3 ms·

I can just pull the network cable from the TV, which removes pretty much the entire attack surface.

by fabian2k 9y ago

goldenkey 9y ago
Every smart TV has WiFi. Even if you switch WiFi off, its not always off, on many devices.
- j45 9y ago
  Even if wifi isn't truly off, as long as it's not authenticated to a wifi network before it's turned off it is a measure more safe. If it looks for open networks... that's another thing.
  - goldenkey 9y ago
    I hate playing the "idiot, its obvious. downvoted" target. HN can be so vicious at times when you would expect someone else to fill in the junior level details. I guess my lesson is to include even the simple blackhat explanations. HN is probably lacking of that kind of crowd...maybe to a boon. Anyhow, you are all wrong to disagree with me. There were just CVEs for radio chip exploits a couple of days ago! These have been coming out quite often lately. The layer at which these exploits can be done does not require the TV to be on any network. Not even ad-hoc. Just the fact that it has a listening radio chip that has old firmware is enough to make it extremely dangerous [digitally.] That TV can literally became a wifi enabled worm distribution center, infecting everything in your home. Not worth the risk IMO. I would stick with a dumb TV. "targets didn't have to connect to the attacker's Wi-Fi network. Simply having Wi-Fi turned on was sufficient to being hacked." [1] https://www.google.com/amp/s/arstechnica.com/information-technology/2017/07/broadcom-chip-bug-opened-1-billion-phones-to-a-wi-fi-hopping-worm-attack/%3famp=1 https://www.google.com/amp/s/arstechnica.com/information-tec...
    - j45 9y ago
      I didn't downvote ya. Nor did I get any upvotes on this comment. You have a number of valid points - I wasn't aware of any issues if wifi is disabled. Dumb TV's with sufficient quality are becoming harder and harder to find. I prefer to plug in my own smarts to TV's since they evolve quicker than the years I'll own a TV.
      - goldenkey 9y ago
        True - projectors should be easier to get as dumb devices. I have a wired Epson projector that provides 4k.
servilio 9y ago
What about the ones with wireless connectivity and no hardware kill switch for it?
- fabian2k 9y ago
  The smart TV can't log into a WiFi network when it doesn't know the password. And I don't think that there are any smart TVs with an embedded mobile phone data connection that you can't shut off.
  - alsetmusic 9y ago
    My neighbor might run an unsecured network. Poorly designed software in a smart tv might cause my device to auto-join an open network. In this case, locking down my own WiFi would be irrelevant to the television. This type of behavior was the cause of new Apple Watches that couldn’t access the net over 3G (they were trapped on captive WiFi networks with no UI to disconnect). If this happened with one device, it could happen with others. edit: split a run on sentence
vetinari 9y ago
A do not put any wifi credentials into the TV. Ever. It will forever try to login into that wifi network, even if you disabled the wifi in the tv ui.
- mynameisvlad 9y ago
  You're going to need to be more specific. Even if there was a TV that did this, you can't generalize and say that all TVs do it.
  - vetinari 9y ago
    In my case, it was Samsung UE46F5570. Sure, all TVs will probably not do that, but before this one it wouldn't occur to me, that it could do that. Lesson learned.
j45 9y ago
I don't use the smart features of any tv either, mostly because the smarts evolve faster than my tv will and I'd rather just plug them into the TV, or through a receiver.
soundwave106 9y ago
The problem with the Link is more or less "devices" that rely on the network for core functionality. So I'm not sure that a smart TV is the best parallel, as most of them from what I know will work without the Internet. To go with the music world, the best parallel would be the increasingly annoying tendency for music software to move to "cloud" based offerings or other Internet authorization techniques. For instance Roland, with their "cloud plugins", apparently thinks all music venues have super spiffy wifi, as they require network authorization every time the plugin loads in the DAW. (https://www.rolandcloud.com/faq#FAQLink17 https://www.rolandcloud.com/faq#FAQLink17) If Roland ever pulled this authorization scheme, poof, your plugins no longer work. I have a 16 year old keyboard (Alesis Andromeda) and a synth that is a bit over a quarter of a century old (Roland D-50), and they both work fine more or less (a few issues here and there but nothing that stops me from using it). They don't need an Internet connection just to work. The companies can discontinue support (or even go bankrupt, in Alesis's case), and the synths still work. Personally, I certainly do not have great confidence that the Roland Cloud authorization service will last a quarter century. Hardware that requires the Internet to work is no different than software that requires the Internet to work, it honestly is a risky prospect for longevity. The Harmony Link from what I see was released in 2011. Maybe 7 years is a long time in this current disposable electronics world, but it doesn't feel like that to me.

I can just pull the network cable from the TV, which removes pretty much the entire attack surface.

goldenkey 9y ago

Every smart TV has WiFi. Even if you switch WiFi off, its not always off, on many devices.

j45 9y ago
Even if wifi isn't truly off, as long as it's not authenticated to a wifi network before it's turned off it is a measure more safe. If it looks for open networks... that's another thing.
- goldenkey 9y ago
  I hate playing the "idiot, its obvious. downvoted" target. HN can be so vicious at times when you would expect someone else to fill in the junior level details. I guess my lesson is to include even the simple blackhat explanations. HN is probably lacking of that kind of crowd...maybe to a boon. Anyhow, you are all wrong to disagree with me. There were just CVEs for radio chip exploits a couple of days ago! These have been coming out quite often lately. The layer at which these exploits can be done does not require the TV to be on any network. Not even ad-hoc. Just the fact that it has a listening radio chip that has old firmware is enough to make it extremely dangerous [digitally.] That TV can literally became a wifi enabled worm distribution center, infecting everything in your home. Not worth the risk IMO. I would stick with a dumb TV. "targets didn't have to connect to the attacker's Wi-Fi network. Simply having Wi-Fi turned on was sufficient to being hacked." [1] https://www.google.com/amp/s/arstechnica.com/information-technology/2017/07/broadcom-chip-bug-opened-1-billion-phones-to-a-wi-fi-hopping-worm-attack/%3famp=1 https://www.google.com/amp/s/arstechnica.com/information-tec...
  - j45 9y ago
    I didn't downvote ya. Nor did I get any upvotes on this comment. You have a number of valid points - I wasn't aware of any issues if wifi is disabled. Dumb TV's with sufficient quality are becoming harder and harder to find. I prefer to plug in my own smarts to TV's since they evolve quicker than the years I'll own a TV.
    - goldenkey 9y ago
      True - projectors should be easier to get as dumb devices. I have a wired Epson projector that provides 4k.

servilio 9y ago

What about the ones with wireless connectivity and no hardware kill switch for it?

fabian2k 9y ago
The smart TV can't log into a WiFi network when it doesn't know the password. And I don't think that there are any smart TVs with an embedded mobile phone data connection that you can't shut off.
- alsetmusic 9y ago
  My neighbor might run an unsecured network. Poorly designed software in a smart tv might cause my device to auto-join an open network. In this case, locking down my own WiFi would be irrelevant to the television. This type of behavior was the cause of new Apple Watches that couldn’t access the net over 3G (they were trapped on captive WiFi networks with no UI to disconnect). If this happened with one device, it could happen with others. edit: split a run on sentence

vetinari 9y ago

A do not put any wifi credentials into the TV. Ever. It will forever try to login into that wifi network, even if you disabled the wifi in the tv ui.

mynameisvlad 9y ago
You're going to need to be more specific. Even if there was a TV that did this, you can't generalize and say that all TVs do it.
- vetinari 9y ago
  In my case, it was Samsung UE46F5570. Sure, all TVs will probably not do that, but before this one it wouldn't occur to me, that it could do that. Lesson learned.

j45 9y ago

I don't use the smart features of any tv either, mostly because the smarts evolve faster than my tv will and I'd rather just plug them into the TV, or through a receiver.

soundwave106 9y ago

The problem with the Link is more or less "devices" that rely on the network for core functionality. So I'm not sure that a smart TV is the best parallel, as most of them from what I know will work without the Internet. To go with the music world, the best parallel would be the increasingly annoying tendency for music software to move to "cloud" based offerings or other Internet authorization techniques. For instance Roland, with their "cloud plugins", apparently thinks all music venues have super spiffy wifi, as they require network authorization every time the plugin loads in the DAW. (https://www.rolandcloud.com/faq#FAQLink17 https://www.rolandcloud.com/faq#FAQLink17) If Roland ever pulled this authorization scheme, poof, your plugins no longer work. I have a 16 year old keyboard (Alesis Andromeda) and a synth that is a bit over a quarter of a century old (Roland D-50), and they both work fine more or less (a few issues here and there but nothing that stops me from using it). They don't need an Internet connection just to work. The companies can discontinue support (or even go bankrupt, in Alesis's case), and the synths still work. Personally, I certainly do not have great confidence that the Roland Cloud authorization service will last a quarter century. Hardware that requires the Internet to work is no different than software that requires the Internet to work, it honestly is a risky prospect for longevity. The Harmony Link from what I see was released in 2011. Maybe 7 years is a long time in this current disposable electronics world, but it doesn't feel like that to me.