Crossposted from https://infosec.pub/post/52518361
The TV world has been a pot of controversy thanks to a two-hour-and-15-minute video from Gamers Nexus claiming LG TVs are nefariously spying on everything you do. They can record and store audio even when they seem to be off, track everything you watch, and could even be hacked remotely and turned into covert surveillance […]
Guess why I don’t own a smart TV.
Are there any hosts file/ublock type of lists that prevent this data from going out? I’d gladly throw that onto any device I can.
I can share the pihole domains I have for my samsung tv (although it’s no longer connected to the internet now)
- ocfconnect-shard-eu[0-9]{2}-euwest1.samsungiotcloud.com (regex deny)
- ads.samsungads.com (exact deny)
- samsungacr.com (exact deny)
- samsungotn.net (exact deny)
- log-config.samsungacr.com (exact deny)
- gpm.samsungqbe.com (exact deny)
- config.samsungads.com (exact deny)
It stopped any ads coming through and also prevent (some) data going back to them, mind you this also breaks installing new apps on the tv, so disable, install app from their store, enable again.
Hope this helps
Better than nothing, but if the TV doesn’t use DNS or connects to other networks or unsecured networks on its own, you’re still hosed
Just play this on a loop
I once tried to connect my Galaxy phone to my Samsung TV that is not connected to the local network. And the phone not only connected via bluetooth to share the video I was trying to project, it also silently passed my wifi credentials from the phone to the TV and connected itself to the internet.
Got rid of the Samsung phone soon after, and I won’t buy another Samsung TV either when this one dies.
Not my dumb tv from 2009, that’s still kicking
here i am still using tv from 1990 XD
Not my projector “flat” screen TV!
This is why when i’m done watching TV, i would pull out the power plug from the electric socket.
If it’s online while on it’s… an improvement I guess.
Just put it on a power strip and turn that off. Just a little easier, I think. You’re welcome.
It’ll also save money on the electric bill because of the vampiric light in the power strip.
Oh the irony
What the fuck is with all this new jargon: pixels instead of tracking-pixels? Pixel technology! You mean loading of a image with a resolution of 1x1. What technology?
Just the next small step in obfuscating spyware: Removing a descriptive term to let it sound less harmful
Samsung Privacy. Download or Delete your data and opt out for all Samsung apps and Services.
My request is processing for the last 6 hours…
Want to delete my data… log in to my account to do it… phone number required before allowing me access to delete my data 😑
I guess it goes the slow way too by sending them an email with your info and that you dont have any number or email access, requesting them to delete everything.
In EU they are obliged to respond and do it (don’t know the timeframe), or you can sue.
I was actually able to use one of the temporary phone number services to get past it in the end and started the request.
These ‘options’ fundamentally don’t work. Even if they were in good-faith one of their partners will still collect and transmit data you’ve generated. The whole industry is built on a no-consent model: it’s software; people can’t see or hear what software is doing; keep it in the background. Any attempt to revoke consent in a no-consent industry is futile. What’s not futile is taking control of your computers and not running their proprietary spyware software in the first place.
Yeah, this is more like a damage control or a lesson for the future for me.
It prompts you to accept all cookies, with no options. Ironic.
My browser get rid these popups in almost every site, so I cant confirm.
Sigh… it never ends.
All people had to do was say no to “smart tvs” But “Android pretty” I’m not innocent because I have a Bluray player with apps, but it does require an Ethernet cord so that’s helpful.
Not until we end it, together.
This article is utter bullshit normalizing this invasion of privacy by entertainment hardware vendors. “Everyone is doing it” is not a valid defense, it only shows that no one should be doing it and that the laws are too lax and not protecting people as they should.
Consumers normalized this decades ago when they started buying all this stuff despite the warnings. People have been selling our collective freedom for what amounts to toys.
To be fair, decades ago the hardware hasn’t been doing these things, and people have been far more optimistic in general regarding the behavior of companies. Maybe it was bad that people (including me) kept warning our surroundings about the possible consequences - It for sure caused some type of warning fatigue and made us look paranoid. Saying “We told ya so” might be satisfying, but not very productive.
Louis Rossmann keeps saying that we are moving rapidly from a high-trust to a low-trust-society. If companies can change contracts, behavior and features regarding products arbitrarily with no recourse for the clients (except fucking forced arbitration ofc), there is no reason for costumers to believe that their issues and complaints are heard. The more trust deteriorates, the more often these things happen, there might be people applying violence instead of lawsuits. It is in the best interest of companies to don’t fuck over their clients too long; If the laws do not protect people, people might decide that these laws do not bind them either.
The hardware has been collecting private data since atleast the internet got popular. I’ve lived through half a dozen momentary concerns over some data collection in yet another device, articles are written and people moan then they buy the product and give up a little more privacy. Its been an incremental increase up until we have microphones and cameras in our homes. Even those warranted a slight public disturbance before people quickly relented and bought them. The “I don’t care if they know…” people helping fascism make it no longer a choice.
Given some of the decisions of the administration I’m concerned about what I can and can’t trust. I’m supposed to believe Hegseth about war and RFK about health, the antivaxer? Not companies get less red tape, less safety and health standards and I gotta be concerned about which company do and don’t make safe products. Its insane.
Ok, i was thinking more about the 80s and 90s when i said decades. And even at the turn of the century data collection still was limited to mostly diagnostic data and “always online” devices and software only really started getting traction later - i can remember the uproar when Simcity needed a permanent internet connection or when the xbox one required the same. But after that things went downhill real fast.
I would not trust any member of the current US admin further than i could throw them. They are fascists or opportunists who have no qualms working with fascists, and they are largely incompetent in their jobs too with very questionable world views (looking primarily at Trump, Hegseth, RFK and Patel here, but the rest of the bunch isn’t much better). But they are only a symptom of the rot that has taken root in the US at least since the 60s.
The signs were there with Nixon getting off the hook and Reagans Contra affair having no repercussions for him. But there was no push to change anything substantially. I personally blame the civic religion the US has adopted; if you say state and religion are to be separate, but at the same time make the country itself a religion, changing anything basic becomes akin to blasphemy (or “communism” it this specific case.
And the people having no issue with bending the rules of course have no issue bending them when it comes to the relationship between companies and their costumers. The regulatory capture is insane in the US, and forced arbitration should be illegal in a country that believes in the rule of law. Contract law also should not allow one-sided changing of contracts regarding removal of features, privacy and cost structure - slapping a subscription fee on something that already has been sold without subscription should not be a thing at all, unless they also allow costumers to return the product for the full price they paid, and the privacy policy should be fixed in its essence (changing some minor wording is fine).
If you can’t be sure that whatever you buy today will work the same way in a few weeks or that it won’t just start selling your data because contracts can change whenever, then you also can’t trust e-commerce at all, which is an essential way of doing business today - being able to buy something online and transferring money to an unknown party does not work in a low-trust society. The companies behaving that way are sawing on the branch they are sitting on because they don’t give a shit about rules.
Entertainment hardware vendors? Dude, it is just a monitor. I don’t agree with their practices, but I also don’t understand why someone would connect a TV to the internet.
But hey: some people want to play Doom on their fridge. shrug
This “monitor” reports home on what you watch, how long you watch, what other devices are in your home, and integrates an ad service called “Alphonso” (a 100% daugter of LG), using this information to bombard you with ads on your mobile devices and selling this info to data brokers, which in the US also means that it lands in the hands of the government. I don’t know much about your standards regarding privacy, but i’d say what i watch on my tv in my living room is nobody’s fucking business.
Can you guarantee that a tv isnt constantly, without consent, searching for an unsecured wireless network to connect to? Or has a secret cellular chip? Or, even if it doesnt right now, that it wont in the future?
This is why we need laws, to protect people who shrug
Dont even need a cell phone. LoRa is a thing and works perfectly fine in both remote areas and not so remote ones.
Oh bro, fuck yes we need the laws. We are certainly on the same team! Absolutely no question.
Shit, man, I will be your brother in arms on this topic!
Need to put them in a faraday cage.
In fact, maybe your entire house should be a faraday cage
How to tell if something is possibly spying on you:
- Can it connect to the internet?
- Is the firmware/software controlled by a corporation?
- Does it have sensors capable of surveillance, like a microphone or camera?
I’m concerned you may not even need to connect it to the internet. It may be enough for a neighbor to leave their WiFi unsecured. The TV may very well watch for one and use it to upload.
So what i’m hearing is I should spin up an open ssid and black hole the traffic
Put a drill to the wifi chip – it’s the only way to be sure.™
I mean it won’t hurt. I don’t think there’s any evidence they do it, though, and if they did, they’d probably try every network they could until they found a way out.
It can be even worse than that. It can use other TVs in the neighborhood that are connected to the internet and just proxy it through them. It’s called a mesh network.
Is there evidence of that? Or is this also like saying an unconnected TV might be slipped the WiFi password by a connected dishwasher through a series of ultrasonic beeps? Sure, not impossible, but also not likely in every home.
Amazon Sidewalk is already delivering that exact capability.
I recall seeing an article about it a while ago but I couldn’t find anything via a google search so I guess take it with a big grain of salt.
Right. So, I’m a privacy advocate, and there’s a looooooot of conspiracy theory stuff like this out there. Yes, there are real versions of this, but companies are also notoriously cheap. There’s a point of diminishing returns on how many components they’re going to slap on a board in hopes of netting data on 1000 more users. Something that costs 2 cents more per board will go into millions of devices and cost hundreds of thousands over a production run… To net $30,000 of data? Experiments usually fizzle based on that math. They’re very often glad to have the fools that connect the TV themselves, which is an increasing proportion of consumers, I think about 65%+ of them last I checked. They’re already eating well without getting overly silly and crazy about how these things work.
Bro you’re researching privacy with Google wyd
I used google as the generic search term. I personally use no aI DuckDuckGo
Cellular modems are getting cheaper. Maybe in a few years they’re looking for Meshtastic nodes.
May be. I’m still waiting for someone to show me a case of that happening, because I’ve been unable to find one.
I’ve never seen proof it happens, so it might not, but I sure as shit wouldn’t suggest it to them if they haven’t thought of it yet.
True, updated above.
Wdym by unsecured? No password?
Yeah, fully broadcast SSID with no password, blatantly obvious to any who look and free to access for any who try.
Anytime a company gets caught spying, it’s pretty safe to assume they all do it but that company was just the first to get caught.
A bit beyond that, though, if pressed, they’ll say they NEED to do it to remain competitive. That’s their reasoning behind every evil thing they do. On the rare occasion they call for some law to restrict the industry, it’s because their company is having trouble competing.
They’ll do anything to profit that isn’t explicitly against the law in whatever country they operate in. But they will also do things against the law if the penalty isn’t high enough to stop them. They will take into account the social penalty, but if the profit is high, and they run a virtual monopoly, then the social costs are almost always outweighed.
They take everything into consideration but have zero empathy or morals, so that never enters the equation. Profit is all that matters.
they NEED to do it to remain competitive
That might literally be true.
Imagine there are two factories. One spends $100 a week disposing of toxic waste. The other one saves that $100 a week by dumping their toxic waste into the local river. Absent of a robust regulatory state that can prevent and punish that kind of behavior, even if the first factory wants to be responsible environmental stewards, they might literally go bankrupt trying to compete with the evil factory.
You can apply this to anything that can be regulated. Companies might not have a choice between doing the evil thing or not; it might literally be a matter of “Well, everyone is doing it, and if I don’t, then I’ll be driven out of business anyway.”
A functional government gets out in front of this phenomenon, makes doing evil shit illegal, and levies fines and punishments against companies that do evil/illegal shit such that doing the evil shit is no longer profitable.
But instead we’ve got… [gestures broadly at our current nightmare reality].
Gamers Nexus said that they assume other brands are just as bad but they only wanted to spend the funds for the one company
Not wanted, had. They would love to do more. And in fact part of the fundraising around this is for that. GN and gamer jesus’s only recently turned to heavy investigative journalism. But they don’t have a sugar daddy to fund them or dedicated viewing area to sell advertising to. Their situation with alphabet and YouTube is very adversarial as well.
100%
Until there is real regulation (which in this case, may actually happen) that is what you should be assuming.
the big mistake is buying a smart tv in the firs tplace.
Why do these types of comments keep getting upvoted when they’re fundamentally virtue signalling with nothing of substance?
If people shouldn’t buy a smart tv, are you suggesting no tv at all? Or a business display that’s not as good for gaming and other media?
Or do you actually have a suggestion for a non-smart tv made with current technology?
It’s hard to find dumb TV. But you can just use a smart TV without connecting it to the internet.
That’s a bit of a misconception, TV’s have other potential paths to try and get themselves connected. Say connecting itself to an unsecured network or uploading through a data stream over HDMI. Or you sell the TV and the next person connects it to the internet (TV’s can store a lot of data too).
The only real ways to cripple a Smart TV is to either destroy the ability to spy (disconnect mics etc.) or properly contain it in a firewall.
Also - lots of ISP-provided routers have secondary unsecured networks as part of a network for customer devices that you may not even realize are coming from your own router.
How can I find out more about these?
Is there any evidence this happens? Why would manufactures go to the trouble of making a nefarious hacker TV when 99.9% of buyers are just going to type in their wifi credentials when prompted?
You should watch the gamers nexus video. The LG TVs they tested automatically look for open wifi networks to connect to and once connected to a network scan for all devices on the same network and send that back to the mothership.
Glad mine is maybe 10 years old at this point.
This is sort of a solvable problem is the thing. If you just check there’s no open networks in/near your home, and do a factory reset when you sell it, you’re covering both of the hypotheticals you mentioned.
If the TV can’t talk to anyone, it can’t talk to anyone. It’s too expensive to insert complements into millions of units for edge cases when so many people connect their TVs anyway.
This is why I thought the “talk to your TV remote” things were all garbage…Involving a fucking microphone and a speech to text algorithm and potentially cloud bullshit just to fucking change a channel? Change the volume level? STUPID. It’s much worse than just pressing a fucking button and having the volume / channel change immediately, as well as a needless sacrifice of what little remains of your privacy.
I don’t get it with smart switches / smart fans and shit either. Like a light switch already works completely fine guys. I don’t know why we need to be able to talk to this shit.
Typing on a TV remote is a miserable experience but we’ve already solved that problem just put a damn keyboard on the remote already
-
Build a cheap PC or buy an NVidia Shield to be your media center. (I actually use a SteamLink to my desktop PC.)
-
Never tell your TV your Wi-Fi password.
-
Use a wireless keyboard with touch-pad as your remote.
(4. Pirate stuff over a VPN.)
-
100%
Personally I have a smart litter box triggering an exhaust fan for 10 minutes every time it cycles.
My A/C turns off if you leave the patio door open for a couple minutes.
I have a light upstairs that I turn red when I’m in an important meeting, like an On Air button.
The foyer light turns on when you open the front door at night.
There are useful things to be done, and most of my info doesn’t leave the house.
None of these use cases require modern “smart” things.
Sure, you can tie a string to one end, and, uh…
Sensors, timers, and other tons of non-ip networked solutions exist. I have lights that automatically turn on with bulb sensors and it does not require that they be IP networked with each other. Your red light could be wirelessly triggered on a lamp in another room if you wanted without IP networked devices. Many of the “dumb”, working solutions for these problems are cheaper and less complicated than using their networked equivalents.
I have motion sensing, magnetically attached wireless lights that turn on when I go down the stairs. I even have things that can use a single light switch to trigger multiple lamps without rewiring that required zero IP networking.
There are wireless light switches that have no battery because the switch sends a signal using the power from the force exerted on it. There are many types of automation that do not require IP networks.
Link to these devices? Sounds neat
Main one (which is a little pricey) is the switcheroo. Comes with a lifetime warranty: https://www.switcheroo.com/
I was thinking of the RunLessWire ones with the switch with no battery required, but it looks like they got sold to Philips. Nowadays it looks like several brands make a similar item: https://www.amazon.com/Self-Powered-Required-Wireless-Receiver-Lighting/dp/B0BRPKLL1Y
These are the stair lights I have: https://www.amazon.com/dp/B09DZ4SQNZ.
There are a whole lot of wireless outlet / light switch kits at low prices if you’re looking to have a lamp somewhere a distance from the switch source.
I like to be able to turn the fan/AC/heat on and off without getting out of bed, or when I’m on my way home.
Right now they’re all just on isolated smart plugs, but if I was to set up more then I’d use homeassistant or something.
There are smart switches and fans and other switchable devices that are controlled through schedule and manual BT switches and ir sensors - rather than voice. I can use voice to control things but I prefer the lights to match my day without my interactions being necessary.
Some applications make more sense to me than others. I haven’t fully dipped into the bluetooth controlled stuff, but I have used other various wireless solutions for things. Funny enough, I’ve been thinking about adding a wireless power switch to my TV so that I know it isn’t snooping on me when it’s off. Can’t snoop on me if you don’t have any power.
Matter over Thread with Home Assistant is the smarthome tech I’d recommend.
With that setup it all stays local. You can even block everything from the internet, unless you want to do an update.
It will work with Google/Apple/Alexa, but of course as soon as you do that… well, that’s the point of running Home Assistant instead.
people are stupid and lazy. that’s it. they want the easiest way to do anything because their ‘time is valuable’ apparently… like cooking… people use Uber for some dumb ass reason, then wonder why they are always broke. but ya know… they saved 30 minutes which was wasted doing fuckall but doom scrolling shitty websites
