cross-posted from: https://lemmy.world/post/51634640
A new Gamers Nexus investigation found a retail LG TV actively scanning the local network for phones, laptops, smartwatches and other connected devices, while also capturing microphone audio when the screen appeared to be in standby. The investigation found voice data being stored locally even after the TV was disconnected from the network, with the queued data uploaded once connectivity returned. Researchers also uncovered webOS vulnerabilities that could potentially turn the television into a remotely controlled surveillance device. The really unsettling part isn't just the advertising angle. It's the fact that a consumer television can sit inside your trusted network, enumerate other devices, access a microphone, store collected data locally and communicate with external infrastructure. Put that same device in a corporate office, hospital, hotel or conference room and the security implications become considerably more serious. I went through the investigation in detail, including the network scanning, microphone behavior, ACR, webOS attack surface, offline data collection and practical mitigations
94 Comments
woelkchen@lemmy.world · 111 pts · 14h
Don't connect TVs to your network.
yaroto98@lemmy.world · 62 pts · 14h
And according to the article the data collection runs even if it's disconnected. So, don't ever connect it to the network. As soon as you do everything gets uploaded.
baines@lemmy.cafe · 5 pts · 10h
how is it collecting and sending data if not connected to a network?
i read the article, it still needs a connection
Cheebus@lemmy.world · 4 pts · 5h
You know how some people rent their wifi routers?
That’s the backbone
baines@lemmy.cafe · 1 pts · 4h
if it’s connecting without your explicit permission each time how us that not a worm
village604@adultswim.fan · 1 pts · 1h
zelahdieliekeis@piefed.blahaj.zone · 2 pts · 10h
baines@lemmy.cafe · 3 pts · 10h
lol i missed the entire second part
and i meant i read the article
not you read the article
thermal_shock@lemmy.world · 2 pts · 7h
Read and read and reed and reed. Love english
zelahdieliekeis@piefed.blahaj.zone · 2 pts · 10h
baines@lemmy.cafe · 4 pts · 10h
yea because
read
read
read the same, i was trying to be clear
i’m saying you are right, relax, i must have skipped over your second sentence on
zelahdieliekeis@piefed.blahaj.zone · 1 pts · 9h
willington@lemmy.dbzer0.com · 2 pts · 1h
The person you are replying to said that the smart TV collects spy data onto a hard drive even when it's not connected.
Then once the TV acquires a connection, it dumps the entire drive worth of spy data to the mothership.
The danger here is obvious, I think.
WereCat@lemmy.world · 1 pts · 10m
It’s not sending them, just collecting them. Then it sends them the moment you connect. They even transcribe speech to text via mic, according to GN they send about 4GB/month… IN TEXT FILES!
BurgerBaron@quokk.au · 3 pts · 3h
Could I burn a hole through a WiFi chip with a soldering iron?
village604@adultswim.fan · 2 pts · 1h
Only one way to find out.
UnLocoPoco@lemmy.world · 18 pts · 14h
This would've worked just a few years back but due to shitty "age verification" laws, even TV manufacturers willl force users to create an account the very least for the TV to even start up. They may also implement an always-online model and they'll justify that it's necessary to monitor users for "age verification purposes". ATP better to get a good monitor and use it as TV cuz cable or satellite boxes are either way gonna be provided by the network companies so that's there
woelkchen@lemmy.world · 8 pts · 13h
Surely only for "smart" features but without enabling any of that shit, you shouldn't get any age verification prompt.
thejml@sh.itjust.works · 3 pts · 9h
I could see them doing it anyway as OTA broadcasts include rating data.
That said, if it's a family TV, you're never going to put everyone on it, just the oldest one anyway.
lIlIlIlIl@lemmy.dbzer0.com · -5 pts · 13h
Impossible - no one would buy them, and that idea would die.
ExLisper@lemmy.curiana.net · 8 pts · 13h
[citation needed]
lIlIlIlIl@lemmy.dbzer0.com · -1 pts · 12h
A citation… of a would be scenario? My what a confusing comment.
emb@lemmy.world · 8 pts · 12h
I think their point is that by and large consumers are stupid and willing to put up with almost any garbage like that. What makes you think otherwise?
credo@lemmy.world · 2 pts · 12h
Where is the original citation showing you cannot use a tv disconnected, without setting up an account?
This whole thread is nonsense.
ExLisper@lemmy.curiana.net · 5 pts · 10h
What emb said. When in the history of the universe did consumers reject a product like that? You do realize Alexa and Google speakers are still very popular and tons of people wear watches with GPS, sleep tracking, heart rate tracking and always turned on BT?
lIlIlIlIl@lemmy.dbzer0.com · 2 pts · 11h
This is the only correct answer. Discussion over.
melfie@lemmy.zip · 2 pts · 12h
Works for now, but my fear is when that may not broadly be the case.
PixeIOrange@lemmy.world · 0 pts · 12h
I wonder if any of such devices use nbiot or alike...
Aqivex@fedinsfw.app · 43 pts · 10h
Really makes one wonder...How many fucking data points do these assholes need telling them we're too fucking broke for their game and want their heads on pikes?
Humanius@lemmy.world · 6 pts · 7h
Enough that they can tell with a decent amount of certainty whose social credit score should be lowered, once that gets inevitably introduced /s
(I don't think that conspiratorially.. It's probably just data harvesting and extreme greed.)
foodandart@lemmy.zip · 3 pts · 6h
That social credit works only as long as you want to buy shit. If you’re like me and don’t even own a credit card, these assholes have zero power over any aspect of my life because anything they own/control, I wouldn’t want to use anyhow. They are only professional capitalists because the public are amateur consumers.
M0oP0o@mander.xyz · 1 pts · 2h
The issue is that they don't care, they sell the data to others and they get to spin it while doing it. Its not selling data (that you are broke) to an advertiser, its the idea of that advertiser falling behind if they don't buy your data (that you are broke).
qarbone@lemmy.world · 1 pts · 3h
At least 13k
kaitco@lemmy.world · 34 pts · 13h
It’s not just LG. It’s all of them.
And, the cheaper the TV, the more often and intrusive these settings are.
It’s honestly better to just have a bare wall and a projector.
woelkchen@lemmy.world · 23 pts · 13h
Consumer projectors come with the same "smart" shit as TVs these days. Just don't connect either to WiFi. Problem solved.
undrwater@lemmy.world · 4 pts · 8h
Apparently not solved. They can connect to open (and hidden) networks without your consent.
Per the marketing chief at LG; (paraphrased, from memory) "we own the glass, and we know everything beyond the glass."
woelkchen@lemmy.world · 1 pts · 8h
That's a wild claim and either I accidentally skipped a paragraph in the article or you should cite a source. Quick googling doesn't show up anything of that sort for me.
undrwater@lemmy.world · 1 pts · 8h
I'm looking for a source as well. The "apparently" I used was supposed to cover the whole comment, but I can see how it didn't.
The video goes into detail, and could be staged, but comments seem to support the idea anyway.
Amazon devices are known to do this with other Amazon products to create a mesh.
It's not outside the realm of possibility.
ExLisper@lemmy.curiana.net · 5 pts · 13h
From a privacy point of view: yes. From every other: not so much.
pelespirit@sh.itjust.works · 6 pts · 12h
Projectors have become amazing.
woelkchen@lemmy.world · 4 pts · 8h
Yeah and consumer oriented ones have their own apps and Google TV integration and the like, so no idea how a different image displaying tech would be a solution to privacy invasive TVs.
ExLisper@lemmy.curiana.net · 2 pts · 10h
But they require dark room. Where I live in summer it gets dark at 23:00 so you need great curtains or you can't see anything most of the day. If you have curtains you have to watch everything in complete darkness. This is fine for a movie night but people like to watch news or watch a game with their friends over some food. You also need extra device to handle apps like Jellyfin. Things like BT can be more complicated to set up (my TV handles multiple BT devices nicely).
Projectors are basically great for one or two things (home theater and gaming) but are bad for everything else.
Zephorah@discuss.online · 31 pts · 14h
I was at my parent’s house, trying to add some items to the smart TV. They started listening to these awful AI interpersonal dramas read by AI, on YouTube.
My thought was to add some podcasts and their Audible account, for more selections. Maybe they’ll still only listen to that, even so. You can’t add much to a smart tv. No podcasts. No podcast app. A pretty spartan selection of apps. Even something as large and mainstream as Audible. No go. Libby? Yeah, right.
I don’t get it. What’s the point? Just buy a monitor, jack it into a PC for media, and have everything you want minus this telemetry.
otacon239@lemmy.world · 14 pts · 13h
My TV has no Internet connection, but does connect to my gaming desktop. I agree with you. There’s no reason TVs should not just be dumb displays. I do also have the Apple TV, but it never ever shows ads and is a one-time purchase. The day it starts showing me ads is the day it meets the bin.
phutatorius@lemmy.zip · 18 pts · 13h
At least, no reason that benefits the consumer. There are strong monetary incentives to spy on customers and sell the data that's collected.
Zephorah@discuss.online · 1 pts · 6h
Once again I’m reminded of Season 1 of Black Mirror. Second episode? Worker drone is “home”, “relaxing” in his sleep cubby and the walls are a barrage of ads. Occasionally he taps to pay credits to shut one down as the rest continue, as casual as anyone scrolling in boredom.
Or a shut down golden retriever in those old, now illegal learned helplessness experiments.
GhostlyPixel@lemmy.world · 1 pts · 8h
Fingers crossed the new Apple TV box is announced this week, I am waiting to finally switch over
schipelblorp@sh.itjust.works · 12 pts · 13h
I have some bad news for you:
LG monitors installing McAfee ads on Windows
UnLocoPoco@lemmy.world · 4 pts · 12h
Ah doesn't matter. Dont use windows. Use a pi and something like LibreELEC or even you can run debloated android on it with the TV interface and a remote. Just get a BT remote or an IR receiver plug into the usb port. Either of them are pretty cheap
Zephorah@discuss.online · 1 pts · 6h
We’re fully Linux now, various distros per machine, so I no longer pay much attention to windows news.
woelkchen@lemmy.world · 1 pts · 8h
Even a proprietary streaming stick like FireTV would be an improvement because it only collects telemetry from the stick itself and not devices connected to other HDMI ports.
godsammitdam@lemmy.zip · 31 pts · 7h
"We own the glass, we own the TV, we own the living room. We know who is in an LG home." --LG President of Ads
These are the Gamers Nexus videos these articles are referencing btw. Support them and their work. Get some cool shirts and physical media while you're at it.
https://www.youtube.com/watch?v=w5KnFmKjFTA
https://www.youtube.com/watch?v=6IFVTcM28KA
ChunkMcHorkle@lemmy.world · 2 pts · 2h
I'm watching the main one right now (your second link). Holy shit.
Redvenom@retrolemmy.com · 16 pts · 5h
Fuck LG, this is creepy AF
Jhex@lemmy.world · 13 pts · 14h
Bosch fucking dishwashers do this, once connected there is no way to disconnect them so I sink all its outgoing traffick at the router level
Complete garbage
phutatorius@lemmy.zip · 11 pts · 13h
Yeah, what kind of idiot wants an internet-connected dishwasher?
How about an AI-powered pair of chopsticks?
Ludicrous0251@piefed.zip · 7 pts · 12h
In a perfect world?
I'd love access to diagnostic data. Is the filter starting to clog? Is any part not working as intended? I'm a big fan of preventative maintenance, but also really bad at sticking to an arbitrary recurring schedule (e.g., clean the filter every 6 months). This could also be accomplished with Bluetooth and an offline-only app on the phone.
In the real world? Nobody provides this, and the privacy risks aren't worth it.
I do have my dishwasher on a ZigBee power meter to 1) track energy use and 2) give me a good-enough estimate of time remaining by starting a 2h timer after it starts.
UnLocoPoco@lemmy.world · 4 pts · 12h
You CAN do this with a few products of diff companies with the help of home assistant and plugins BUT many companies are pulling off support OR restricting features to its own app and giving free access to the bare minimum voa protocols like matter and all. I read somewhere on reddit that a robovac company had matter access technically but only the vac on off switch access was there and none of the other basic functions. For that you need their app. But again, still some companies do support all it's features on home assistant. Many light fixtures, switches, ACs and much more support it. So yes you can run them locally BUT it all depends on the manufacturer how much control they are willing to provide openly
NewNewAugustEast@lemmy.zip · 1 pts · 11h
But WHY! If those diags are important, then just put them in the local display of the machine itself.
Jhex@lemmy.world · 1 pts · 11h
exactly! it's so useless they had to hide regular features under the wifi connection to force customer's hand
woelkchen@lemmy.world · 4 pts · 13h
Why would you connect a dishwasher to the internet? Setting a timer can tell you just as well if the dishes are clean.
WWLAladdinSane@lemmy.world · 2 pts · 12h
Sadly, the only way to change most of the settings or running a cleaning cycle is via the app. It’s insane.
dragonlover@lemmy.zip · 2 pts · 6h
No way in hell id buy that. Soon as the app is dead so is your dishwasher, at the whim of the manufacturer
silicon@lemmy.dbzer0.com · 1 pts · 4h
Planned obsolescence is great isn't it. /s I try to keep my appliances on life support as long as I can.
fatcat@discuss.tchncs.de · 2 pts · 12h
Mh. What about... creating a guest network, connecting that abomination to that and deleting the guest network? Hopefully it can remember only one...
Railcar8095@lemmy.world · 2 pts · 8h
My TV is wired to the router but blocked from WAN access.
Only connected to the internet to install jellyfin on it.
isleepinahammock@lemmy.blahaj.zone · 2 pts · 4h
Why wouldn't a company this dedicated to advertising just install a cheap cell network modem in them? You're talking pennies on a device that costs hundreds of dollars.
20cello@lemmy.world · 10 pts · 14h
Imagine when it's turned on...
Ludicrous0251@piefed.zip · 6 pts · 12h
This is why I don't let my TV watch porn.
johntwinkletits@fedinsfw.app · 8 pts · 2h
Every device with a CPU, WiFi module, and microphones are vulnerable to this. If you don't want to be vulnerable, build your own hardware, software, and network. There's no other option.
bold_atlas@lemmy.world · 1 pts · 50m
Or just don't allow corporations to put microphones and wifi into literally everything so that we CAN have some options. Even a no frills basic TV wouldn't need a CPU if it just uses analogue connections. Those are still being made for now. So yeah it's possible to have a TV and not have to live in fear of it spying on you.
IsoKiero@sopuli.xyz · 7 pts · 10h
My LG TV is blocked from my network and always has been. However, the andriod tv connected to it is a different thing, so it's more or less lost cause anyways and I haven't had enough incentive to block the android box from the rest of network since it'd need some tweaking so that casting and other occasionally used features still work. And even if I'd block the android tv box there's still our cellphones gathering all the data, so I'm pretty much just running things on hopium that EU offers at least some protection on my data.
potustheplant@feddit.nl · 18 pts · 10h
Well, if you watch the Gamer Nexus video, you'll see that even if you don't connect your tv to the internet, you're still not safe.
lazynooblet@lazysoci.al · 5 pts · 9h
I haven't watched the video, but how can an offline TV transmit its data to the mothership?
potustheplant@feddit.nl · 9 pts · 8h
If I understood correctly, the tv can connect to open networks it finds and transmit data even if you disable wifi.
IsoKiero@sopuli.xyz · 3 pts · 8h
Mine is several years old by now, I doubt that the firmware on that has all the options enabled. And also I live in a pretty rural area, there's no open networks around.
But something LG has achieved with this, I'm going to look for other brands when I'm on a market for new TV. Which I hope will be many years in the future, maybe there's a change on products while waiting and something better is available by then.
potustheplant@feddit.nl · 8 pts · 7h
Not to be disrespectful but your very particular case as an individual is irrelevant. I just wanted to share information regarding how scummy these devices are. If some people are not affected, good for them. However, that's not the case for a lot (if not most) people.
micka190@lemmy.world · 8 pts · 8h
It'll scan for open networks and use them, regardless of whether you enabled wifi or not.
fyzzlefry@retrolemmy.com · 2 pts · 6h
Can you join it to an ssid and black hole its traffic?
cmnybo@discuss.tchncs.de · 6 pts · 8h
If you are going to have smart devices, put them on their own VLAN. They should not have access to the rest of your network. TVs shouldn't be connected at all. Use a PC or android box if you want to stream stuff.
Humanius@lemmy.world · 12 pts · 8h
The issue in this case is that they apparently use text to speech locally, store that information on the device itself, and then if at any point in the future gets connected to the internet for any meaningful length of time (be it by a subsequent owner) it will then be sent on to LG.. for safekeeping of course /s
The deep-dive by GamersNexus is pretty in depth.
https://www.youtube.com/watch?v=6IFVTcM28KA
cmnybo@discuss.tchncs.de · 1 pts · 2h
In that case, it should be disposed of like an SSD that contains sensitive information. Find the flash chips and either drill holes through them or smash them into dust with a big hammer.
village604@adultswim.fan · 1 pts · 1h
Just desolder the mic
cmnybo@discuss.tchncs.de · 1 pts · 42m
That would work if you can open the case without breaking it. Modern TVs are usually clipped together and the bezels are really thin. It's very easy to crack the panel when trying to get the case apart.
Hueristic_Autistic@lemmy.world · 4 pts · 5h
So get power strips and turn them off when you're not using the TV.
silicon@lemmy.dbzer0.com · 9 pts · 5h
Also keep them off wifi/network and you should be good unless they're smart enough to try to connect to any open network they can find like some sort of malware
M0oP0o@mander.xyz · 1 pts · 2h
Uhhhhhhh, bad news there. Many companies have been found to have their stuff make hidden networks and share info these days. I am sure you could figure out a work around if you are savvy enough, but the normal dood? Fucked and pretending this is normal.
redkid1324@sh.itjust.works · 4 pts · 11h
I need to get my network and vlans setup sooner rather than later.
MehBlah@lemmy.world · 2 pts · 3h
If I had a LG the on thing it would spy on would be the other untrusted shit I have on the vlan I let them use.
Bluedragon012@lemmy.world · 2 pts · 11h
I want to care.. I really do.. But untill ceos and those who decided this was OK are killed, it will continue. Money means nothing to these evil people.
Tikiporch@lemmy.world · 2 pts · 2h
Is this anything a VLAN and Pihole can't fix?
Edit: looks kind of impossible to prevent, if it can access an open Wi-Fi nearby.
M0oP0o@mander.xyz · 4 pts · 2h
Possible that they are piggy backing on other hidden networks. I remember there was a whole thing with Samsung years ago with their stuff doing something like that, and there are a few patents around that propose hidden networks from the "internet of things" days.
I just don't want to even truck with this nonsense, where the fuck is the line before we just stop using these things? I know there must not be a line, since we are talking about circumventing our shit spying on us like it is normal.
SaharaMaleikuhm@feddit.org · 2 pts · 7h
I keep mine offline and fully turn it off via the power switch on the extension cord. My steam deck is my smart TV instead. Yay Linux!
motruck@lemmy.zip · 1 pts · 7h
What do you use for YouTube?
HexaBack@lemmy.blahaj.zone · 3 pts · 4h
VacuumTube
fyzzlefry@retrolemmy.com · 3 pts · 7h
Nothing
BeardedBlaze@lemmy.world · 1 pts · 2h
A browser.
dragonlover@lemmy.zip · 1 pts · 6h
Invidious