Samsung and Roku Smart TVs Vulnerable To Hacking, Consumer Reports Finds (consumerreports.org) 102
An anonymous reader quotes a report from Consumer Reports: Consumer Reports has found that millions of smart TVs can be controlled by hackers exploiting easy-to-find security flaws. The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra. We found that a relatively unsophisticated hacker could change channels, play offensive content, or crank up the volume, which might be deeply unsettling to someone who didn't understand what was happening. This could be done over the web, from thousands of miles away. (These vulnerabilities would not allow a hacker to spy on the user or steal information.) The findings were part of a broad privacy and security evaluation, led by Consumer Reports, of smart TVs from top brands that also included LG, Sony, and Vizio. The testing also found that all these TVs raised privacy concerns by collecting very detailed information on their users. Consumers can limit the data collection. But they have to give up a lot of the TVs' functionality -- and know the right buttons to click and settings to look for.
Re: Pfft. I sucked BeauHD's boner in high school. (Score:2)
Comment removed (Score:5, Insightful)
Re: What we've been saying (Score:1)
Itâ(TM)s called USE A FIREWALL.
FIlter our the traffic. Or as two smart TVs in my house. What network connection.
Re: (Score:2)
Best thing to do is return the product. Manufacturers keep data on returns, and if they see a significant number coming back because "user rejected EULA" they will do something about it.
Check your local laws too. In the UK you don't have to return the original packaging at all, or you can just wrap it in parcel tape for transport so that it can't be re-used. Make sure that the return costs them as much as possible and they can't just throw it back on the shelf.
Re:What we've been saying (Score:4, Interesting)
No, best thing is some people bind together and sue their asses. Software shrinkwrap licenses are at least based on the belief that copyright prevents a user from installing the software without agreement.
Not so much with a phone or IoT device - the user isn't copying anything, and has no need to agree to anything. There is no "consideration" to create a contract. There's nothing which legally prevents a purchaser from using a device without accepting terms. If you're sold a phone or IoT for some function, and they want you to agree to some terms before using it, after you've already bought it, that seems a perfect example of an attempt to create an unconscionable contract of adhesion. Same with, say, GM and OnStar tracking (they never explain how they know if a car has been sold, or what allows them to track the second purchaser).
When one of those things comes up on the screen, cover it with a sticky note saying "This is my device, and I'll use it as I please. By clicking continue, I retain all rights."
Re: (Score:2)
I remember AMD graphics cards always had a note at the top of the EULA stating that if you didn't agree to it you should return the card to the retailer for a full refund.
That text was in a little text file you could edit. You could make the EULA say anything you wanted, then click "I agree". Be interesting to know what the legal status of editing the EULA in that manner would be, and if the software accepting you "I agree" click counted as AMD accepting your terms.
Re: (Score:2)
Better things to do (Score:3)
Best thing to do is return the product.
A) That will never happen in any meaningful scale.
B) A better thing to do is to simply not connect the device to a network if you don't have a compelling need to do so. Can't be hacked if it can't be reached.
C) Another better thing to do is for some enterprising lawyer(s) to sue them until they get the message. EULA be damned lawsuits will cost them money even if they win so eventually it becomes cheaper to actually provide real security.
D) EULA that you don't agree to prior to purchase are on thin legal
Re: (Score:1)
LG, Sony and Samsung cripple their devices unless you agree to the T&C as part of the setting procedure, and they all report back to base with regular network traffic. They will not operate on your LAN without external net access, if you block the mothership domains at the firewall, you'll be locked out of third party services like, Netflix, Hulu, etc, in addition to denying access to your local NAS media with lying network errors.
Re: (Score:3)
1. Don't buy a so-called 'smart TV' in the first place. They're still out there.
2. If you must buy a 'smart TV', only connect it to the Internet long enough to get through their shitty 'agreement', then disconnect it.
2a. If it insists on being connected: block it's IP address on your router. 3. Alternately: Call the manufacturer help line. Tell them you have no Internet at home. There has to be a way to 'activate' the TV without the internet.
Everyone: There are some cases where t
Dont network (Score:2)
Collect media to play back on a secure network.
Use a sneaker net https://en.wikipedia.org/wiki/... [wikipedia.org] to bring data to the smart display. Select the media and play.
Re:Dont network (Score:4, Insightful)
If in doubt about a device that suggests it needs network, don't connect the network.
Wait, do you have one of those new-fangled magic smart TVs that can access DirecTV NOW, Netflix, and Amazon without connecting to a network? Good for you, but I'm more than happy to connect my vulnerable TCL to my home network. I mean, I wouldn't connect my refrigerator or my sewing machine, but there's nothing you can do with my TV that concerns me. And I like what the Roku interface can do.
Re: (Score:2)
what if it has a microphone?
Re: (Score:2)
Roku TVs work with the Roku Enhanced Remote, which comes with a microphone for voice control.
Re: (Score:3)
I'm surprised no-one has done a Kickstarter for a firewall appliance dedicated to TVs and other IoT devices. It would block all incoming connections and only allow outgoing ones to a whitelist of approved domains. You could have an app that lets you enable specific services like YouTube and Netflix, but nothing else.
As an added bonus it could block ads on services like YouTube.
Re: (Score:2)
You can do that from your router already.
If you are talking about an app you can install on your TV to do this, most smart TVs don't let you sideload apps and would probably never allow such an app in their official app store
Overconfidence (Score:2)
Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.
And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.
but there's nothing you can do with my TV that concerns me.
If you honestly believe that then you don't understand the problem or what some clever asshat might do with it.
And I like what the Roku interface can do.
That's nice but not of concern here.
Re: (Score:3)
Good for you, but I'm more than happy to connect my vulnerable TCL to my home network.
And just how confident are you that your home network is some impregnable fortress? Unless you are an anal retentive network security professional I'm dubious you have it locked down tight.
If you've owned someones router sufficiently to get onto their LAN, why would you bother with their TV? There are way richer targets on the average home network.
To quote the article:
Yeah, if you can get someone to do that, you've already compromised the device they installed the application on and
Re: (Score:2)
If you've owned someones router sufficiently to get onto their LAN, why would you bother with their TV? There are way richer targets on the average home network.
The TV is harder for the user to secure, and it's unlikely to change much for years.
If someone owns a PC, chances are the user will notice -- degraded performance, anti-virus or other product sending out warnings, more computer-savvy relative running tests. It's more likely to be wiped or replaced. Almost no one thinks of checking the TV for something it might be doing behind the scenes. It's a tempting target because it's less likely to get fixed unless your rootkit thing is sloppy enough to affect the wa
Re: (Score:2)
but there's nothing you can do with my TV that concerns me
So you're saying you have a Smart TV, and you don't care if it's got a camera and microphone and is literally allowing undisclosed 3rd parties to watch and listen to you and everything that goes on in your house? Even when it's ostensibly turned off? Are you an exhibitionist, or do you just not understand what's going on here? Do you not understand that by 'not caring' you're helping create a precedent that spying on people in their homes is okay? Does that really not bother you at all? What if it's your ki
Re: (Score:3)
The problem is that a Sumsung smart TV has WiFi. It is reaching out to any Access Point it can find in its desparate attempt to phone home.
Re: (Score:2)
From Roku (Score:5, Informative)
https://blog.roku.com/consumer-reports-got-wrong
Gary Ellison - February 7, 2018
Consumer Reports issued a report saying that Roku TVs and players are vulnerable to hacking. This is a mischaracterization of a feature. It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.
Roku enables third-party developers to create remote control applications that consumers can use to control their Roku products. This is achieved through the use of an open interface that Roku designed and published. There is no security risk to our customers’ accounts or the Roku platform with the use of this API. In addition, consumers can turn off this feature on their Roku player or Roku TV by going to Settings>System>Advanced System Settings>External Control>Disabled.
In addition the article discusses the use of ACR (Automatic Content Recognition). We took a different approach from other companies to ensure consumers have the choice to opt-in. ACR is not enabled by default on Roku TVs. Consumers must activate it. And if they choose to use the feature it can be disabled at any time. To disable consumers have to uncheck Settings > Privacy > Smart TV experience > Use info from TV inputs.
We take the security of our platform and the privacy of our users very seriously.
Happy Streaming!
Re: From Roku (Score:4, Informative)
So you want them to close their API and lock down what 3rd part developers can do? This is an opt in as well, not opt out.
Next, more bitching that you can root your android phone and install possibly dangerous 3rd party apps. Followed by google making it hard to root and then people bitching that it is their phone to do what they want
Re: From Roku (Score:4, Informative)
No what the rebuttal misconstrues and gets wrong from Consumer Reports criticism is not that Roku has an API for 3rd party developers but that the API itself is unsecured.
The problem we found involved the application programming interface, or API, the program that lets developers make their own products work with the Roku platform. “Roku devices have a totally unsecured remote control API enabled by default,” says Eason Goodale, Disconnect’s lead engineer. “This means that even extremely unsophisticated hackers can take control of Rokus. It’s less of a locked door and more of a see-through curtain next to a neon ‘We’re open!’ sign.” And, it turned out we weren’t the first to notice this: The unsecured API had been discussed in online programming forums since 2015.
Also the advice given by Roku is already addressed in the article. Disabling External Control will prevent hacking however it also disables Roku's own app.
A Roku spokeswoman said via email, “There is no security risk to our customers’ accounts or the Roku platform with the use of this API,” and pointed out that the External Control feature can be turned off in the settings. However, this will also disable control of the device through Roku’s own app.
you have to be in the same network (Score:4, Informative)
Bullshit. (Score:5, Informative)
Sure, Roku and some others (a number of AVR [wikipedia.org]s come to mind) and have no security, but in practical terms, it's only a matter of annoyance.
Reminds me on the time Consumer's Report dinged VW for only having a single turn signal "blinker" indicator on the dashboard, instead of two (showing left/right). Only an idiot CR reviewer wouldn't remember which way they wanted to turn and need a reminder.
Re: (Score:3)
They're like lots of IOT devices - wide open on the local network for nefarious things like cranking up the volume. Not so much for the exaggerated claim that it can be done from the Internet. That's not happening unless you went out of your way to specifically configure your NAT gateway to allow incoming connections to your TV, in which case it's your own damn fault.
But then you're just moving the security from one device (the television) to another (the router). So if a vulnerability is found in your router, perhaps a zero-day exploit for which a patch isn't available for several weeks, then your television is vulnerable as well. You might say something like "If your router is hacked, have have bigger problems than the fact that someone can control your TV!" That may be true, but it misses the point. There is NO GOOD REASON why televisions need to be designed in s
Re:Bullshit. (Score:5, Insightful)
But then you're just moving the security from one device (the television) to another (the router).
It turns out all TVs have are vulnerable to infrared hacking! If your window is open, hackers can control your TV! This just moves the security from the TV to the blinds.
There is NO GOOD REASON why televisions need to be designed in such a way that they are vulnerable to this kind of hacking, especially if people don't really want or need a lot of "smart TV" features, i.e. just watching over the air broadcasts, or DVD/BluRay discs, or playing video games.
Then don't put it on your network. Problem solved.
Re: (Score:3)
I get it, tons of IOT things are vulnerable to remote hijacking of various types. But I'm not worried about someone changing my volume - I'm sorry for them if that's how they spend their time. This all reminds me of the PSAs on the Justice Network, which are all just a nice cop smiling and tellin
Re: (Score:2)
Be cautious, of course, but if you're afraid all the time then the hackers/terrorists are winning.
They don't want you to be afraid. They want you to take the blue pill with a glass of DHMO and go back to sleep.
"They" as in the manufacturers and advertisers would prefer you use their services without a thought toward privacy. "They" as in the news outlets, security vendors, and nanny state, crusading politicians do want you to be scared.
Re: (Score:3)
It turns out all TVs have are vulnerable to infrared hacking! If your window is open, hackers can control your TV! This just moves the security from the TV to the blinds.
Kids do this occasionally around here. Take their Sky satellite TV remote and wonder around changing people's TVs to the porn channels and cranking the volume up.
Re: (Score:2)
Unfortunately, there are so many unsecured devices out there that the router is the only thing keeping things secure. From your stupid $15 IoT WiFi nanny camera to multi-million dollar machines. Fortunately, routers and switches with greater security and greater features are out there for reasonable prices now to deal with it. But you're right, if the router is compromised, all those devices are vulnerable.
Re: (Score:2)
Unfortunately, there are so many unsecured devices out there that the router is the only thing keeping things secure. From your stupid $15 IoT WiFi nanny camera to multi-million dollar machines.
Anyone who spent more than a million dollars on a television set deserves everything that happens to them.
Re: (Score:2)
Um... I take advantage of Sonos' same terrible, awful, incorrigible security hole all the time, and I am thankful they have them! How else would you control what is playing, adjust volume, configure zones, etc without needing to use the Sonos app that constantly asks to be updated?
I have a mix of Insteon, Hue, Sonos, and some other crap in my home, glued together (technically much more like duct tape) with a Universal Devices ISY994 (and in true Rube-Goldberg fashion, with a Beagle or Pi adding some specif
Re: (Score:2)
Um... I take advantage of Sonos' same terrible, awful, incorrigible security hole all the time, and I am thankful they have them! How else would you control what is playing, adjust volume, configure zones, etc without needing to use the Sonos app that constantly asks to be updated?
Sonos is malware.
Re: (Score:2)
You might say something like "If your router is hacked, have have bigger problems than the fact that someone can control your TV!"
I like the CSRFish argument in TFA. Of all the possibilities this seems to be the most credible vector against average user.
People installing smartphone apps that are actually (surprise) malware or exploit some wizbang browser feature enabling your LAN to be owned when you visit the wrong site by actors who would not otherwise have direct access.
There is NO GOOD REASON why televisions need to be designed in such a way that they are vulnerable to this kind of hacking
Personally I have unauthenticated access configured on my libreelec SBC because I want people to broadcast their drivel to our crummy TV without asking permission.
Re: (Score:2)
I'm continually disappointed (Score:3)
that my (bought for lack of smart features) dumb TV continues to not have any of these issues.
Re: (Score:2)
It'll break sooner or later,
My money's on "later".
So? (Score:2)
Re: (Score:3)
Good luck, The problem isn't hackers turning your TV on and off or controlling the channel or volume. It is when one of these exploits lets them use the TV or other IoT device as a jumping off point to the more sensitive points within your network.
Good luck when someone finds a way to inject malware into your network though one of these devices that manages to infect every desktop on the network. Why would someone want to do this you say? Have you ever heard of crypto paid ransomware? Now you know!
If someone can get to your smart TV behind your LAN what stops them from getting to whatever other shit exists behind same LAN? Why is it necessary to hack TV as a jumping off point?
For example say someone with your home WiFi password installs Mr Clean's malware app on their smart phone. What prevents the app from attacking your systems directly without the smart TV foothold?
What access scenario in TFA is necessarily limited to smart TV?
Please don't misunderstand. I'm not arguing rooting televisions is h
Re: (Score:2)
If your TV is on a secure network the network is not secure. Media devices like this moved to their own vlan a decade ago. The TLC roku's, in particular, need a little love as they will refuse to connect to wifi that they can not call home from though it's easy to fake and I have a strong preference for wired anyways.
Extremely negative publicity (Score:2)
It seems to me that the long-term effect will be to do severe damage to the reputation of both Samsung and Roku.
Don't let it talk back. (Score:2)
Hook it to a streaming device like a Amazon Fire.
Disable voice, and tape over the microphones with duct tape.
Put a dedicated NAT router between the streaming device and the main home router.
Disable wireless and run wired.
Got to get 3 levels deep to get to the TV, the most expensive part on that chain of devices.
Re: Don't let it talk back. (Score:3)
Zero Shits Given (Score:2)
Re: (Score:1)
Lock up your remotes. They are a security risk. If someone breaks into your house they can use them to change your TV settings!
Re: (Score:2)
Lock up your remotes. They are a security risk. If someone breaks into your house they can use them to change your TV settings!
Yeah, last year some dudes broke into my house and set the TV to the Playboy channel and then left it on that channel for my wife to find! I'm lucky they didn't steal anything, but it took awhile to convince my wife that the neer-do-wells had broken in.
So... (Score:2)
I dunno about Roku, but you know... water is wet, smart TVs are vulnerable to hacking.
Finish it! (Score:1)
Other issue is support (Score:2)
I never tested Roku, but assumed that staying up was going to be hard because they have lots of capabilities, i.e. lots and lots of code. The only ones I trust are those backed by large software companies, which is apple tv, Android TV, and Chromecast. Out of these, only Chromecast is a minimalist appro
Re: (Score:2)
I don't own a Bluray player and had heard something about key revocation and so but never imagined that existed legitimate hardware players that couldn't play original discs. Madness.
Re: Other issue is support (Score:2)
Published? (Score:3)
So did they publish it so we can take control of our own TVs?
I've seen that Samsung has Android apps available that work only on Samsung phones. And a bunch of other guys have advertising laden apps that ask for far too many permissions just like the Samsung one. What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).
Re: (Score:2)
What I really want is to control my TV from my Home Automation server in response to other events (since the HDMI-CEC on Samsung TVs is next to useless).
Agreed. I'd very much to have a means to control my Fire TV from my home automation server (without using the kludgey ADB hack), but they have it locked behind an undocumented, encrypted API that AFAIK is currently only supported by Google and Amazon apps.
I think what CR calls a "security vulnerability" I'd call an "Open API".
It's simple really... (Score:1)
1953 Crosley (Score:1)
This is why my TV is a 1953 Crosley model EU-21COLBe. No one is hacking it from the internet.
I used to be jealous of all of my friends with their fancy solid state color TVs because they would turn on without having to warm up the tubes first. But with modern smart TV's my trusty old EU-21 actually shows a picture faster than their newfangled televisions. And even then, they still have to wait for it to finish booting until they can actually change the channel.
Plus I've never once lost the remote. Gran
How is this news? (Score:2)
Roku was the worst tech product I every bought (Score:1)