Crossposted from https://infosec.pub/post/52518361

The TV world has been a pot of controversy thanks to a two-hour-and-15-minute video from Gamers Nexus claiming LG TVs are nefariously spying on everything you do. They can record and store audio even when they seem to be off, track everything you watch, and could even be hacked remotely and turned into covert surveillance […]

top 79 comments

sorted by: hot top controversial new old
[–] 121 points 1 month ago (5 children)

Anytime a company gets caught spying, it's pretty safe to assume they all do it but that company was just the first to get caught.

  • source
  • hideshow 5 child comments
  • [–] 36 points 1 month ago (1 child)

    Gamers Nexus said that they assume other brands are just as bad but they only wanted to spend the funds for the one company

  • source
  • parent
  • hideshow 1 child comment
  • [–] 39 points 1 month ago

    Not wanted, had. They would love to do more. And in fact part of the fundraising around this is for that. GN and gamer jesus's only recently turned to heavy investigative journalism. But they don't have a sugar daddy to fund them or dedicated viewing area to sell advertising to. Their situation with alphabet and YouTube is very adversarial as well.

  • source
  • parent
  • [–] 6 points 1 month ago (1 child)

    A bit beyond that, though, if pressed, they'll say they NEED to do it to remain competitive. That's their reasoning behind every evil thing they do. On the rare occasion they call for some law to restrict the industry, it's because their company is having trouble competing.

    They'll do anything to profit that isn't explicitly against the law in whatever country they operate in. But they will also do things against the law if the penalty isn't high enough to stop them. They will take into account the social penalty, but if the profit is high, and they run a virtual monopoly, then the social costs are almost always outweighed.

    They take everything into consideration but have zero empathy or morals, so that never enters the equation. Profit is all that matters.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 month ago

    they NEED to do it to remain competitive

    That might literally be true.

    Imagine there are two factories. One spends $100 a week disposing of toxic waste. The other one saves that $100 a week by dumping their toxic waste into the local river. Absent of a robust regulatory state that can prevent and punish that kind of behavior, even if the first factory wants to be responsible environmental stewards, they might literally go bankrupt trying to compete with the evil factory.

    You can apply this to anything that can be regulated. Companies might not have a choice between doing the evil thing or not; it might literally be a matter of "Well, everyone is doing it, and if I don't, then I'll be driven out of business anyway."

    A functional government gets out in front of this phenomenon, makes doing evil shit illegal, and levies fines and punishments against companies that do evil/illegal shit such that doing the evil shit is no longer profitable.

    But instead we've got... [gestures broadly at our current nightmare reality].

  • source
  • parent
  • [–] 56 points 1 month ago* (last edited 1 month ago) (18 children)

    How to tell if something is possibly spying on you:

    1. Can it connect to the internet?
    2. Is the firmware/software controlled by a corporation?
    3. Does it have sensors capable of surveillance, like a microphone or camera?
  • source
  • hideshow 18 child comments
  • [–] 27 points 1 month ago (17 children)

    I'm concerned you may not even need to connect it to the internet. It may be enough for a neighbor to leave their WiFi unsecured. The TV may very well watch for one and use it to upload.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 6 points 1 month ago (3 children)

    So what i'm hearing is I should spin up an open ssid and black hole the traffic

  • source
  • parent
  • hideshow 3 child comments
  • [–] 14 points 1 month ago (6 children)

    It can be even worse than that. It can use other TVs in the neighborhood that are connected to the internet and just proxy it through them. It’s called a mesh network.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 6 points 1 month ago (5 children)

    Is there evidence of that? Or is this also like saying an unconnected TV might be slipped the WiFi password by a connected dishwasher through a series of ultrasonic beeps? Sure, not impossible, but also not likely in every home.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 0 points 1 month ago (3 children)

    I recall seeing an article about it a while ago but I couldn’t find anything via a google search so I guess take it with a big grain of salt.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 1 month ago

    Right. So, I'm a privacy advocate, and there's a looooooot of conspiracy theory stuff like this out there. Yes, there are real versions of this, but companies are also notoriously cheap. There's a point of diminishing returns on how many components they're going to slap on a board in hopes of netting data on 1000 more users. Something that costs 2 cents more per board will go into millions of devices and cost hundreds of thousands over a production run... To net $30,000 of data? Experiments usually fizzle based on that math. They're very often glad to have the fools that connect the TV themselves, which is an increasing proportion of consumers, I think about 65%+ of them last I checked. They're already eating well without getting overly silly and crazy about how these things work.

  • source
  • parent
  • [–] [S] 52 points 1 month ago (3 children)

    Solid article. Definitely recommend the read.

    Here’s the video by Gamers Nexus the article is talking about. It’s 2 hours and 15 minutes long.

  • source
  • hideshow 3 child comments
  • [–] 51 points 1 month ago (15 children)

    This is why I thought the "talk to your TV remote" things were all garbage...Involving a fucking microphone and a speech to text algorithm and potentially cloud bullshit just to fucking change a channel? Change the volume level? STUPID. It's much worse than just pressing a fucking button and having the volume / channel change immediately, as well as a needless sacrifice of what little remains of your privacy.

    I don't get it with smart switches / smart fans and shit either. Like a light switch already works completely fine guys. I don't know why we need to be able to talk to this shit.

  • source
  • hideshow 15 child comments
  • [–] 14 points 1 month ago (6 children)

    Personally I have a smart litter box triggering an exhaust fan for 10 minutes every time it cycles.

    My A/C turns off if you leave the patio door open for a couple minutes.

    I have a light upstairs that I turn red when I'm in an important meeting, like an On Air button.

    The foyer light turns on when you open the front door at night.

    There are useful things to be done, and most of my info doesn't leave the house.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 10 points 1 month ago (4 children)

    None of these use cases require modern "smart" things.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 1 month ago (3 children)

    Sure, you can tie a string to one end, and, uh...

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 1 month ago* (last edited 1 month ago) (2 children)

    Sensors, timers, and other tons of non-ip networked solutions exist. I have lights that automatically turn on with bulb sensors and it does not require that they be IP networked with each other. Your red light could be wirelessly triggered on a lamp in another room if you wanted without IP networked devices. Many of the "dumb", working solutions for these problems are cheaper and less complicated than using their networked equivalents.

    I have motion sensing, magnetically attached wireless lights that turn on when I go down the stairs. I even have things that can use a single light switch to trigger multiple lamps without rewiring that required zero IP networking.

    There are wireless light switches that have no battery because the switch sends a signal using the power from the force exerted on it. There are many types of automation that do not require IP networks.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 month ago (1 child)

    Link to these devices? Sounds neat

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago* (last edited 1 month ago)

    Main one (which is a little pricey) is the switcheroo. Comes with a lifetime warranty: https://www.switcheroo.com/

    I was thinking of the RunLessWire ones with the switch with no battery required, but it looks like they got sold to Philips. Nowadays it looks like several brands make a similar item: https://www.amazon.com/Self-Powered-Required-Wireless-Receiver-Lighting/dp/B0BRPKLL1Y

    These are the stair lights I have: https://www.amazon.com/dp/B09DZ4SQNZ.

    There are a whole lot of wireless outlet / light switch kits at low prices if you're looking to have a lamp somewhere a distance from the switch source.

  • source
  • parent
  • [–] 3 points 1 month ago

    I like to be able to turn the fan/AC/heat on and off without getting out of bed, or when I'm on my way home.

    Right now they're all just on isolated smart plugs, but if I was to set up more then I'd use homeassistant or something.

  • source
  • parent
  • [–] 20 points 1 month ago (2 children)

    Typing on a TV remote is a miserable experience but we've already solved that problem just put a damn keyboard on the remote already

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 1 month ago*
    1. Build a cheap PC or buy an NVidia Shield to be your media center. (I actually use a SteamLink to my desktop PC.)

    2. Never tell your TV your Wi-Fi password.

    3. Use a wireless keyboard with touch-pad as your remote.

    (4. Pirate stuff over a VPN.)

  • source
  • parent
  • [–] 7 points 1 month ago (1 child)

    Matter over Thread with Home Assistant is the smarthome tech I'd recommend.

    With that setup it all stays local. You can even block everything from the internet, unless you want to do an update.

    It will work with Google/Apple/Alexa, but of course as soon as you do that... well, that's the point of running Home Assistant instead.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago

    Zigbee for me, but on the apple front you can integrate homekit and control what's exposed. As far as apple is concerned there's just a webhook "basement light" that has an on or off command i can say

  • source
  • parent
  • [–] 1 point 1 month ago (1 child)

    There are smart switches and fans and other switchable devices that are controlled through schedule and manual BT switches and ir sensors - rather than voice. I can use voice to control things but I prefer the lights to match my day without my interactions being necessary.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 month ago* (last edited 1 month ago)

    Some applications make more sense to me than others. I haven't fully dipped into the bluetooth controlled stuff, but I have used other various wireless solutions for things. Funny enough, I've been thinking about adding a wireless power switch to my TV so that I know it isn't snooping on me when it's off. Can't snoop on me if you don't have any power.

  • source
  • parent
  • [–] -2 points 1 month ago

    people are stupid and lazy. that's it. they want the easiest way to do anything because their 'time is valuable' apparently... like cooking... people use Uber for some dumb ass reason, then wonder why they are always broke. but ya know... they saved 30 minutes which was wasted doing fuckall but doom scrolling shitty websites

  • source
  • parent
  • [–] 27 points 1 month ago

    Need to put them in a faraday cage.

    In fact, maybe your entire house should be a faraday cage

  • source
  • [–] 26 points 1 month ago (15 children)

    My Samsung tv literally phones home and Netflix 24/7 even when it is off. My “Sniffet” app screams with nothing but Samsung and Netflix garbage URLs. So does my pi-hole. It’s insane how any of this is actually even legal.

  • source
  • hideshow 15 child comments
  • [–] 32 points 1 month ago (1 child)

    FYI the default blocklist included with PiHole does not block smart TVs. Strongly recommend Perflyst SmartTV List:

    https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 1 month ago

    I don’t use the default one from pihole, I had to dig around to find the ones that actually did block all the ads and other garbage. But I’ll definitely dig into the link you have provided. Much appreciated, fellow great human being <3

  • source
  • parent
  • [–] 3 points 1 month ago (8 children)

    Can they be rooted? I'm honestly about to throw them out.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 5 points 1 month ago (7 children)

    I know LG TVs can rooted, but I don’t know about Samsung. It actually won’t matter anymore until the government legislates something to make this shit illegal. All of this actually go against the 4th amendment in the US. I that LG has been talking about putting a little modem in their displays that gets its internet from the whole neighborhood’s routers after some deals with AT&T (I think). So then disconnecting the tv from your home network won’t matter.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 8 points 1 month ago (2 children)

    The fourth amendment only binds the government, not private individuals or companies.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago (1 child)

    True, but how many of these companies don’t actually give that data to the government?

  • source
  • parent
  • hideshow 1 child comment
  • Well that's the loophole in the Fourth Amendment, as long as anyone gives the data willingly the government is off the hook, even if the person who gave it stole it illegally. As long as the govt didn't force someone to without due process, they're in the clear.

  • source
  • parent
  • [–] 3 points 1 month ago (3 children)

    See the same on my pi-hole. Chromecast is especially evil.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 month ago (2 children)

    They can get around your Pi Hole with DNS over HTTPS these days. I don't have one. Do you find yours still works well?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    I've censored so much traffic that it has issues with certain things. If there wasn't a price crisis I had planned to build my own Android TV box with an old Intel NUC or such but not at these prices. I've not looked into anything about DNS over https. I am behind a VPN at the router though not sure if that helps.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago

    I appreciate the info! A TV box really doesn't require much in the way of hardware. Have you considered picking up an old laptop? I personally use a SteamLink to stream from my desktop. (Pretty rare that I want to watch TV and game at the same time.)

  • source
  • parent
  • [–] 24 points 1 month ago

    I once tried to connect my Galaxy phone to my Samsung TV that is not connected to the local network. And the phone not only connected via bluetooth to share the video I was trying to project, it also silently passed my wifi credentials from the phone to the TV and connected itself to the internet.

    Got rid of the Samsung phone soon after, and I won’t buy another Samsung TV either when this one dies.

  • source
  • [–] 20 points 1 month ago (2 children)
  • [–] 18 points 1 month ago (7 children)

    Samsung Privacy. Download or Delete your data and opt out for all Samsung apps and Services.

    My request is processing for the last 6 hours....

  • source
  • hideshow 7 child comments
  • [–] 15 points 1 month ago* (1 child)

    These 'options' fundamentally don't work. Even if they were in good-faith one of their partners will still collect and transmit data you've generated. The whole industry is built on a no-consent model: it's software; people can't see or hear what software is doing; keep it in the background. Any attempt to revoke consent in a no-consent industry is futile. What's not futile is taking control of your computers and not running their proprietary spyware software in the first place.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 month ago (2 children)

    Want to delete my data... log in to my account to do it... phone number required before allowing me access to delete my data 😑

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    I guess it goes the slow way too by sending them an email with your info and that you dont have any number or email access, requesting them to delete everything.

    In EU they are obliged to respond and do it (don't know the timeframe), or you can sue.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 13 points 1 month ago (4 children)
  • [–] 3 points 1 month ago (2 children)

    All people had to do was say no to "smart tvs" But "Android pretty" I'm not innocent because I have a Bluray player with apps, but it does require an Ethernet cord so that's helpful.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    Oh that's all? Really? Have you tried to buy a "Not Smart" TV lately? Not exactly any options that are branded as TVs. I tried. I would have had to sacrifice quality and pay more for the privilege to buy a device intended to be used to display mostly static images as a menu board not be great at playing movies and high FPS video games. As a consumer, I was never really get a choice or a vote in this smart TV switchover decision.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments
    view more: next ›
    3 comments in c/pulse_of_truth@infosec.pub view that post