134
LG TV shown scanning LAN for third-party phones and other devices (arstechnica.com)
submitted 2 months ago by to c/privacy@lemmy.ca
18 comments fedilink hide all child comments

all 18 comments

sorted by: hot top controversial new old
[–] 14 points 2 months ago (3 children)

https://cani.rootmy.tv/

you can stop this BS if you happen to have one of these TVs

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
    • [–] 8 points 2 months ago (5 children)

    smart devices belong in an isolated network zone on your network.

    I realize (and so does LG and many others) that smart devices offer a back door through perimeter security defenses. They understand that most people cannot defend themselves against (or even understand) this and also effectively use the product at the same time.

    Effectively, many smart devices are trojan horses. Limit how many you use, understand whether or not they actually need persistent internet access, and segment your network if you have the ability.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 2 points 2 months ago (4 children)

    Except they're scanning for unsecure ones and piggybacking through HDMI cables.

    The only secure way is to not have them at all

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 months ago* (2 children)

    In some cases, they might be looking for unsecure devices.. but really I think the main use case for LG is to identify the devices. They are more interested in knowing what and whose products you have. And maybe also to what degree they identify individual people by the unique characteristics.

    Your phone, for example, would communicate its response to this scan using a unique physical ID (MAC address), and that ID would stay consistent regardless of what wifi network you were on. So you see how that's useful to fucking Palantir or whoever wants it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    Where have you been? The default for phones now is create a random MAC address every time it connects to a WiFi network. So no it well not allow tracking over networks or even on the same network. This is the default on iOS and Android, and people do not change from the default.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 6 points 2 months ago (2 children)

    So I have some experience using ADB (Android Debug Bridge) to manually remove bloatware and disable invasive background processes on Android devices. Does anyone know if there's a similar method for LG tvs running WebOS?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 7 points 2 months ago (1 child)

    To use a LG developer account/firmware access, you would have to first update to the latest firmware which auto uploads everything, sorta not helping the issue.

    You can manually remove the back and remove the Wi-Fi/Bluetooth daughter board/ribbon cable tho!

    cries in C8.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 4 points 2 months ago* (1 child)

    Doesn't almost everything with Bluetooth and wifi do this?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 2 months ago (1 child)

    I connect once to get updates on the IoT wifi then block it on the router. I do wonder what the Roku, PlayStation, Xbox, and other devices people use are doing.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 2 months ago

    as if that would stop people from buying them

  • permalink
  • fedilink
  • source
    •
    22 comments in c/privacy@lemmy.dbzer0.com view that post
    [–] 30 points 2 months ago (6 children)

    It's odd how quiet they've been since this all came out, almost like a "yeah, and?" response.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 3 points 2 months ago (3 children)

    They're all colluding and know Trump will kill any investigations or justice of any kind.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 months ago (2 children)

    Being a foreign company, I'm fairly sure that's unlikely to happen unless he somehow convinces them to ditch South Korea entirely (doubtful).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 10 points 2 months ago* (last edited 2 months ago) (14 children)

    We have a 65" LG TV in our master bedroom (model 65UT8000AUA). After finding out about this, I blocked it from my network and then unplugged it from power. It is rooted, hilariously, but until I can figure out a way to gain complete control over it (removing telemetry and other shit), it's gonna stay unplugged.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 7 points 2 months ago (7 children)

    I wouldn't remove the network card. That also kills the Bluetooth remote.

    Unplugging it from ethernet/wifi may also not be enough. If it's connected via HDMI-HEC, it could get Ethernet over HDMI. LG doesn't specifically list HEC support, but at this point, I'm not sure they can be trusted.

    Safest path is to block its IP addresses at router level, unplug it from ethernet, factory reset it, only go through a trusted streaming device without HEC support, block all the LG servers at router level, and power the TV down when not in use.

    What a stupid way to lose trust.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 6 points 2 months ago* (6 children)

    I wouldn’t remove the network card. That also kills the Bluetooth remote.

    It's a sacrifice I'm willing to make.

    Unplugging it from ethernet/wifi may also not be enough. If it’s connected via HDMI-HEC, it could get Ethernet over HDMI.

    This is why it's unplugged from power until I can properly control it without compromise. If that means I rip out the hardware in favor of some generic "is just an HDMI receiver with an LG display attached", then so be it. Or it goes in the trash. IDK yet.

    LG doesn’t specifically list HEC support, but at this point, I’m not sure they can be trusted.

    Model # 65UT8000AUA, which is rootable. I already rooted it though 😂

    Safest path is to block its IP addresses at router level, unplug it from ethernet, factory reset it

    Yep. I blocked it on my UDM. I don't think it even has an ethernet port, now that I think about it... I should check.

    only go through a trusted streaming device without HEC support, block all the LG servers at router level

    The only thing plugged into it is an Apple TV. And we rarely use it these days. I do run Pihole on my network, but admittedly I haven't kept track of the shit coming out of the TV.

    and power the TV down when not in use

    They do this even when "turned off". That's why it's unplugged.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 2 months ago (5 children)

    The remote is still needed so you can pick the AppleTV from input sources, adjust volume, or select picture mode. AppleTV, AFAIK doesn't have HEC. You need it on both ends for one device to tunnel via Ethernet. AppleTV also doesn't do ACR and has third-party Jellyfin support. Not so sure about other streaming stick/boxes.

    Two other potential sources for the TV getting out: 1) TV may silently turn wifi on and scan for open routers nearby, and 2) if the REMOTE has wifi on it. Both would be easy to honeypot.

    It's pure madness we all have to speculate about ANY of this. Anyone in LG's corporate line who approved this crap should be demoted for sheer stupidity.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 months ago* (2 children)

    The remote is still needed so you can pick the AppleTV from input sources, adjust volume, or select picture mode. AppleTV, AFAIK doesn’t have HEC. You need it on both ends for one device to tunnel via Ethernet. AppleTV also doesn’t do ACR and has third-party Jellyfin support. Not so sure about other streaming stick/boxes.

    The interface is navigable with the single button they give you on the bottom (Remember buttons? I 'member...), so that's workable. I know the Apple TV reports itself as such on the TV's input selector. Not sure if that's related to this HEC thing though.

    It’s pure madness we all have to speculate about ANY of this. Anyone in LG’s corporate line who approved this crap should be demoted for sheer stupidity.

    I don't disagree there. But that's the thing - it's not just LG doing this. Nearly every "smart" TV manufacturer does it.

    I've been working hard to rid my house of this spy shit, but the TV went under the radar for a long time. This has given me a good motivation bump to keep at it, knowing that what I'm doing isn't for nothing. And my wife is 100% onboard, which really helps.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago (1 child)

    I have ZERO doubt other makers pull the same shit. I've been through Sony and Samsung. LG just had the best picture quality. Didn' think they would abuse the trust. They have.

    LG also sells really decent home appliances. We have a few. Not sure I trust them not to be abusing that trust.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 months ago

    Yeah, I'm like hyper aware of these shenanigans at this point.

    Hell, we just bought a HiSense portable AC that I didn't realize had wifi until it was delivered. I straight up ripped out the wifi module as soon as I took it out of the box. I actually just got some parts for a fully local ESP32 replacement that I found on a whim after a bit of googling 😂

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 months ago (1 child)

    CEC covers most use cases for me. I barely touch the TV remote. Some models have physical joystick controls if you still want back into the menus.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 months ago

    Out of curiosity, I checked online. You can find basic, LG-compatible remotes for under $7 USD. At that price, I can't imagine it's more than just infra-red. In that case, the TV's network board can be disconnected without losing any functionality.

    Fortunately, CEC alone is not enough to get out to the net.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 2 months ago (3 children)

    If you can you should talk about this in the WebOS Homebrew community so it's more likely we'll see apps and fixes for it on Rooted devices.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 months ago (2 children)

    I'm sure that community is already well aware of it. Is there a group on Lemmy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 months ago (1 child)

    I haven't seen a WebOS Homebrew group on Lemmy. I'm sure that they are but I haven't seen any discussions from them about this stuff. Actually I haven't seen anyone really talk about this and WebOS rooting together. People talking about the scandal seem to avoid discussing root.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •