs. Consumers must activate it. And if they choose to use the feature it can be disabled at any time. To disable consumers have to uncheck Settings > Privacy > Smart TV experience > Use info from TV inputs.

    We take the security of our platform and the privacy of our users very seriously.

    Happy Streaming!

  • you have to be in the same network (Score:4, Informative)

    by OppMan29 ( 1270518 ) on Wednesday February 07, 2018 @11:10PM (#56087593)
    in order to control the Roku TV....if you are already in my WiFi network I'm sure that turning up the volume on the tv is not what im worry about..

  • Bullshit. (Score:5, Informative)

    by msauve ( 701917 ) on Wednesday February 07, 2018 @11:15PM (#56087605)
    They're like lots of IOT devices - wide open on the local network for nefarious things like cranking up the volume. Not so much for the exaggerated claim that it can be done from the Internet. That's not happening unless you went out of your way to specifically configure your NAT gateway to allow incoming connections to your TV, in which case it's your own damn fault.

    Sure, Roku and some others (a number of AVR [wikipedia.org]s come to mind) and have no security, but in practical terms, it's only a matter of annoyance.

    Reminds me on the time Consumer's Report dinged VW for only having a single turn signal "blinker" indicator on the dashboard, instead of two (showing left/right). Only an idiot CR reviewer wouldn't remember which way they wanted to turn and need a reminder.

    • They're like lots of IOT devices - wide open on the local network for nefarious things like cranking up the volume. Not so much for the exaggerated claim that it can be done from the Internet. That's not happening unless you went out of your way to specifically configure your NAT gateway to allow incoming connections to your TV, in which case it's your own damn fault.

      But then you're just moving the security from one device (the television) to another (the router). So if a vulnerability is found in your router, perhaps a zero-day exploit for which a patch isn't available for several weeks, then your television is vulnerable as well. You might say something like "If your router is hacked, have have bigger problems than the fact that someone can control your TV!" That may be true, but it misses the point. There is NO GOOD REASON why televisions need to be designed in s

      • Re:Bullshit. (Score:5, Insightful)

        by chispito ( 1870390 ) on Wednesday February 07, 2018 @11:39PM (#56087653)

        But then you're just moving the security from one device (the television) to another (the router).

        It turns out all TVs have are vulnerable to infrared hacking! If your window is open, hackers can control your TV! This just moves the security from the TV to the blinds.

        There is NO GOOD REASON why televisions need to be designed in such a way that they are vulnerable to this kind of hacking, especially if people don't really want or need a lot of "smart TV" features, i.e. just watching over the air broadcasts, or DVD/BluRay discs, or playing video games.

        Then don't put it on your network. Problem solved.

        • The real takeaway here: be afraid, VERY AFRAID! *They* are watching, even if your TV doesn't have a camera - *they* are very clever, and have a whole lot of time to waste spying on super-important people like you.

          I get it, tons of IOT things are vulnerable to remote hijacking of various types. But I'm not worried about someone changing my volume - I'm sorry for them if that's how they spend their time. This all reminds me of the PSAs on the Justice Network, which are all just a nice cop smiling and tellin

        • Re: (Score:3)

          by AmiMoJo ( 196126 )

          It turns out all TVs have are vulnerable to infrared hacking! If your window is open, hackers can control your TV! This just moves the security from the TV to the blinds.

          Kids do this occasionally around here. Take their Sky satellite TV remote and wonder around changing people's TVs to the porn channels and cranking the volume up.

      • Re: (Score:2)

        by nnull ( 1148259 )

        Unfortunately, there are so many unsecured devices out there that the router is the only thing keeping things secure. From your stupid $15 IoT WiFi nanny camera to multi-million dollar machines. Fortunately, routers and switches with greater security and greater features are out there for reasonable prices now to deal with it. But you're right, if the router is compromised, all those devices are vulnerable.

        • Unfortunately, there are so many unsecured devices out there that the router is the only thing keeping things secure. From your stupid $15 IoT WiFi nanny camera to multi-million dollar machines.

          Anyone who spent more than a million dollars on a television set deserves everything that happens to them.

      • Um... I take advantage of Sonos' same terrible, awful, incorrigible security hole all the time, and I am thankful they have them! How else would you control what is playing, adjust volume, configure zones, etc without needing to use the Sonos app that constantly asks to be updated?

        I have a mix of Insteon, Hue, Sonos, and some other crap in my home, glued together (technically much more like duct tape) with a Universal Devices ISY994 (and in true Rube-Goldberg fashion, with a Beagle or Pi adding some specif

        • Um... I take advantage of Sonos' same terrible, awful, incorrigible security hole all the time, and I am thankful they have them! How else would you control what is playing, adjust volume, configure zones, etc without needing to use the Sonos app that constantly asks to be updated?

          Sonos is malware.

      • You might say something like "If your router is hacked, have have bigger problems than the fact that someone can control your TV!"

        I like the CSRFish argument in TFA. Of all the possibilities this seems to be the most credible vector against average user.

        People installing smartphone apps that are actually (surprise) malware or exploit some wizbang browser feature enabling your LAN to be owned when you visit the wrong site by actors who would not otherwise have direct access.

        There is NO GOOD REASON why televisions need to be designed in such a way that they are vulnerable to this kind of hacking

        Personally I have unauthenticated access configured on my libreelec SBC because I want people to broadcast their drivel to our crummy TV without asking permission.

    • Re: (Score:2)

      by jrumney ( 197329 )
      I see these idiots on the road daily. Next time I'll take note of whether they are driving a VW and if so, sue for the disruption caused to my motoring.

  • I'm continually disappointed (Score:3)

    by bobstreo ( 1320787 ) on Wednesday February 07, 2018 @11:33PM (#56087639)

    that my (bought for lack of smart features) dumb TV continues to not have any of these issues.

  • I have a TCL Roku TV, and if you have so much time on your hands that you want to track it down change the volume on me, have at it. I have a great TV that was a true bargain, and there's nothing sensitive stored on it, so I'm happy.
  • From the Slashdot summary: "... all these TVs raised privacy concerns by collecting very detailed information on their users."

    It seems to me that the long-term effect will be to do severe damage to the reputation of both Samsung and Roku.

  • Hook it to a streaming device like a Amazon Fire.

    Disable voice, and tape over the microphones with duct tape.

    Put a dedicated NAT router between the streaming device and the main home router.

    Disable wireless and run wired.

    Got to get 3 levels deep to get to the TV, the most expensive part on that chain of devices.

  • The attacker has to have a presence on my LAN and then they can adjust the volume of a TV ..... wow. I really think that's low on the list of things to worry about if they are on my subnet. I don't own one of these sets but this isn't a big deal IMO.

    • Re: (Score:1)

      by Anonymous Coward

      Lock up your remotes. They are a security risk. If someone breaks into your house they can use them to change your TV settings!

      • Re: (Score:2)

        by Rakarra ( 112805 )

        Lock up your remotes. They are a security risk. If someone breaks into your house they can use them to change your TV settings!

        Yeah, last year some dudes broke into my house and set the TV to the Playboy channel and then left it on that channel for my wife to find! I'm lucky they didn't steal anything, but it took awhile to convince my wife that the neer-do-wells had broken in.

  • I dunno about Roku, but you know... water is wet, smart TVs are vulnerable to hacking.

  • Some time ago, I found that Samsung had stopped updating software on my blueray player( which killed new blueray ), so I started playing with the TV. Sure enough it was obvious that our TV has holes in it.
    I never tested Roku, but assumed that staying up was going to be hard because they have lots of capabilities, i.e. lots and lots of code. The only ones I trust are those backed by large software companies, which is apple tv, Android TV, and Chromecast. Out of these, only Chromecast is a minimalist appro
    • So there are hardware Bluray players that can't play new movies because the manufacturers can't be bothered to update them? Wouldn't that count as not being fit for purpose?
      I don't own a Bluray player and had heard something about key revocation and so but never imagined that existed legitimate hardware players that couldn't play original discs. Madness.

  • Published? (Score:3)

    by jrumney ( 197329 ) on Thursday February 08, 2018 @05:49AM (#56088357)

    So did they publish it so we can take control of our own TVs?

    I've seen that Samsung has Android apps available that work only on Samsung phones. And a bunch of other guys have advertising laden apps that ask for far too many permissions just like the Samsung one. What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).

    • Re: (Score:2)

      by ody ( 100079 )

      What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).

      Agreed. I'd very much to have a means to control my Fire TV from my home automation server (without using the kludgey ADB hack), but they have it locked behind an undocumented, encrypted API that AFAIK is currently only supported by Google and Amazon apps.

      I think what CR calls a "security vulnerability" I'd call an "Open API".

  • ....don't buy a "smart" TV. See how easy that is?!

  • This is why my TV is a 1953 Crosley model EU-21COLBe. No one is hacking it from the internet.

    I used to be jealous of all of my friends with their fancy solid state color TVs because they would turn on without having to warm up the tubes first. But with modern smart TV's my trusty old EU-21 actually shows a picture faster than their newfangled televisions. And even then, they still have to wait for it to finish booting until they can actually change the channel.

    Plus I've never once lost the remote. Gran

  • How is this news? Any device reachable through the Internet is vulnerable to hacking. Period.
  • Bad software, out of sync audio, updates that broke more than they fixed and a forum staffed by people that ignored major problems while criticizing users for minor forum etiquette. Returned as defective after only a few weeks of frustration.

Slashdot Top Deals

news: gotcha

Close