Crossposted from https://infosec.pub/post/52518361
The TV world has been a pot of controversy thanks to a two-hour-and-15-minute video from Gamers Nexus claiming LG TVs are nefariously spying on everything you do. They can record and store audio even when they seem to be off, track everything you watch, and could even be hacked remotely and turned into covert surveillance […]
Solid article. Definitely recommend the read.
Here’s the video by Gamers Nexus the article is talking about. It’s 2 hours and 15 minutes long.
Oh shit I accidentally clicked accept on the terms for voice and I’m incredibly inebriated.
Wendell was having a blast for sure. 🤣
Well worth watching the whole thing.
Samsung Privacy. Download or Delete your data and opt out for all Samsung apps and Services.
My request is processing for the last 6 hours…
It prompts you to accept all cookies, with no options. Ironic.
My browser get rid these popups in almost every site, so I cant confirm.
Want to delete my data… log in to my account to do it… phone number required before allowing me access to delete my data 😑
I guess it goes the slow way too by sending them an email with your info and that you dont have any number or email access, requesting them to delete everything.
In EU they are obliged to respond and do it (don’t know the timeframe), or you can sue.
I was actually able to use one of the temporary phone number services to get past it in the end and started the request.
These ‘options’ fundamentally don’t work. Even if they were in good-faith one of their partners will still collect and transmit data you’ve generated. The whole industry is built on a no-consent model: it’s software; people can’t see or hear what software is doing; keep it in the background. Any attempt to revoke consent in a no-consent industry is futile. What’s not futile is taking control of your computers and not running their proprietary spyware software in the first place.
Yeah, this is more like a damage control or a lesson for the future for me.
Sigh… it never ends.
Not until we end it, together.
All people had to do was say no to “smart tvs” But “Android pretty” I’m not innocent because I have a Bluray player with apps, but it does require an Ethernet cord so that’s helpful.
Oh that’s all? Really? Have you tried to buy a “Not Smart” TV lately? Not exactly any options that are branded as TVs. I tried. I would have had to sacrifice quality and pay more for the privilege to buy a device intended to be used to display mostly static images as a menu board not be great at playing movies and high FPS video games. As a consumer, I was never really get a choice or a vote in this smart TV switchover decision.
Duh… it’s pretty much like how the news only covered that one auto maker about how they track your activity but the reality is, they’re all doing it.
If it has a mic or GPS, you better believe they’ll have a way to track you. Don’t matter if Android or iPhone, Kia, Niisan, whatever. Tech bros and the state are all in cahoots.
My car is pretty old, so this may not work for everyone, but I can pull the fuse that powers the modem, then program the carnet or whatever VW calls it so it doesn’t expect to find a modem. All you need is an ELM327 dongle and one of the apps. (Car Scanner Pro is like $8 and a single payment.)
I once tried to connect my Galaxy phone to my Samsung TV that is not connected to the local network. And the phone not only connected via bluetooth to share the video I was trying to project, it also silently passed my wifi credentials from the phone to the TV and connected itself to the internet.
Got rid of the Samsung phone soon after, and I won’t buy another Samsung TV either when this one dies.
And you can bet that in the US at least, they will happily provide everything to law enforcement, even if not asked.
They can’t really spy on me b/c I don’t have it connected to the internet and I’m 99.999% sure that whatever they might discover by spying on me isn’t worth the price of a cellular network card and ongoing costs associated with that.
That’s sort of the “I’ve got nothing to hide” argument. They want your data for a reason. It’s valuable to them. It’s like, why have blinds or curtains on your windows if you don’t have something to hide?
Yeah nah mate they worked that one out years ago. Shit scans for adhoc/unsecured, or uses a low level local mesh until they hit one that does have internet
After turning off the wifi setting on my 2022ish Samsung TV, no attempts to connect to wifi. I don’t have a password, but it doesn’t appear to have connected to my wifi.
I also live in the woods and there’s no neighbor wifi or anything.
That said, before I turned wifi off, the TV was CONSTANTLY sending data to the mothership.
But why don’t you have a WiFi password?
How to tell if something is possibly spying on you:
- Is it connected to the internet?
- Is the firmware/software controlled by a corporation?
- Does it have sensors capable of surveillance, like a microphone or camera?
I’m concerned you may not even need to connect it to the internet. It may be enough for a neighbor to leave their WiFi unsecured. The TV may very well watch for one and use it to upload.
So what i’m hearing is I should spin up an open ssid and black hole the traffic
Put a drill to the wifi chip – it’s the only way to be sure.™
Please someone work out how to install Linux on these things
I mean it won’t hurt. I don’t think there’s any evidence they do it, though, and if they did, they’d probably try every network they could until they found a way out.
May be. I’m still waiting for someone to show me a case of that happening, because I’ve been unable to find one.
I’ve never seen proof it happens, so it might not, but I sure as shit wouldn’t suggest it to them if they haven’t thought of it yet.
Cellular modems are getting cheaper. Maybe in a few years they’re looking for Meshtastic nodes.
True, updated above.
It can be even worse than that. It can use other TVs in the neighborhood that are connected to the internet and just proxy it through them. It’s called a mesh network.
Is there evidence of that? Or is this also like saying an unconnected TV might be slipped the WiFi password by a connected dishwasher through a series of ultrasonic beeps? Sure, not impossible, but also not likely in every home.
Amazon Sidewalk is already delivering that exact capability.
I recall seeing an article about it a while ago but I couldn’t find anything via a google search so I guess take it with a big grain of salt.
Right. So, I’m a privacy advocate, and there’s a looooooot of conspiracy theory stuff like this out there. Yes, there are real versions of this, but companies are also notoriously cheap. There’s a point of diminishing returns on how many components they’re going to slap on a board in hopes of netting data on 1000 more users. Something that costs 2 cents more per board will go into millions of devices and cost hundreds of thousands over a production run… To net $30,000 of data? Experiments usually fizzle based on that math. They’re very often glad to have the fools that connect the TV themselves, which is an increasing proportion of consumers, I think about 65%+ of them last I checked. They’re already eating well without getting overly silly and crazy about how these things work.
Bro you’re researching privacy with Google wyd
I used google as the generic search term. I personally use no aI DuckDuckGo
Wdym by unsecured? No password?
Oh the irony
What the fuck is with all this new jargon: pixels instead of tracking-pixels? Pixel technology! You mean loading of a image with a resolution of 1x1. What technology?
Just the next small step in obfuscating spyware: Removing a descriptive term to let it sound less harmful
Just play this on a loop
Well glad that I still have my good old dumb 1080p LCD and my HTPC.
Are there any hosts file/ublock type of lists that prevent this data from going out? I’d gladly throw that onto any device I can.
I can share the pihole domains I have for my samsung tv (although it’s no longer connected to the internet now)
- ocfconnect-shard-eu[0-9]{2}-euwest1.samsungiotcloud.com (regex deny)
- ads.samsungads.com (exact deny)
- samsungacr.com (exact deny)
- samsungotn.net (exact deny)
- log-config.samsungacr.com (exact deny)
- gpm.samsungqbe.com (exact deny)
- config.samsungads.com (exact deny)
It stopped any ads coming through and also prevent (some) data going back to them, mind you this also breaks installing new apps on the tv, so disable, install app from their store, enable again.
Hope this helps
Better than nothing, but if the TV doesn’t use DNS or connects to other networks or unsecured networks on its own, you’re still hosed
These work for at least the 7 series, there were no more ads in the menu’s.
My Samsung tv literally phones home and Netflix 24/7 even when it is off. My “Sniffet” app screams with nothing but Samsung and Netflix garbage URLs. So does my pi-hole. It’s insane how any of this is actually even legal.
FYI the default blocklist included with PiHole does not block smart TVs. Strongly recommend Perflyst SmartTV List:
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
I don’t use the default one from pihole, I had to dig around to find the ones that actually did block all the ads and other garbage. But I’ll definitely dig into the link you have provided. Much appreciated, fellow great human being <3
Make sure to also use the extra RegEx list at https://perflyst.github.io/PiHoleBlocklist/regex.list, which helps remove regional LG ad domains among other things.
——-
But hasn’t been updated since 2023. Oof.
Can they be rooted? I’m honestly about to throw them out.
I know LG TVs can rooted, but I don’t know about Samsung. It actually won’t matter anymore until the government legislates something to make this shit illegal. All of this actually go against the 4th amendment in the US. I that LG has been talking about putting a little modem in their displays that gets its internet from the whole neighborhood’s routers after some deals with AT&T (I think). So then disconnecting the tv from your home network won’t matter.
I was thinking of taking the Wi-Fi board out entirely
That won’t matter in the future. You’ll need to think of taking the future modem they’ll put there.
Doesn’t the fourth amendment apply to the government, much like the first?
It does, but all these companies are willing to hand out data to the government easily.
The fourth amendment only binds the government, not private individuals or companies.
True, but how many of these companies don’t actually give that data to the government?
See the same on my pi-hole. Chromecast is especially evil.
They can get around your Pi Hole with DNS over HTTPS these days. I don’t have one. Do you find yours still works well?
I’ve censored so much traffic that it has issues with certain things. If there wasn’t a price crisis I had planned to build my own Android TV box with an old Intel NUC or such but not at these prices. I’ve not looked into anything about DNS over https. I am behind a VPN at the router though not sure if that helps.
Need to put them in a faraday cage.
In fact, maybe your entire house should be a faraday cage
Guess why I don’t own a smart TV.
