I used to work for an MSP (Managed Service Provider), can confirm. Security is something I had to redirect attention to on a day-to-day basis. Even then, the company was more concerned with appearance and audit compliance than security.
I have worked at IT companies that really did care about security, but those companies were driven by management and staff that personally cared about IT security. One of them was a certificate authority.
Here's a story about physical security from before that time.
I once had equipment in a Data Center that was embedded in the 4th floor of an office building. There was a mantrap at the entrance, designed to prevent you from walking away with the main DC door open, or letting people tailgate in to it. One of the doors of the mantrap was a sliding door, disguised as a bit of the hallway.
The sliding door was locked with a maglock on the thin end, so when it fully closed, it locked and you couldn't slide it open without a key card, from inside or out.
...unless you bumped in to it with your shoulder, which separated the lock and opened the door. Which, after it was figured out (about 1 month), happened all the time. People would get let in to the DC without a card that opened that specific door. (DC security control provisioned the main door was separate from building control, which managed the sliding door).
When they tried to get out later, they'd get stuck in the mantrap, then they'd wait for someone to let them out (pre-cellphones). That person would then show them the trick. This was so common they turned off the forced-lock alarm. This lead to the mantrap being useless, and people propping the DC door open for ease of access when moving stuff in and out.
This was put in place in 2001, and I visited the building last year in 2025, it's still in place today.
It's worth noting that this DC was shared by multiple competitive reinsurers, ISPs and financial agencies. The were no cameras outside or inside, and you could poke most server reset buttons through the rack cages with the ink cartridge of a ball point pen. Not everyone was shown that trick.
Usually those are commercial models. Those shouldn't have mics, but are usually connected to Ethernet/Wi-Fi for remote control or signage applications.
I have AdGuard running on the router as a preventative measure, and it’s an older Samsung Q65 that doesn’t have any confirmed 5g modules. I should probably block its MAC address for added security though.
Can you provide a reference for this? While technically possible, I don't think this has actually happened, and spreading misinformation is counter productive.
Watched this last night. I'm wondering if I could make money lobotomizing smart TVs. Remove the WiFi antenna and either remove the mic or put a actual hardwire switch to it.
You'd have to test whether the TV's firmware allows it to run without the microphone or WiFi. Some manufacturers will anticipate people trying to control their own tech and shut their device down at any sign of tampering.
While I haven't heard about any TVs that do this, seems like only a matter of time until Tvs that won't function unless they can contact the mothership.
It wouldn't be hard to make it. Or w/e other consumer devices. Just gate all functionality behind the user "agreeing". Most ppl will click OK on literally anything.
By clicking agree, you accept that we or our 1829 partners can break into your house, steal your shit, shoot your puppy, plant rootkits in all your devices, piss in your pot of soup, and set the place on fire before we go. Millions of ppl -> Clicks OK.
I caught an app that my daughter's school uses called ClassDojo that wouldn't work at my company for some reason. I had to reach out to our security admin and it turns out it was doing DNS lookups by bypassing my company's DNS server. I submitted a ticket to the company and they ended up either designing the app to fallback to the device's assigned DNS or either probably doing something else shady. Idk, it works now.
My point is there's more than one way to do a DNS lookup.
It's definitely not fool-proof, apparently they can bypass DNS for their connections too. On the other hand, IP block is a thing as well, so maybe it's a double-edged sword for them.
Even if you never connect to wifi TVs can seek out open connections, so is there a way to disrupt or weaken the wifi signal range on TVs without physically opening it?
While possible technically, I don't believe there is any evidence this has happened. Can you provide a reference? Spreading misinformation is counter productive.
Link? Last time this came up a reddit thread from someone that had no idea what they were doing and no corroborators was all anyone produced as evidence.
If it was really happening you would have privacy YouTube/bloggers reproducing it instead of an urban legend from reddit, don't you think?
Watched the first bit. It mentions at ~10:45 that it is possible and shows some random internet chatter, which I think can only be construed as heresay as long as no one like these guys are actually replicating it. Is there more later?
"It is possible" is a concern, but people have been saying "it is happening" without any credible evidence or reproduction for years now.
A company that is harvesting data is better to not be given benefit of the doubt. I'm left trusting them less as opposed to trusting them to respect privacy.
It's not about benefit of the doubt. Fuck these data harvesting companies. What is important, however, is the truth. Making shit up and spreading unjustified FUD is not useful.
Look you are right, but everything that promotes awareness about privacy it's a plus in my book.
Being the devil's advocate, nexus gamer is not a privacy channel. They are a tech one that started doing some journalism and they seem to be new to the privacy side of things. This story come about after the monitor ad pop stuff.
Related rant:
For me phones are way more scary, they are everywhere, and you have no control on your friends and family devices. You can´t ask everyone to buy pixels and install graphene os on them.
And certainly some argument such as "more eyes" can be a valid part of the overall discussion.
For myself, I would counter that posting YT links in a privacy focused community is defeatist in nature. Literally rewarding a platform, influencers that actually have no genuine interest in the topic, other than they found a new crowd they can cash in upon.
Obviously I didn't watch, but informed guess -- the video was 10 times longer than it needed to be, filled with fluff to fit in ever more commercials and/or inline promotions?
Does anyone interested in privacy not know TVs are invasive & nasty?
Perhaps. So start a topic upon it, without feeding the beast you wish to slay. Its truly a good discussion. And much valuable input from those who have confronted it can be shared.
I do agree, phones are horrific, and none of my crowd cares about privacy. Running a degoogled OS, no microG, no play store, only open source apps. We all try to take whatever steps we can, and its not easy, including changing ones online habits, usually the biggest obstacle. Which makes putting YT links in these privacy forums insulting.
Seriously. That is my (unpopular) opinion. I call it my ongoing journey to walk the walk best as able.
One can be offended, or reflect upon their habits effecting real change. I'll end my rants on this topic now. Cheers, mate!
Yeah you are right, posting a youtube link was a bad call from op, even the rules on the forum frown on it. (First rule even!)
A better approach would have been a summary or article with the important points.
And I have to be fair with you.... you guessed right.
The video is too long, I had to skip a lot since they were repeating the same things over and over.
Worse part is that, my awareness pitch, fell flat.
I just checked the comments in the video, half of the section reads like this:
"I wont buy from LG anymore"
"FuckLG"
"Thas why i don't use tvs"
They didn't understand that the problem is bigger than one brand or device, that there's a whole system behind this.
Nor the irony of being horrified of spying software while signed to google services.
Sigh.. maybe i shouldn't rush to be a devil's advocate anymore... it always bites me back.
Anyways, I still think is important to reach people where they are, and youtube videos should help, it has reach and its were the more oblivious guys are. Although, it would have been really really nice from them to host it in a less hostile platform for everyone else.
Now like you, i will end my rant here. Loved yours, even if it was a little spicy, which may have offended some people. But there was truth there, and for me at least, made me reconsider some things.
59 Comments
e8d79@discuss.tchncs.de · 77 pts · 1d
These Smart TVs are hanging in lots of meeting rooms at companies around the world. I wonder how many IT departments thought about checking for this.
clmbmb@lemmy.dbzer0.com · 33 pts · 1d
They don't care... Most of the "IT departmens" at the companies I worked for were not interested in security stuff besides the employees' endpoints.
med@sh.itjust.works · 15 pts · 1d
I used to work for an MSP (Managed Service Provider), can confirm. Security is something I had to redirect attention to on a day-to-day basis. Even then, the company was more concerned with appearance and audit compliance than security.
I have worked at IT companies that really did care about security, but those companies were driven by management and staff that personally cared about IT security. One of them was a certificate authority.
Here's a story about physical security from before that time.
I once had equipment in a Data Center that was embedded in the 4th floor of an office building. There was a mantrap at the entrance, designed to prevent you from walking away with the main DC door open, or letting people tailgate in to it. One of the doors of the mantrap was a sliding door, disguised as a bit of the hallway.
The sliding door was locked with a maglock on the thin end, so when it fully closed, it locked and you couldn't slide it open without a key card, from inside or out.
...unless you bumped in to it with your shoulder, which separated the lock and opened the door. Which, after it was figured out (about 1 month), happened all the time. People would get let in to the DC without a card that opened that specific door. (DC security control provisioned the main door was separate from building control, which managed the sliding door).
When they tried to get out later, they'd get stuck in the mantrap, then they'd wait for someone to let them out (pre-cellphones). That person would then show them the trick. This was so common they turned off the forced-lock alarm. This lead to the mantrap being useless, and people propping the DC door open for ease of access when moving stuff in and out.
This was put in place in 2001, and I visited the building last year in 2025, it's still in place today.
It's worth noting that this DC was shared by multiple competitive reinsurers, ISPs and financial agencies. The were no cameras outside or inside, and you could poke most server reset buttons through the rack cages with the ink cartridge of a ball point pen. Not everyone was shown that trick.
umbrella@lemmy.ml · 10 pts · 1d
we are not paid to care about TVs. or privacy at all, too "paranoid".
so we don't lmao.
DannyMac@sh.itjust.works · 2 pts · 23h
Usually those are commercial models. Those shouldn't have mics, but are usually connected to Ethernet/Wi-Fi for remote control or signage applications.
generator@lemmy.zip · 47 pts · 1d
And it's no only LG, it's all of them
"LG Isn't the Only TV Company Spying on You" https://youtu.be/IvFu343KNek
orca@orcas.enjoying.yachts · 32 pts · 1d
My Samsung TV will never see a WiFi password in its life.
comrade_twisty@feddit.org · 20 pts · 1d
Some have esims and 4/5g modules installed already for "telemetry".
orca@orcas.enjoying.yachts · 11 pts · 1d
I have AdGuard running on the router as a preventative measure, and it’s an older Samsung Q65 that doesn’t have any confirmed 5g modules. I should probably block its MAC address for added security though.
Thunderbird4@lemmy.world · 8 pts · 1d
I’ve read that DNS level blocking often doesn’t stop this kind of telemetry because it goes directly to an IP without a DNS query involved.
orca@orcas.enjoying.yachts · 3 pts · 1d
Hey, good catch. I didn’t think of that.
rollerbang@lemmy.world · 9 pts · 1d
For real? You've got a source for that? Because that's probably not cheap to do for continued use.
PushButton@lemmy.world · 4 pts · 1d
I worked with IoT devices with a "5g" radio. The company had to pay a cellular contract just like anybody else.
I HIGHLY doubt LG is going to pay for that.
luipaard0011@lemmy.zip · 3 pts · 1d
Someday. Sounds crazy but someday it will be profitable to do it, like a Skynet rising
Feyd@programming.dev · 8 pts · 1d
Can you provide a reference for this? While technically possible, I don't think this has actually happened, and spreading misinformation is counter productive.
pHr34kY@lemmy.world · 6 pts · 20h
I have an open guest network and the neighbour's TV is on it...
orca@orcas.enjoying.yachts · 3 pts · 19h
That’s wild. I guess I need to do a review of my setup…
pHr34kY@lemmy.world · 2 pts · 19h
It's completely isolated from my own network. Ironically, it would almost be safer to put my TV on it instead of my home network.
The annoying thing is that if I have a dedicated clanker VLAN, I can't cast to my TV.
Aqarius@lemmy.world · 1 pts · 12h
Yeah, I already blocked it from half the internet, as soon as I figure out casting it's getting cut off completely.
umbrella@lemmy.ml · 25 pts · 1d
i wonder what our stock phones are doing.
yaroto98@lemmy.world · 10 pts · 20h
All this and more.
umbrella@lemmy.ml · 1 pts · 19h
next time you are setting up your samsung phone, give the agreement a read.
SillyDude@lemmy.zip · 18 pts · 1d
Watched this last night. I'm wondering if I could make money lobotomizing smart TVs. Remove the WiFi antenna and either remove the mic or put a actual hardwire switch to it.
floofloof@lemmy.ca · 10 pts · 23h
You'd have to test whether the TV's firmware allows it to run without the microphone or WiFi. Some manufacturers will anticipate people trying to control their own tech and shut their device down at any sign of tampering.
yardy_sardley@lemmy.ca · 5 pts · 19h
And if you try to overcome the anti-tampering firmware, it's a federal crime in basically every country.
motruck@lemmy.zip · 13 pts · 20h
All you need to know is the US military bas to block ad Ids on their soldiers phones to stop people from buying data with a credit card to find them.
It cannot continue to be acceptable for companies to track anyone and everyone at this level.
FineCoatMummy@sh.itjust.works · 13 pts · 1d
While I haven't heard about any TVs that do this, seems like only a matter of time until Tvs that won't function unless they can contact the mothership.
It wouldn't be hard to make it. Or w/e other consumer devices. Just gate all functionality behind the user "agreeing". Most ppl will click OK on literally anything.
By clicking agree, you accept that we or our 1829 partners can break into your house, steal your shit, shoot your puppy, plant rootkits in all your devices, piss in your pot of soup, and set the place on fire before we go. Millions of ppl -> Clicks OK.
SolarPunker@slrpnk.net · 12 pts · 1d
I'm wondering if something like a PiHole can "fake" a connection for these devices.
muhyb@programming.dev · 9 pts · 1d
I don't know about that part (though would like to know as well), this is currently blocked on my pi-hole:
ryper@lemmy.ca · 5 pts · 1d
It put my TV in its own group in pi-hole, blocked everything (.*) for that group, and then whitelisted what I needed the TV to be able to get to.
muhyb@programming.dev · 1 pts · 1d
I should try this. I presume you would need static IP on your TV?
ryper@lemmy.ca · 3 pts · 23h
You can also add devices to groups by MAC address or hostname, but a static IP might be best.
I only need a couple of domains to work. My way could be a hassle if you need to figure out whitelists for a few services.
muhyb@programming.dev · 1 pts · 1h
Yeah, I guess that would work too.
It is a hassle but usually only done once or at least between some intervals. My RegExs were also a hassle though.
DannyMac@sh.itjust.works · 3 pts · 23h
I caught an app that my daughter's school uses called ClassDojo that wouldn't work at my company for some reason. I had to reach out to our security admin and it turns out it was doing DNS lookups by bypassing my company's DNS server. I submitted a ticket to the company and they ended up either designing the app to fallback to the device's assigned DNS or either probably doing something else shady. Idk, it works now.
My point is there's more than one way to do a DNS lookup.
muhyb@programming.dev · 1 pts · 1h
Yeah that looks suspicious.
It's definitely not fool-proof, apparently they can bypass DNS for their connections too. On the other hand, IP block is a thing as well, so maybe it's a double-edged sword for them.
steelplatedmech@piefed.ca · 10 pts · 1d
Even if you never connect to wifi TVs can seek out open connections, so is there a way to disrupt or weaken the wifi signal range on TVs without physically opening it?
surewhynotlem@lemmy.world · 7 pts · 1d
Faraday cage?
sawdustprophet@midwest.social · 22 pts · 1d
You could install the TV in a block of lead. Bonus: +20 against a Burglary check.
Feyd@programming.dev · -4 pts · 1d
While possible technically, I don't believe there is any evidence this has happened. Can you provide a reference? Spreading misinformation is counter productive.
lepinkainen@lemmy.world · 8 pts · 1d
A Samsung TV did this a few years ago, story on Reddit and HN.
It found an open passwordless WiFi and connected to it.
Feyd@programming.dev · -1 pts · 1d
Link? Last time this came up a reddit thread from someone that had no idea what they were doing and no corroborators was all anyone produced as evidence.
If it was really happening you would have privacy YouTube/bloggers reproducing it instead of an urban legend from reddit, don't you think?
OrganicMustard@lemmy.world · 2 pts · 1d
It's literally mentioned in the video
Feyd@programming.dev · 0 pts · 1d
It's 2 hours long and I haven't the time to watch something I mostly already know about. Can you provide a timestamp so I can see that specific part?
OrganicMustard@lemmy.world · 2 pts · 1d
It's mentioned in the first half hour, but I don't have the timestamp
Feyd@programming.dev · 1 pts · 1d
Watched the first bit. It mentions at ~10:45 that it is possible and shows some random internet chatter, which I think can only be construed as heresay as long as no one like these guys are actually replicating it. Is there more later?
"It is possible" is a concern, but people have been saying "it is happening" without any credible evidence or reproduction for years now.
steelplatedmech@piefed.ca · 2 pts · 20h
A company that is harvesting data is better to not be given benefit of the doubt. I'm left trusting them less as opposed to trusting them to respect privacy.
Feyd@programming.dev · 0 pts · 20h
It's not about benefit of the doubt. Fuck these data harvesting companies. What is important, however, is the truth. Making shit up and spreading unjustified FUD is not useful.
Bluedragon012@lemmy.world · 8 pts · 1d
So, We should take lg employees hostage. Tell them we're just extracting useful data to sell.
Or you know Luigi because let's be real none of us getting a dime.
siravious@lemmy.world · 6 pts · 1d
I wonder if they just call a MS Win11 API to get their tracking ID just to make it a well rounded spy conglomerate
degen@midwest.social · 6 pts · 1d
Shit, I don't even own that many TVs
PixeIOrange@lemmy.world · 0 pts · 1d
Must be loud for anyone listening if i flick against the tv (or phone or any other internet device) so i do it regulary to repel the cia 😡
BrilliantBadger@piefed.ca · -11 pts · 1d
And if you click the YT link, Google is spying on you. Sad no alternative is given, but that would hurt the bottom line, right?
bert@lemmy.monster · 13 pts · 1d
Open said link in your front end of choice
Save yourself the time you spent writing this
Profit
BrilliantBadger@piefed.ca · -13 pts · 1d
Folks sure get cranky & defensive when the hypocrisy of their favorite "privacy" influencers cashing in on them is called out.
Talk the talk, but won't walk the walk.
Sad.
SusanoStyle@lemmy.ml · 5 pts · 1d
Look you are right, but everything that promotes awareness about privacy it's a plus in my book.
Being the devil's advocate, nexus gamer is not a privacy channel. They are a tech one that started doing some journalism and they seem to be new to the privacy side of things. This story come about after the monitor ad pop stuff.
Related rant: For me phones are way more scary, they are everywhere, and you have no control on your friends and family devices. You can´t ask everyone to buy pixels and install graphene os on them.
BrilliantBadger@piefed.ca · 1 pts · 1d
Its an interesting topic of discourse, no?
And certainly some argument such as "more eyes" can be a valid part of the overall discussion.
For myself, I would counter that posting YT links in a privacy focused community is defeatist in nature. Literally rewarding a platform, influencers that actually have no genuine interest in the topic, other than they found a new crowd they can cash in upon.
Obviously I didn't watch, but informed guess -- the video was 10 times longer than it needed to be, filled with fluff to fit in ever more commercials and/or inline promotions?
Does anyone interested in privacy not know TVs are invasive & nasty?
Perhaps. So start a topic upon it, without feeding the beast you wish to slay. Its truly a good discussion. And much valuable input from those who have confronted it can be shared.
I do agree, phones are horrific, and none of my crowd cares about privacy. Running a degoogled OS, no microG, no play store, only open source apps. We all try to take whatever steps we can, and its not easy, including changing ones online habits, usually the biggest obstacle. Which makes putting YT links in these privacy forums insulting.
Seriously. That is my (unpopular) opinion. I call it my ongoing journey to walk the walk best as able.
One can be offended, or reflect upon their habits effecting real change. I'll end my rants on this topic now. Cheers, mate!
SusanoStyle@lemmy.ml · 1 pts · 20h
Yeah you are right, posting a youtube link was a bad call from op, even the rules on the forum frown on it. (First rule even!) A better approach would have been a summary or article with the important points.
And I have to be fair with you.... you guessed right. The video is too long, I had to skip a lot since they were repeating the same things over and over. Worse part is that, my awareness pitch, fell flat. I just checked the comments in the video, half of the section reads like this:
"I wont buy from LG anymore" "FuckLG" "Thas why i don't use tvs"
They didn't understand that the problem is bigger than one brand or device, that there's a whole system behind this. Nor the irony of being horrified of spying software while signed to google services.
Sigh.. maybe i shouldn't rush to be a devil's advocate anymore... it always bites me back.
Anyways, I still think is important to reach people where they are, and youtube videos should help, it has reach and its were the more oblivious guys are. Although, it would have been really really nice from them to host it in a less hostile platform for everyone else.
Now like you, i will end my rant here. Loved yours, even if it was a little spicy, which may have offended some people. But there was truth there, and for me at least, made me reconsider some things.
Cheers!