27 ms·

Samsung TVs should be regularly virus-checked, the company says

323 points by haxiomic 7y ago

petepete 7y ago
Here's another case for not owning a Samsung Smart TV. Mine, which I bought for approximately £1.3k in late 2016 received a firmware "upgrade" in mid-2017 that inserted advertising into the TV's UI. Upon contacting Samsung to complain they informed me that it was my fault that they were appearing due to applications that I have installed. The ads all originated from applications that were pre-installed that were locked and un-removable. In the end I had to work out how to block the TV from contacting Samsung's ad servers at the DNS level, although now a PiHole is an easier solution to this problem. https://gist.github.com/peteryates/b44b70d19ccd52f62d66cdd4bcef1e52 https://gist.github.com/peteryates/b44b70d19ccd52f62d66cdd4b...
- dessant 7y ago
  LG TVs also contain ads in the home menu and other places, and there is no official way to opt out. Sony TVs appear to be the most user friendly options if you'd rather not see ads on a premium device. https://www.rtings.com/tv/learn/ads-in-smart-tv https://www.rtings.com/tv/learn/ads-in-smart-tv
  - owenwil 7y ago
    I swore off Sony when my TV got an update to add advertising to the volume slider on the screen, which was the last straw. Weirdly enough, I replaced it with a Samsung, which appears to have ads if configured into any North American country, but if you select any GDPR-included territory, the ads don't appear at all
    - mcv 7y ago
      Thank God for GDPR, then. My Samsung smart TV hasn't shown me any ads yet. Except in the Youtube app I think, but that's probably not Samsung's fault.
      - chipperyman573 7y ago
        Serious question, has having a smart fridge really helped you in any meaningful way? I'm not sure if I'm just missing something because I've never owned one but they seem useless.
        paulie_a 7y ago
        I had one. It was junk. Terrible touchscreen, rebooting several times a day, no compelling reason to even use it. I use a tablet on the counter for recipes and music, much more efficient and a better system.
    - neves 7y ago
      Thank you Europeans for the GDPR law. The need to click to accept cookies in each site looks like a useless bureaucracy, but now we see the real advantages of the law.
      - Dylan16807 7y ago
        And in theory GDPR should reduce the number of cookie warnings, because it makes it much clearer what can be opt-out.
  - mxuribe 7y ago
    I've also tried my best to avoid purchasing any Sony products...ever since around 2005 [0]. While i do acknowledged that some of their products historically have been good quality...I've tried my best to use my wallet to vote my conscience. [0] = https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
    - q3k 7y ago
      I'm on the same boat, also fueled by the way Sony handled PS3 OtherOS [1] and Homebrew [2]. [1] - https://en.wikipedia.org/wiki/OtherOS#History https://en.wikipedia.org/wiki/OtherOS#History [2] - https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_America,_Inc._v._Hotz https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_Am...
    - ken 7y ago
      Thus, the problem with Adam Smith's Invisible Hand in the modern world. I salute you for sticking to your guns, but I think we all could have predicted that Sony wasn't going to suffer any significant consequences from that. There's 10 major brands of TVs, and 10 attributes by which consumers decide what to buy. Even if you could got 95% of consumers to agree (ha) that one brand is the absolute worst at the most important attribute, it's still going to be the best at something else. There simply aren't a sufficient number of axes of control here to influence change.
  - floydnoel 7y ago
    I have an LG, it has no ads. It's easy to opt-out- I never connected it to WiFi.
- mercora 7y ago
  It is possible to disable this behavior unofficially via the service menu if you are brave enough (its kinda easy to break stuff). Not sure what happens to your warranty though. On mine it is also possible to disable OTA updates there.
  - Chazprime 7y ago
    Besides the dangers of the service menu, newer Samsung Smart TVs have the newer "smart remotes" that don't have the buttons access those functions. I had to purchase an older BN59-01198Q[0] remote just to get at the service menu. [0] https://www.google.com/search?q=BN59-01198Q https://www.google.com/search?q=BN59-01198Q
- axaxs 7y ago
  Samsung does some odd things. I have a 2017ish model...when you turn it on it was silent, until I chose an app. One day, seemingly out of nowhere, there was a new live tv app of sorts in the first position, and the default behavior was that app when you turn the tv on. So now you get some awful commercial blasting every time you turn on the tv...
sschueller 7y ago
Does anyone have a list of IPs and domains Samsung uses which I can block in my outgoing firewall rules? Or alternatively all IPs Netflixe uses so I can whitelist those. EDIT: From another comment's link. log-ingestion-eu.samsungacr.com lcprd1.samsungcloudsolution.net osb-apps.samsungqbe.com acr0.samsungcloudsolution.com ads.samsungads.com www.samsungotn.net osb.samsungqbe.com cdn.samsungcloudsolution.com www.samsungrm.net osb-eusvc.samsungqbe.com oempprd.samsungcloudsolution.com time.samsungcloudsolution.com noticecdn.samsungcloudsolution.com notice.samsungcloudsolution.com otn.samsungcloudcdn.com multiscreen.samsung.com gpm.samsungqbe.com configprd.samsungcloudsolution.net ypu.samsungelectronics.com kpu.samsungelectronics.com sas.samsungcloudsolution.com otnprd9.samsungcloudsolution.net otnprd8.samsungcloudsolution.net otnprd11.samsungcloudsolution.net otnprd10.samsungcloudsolution.net apps.samsungcloudcdn.com
- petepete 7y ago
  That list might be a bit out of date, it's from April 2018.
- andy123456 7y ago
  Can't you just block the TV's MAC address entirely in your router.
  - slig 7y ago
    Or just don't enter your WiFi password on it.
    - seieste 7y ago
      There were reports that some TV’s will automatically connect to any unsecured WiFi.
    - hadlock 7y ago
      Our smart TV lives on it's own wifi network, I super don't trust it to interact nicely with other devices on our home network. All the other smart home stuff (smart led lights, etc) lives on it's own network as well.
jgrahamc 7y ago
I own a Samsung TV. It works great. There were apps, I used to use them but slowly by slowly they bitrotted until the TV is simply an HDMI monitor at this point. It still supports legacy broadcast TV over coax etc. but anything "modern" has rotted away. Which makes me think I simply don't want any smart at all in the TV.
- wayoutthere 7y ago
  This is both true and not true — yes, a great many apps have been abandoned, but the big ones (Netflix, Prime Video, Hulu, HBO, premium sports apps, etc.) are well maintained. The built-in apps are by far the easiest way to watch 4K HDR video (which Amazon has lots of). But yeah, all that said, the “smart TV” functionality would be better off in an external box. I trust that Netflix will update its app because I pay them every month. I don’t trust Samsung will update the TV software for the 10-year life of the TV because I paid them all up front. Such is life in the modern world :)
  - gbear605 7y ago
    That only works so long as Samsung (or whoever) keeps the update mechanism continuing to work.
  - darrenf 7y ago
    > I trust that Netflix will update its app because I pay them every month I pay each month for the WWE Network, yet last week the app stopped working, with a "no longer supported" message, on my 2013 Samsung TV.
    - wayoutthere 7y ago
      Oh, I totally agree that a lot of smaller services (including most of the cable / TV companies) stopped building apps. IMO it’s only worth it for global services because smart TV apps are far more heavily used in Asia and Europe. The client I worked for (a big US cable provider) killed all their smart TV apps when they realized they were spending ~$500k a year on a bunch of apps that were being used by maybe 3,000 people a month. They do continue to support apps for external devices like Roku and Fire TV.
Bucephalus355 7y ago
I worked for a large network company at one time as a contractor. I was pretty horrified at some parts of their security. That being said they had a great attitude towards security I haven’t encountered since, so maybe they’ve improved. But still very little stopping even a small determined country like say Monaco from hiring 2-3 decent sysadmins and hacking them to pieces. Anyway it would surprise me if the TV companies even had bare minimum acceptable security, because even the net security guys are struggling.
CSDude 7y ago
What is the attack surface for a Smart TV? Any exploits? This is scary and disappointing. I disable my TVs wifi and only use Apple TVs.
- sschueller 7y ago
  Especially since these TVs have microphones and some even cameras in them.
- ahje 7y ago
  My TV (Finlux) has an undocumented API, that allows anyone to pull information about what I'm watching at the moment. That same API can be used to launch a telnet daemon which can then be used to log in as root without using a password. Needless to say I've disabled wifi on it and I don't intend to ever connect it again. But hey, the TV runs Linux, which is nice I guess.
- imglorp 7y ago
  Forget the attack, the device IS the attack. It doesn't get any worse than this: https://www.cnet.com/news/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec...
jasode 7y ago
>“Prevent malicious software attacks on your TV by scanning for viruses on your TV every few weeks,” This reads like an Onion parody article but unfortunately, that security precaution is reality. To generalize the Samsung example further, this is why I don't believe it's realistic that decentralization can happen via average homeowners owning a "server appliance" that serves up webpages, social media profiles, videos, email, etc. I made a previous comment on how disciplined security practices are too tricky for non-techies.[0] Yes, a bunch of techies can run personal servers (Raspberry Pis, Freedombox, etc) to run a decentralized Q&A site to replace Stackoverflow. Or maybe run a decentralized discussion forum to replace HN. However, a bunch of grandmothers cannot be expected to maintain their own web appliances to run a decentralized cooking recipes website. [0] https://news.ycombinator.com/item?id=11861683 https://news.ycombinator.com/item?id=11861683
- eudora 7y ago
  If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date. Why couldn't that work? I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust. And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI
  - jasode 7y ago
    >served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. [...] Docker image that gets updated upstream for security issues [...] Why couldn't that work? The update process itself acts as an attack vector. Even the techies like programmers can get pwned with trusted repositories that suddenly became untrusted.[0][1][2] A decentralized server appliance of powerful sophistication that requires updates will require a baseline level of technical expertise. So far, even the less sophisticated hardware like wifi cameras and Nest devices are leaving unwitting homeowners exposed to criminals and unwanted spying.[3][4] [0] https://www.theregister.co.uk/2018/07/12/npm_eslint/ https://www.theregister.co.uk/2018/07/12/npm_eslint/ [1] https://www.infoworld.com/article/3184399/malware-finds-unwitting-ally-in-github.html https://www.infoworld.com/article/3184399/malware-finds-unwi... [2] https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l... [3] https://www.google.com/search?q=home+wifi+cameras+hacked https://www.google.com/search?q=home+wifi+cameras+hacked [4] https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...
SomeOldThrow 7y ago
Is it even possible to buy dumb tvs anymore? I have been hanging on to my 2014 model (and will probably try to use it for another decade) because the new tvs I interact with have ruined basic tv interactions. All I want: on/off, input switch, volume control.
- deleted 7y ago
  [deleted]
- petepete 7y ago
  Last time I bought one I looked but couldn't find anything that fitted my requirements, (~55", excellent image quality preferably with HDR, supports ARC and CEC). If there was a DumbTV that did all those things and was reasonably priced, I'd have bought it there and then.
- outime 7y ago
  If you buy a smart TV and just not connect it to the internet you can use it as a dumb TV.
  - mywittyname 7y ago
    For now... Just wait until they have always-on cellular service which is used to deliver ads, spy on you, and "upgrade" firmware.
    - chopin 7y ago
      That's what I fear most. For cars, this is already becoming reality.
    - MrMember 7y ago
      Always on cell modems are eventually going to be installed in most electronics and it kind of terrifies me. I only want a handful of internet connected devices in my home and at some point that won't be possible. I can keep my "smart" TV offline today, but what about when it has a cell connection? Will I need to physically destroy the cell modem on my TV, refrigerator, stove, etc just to maintain some modicum of privacy?
ksec 7y ago
I am willing to pay additional 30% mark up on top of the current price of Samsung SmartTV for an Apple TV Set. Benedict Evans has been saying TV market has slim margin, and long replacement cycle. I doubt the HomePod addressable market is any bigger than TV, and likely has similar long circle. Why not TV? Clearly there is something the Apple could bring value to the TV market. ( Although he has been right every time I disagree with him )
- rchaud 7y ago
  Apple now has 8k displays with $5000 price tags. A 4k TV, would cannibalize that pretty heavily, even if it was priced at 2-3x the competition.
  - ksec 7y ago
    You mean 6K? The thing is, that monitor is actually compared to Reference Monitor, and as far as the initial preview from those who have seen it, most can't believe a LCD could be as good if not even better than the OLED. And if the spec is actually as good as they say ( Apple has always been very conservative in Spec listing ) may be they are really targeting Reference Monitor? If so, then a normal monitor / tv would not cannibalise it, since they are completely different segment.
thom 7y ago
Given that we do everything via HDMI and use a Chromecast for anything fancy, what would people recommend if someone doesn't need these doodads? Computer monitor plus a soundbar or something? Or does anyone in the UK know of a non-smart TV that can do FreeView and nothing else, but has a decent spec panel?
- deleted 7y ago
  [deleted]
- retSava 7y ago
  Don't give it internet access. You don't even need to give it network access if you use a chromecast.
- luxpir 7y ago
  Had a similar thought before recently buying a new TV. I had heard of Samsung ads, LG's slow interface so was looking for something else. I do use a PiHole in the house, but didn't want to rely on it. Ended up finding the Philips 50PUS6753/12 50in 4k - the previous version got What Hi-Fi's TV of year award and does a much better job than a PC monitor. Under £400 on Amazon atm. In-built sound is, for me, enough to avoid the soundbar. Also the Ambilight is a nice touch, sort of extending the picture beyond the screen. Responds to screen, audio or custom colour. Main thing though is there are no ads that I've noticed and it's a fast enough interface. Currently using the TV itself for catchup/freeview/youtube and the rpi as a media centre. You can just not plug the TV in too if you want it truly dumb.
- HelloMcFly 7y ago
  You can always get into the projector game.
- mrguyorama 7y ago
  Vizio probably still sells lower quality TVs without smart features, and their "premium" lines seem to use a "built in chromecast" instead of some stupid knockoff system. So check out your local walmart I guess
koolba 7y ago
Also insane is that there is no “disconnect and forget” option for the WiFi on these TVs. The only method I’ve found that works is to trick the TV into joining a different network and then turning off that other network.
- jtmarl1n 7y ago
  I have discovered the same thing, had to factory reset the one TV I connected before I realized this. Now I have a "dummy" SSID I start up anytime I do want IoT devices to connect to the internet.
myself248 7y ago
I think this makes the case for not owning ANY smart TV. Are there ANY manufacturers that have a strong track record of out-of-the-box configs that aren't total swiss cheese, combined with years of prompt updates to address issues discovered later, going out to the lifespan of a typical dumb TV?
linachka 7y ago
I have a Samsung TV but I've never thought of scanning it for viruses. So, thank you for this piece of news. Looks like we should take care of ourselves; at least, thanks to Samsung for warning.
- obituary_latte 7y ago
  I don’t understood with how cheap chromecast/Apple TV/whatever streaming machines are these days why people don’t use one of those and just not hook the TVs to the network? Is there something specific on the tv that’s not available on these other platforms?
  - antidaily 7y ago
    It's one less remote.
- retSava 7y ago
  I think the article lifts a good point: since it's necessary, why not automate this process in the TV? And what do you do if this process returns positive (ie compromised)?
FerretFred 7y ago
Wow! Who designed that UI to get to the virus scanner?!
JustSomeNobody 7y ago
Our Samsung TV isn't allowed to speak to the internet. Hopefully, by the time we are in the market for another TV, there will have been a swing in the market away from Smart TVs.
- ksec 7y ago
  If we could somehow standardise on the panel cable, like the one used in LG OLED Thin and Samsung. Then the panel maker concentrate on making better panel. While we get a choice and more competition of "Smart".
rock_artist 7y ago
The biggest issue is lack of software/security updates. They treat those products as dumb TVs. they've compiled an OS build ("firmware") and you'd might get a year of updates and that's it. Any Smart TV will eventually become a security hazard. meaning "dumb" TV with an AppleTV or a reasonable modern streaming device is safer :)
fabian2k 7y ago
Having a manual virus scan button on a TV is ridiculous. It wouldn't entirely surprise me if it doesn't do anything useful at all and is purely a placebo. If a signature-based virus scan tailored to TVs is available, it should just run in the background, requiring manual interaction is entirely insane. Securing the TVs well in the first place would be the best option, but that is unlikely to happen.
shultays 7y ago
Also apparently Samsung support has a twitterbot that replies something similar > `Hello there! Thanks for reaching out! Could you please send us a DM with the TV Model code and more details about this concern? ^Nick` to every tweet it gets. https://twitter.com/SamsungSupport/status/1140415146675728384 https://twitter.com/SamsungSupport/status/114041514667572838...
- catherd 7y ago
  Chase bank has one of these as well. Pretty awesome to get a canned response (then ignored all weekend) when you get locked out of your bank while in a different country. https://twitter.com/ChaseSupport/status/1139899780283469825 https://twitter.com/ChaseSupport/status/1139899780283469825 > 'Hi there. We're here to lend our support. Please DM us with your full name, zip code, and additional details regarding your concerns. ^EL'
WarDores 7y ago
Precisely the reason that I just disable the network connection on mine and use my Xbox for media. The convenience isn't worth the hassle.
skocznymroczny 7y ago
I feel glad I own a "stupid" TCL TV. If I feel the need to have "smart" features, a Raspberry PI running Kodi/OSMC connected by HDMI is more than enough.
- rchaud 7y ago
  These types of TVs are rapidly becoming unavailable. It's not just 4K TVs, anything above 24" is going the SmartTV route.
codedokode 7y ago
Slightly unrelated, but maybe we should start calling TVs with cameras "telescreens"? Like, "don't forget to check your telescreen for viruses every several days".
mrbonner 7y ago
I bought a samsung SmatTV in 2017 in Costco. The tv is ridden with software bug: it would turn off itself randomly or cannot turn on the tv unless I remove the remote batteries and reinstall them. The ui is really slow. I also owned a series of samsung Android phones since the S2 to S5, a samsung security camera. They are all ridden with a lot of bugs. I have vowed not to buy a single samsung product anymore.
- whymsicalburito 7y ago
  I got my TV at costco and it came with a 2 year warranty. Take it back if it's broken!
lykahb 7y ago
Recently I did some research to choose a new TV. I plan to use it as a regular one, with HDMI input and don't need any smart stuff. Unfortunately, most models are smart and there is no information about their behavior when disconnected. It may still show popups to make an account or connect to the network. Choosing a smart TV feels like choosing a blind box with crap. Perhaps I'd spend more and buy a commercial monitor instead.
anbop 7y ago
I never give my TV Wi-Fi credentials, only the Roku and Prime stick.
- CDSlice 7y ago
  Unless your Roku or Prime Stick passthrough the internet access to your TV. https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx
  - unwiredben 7y ago
    Again, no Roku device has ever implemented Ethernet over HDMI. It's too poorly supported in TV hardware to be worth doing.
CDSlice 7y ago
Many of the comments here say that you can just not give your TV access to your network and you'll be OK. This may not actually be true thanks to Ethernet over HDMI(1), which could let your Roku/Fire Stick/Apple TV give your TV internet access over the HDMI cable. (1) https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx
- unwiredben 7y ago
  As far as I know, no Roku device has ever implemented Ethernet over HDMI. It's too poorly supported by devices to spend money on implementing, and WiFi just works better.
jandrese 7y ago
I guess it would be too difficult for Samsung to have the TV run it's own checks? They could be run while the TV was off to avoid impacting the user experience. But honestly if it's anything like PC antivirus software those scans are useless. If you don't intercept the virus before or while it is installing it's too late. Once it's in there it can hide from regular AV software all day long.
UI_at_80x24 7y ago
You know that special feeling of vindication and moral superiority when you are proven correct years-later? There's got to be a German word for that.
- hombre_fatal 7y ago
  aka the need to let others know that you were right about something no matter how little they care. If there was a word for that, I feel like we'd already be seeing it daily on HN.
- wtfrmyinitials 7y ago
  Not exactly it but Schadenfreude is pretty close
duxup 7y ago
I recently bought a new TV. After reading all the messes with smart TVs I just didn't connect mine to my local network. It's just not connected to the network and I don't intend to connect it. I do every "smart" activity through a Chomecast device or similar devices anyway. Now that alone could in theory be a security risk as it could be out of date and vulnerable to someone else messing with it in that sense ... but I felt connecting it was the bigger risk / hassle. I kinda wish there was just a switch to power off the "smart" options and just have it operate in monitor only mode. I feel the same about microphones and cameras on phones. Give me a physical power off switch and led indicator for those things.
- Isamu 7y ago
  Same here ... don't let your smart TV connect to the network, just use it as an hdmi endpoint for devices you can (hopefully) control better.
pmh 7y ago
Earlier discussion here: https://news.ycombinator.com/item?id=20201485 https://news.ycombinator.com/item?id=20201485
- dang 7y ago
  Thanks! Comments moved thither. Edit: actually, the BBC article seems to contain more information, so let's keep this submission instead.
xfitm3 7y ago
Samsung TVs should not be online: it’s proven you can’t trust them. It phones home and reports your usage - even every time you press the volume button. Login to Smartthings and you can see some of the data it collects.
sschueller 7y ago
How about open sourcing the code running on it or at least letting us run our own software? A lot of apps that came with my TV from Samsung have been removed over the years as they stopped supporting them. For example Skype. So I paid for a TV with Skype, now it has no more Skype.
- minimaul 7y ago
  No, you paid for a TV with an App Store, where there were apps (pretty much all provided by third parties). It’s not Samsung’s fault if a third party pulls their app.
  - kbenson 7y ago
    It depends. If the TV was advertised with a specific application, which I see often, then the loss of that application is a loss of advertised functionality. The way I see it, if they used the availability of an app as a direct selling point, that makes them somewhat liable to it's continued functionality. If they didn't secure that contractually or with some level of assurance, they should not have advertised it.
    - JustSomeNobody 7y ago
      No, you received an implied license for the life of the television to operate it as a television. Samsung reserves the right to modify the software on said television as it so chooses.
      - kbenson 7y ago
        It's not that simple. It really does matter how it was advertised (but it also matters whether the FTC is willing to make a case).[1] 1: https://www.ftc.gov/news-events/media-resources/truth-advertising https://www.ftc.gov/news-events/media-resources/truth-advert...
      - horsawlarway 7y ago
        I think without trying this opinion before a court, you have no idea. Samsung may have reserved the right to modify the software, but I've literally seen smart tvs from Samsung that have a "Netflix" button on the physical remote. They have shipped tv boxes that clearly and prominently display the Netflix app on the tv. If the Netflix button on the remote no longer works, the tv is not doing what the user bought it to do and what it was advertised as being capable of.
amiga-workbench 7y ago
This is absolutely comical, I'm grabbing a second hand NEC commercial panel when my current TV kicks the bucket.
drspacemonkey 7y ago
I simply do not want a "smart" TV. No internet access, no apps - just a lot of HDMI inputs, CEC, and a display. Sadly, this is getting harder and harder to find. When I went to buy last time, Costco didn't have any "dumb" TVs, so all I did was refuse to hook it up to the internet. I got a Roku and a Chromecast. Those provide better "smart" functionality than any TV ever could.
- tombert 7y ago
  I agree; I bought a Vizio TV a few months back. It had all this smart crap built in, but it was pathetic compared to even some of the cheaper AndroidTV boxes you could buy on Amazon or Walmart for ~$40.
  - behringer 7y ago
    I use my Vizio TV for my computer monitor. That's all it ever does is be a monitor. Except when my computer breaks and I have to repair it. For a day or two, that built in netflix app is a wonder :)
  - xeonoex 7y ago
    New Vizio's are pretty much dumb TVs with built in Chromecasts. Which is exactly what I want. Every Smart TV interface I've used is worse than using my phone as a remote, or Google Home voice commands to control my TV. The experience isn't perfect, but it's pretty good.
- deleted 7y ago
  [deleted]
- radiorental 7y ago
  TCLs are 'dumb' tv's with a Roku built in. They're quite popular so I might be missing why these are to be avoided and/or network disabled and Roku over HDMI is preferred?
  - kevin_thibedeau 7y ago
    They're superior to a standalone Roku for ease of use, at least until the hardware goes unsupported which will be a while. One annoyance with mine using the RokuTV speakers is that speakers drop out and don't maintain a consistent volume level whenever the WAN connection is lost. Something is taking up too much processor time trying to connect to the outside world. The speakers are unfortunately the only way to get AGC in a stereo system because the TV itself can't do it for whatever reason.
Someone1234 7y ago
Conceptually embedded devices shouldn't even have writeable storage for malware to persist. This doesn't require a special operating system or a kernel patch, Linux (which is popular for these types of devices) natively supports read only storage. You can have a small read/write volume where update bins are placed. Upon reboot, a pre-boot environment checks the bin's cryptographic signature, and if it passses it then extracts the bin, overwriting the the read only filesystem and a second reboot occurs allowing normal boot into the updated OS where the file system is again read only. This is how e.g. the Playstation works. Amongst several vehicle manufacturer's infotainment units. Even Windows uses a pre-boot environment to write certain "hard lock" files and registry areas. This is not wild "pie in the sky" thinking, this is an industry norm or was. Why does a smart TV that's meant primarily for streaming content directly from the internet need a R/W file system? Settings? Couldn't that be stored in a micro-volume without execute flag and SELinux limits?
- behringer 7y ago
  And what if the cryptographic hashes are broken, stolen, or whatever? Once you're in the system, if there's rewriteable storage at all, it can be compromised. If you want to stream, the apps need to be updated as streaming service providers update their systems from time to time.
  - Someone1234 7y ago
    > And what if the cryptographic hashes are broken, stolen, or whatever? You've still improved the scope of exploitation from: - Need an RCE (remote code execution) in any service on the device for a persistent threat To: - You need an RCE in any service on the device - You also need to be able to generate a cryptographically signed update which will install for persistent threat That's a win. That's a BIG win. Particularly as regular updates can replace compromised cryptographic credentials. You're essentially arguing the "if the solution is imperfect, we should do nothing" fallacy. You haven't proposed a better alternative, just argued that no action is better than an action that falls below perfection. > If you want to stream, the apps need to be updated as streaming service providers update their systems from time to time. Which may require a reboot. It is unfortunate, but makes the device more secure and less susceptible to hardware originated data corruption (since the volumes can be completely verified for correctness, compared to the source images which can also be verified for correctness via HMAC). There's no specific set standard for how bin updates work. They can range from complete file system updates to incremental updates.
tombert 7y ago
Things like this are why I kind of despise the "smart TV" movement. I can't blame people for using them, they're convenient as hell, but at some level I have trouble seeing why the TV needs to have the computer built into it. To me, a TV should be a more-or-less "mechanical" device that does one thing and one thing only: display video. Obviously, though, this only defers the error over to AppleTV or AndroidTV or whatever computer you have plugged in. I guess with the (admittedly awesome) advent of streaming-all-the-things, stuff like viruses are an inevitability.
- rietta 7y ago
  In my experience, a SmartTV can stream and HAS ONE REMOTE. Every family member who is not an IT professional has struggled deeply with any TV/AV setup where two or three remotes are needed. This same customer is also not going to have an easy time on their own setting up some yet another third party universal remote.
  - tombert 7y ago
    You know, that's a pretty fair point. I guess not seeing that as an issue is a consequence of an engineer running AV setup at home. More remotes = more to lose. None of my stuff seems to do this, but isn't there something for HDMI that allows bidirectional stuff to allow a device to control the volume and whatnot?
    - flyinghamster 7y ago
      CEC. It's nice, but if and only if all of the relevant functions on your device can be controlled from the TV remote. My Sharp dumb TV (actually a Hisense since Sharp quit the US market) has several buttons that ought to be sent to a device but aren't, which limits CEC's usefulness with my Kodi setup. I ended up putting an IR receiver in the box (a Raspberry Pi running OSMC) and using an RC6 remote instead.
      - bootlooped 7y ago
        And if it does't all work then that is even more cognitive load on the user: "you can use remote A for everything devices A and B do, except functions C-D, for those you need to use remote B, but use A for everything else, got it?"
MobileVet 7y ago
Not news to this crowd... but I think it is pretty significant that a major consumer electronics manufacturer would come out and say this to the mainstream public. What can a hacked tv do besides relay viewing information or connect to Hoolinet? Clearly it could be added to a botnet, but would Samsung be liable for that? Do the TVs have microphones or cameras... that would open Samsung up for a lawsuit. What is to gain from this announcement?
- hombre_fatal 7y ago
  > Clearly it could be added to a botnet This is why I believe in metered data plans. Certainly not ridiculously expensive ones, but not "unlimited" access either. If your IoT devices become open relay DDoS machines, it should show up on your bill. I'm convinced it's the only solution that aligns incentives correctly.
  - okmokmz 7y ago
    That does not at all seem like an appropriate solution to the problem
  - justwalt 7y ago
    Seems like a bit of a silly solution. Personally, I wouldn’t need financial incentive not to have devices on my network be associated with illegal activity.
  - verisimilitudes 7y ago
    So, people shouldn't have ''unlimited'' access to the Internet, because they've had IoT garbage forced upon them and its their ''responsibility'' to manage it, when they usually can't actually control it anyway? Not only that, but a DDoS is usually only an issue for a large central location that is perhaps part of this manner of problem, anyway. They can go to Hell.
    - 0xffff2 7y ago
      Nobody has had IoT garbage forced upon them. They bought it and connected it to the network, therefore it's their responsibility to manage it. Ignorance of basic network security is no more a defense against allowing malicious code on your network than ignorance of the law is a defense in court.
aphextim 7y ago
Surprised they don't come pre-loaded with McAfee
- lozaning 7y ago
  They do though, https://www.howtogeek.com/406177/samsung-is-bloating-everything-with-mcafee%E2%80%94even-smart-tvs/ https://www.howtogeek.com/406177/samsung-is-bloating-everyth...
  - aphextim 7y ago
    That made my day. Thank you.
dewey 7y ago
I wish there was a company selling TVs without any “smart” software on it. 100% of the time I use my TV through the Apple TV and even the changing of input to switch to a console is done through HomeKit. I guess it would be way more expensive if they can’t subsidize the price without all the stock apps and ads they ship with it.
- mrweasel 7y ago
  We do the same, the AppleTV is really the only device with the right apps here in Denmark. We had to get a SmartTV, but we simply don't use that part, the TV is not allowed on the internet. The Philips remote have a big ass Netflix button right in the center, but we just use the Netflix app on the AppleTV, because using any of the apps on the TV is an unpleasant experience. I can sort of understand the idea of a smart TV, but the TV manufactures do not have the organisation, infrastructure, developers nor the hardware to deliver good and up to date apps, so I don't understand why they keep insisting on building smart TVs. Companies like Samsung must know that their app suck.
- 0xffff2 7y ago
  Isn't this basically a monitor (with built-in speakers)? A quick look at Newegg suggests you can get a 43" monitor for pretty a pretty reasonable price.
  - dewey 7y ago
    Yes but 43” is not really TV size material. They are made for different use cases.
    - 0xffff2 7y ago
      What is TV size material to you? A friend of mine has a 60" TV and it's huge. I really can't imagine that most people have TVs that big. You can go even bigger with monitors, but the selection is thinner so it's hard to tell if it's really economical. The whole point of my comment is that average size aside, they really don't seem to be different use cases at all for a lot of people.
awalton 7y ago
This is precisely why my "smart TV" isn't allowed on my network. Millions of dollars of work to theoretically save the user on a $10 HDMI cable (but, more honestly, just to make consumers buy new TVs every couple of years regardless of whether they need one or not, simply because the "smart" unit is out-of-date). Sometimes this industry needs a boot to the head.
- rietta 7y ago
  Despite all the trying I have, I cannot get my mom or grandmother to ever understand switching HDMI sources. The SmartTV has most functions built in with a single remote control. This is crazy significant to the appeal.
  - awalton 7y ago
    My cable box has a remote that's able to turn off and on my TV and switch the TV's sources. I haven't taken the TV's remote out of its original packaging. It's 2019 - this is a solution in search of a problem.
    - hombre_fatal 7y ago
      Seems by your posts you're assuming everyone already has a cable box + service since you think the TV saves you a mere HDMI cable. Meanwhile I'm not sure I've even had roommates or been to someone's house my age (25-40) in the last 5 years that had cable service. It's always the same: everyone just navigates to the TV's built-in Netflix/HBO/Amazon/etc. app and puts something on. If you think everyone in the world has a cable box, then I understand why you don't understand smart TVs. But your premise is mistaken.
    - scarface74 7y ago
      Then you have to program the remote and make sure you are in the right mode. Have you compared the typical cable remote with the Roku remote for smart TVs with Roku built in? Not to mention remote listening where you listen to audio on your phone from your TV. But part of the purpose of having a smart TV is that you don’t need cable.
kevinherron 7y ago
I'm sad that the next TV I buy will probably have to be a "smart" TV. I went out of my way to find a dumb one the last time around, and I had to settle for a lower end model because all the higher end ones have a "smart" component. All my apps are via an attached Apple TV. Oh well. As long as it works without being connected to my network I guess it's fine.
pharrington 7y ago
The obvious solution is to write an ad-blocker for your TV.
- jethro_tell 7y ago
  Don't have a smart tv, but I assume something like PieHole would do the job
flexie 7y ago
How do I check my Samsung TV with my Samsung remote?
anm89 7y ago
It's funny to me how clear the divide is in terms of valuing this technology vs being scared of it for people working in tech vs not
tomc1985 7y ago
"A better solution would be for Samsung to automatically update its operating system for you." An even better solution is to stop making unnecessary appliances "smart" and not handing bad actors a surface area to attack when companies aren't willing to invest in security But of course this runs contrary to the bread-and-circuses mode of operation that dominates tech "innovation" nowadays. Nobody is content making a really good TV anymore; now they've been infected by the same featureitis that corrupted software development decades ago
PopeDotNinja 7y ago
My approach to a smart TV was just to buy a PlayStation. Anything I've wanted to do on my TV was available as an app in the PlayStation store, with the exception being Google Play Music. I had previously tried using a Google Chrome, but eventually got sick of its lack of local storage & native remote.
- mikepurvis 7y ago
  > lack of local storage Ironic, given the subject of this thread. Though obviously the point stands that there's no need for execute permissions on an area being used for config settings and media storage.
  - saagarjha 7y ago
    You would need an OS and hardware that understands such protections, of course.
    - monocasa 7y ago
      These things run full Linux distros.
      - saagarjha 7y ago
        Do their processors support memory protection?
        monocasa 7y ago
        Yep, at least an MPU is a requirement for full Linux.
- bobbyi_settv 7y ago
  I try to use PS4 Pro as my "smart TV", but I end up having to use the TV itself (which runs Roku) sometimes because of its larger app base. You can't watch Starz through PS4. You can watch Amazon Prime, but not in 4k.
diminoten 7y ago
Or else what? Not exactly the end of the world if my TV is pwned as long as I can still, you know, use it. The ability to move laterally in my home network is about as valuable to anyone sophisticated enough to use it as walking around my apartment complex would be to a real life Danny Ocean. Could Danny get into my house and take my PII? Sure, but like, why the fuck would he? It's not wonderful to potentially be contributing to some botnet, but that's on Samsung not me.
- mmahemoff 7y ago
  One consequence is having your accounts compromised if you choose to login to Netflix, YouTube, etc on the device. That could be especially problematic if there are marketplaces involved, such as on-demand video (scams like this where the attackers operate a selling account https://www.denverpost.com/2017/04/10/amazon-third-party-sellers-hackers/ https://www.denverpost.com/2017/04/10/amazon-third-party-sel...)
- saagarjha 7y ago
  I would rather my device not contribute to a DDoS, especially as there may be legal implications to allowing this, but you do you I guess…
  - diminoten 7y ago
    I've never heard of a single person in this specific scenario getting into any legal trouble whatsoever, let alone enough people for me to reasonably worry about the likelihood being high enough to register on the list of things that could actually happen to me.
  - Cannibusted 7y ago
    You do you? I would lose that ridiculous phrase. It's super condescending and not needed. No one needs your permission to be themself, or even a 'reminder'.
- Raphmedia 7y ago
  Most smart TVs have built-in microphones. You don't want microphones on a compromised device in the middle of your living room.
retrac98 7y ago
Is there a market out there for a modern dumb TV? A good panel, decent speakers and a load of I/O in a slick enclosure? I think I’d buy this.
- scarface74 7y ago
  No because just like Windows PCs. They operate on small margins and make money by bundling software in the case of consumer Windows PCs or selling viewing data in the case of TVs.
  - retrac98 7y ago
    I know there’s not a mass market for it, but I think a lot of privacy conscious folks would pay extra not to have apps on their TV.
- kevin_thibedeau 7y ago
  Industrial TVs are like this minus the speakers.
- majewsky 7y ago
  I have a 40" 4K PC monitor for this purpose. Works reasonably well.
- ericskiff 7y ago
  I buy these. I'm pretty easy to please, their 1080p is great, a little bright at the corners but I truly don't care, it looks great when watching actual shows/movies. https://www.walmart.com/browse/electronics/sceptre-tvs/3944_1060825_1939756_5735890 https://www.walmart.com/browse/electronics/sceptre-tvs/3944_... Cheap / Dumb display panels. Bring your own apple/chromecast/retropie whatever
- 0xffff2 7y ago
  At this point, don't most people primarily use their dumb-TVs either by hooking up a cable box, game console, etc? A quick look a Newegg suggests that plain old LCD monitors can be had up to 43" for quick reasonable prices.
oflannabhra 7y ago
The reason TV manufacturers want to have connected TVs is not to provide utility to the user, but so that they can monetize a user's data. The "smart" part runs recognition software to identify what content you are watching, how long you watch it, records it, uploads it to the manufacturer's service, and then the manufacturer can aggregate it and sell it off. The Verge interviewed Vizio's CEO [0], who stated > This is a cutthroat industry. It’s a 6-percent margin industry, right? I mean, you know it’s pretty ruthless. You could say it’s self-inflicted, or you could say there’s a greater strategy going on here, and there is. The greater strategy is I really don’t need to make money off of the TV. I need to cover my cost. And then I need to make money off those TVs. Apple had to directly fight this when they brought their TV app over to smart TVs. It's also why I will never let a TV on my network, and will always use a separate streaming box. [0] - https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit-vizio-tv-bill-baxter-interview-vergecast-ces-2019 https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit...
- Illniyar 7y ago
  How much can you sell it for? Really - let's say you have my entire viewing history for a year, let's say I'm from a valuable demographic, how much would that be worth? A dollar? 10 dollars? I've just bought a tv for thousands of dollars from the company, selling my data doesn't seem very cost effective, especially considering the PR backlash of some scandal that could come out of it.
  - admax88q 7y ago
    It's advertising. There's tons of money to be made. Maybe your data is not worth a lot alone, but viewing data of the entire TV watching population would be huge. If you don't think there's money to be made in collecting and selling people's data how do you explain facebook and Google?
    - planb 7y ago
      Google and Facebook do not sell peoples data. They sell their eyeballs. That‘s where money is to be made.
morpheuskafka 7y ago
Why would you have a scan-based security approach? Why not just enforce code-signing of all executables like on iOS? It shouldn't be too hard for a closed, embedded platform.
- saagarjha 7y ago
  That sounds like extra work.
dawnerd 7y ago
This comes from the same company that pushed advertisements through their notification system and when called out they denied it like crazy until some news articles came out. Also the same company that was injecting ads into plex. Basically, don't connect your Samsung (or any tv) to the internet.
jka 7y ago
Miniature sci-fi concept pitch: A future where the world is largely a privacy-scarce melting pot of competition where individuals vie for leverage over each other based on the scraps of information they can gather, barter for, or source through a myriad of insecure networks which provide some base level of value to users (like, say, a third-party piece of software that runs on a television after the user grants it permission, accidentally or otherwise). Meanwhile, VCs and technology experts have long seen this coming and retreated to countryside enclaves where electronics are banned, and news of the world is relayed via one-time-pad-over-horseback to ensure that the next level of marginal gain for the elite is collaborated upon in safety from reprisal. That's the context at least; many possible plots from there. Basically Elysium except that the elite eschew technology because technology security is so flawed that it unintentionally sells them out every time.
- im3w1l 7y ago
  I don't think it will be possible to escape even for the very top.
- Bakary 7y ago
  Couldn't the elite just eliminate/enslave the rest of the population altogether and rely on automation?
CommanderData 7y ago
I remember reading an obsecure paper hacking a smart TV through the radio antenna after which WiFi could be turned on. It was a work of art and sounded almost fictional. In the end the attacker would turn on WiFi and control the TV for not just one, any TV in radius, or execute a payload to connect back to a CnC for tvs out of range. It would work even if the TV was in standby. Patching this particular vuln would have been difficult, though the attacker would have to craft a payload specific to the make and model. It's a nice example where adding features increases attack surface, and protecting against such hacks even for the experienced is near impossible. Would make for a good HN submission.
- jethro_tell 7y ago
  Man, If you have any clues about where this could be found or any other info I'd really appreciate it. I'd love to read this.
  - CommanderData 7y ago
    Found. Did get some coverage in the end. PoC: https://www.youtube.com/watch?v=bOJ_8QHX6OA https://www.youtube.com/watch?v=bOJ_8QHX6OA DVB standards updated their specification after the disclosure too. [1] DVB announcement: https://www.dvb.org/resources/public/pressreleases/dvb_pr263_steering_board_approves_updates_to_prevent_man_in_the_middle_attacks_final.pdf https://www.dvb.org/resources/public/pressreleases/dvb_pr263... Someone found another vulnerability using the same vector - will post if I can find it.
fredley 7y ago
Don't buy a smart TV, don't let your family/friends buy smart TVs. Buy a dumb screen and hook it up to an Apple TV, Chromecast etc. The 'smart' software is a privacy nightmare over which you have very little control. And sure, so is the Chromecast, but I at least have more faith that wherever that data's going it's going there securely and is relatively unlikely to be breached. Also, the software on your smart TV will age much faster than the screen itself.
- imgabe 7y ago
  Is it even possible to buy a dumb screen anymore?
  - jay_kyburz 7y ago
    Probably not, but you don't need to give it your wifi password.
    - fencepost 7y ago
      Discussion of this on reddit leads me to believe that at least some Samsung TVs would connect to any available open wifi networks.
      - Domenic_S 7y ago
        I purposefully didn't give my Sony tv (android) my wifi password. A few weeks later it prompted me to install a firmware update, and I saw it was connected to my home wifi. How? Best I can guess is another android device shared credentials with the TV. I blocked that stupid thing at the router. I don't need firmware updates for my TV.
        imgabe 7y ago
        Is there anyone else in your house who might have put in the credentials? That seems like a big security hole if Android will just share wifi credentials with other random Android devices.
gumby 7y ago
This is what drove me off Windows (in the 1990s* ): having to spend too large a proportion of time managing my computer rather than using it (AV, disk optimizers etc). Although I love writing code and designing hardware I didn't like the "computer" experience. Nowadays nobody sysadmins their phone and barely their tablet. And TV users want to do even less maintenance. In the quest to "add value" these TV guys have lost the plot. * I assume things have improved dramatically since then. No slur against Windows implied by my comment, it's merely how things were.
yongjik 7y ago
Last year my teenage daughter decided to trip over the cord of a perfectly good TCL television, ruining it, so we ended up buying a Samsung TV. It has a slightly bigger screen and sturdier legs that wouldn't trip over so easily, but man, it's an exercise in software disaster. Simply starting Youtube is an exercise in frustration with six or seven arrow keys, and it comes with a dozen built-in advertisement channels that will start auto-playing when powered on. After I finally got fed up, I looked up how to disable them, and turns out I have to click each channel individually to disable them. Also, I don't know if it's the fault of Samsung, Youtube app, or my phone (made by Samsung, haha), but trying to cast a Youtube video from my phone is a total shitfest - sometimes it takes a minute and the streaming still doesn't start. (Come on, you guys are sitting next to each other!) It's sad to see such a great brand being ruined for shitty software, but I've had enough. My next TV won't be Samsung. Maybe it will have a slightly smaller viewing angle, but who cares.
- SketchySeaBeast 7y ago
  That's frustrating. My LG smart TV is one click away from Netflix and Amazon, and I've got mapped buttons to YouTube and google play - it's a half second away, and there are no built in advertising channels. The worst we have is occasionally we need to exit out of whatever Netflix or Amazon stream we're on and go back in.
scarface74 7y ago
On a related note: “The CIA Spied on People Through Their Smart TVs, Leaked Documents Reveal” https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...
achillean 7y ago
There are nearly 20,000 Samsung Smart TVs directly hooked up to the Internet: https://www.shodan.io/report/3AhBQ8hu https://www.shodan.io/report/3AhBQ8hu
wnevets 7y ago
Wanna guess which brand of tv I won't be buying when I upgrade to 4k? Is it still possible to buy "dumb" TVs with the latest display tech?
petee 7y ago
And yet Samsung stopped providing updates for my 2014 SmartTV 1 year in, so that's 4 years of NO JAVA UPDATES! Yes, it is permanently disconnected. I've complained to support and they don't seem to care much, and that I'll just buy a new TV every 2 years...
Lowkeyloki 7y ago
My TV is a 42" 1080p LG TV I've had for almost ten years now and I fear the day it gives up the ghost. I don't really care about 4K or the thinner bezels (although having a physically lighter, as in less heavy, TV would be nice). But the last thing I want is a "smart" TV. I just want a dumb box that pushes the pixels I give it. Are there any of those left out there? Will I have to sacrifice quality otherwise just so my TV doesn't spy on me or get viruses?
- pard68 7y ago
  Different TV, same situation. I just figure I won't ever plug it in.
- deleted 7y ago
  [deleted]
georgebarnett 7y ago
Years ago I switched to a dumb short throw projector. Now I get a huge clear picture connected to an Apple TV and a decent set of speakers. I do not regret my decision. No crappy smart software. Just on and off.
Sophistifunk 7y ago
Honest question - this is a technical audience, why on earth are any of you guys ever letting your TV connect to the internet?
leoh 7y ago
Dumb question: why doesn't the TV just run antivirus without user intervention?
cmod 7y ago
Somewhat tangential and not workable in all situations, but the best "TV" I've found is a projector bolted to the ceiling. It's out of the way. There's no "black mirror" taking up space or pulling on your gaze. Project against a white wall and it's like having a magic wall that turns into a cinema on demand. The fact that it doesn't work well in daylight is a forcing function to keep from watching TV / movies during the day. I have an Apple TV plugged into it, wedged into the ceiling mount, bluetooth audio to the stereo, no wires anywhere. I love it.

323 points by haxiomic 7y ago

Here's another case for not owning a Samsung Smart TV. Mine, which I bought for approximately £1.3k in late 2016 received a firmware "upgrade" in mid-2017 that inserted advertising into the TV's UI. Upon contacting Samsung to complain they informed me that it was my fault that they were appearing due to applications that I have installed. The ads all originated from applications that were pre-installed that were locked and un-removable. In the end I had to work out how to block the TV from contacting Samsung's ad servers at the DNS level, although now a PiHole is an easier solution to this problem. https://gist.github.com/peteryates/b44b70d19ccd52f62d66cdd4bcef1e52 https://gist.github.com/peteryates/b44b70d19ccd52f62d66cdd4b...

dessant 7y ago
LG TVs also contain ads in the home menu and other places, and there is no official way to opt out. Sony TVs appear to be the most user friendly options if you'd rather not see ads on a premium device. https://www.rtings.com/tv/learn/ads-in-smart-tv https://www.rtings.com/tv/learn/ads-in-smart-tv
- owenwil 7y ago
  I swore off Sony when my TV got an update to add advertising to the volume slider on the screen, which was the last straw. Weirdly enough, I replaced it with a Samsung, which appears to have ads if configured into any North American country, but if you select any GDPR-included territory, the ads don't appear at all
  - mcv 7y ago
    Thank God for GDPR, then. My Samsung smart TV hasn't shown me any ads yet. Except in the Youtube app I think, but that's probably not Samsung's fault.
    - chipperyman573 7y ago
      Serious question, has having a smart fridge really helped you in any meaningful way? I'm not sure if I'm just missing something because I've never owned one but they seem useless.
      - paulie_a 7y ago
        I had one. It was junk. Terrible touchscreen, rebooting several times a day, no compelling reason to even use it. I use a tablet on the counter for recipes and music, much more efficient and a better system.
  - neves 7y ago
    Thank you Europeans for the GDPR law. The need to click to accept cookies in each site looks like a useless bureaucracy, but now we see the real advantages of the law.
    - Dylan16807 7y ago
      And in theory GDPR should reduce the number of cookie warnings, because it makes it much clearer what can be opt-out.
- mxuribe 7y ago
  I've also tried my best to avoid purchasing any Sony products...ever since around 2005 [0]. While i do acknowledged that some of their products historically have been good quality...I've tried my best to use my wallet to vote my conscience. [0] = https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
  - q3k 7y ago
    I'm on the same boat, also fueled by the way Sony handled PS3 OtherOS [1] and Homebrew [2]. [1] - https://en.wikipedia.org/wiki/OtherOS#History https://en.wikipedia.org/wiki/OtherOS#History [2] - https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_America,_Inc._v._Hotz https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_Am...
  - ken 7y ago
    Thus, the problem with Adam Smith's Invisible Hand in the modern world. I salute you for sticking to your guns, but I think we all could have predicted that Sony wasn't going to suffer any significant consequences from that. There's 10 major brands of TVs, and 10 attributes by which consumers decide what to buy. Even if you could got 95% of consumers to agree (ha) that one brand is the absolute worst at the most important attribute, it's still going to be the best at something else. There simply aren't a sufficient number of axes of control here to influence change.
- floydnoel 7y ago
  I have an LG, it has no ads. It's easy to opt-out- I never connected it to WiFi.
mercora 7y ago
It is possible to disable this behavior unofficially via the service menu if you are brave enough (its kinda easy to break stuff). Not sure what happens to your warranty though. On mine it is also possible to disable OTA updates there.
- Chazprime 7y ago
  Besides the dangers of the service menu, newer Samsung Smart TVs have the newer "smart remotes" that don't have the buttons access those functions. I had to purchase an older BN59-01198Q[0] remote just to get at the service menu. [0] https://www.google.com/search?q=BN59-01198Q https://www.google.com/search?q=BN59-01198Q
axaxs 7y ago
Samsung does some odd things. I have a 2017ish model...when you turn it on it was silent, until I chose an app. One day, seemingly out of nowhere, there was a new live tv app of sorts in the first position, and the default behavior was that app when you turn the tv on. So now you get some awful commercial blasting every time you turn on the tv...

sschueller 7y ago

Does anyone have a list of IPs and domains Samsung uses which I can block in my outgoing firewall rules? Or alternatively all IPs Netflixe uses so I can whitelist those. EDIT: From another comment's link. log-ingestion-eu.samsungacr.com lcprd1.samsungcloudsolution.net osb-apps.samsungqbe.com acr0.samsungcloudsolution.com ads.samsungads.com www.samsungotn.net osb.samsungqbe.com cdn.samsungcloudsolution.com www.samsungrm.net osb-eusvc.samsungqbe.com oempprd.samsungcloudsolution.com time.samsungcloudsolution.com noticecdn.samsungcloudsolution.com notice.samsungcloudsolution.com otn.samsungcloudcdn.com multiscreen.samsung.com gpm.samsungqbe.com configprd.samsungcloudsolution.net ypu.samsungelectronics.com kpu.samsungelectronics.com sas.samsungcloudsolution.com otnprd9.samsungcloudsolution.net otnprd8.samsungcloudsolution.net otnprd11.samsungcloudsolution.net otnprd10.samsungcloudsolution.net apps.samsungcloudcdn.com

petepete 7y ago
That list might be a bit out of date, it's from April 2018.
andy123456 7y ago
Can't you just block the TV's MAC address entirely in your router.
- slig 7y ago
  Or just don't enter your WiFi password on it.
  - seieste 7y ago
    There were reports that some TV’s will automatically connect to any unsecured WiFi.
  - hadlock 7y ago
    Our smart TV lives on it's own wifi network, I super don't trust it to interact nicely with other devices on our home network. All the other smart home stuff (smart led lights, etc) lives on it's own network as well.

jgrahamc 7y ago

I own a Samsung TV. It works great. There were apps, I used to use them but slowly by slowly they bitrotted until the TV is simply an HDMI monitor at this point. It still supports legacy broadcast TV over coax etc. but anything "modern" has rotted away. Which makes me think I simply don't want any smart at all in the TV.

wayoutthere 7y ago
This is both true and not true — yes, a great many apps have been abandoned, but the big ones (Netflix, Prime Video, Hulu, HBO, premium sports apps, etc.) are well maintained. The built-in apps are by far the easiest way to watch 4K HDR video (which Amazon has lots of). But yeah, all that said, the “smart TV” functionality would be better off in an external box. I trust that Netflix will update its app because I pay them every month. I don’t trust Samsung will update the TV software for the 10-year life of the TV because I paid them all up front. Such is life in the modern world :)
- gbear605 7y ago
  That only works so long as Samsung (or whoever) keeps the update mechanism continuing to work.
- darrenf 7y ago
  > I trust that Netflix will update its app because I pay them every month I pay each month for the WWE Network, yet last week the app stopped working, with a "no longer supported" message, on my 2013 Samsung TV.
  - wayoutthere 7y ago
    Oh, I totally agree that a lot of smaller services (including most of the cable / TV companies) stopped building apps. IMO it’s only worth it for global services because smart TV apps are far more heavily used in Asia and Europe. The client I worked for (a big US cable provider) killed all their smart TV apps when they realized they were spending ~$500k a year on a bunch of apps that were being used by maybe 3,000 people a month. They do continue to support apps for external devices like Roku and Fire TV.

Bucephalus355 7y ago

I worked for a large network company at one time as a contractor. I was pretty horrified at some parts of their security. That being said they had a great attitude towards security I haven’t encountered since, so maybe they’ve improved. But still very little stopping even a small determined country like say Monaco from hiring 2-3 decent sysadmins and hacking them to pieces. Anyway it would surprise me if the TV companies even had bare minimum acceptable security, because even the net security guys are struggling.

CSDude 7y ago

What is the attack surface for a Smart TV? Any exploits? This is scary and disappointing. I disable my TVs wifi and only use Apple TVs.

sschueller 7y ago
Especially since these TVs have microphones and some even cameras in them.
ahje 7y ago
My TV (Finlux) has an undocumented API, that allows anyone to pull information about what I'm watching at the moment. That same API can be used to launch a telnet daemon which can then be used to log in as root without using a password. Needless to say I've disabled wifi on it and I don't intend to ever connect it again. But hey, the TV runs Linux, which is nice I guess.
imglorp 7y ago
Forget the attack, the device IS the attack. It doesn't get any worse than this: https://www.cnet.com/news/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec...

jasode 7y ago

>“Prevent malicious software attacks on your TV by scanning for viruses on your TV every few weeks,” This reads like an Onion parody article but unfortunately, that security precaution is reality. To generalize the Samsung example further, this is why I don't believe it's realistic that decentralization can happen via average homeowners owning a "server appliance" that serves up webpages, social media profiles, videos, email, etc. I made a previous comment on how disciplined security practices are too tricky for non-techies.[0] Yes, a bunch of techies can run personal servers (Raspberry Pis, Freedombox, etc) to run a decentralized Q&A site to replace Stackoverflow. Or maybe run a decentralized discussion forum to replace HN. However, a bunch of grandmothers cannot be expected to maintain their own web appliances to run a decentralized cooking recipes website. [0] https://news.ycombinator.com/item?id=11861683 https://news.ycombinator.com/item?id=11861683

eudora 7y ago
If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date. Why couldn't that work? I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust. And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI
- jasode 7y ago
  >served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. [...] Docker image that gets updated upstream for security issues [...] Why couldn't that work? The update process itself acts as an attack vector. Even the techies like programmers can get pwned with trusted repositories that suddenly became untrusted.[0][1][2] A decentralized server appliance of powerful sophistication that requires updates will require a baseline level of technical expertise. So far, even the less sophisticated hardware like wifi cameras and Nest devices are leaving unwitting homeowners exposed to criminals and unwanted spying.[3][4] [0] https://www.theregister.co.uk/2018/07/12/npm_eslint/ https://www.theregister.co.uk/2018/07/12/npm_eslint/ [1] https://www.infoworld.com/article/3184399/malware-finds-unwitting-ally-in-github.html https://www.infoworld.com/article/3184399/malware-finds-unwi... [2] https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l... [3] https://www.google.com/search?q=home+wifi+cameras+hacked https://www.google.com/search?q=home+wifi+cameras+hacked [4] https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...

SomeOldThrow 7y ago

Is it even possible to buy dumb tvs anymore? I have been hanging on to my 2014 model (and will probably try to use it for another decade) because the new tvs I interact with have ruined basic tv interactions. All I want: on/off, input switch, volume control.

deleted 7y ago
[deleted]
petepete 7y ago
Last time I bought one I looked but couldn't find anything that fitted my requirements, (~55", excellent image quality preferably with HDR, supports ARC and CEC). If there was a DumbTV that did all those things and was reasonably priced, I'd have bought it there and then.
outime 7y ago
If you buy a smart TV and just not connect it to the internet you can use it as a dumb TV.
- mywittyname 7y ago
  For now... Just wait until they have always-on cellular service which is used to deliver ads, spy on you, and "upgrade" firmware.
  - chopin 7y ago
    That's what I fear most. For cars, this is already becoming reality.
  - MrMember 7y ago
    Always on cell modems are eventually going to be installed in most electronics and it kind of terrifies me. I only want a handful of internet connected devices in my home and at some point that won't be possible. I can keep my "smart" TV offline today, but what about when it has a cell connection? Will I need to physically destroy the cell modem on my TV, refrigerator, stove, etc just to maintain some modicum of privacy?

ksec 7y ago

I am willing to pay additional 30% mark up on top of the current price of Samsung SmartTV for an Apple TV Set. Benedict Evans has been saying TV market has slim margin, and long replacement cycle. I doubt the HomePod addressable market is any bigger than TV, and likely has similar long circle. Why not TV? Clearly there is something the Apple could bring value to the TV market. ( Although he has been right every time I disagree with him )

rchaud 7y ago
Apple now has 8k displays with $5000 price tags. A 4k TV, would cannibalize that pretty heavily, even if it was priced at 2-3x the competition.
- ksec 7y ago
  You mean 6K? The thing is, that monitor is actually compared to Reference Monitor, and as far as the initial preview from those who have seen it, most can't believe a LCD could be as good if not even better than the OLED. And if the spec is actually as good as they say ( Apple has always been very conservative in Spec listing ) may be they are really targeting Reference Monitor? If so, then a normal monitor / tv would not cannibalise it, since they are completely different segment.

thom 7y ago

Given that we do everything via HDMI and use a Chromecast for anything fancy, what would people recommend if someone doesn't need these doodads? Computer monitor plus a soundbar or something? Or does anyone in the UK know of a non-smart TV that can do FreeView and nothing else, but has a decent spec panel?

deleted 7y ago
[deleted]
retSava 7y ago
Don't give it internet access. You don't even need to give it network access if you use a chromecast.
luxpir 7y ago
Had a similar thought before recently buying a new TV. I had heard of Samsung ads, LG's slow interface so was looking for something else. I do use a PiHole in the house, but didn't want to rely on it. Ended up finding the Philips 50PUS6753/12 50in 4k - the previous version got What Hi-Fi's TV of year award and does a much better job than a PC monitor. Under £400 on Amazon atm. In-built sound is, for me, enough to avoid the soundbar. Also the Ambilight is a nice touch, sort of extending the picture beyond the screen. Responds to screen, audio or custom colour. Main thing though is there are no ads that I've noticed and it's a fast enough interface. Currently using the TV itself for catchup/freeview/youtube and the rpi as a media centre. You can just not plug the TV in too if you want it truly dumb.
HelloMcFly 7y ago
You can always get into the projector game.
mrguyorama 7y ago
Vizio probably still sells lower quality TVs without smart features, and their "premium" lines seem to use a "built in chromecast" instead of some stupid knockoff system. So check out your local walmart I guess

koolba 7y ago

Also insane is that there is no “disconnect and forget” option for the WiFi on these TVs. The only method I’ve found that works is to trick the TV into joining a different network and then turning off that other network.

jtmarl1n 7y ago
I have discovered the same thing, had to factory reset the one TV I connected before I realized this. Now I have a "dummy" SSID I start up anytime I do want IoT devices to connect to the internet.

myself248 7y ago

I think this makes the case for not owning ANY smart TV. Are there ANY manufacturers that have a strong track record of out-of-the-box configs that aren't total swiss cheese, combined with years of prompt updates to address issues discovered later, going out to the lifespan of a typical dumb TV?

linachka 7y ago

I have a Samsung TV but I've never thought of scanning it for viruses. So, thank you for this piece of news. Looks like we should take care of ourselves; at least, thanks to Samsung for warning.

obituary_latte 7y ago
I don’t understood with how cheap chromecast/Apple TV/whatever streaming machines are these days why people don’t use one of those and just not hook the TVs to the network? Is there something specific on the tv that’s not available on these other platforms?
- antidaily 7y ago
  It's one less remote.
retSava 7y ago
I think the article lifts a good point: since it's necessary, why not automate this process in the TV? And what do you do if this process returns positive (ie compromised)?

FerretFred 7y ago

Wow! Who designed that UI to get to the virus scanner?!

JustSomeNobody 7y ago

Our Samsung TV isn't allowed to speak to the internet. Hopefully, by the time we are in the market for another TV, there will have been a swing in the market away from Smart TVs.

ksec 7y ago
If we could somehow standardise on the panel cable, like the one used in LG OLED Thin and Samsung. Then the panel maker concentrate on making better panel. While we get a choice and more competition of "Smart".

rock_artist 7y ago

The biggest issue is lack of software/security updates. They treat those products as dumb TVs. they've compiled an OS build ("firmware") and you'd might get a year of updates and that's it. Any Smart TV will eventually become a security hazard. meaning "dumb" TV with an AppleTV or a reasonable modern streaming device is safer :)

fabian2k 7y ago

Having a manual virus scan button on a TV is ridiculous. It wouldn't entirely surprise me if it doesn't do anything useful at all and is purely a placebo. If a signature-based virus scan tailored to TVs is available, it should just run in the background, requiring manual interaction is entirely insane. Securing the TVs well in the first place would be the best option, but that is unlikely to happen.

shultays 7y ago

Also apparently Samsung support has a twitterbot that replies something similar > `Hello there! Thanks for reaching out! Could you please send us a DM with the TV Model code and more details about this concern? ^Nick` to every tweet it gets. https://twitter.com/SamsungSupport/status/1140415146675728384 https://twitter.com/SamsungSupport/status/114041514667572838...

catherd 7y ago
Chase bank has one of these as well. Pretty awesome to get a canned response (then ignored all weekend) when you get locked out of your bank while in a different country. https://twitter.com/ChaseSupport/status/1139899780283469825 https://twitter.com/ChaseSupport/status/1139899780283469825 > 'Hi there. We're here to lend our support. Please DM us with your full name, zip code, and additional details regarding your concerns. ^EL'

WarDores 7y ago

Precisely the reason that I just disable the network connection on mine and use my Xbox for media. The convenience isn't worth the hassle.

skocznymroczny 7y ago

I feel glad I own a "stupid" TCL TV. If I feel the need to have "smart" features, a Raspberry PI running Kodi/OSMC connected by HDMI is more than enough.

rchaud 7y ago
These types of TVs are rapidly becoming unavailable. It's not just 4K TVs, anything above 24" is going the SmartTV route.

codedokode 7y ago

Slightly unrelated, but maybe we should start calling TVs with cameras "telescreens"? Like, "don't forget to check your telescreen for viruses every several days".

mrbonner 7y ago

I bought a samsung SmatTV in 2017 in Costco. The tv is ridden with software bug: it would turn off itself randomly or cannot turn on the tv unless I remove the remote batteries and reinstall them. The ui is really slow. I also owned a series of samsung Android phones since the S2 to S5, a samsung security camera. They are all ridden with a lot of bugs. I have vowed not to buy a single samsung product anymore.

whymsicalburito 7y ago
I got my TV at costco and it came with a 2 year warranty. Take it back if it's broken!

lykahb 7y ago

Recently I did some research to choose a new TV. I plan to use it as a regular one, with HDMI input and don't need any smart stuff. Unfortunately, most models are smart and there is no information about their behavior when disconnected. It may still show popups to make an account or connect to the network. Choosing a smart TV feels like choosing a blind box with crap. Perhaps I'd spend more and buy a commercial monitor instead.

anbop 7y ago

I never give my TV Wi-Fi credentials, only the Roku and Prime stick.

CDSlice 7y ago
Unless your Roku or Prime Stick passthrough the internet access to your TV. https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx
- unwiredben 7y ago
  Again, no Roku device has ever implemented Ethernet over HDMI. It's too poorly supported in TV hardware to be worth doing.

CDSlice 7y ago

Many of the comments here say that you can just not give your TV access to your network and you'll be OK. This may not actually be true thanks to Ethernet over HDMI(1), which could let your Roku/Fire Stick/Apple TV give your TV internet access over the HDMI cable. (1) https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx https://www.hdmi.org/manufacturer/hdmi_1_4/hec.aspx

unwiredben 7y ago
As far as I know, no Roku device has ever implemented Ethernet over HDMI. It's too poorly supported by devices to spend money on implementing, and WiFi just works better.

jandrese 7y ago

I guess it would be too difficult for Samsung to have the TV run it's own checks? They could be run while the TV was off to avoid impacting the user experience. But honestly if it's anything like PC antivirus software those scans are useless. If you don't intercept the virus before or while it is installing it's too late. Once it's in there it can hide from regular AV software all day long.

UI_at_80x24 7y ago

You know that special feeling of vindication and moral superiority when you are proven correct years-later? There's got to be a German word for that.

hombre_fatal 7y ago
aka the need to let others know that you were right about something no matter how little they care. If there was a word for that, I feel like we'd already be seeing it daily on HN.
wtfrmyinitials 7y ago
Not exactly it but Schadenfreude is pretty close

duxup 7y ago

I recently bought a new TV. After reading all the messes with smart TVs I just didn't connect mine to my local network. It's just not connected to the network and I don't intend to connect it. I do every "smart" activity through a Chomecast device or similar devices anyway. Now that alone could in theory be a security risk as it could be out of date and vulnerable to someone else messing with it in that sense ... but I felt connecting it was the bigger risk / hassle. I kinda wish there was just a switch to power off the "smart" options and just have it operate in monitor only mode. I feel the same about microphones and cameras on phones. Give me a physical power off switch and led indicator for those things.

Isamu 7y ago
Same here ... don't let your smart TV connect to the network, just use it as an hdmi endpoint for devices you can (hopefully) control better.

pmh 7y ago

Earlier discussion here: https://news.ycombinator.com/item?id=20201485 https://news.ycombinator.com/item?id=20201485

dang 7y ago
Thanks! Comments moved thither. Edit: actually, the BBC article seems to contain more information, so let's keep this submission instead.

xfitm3 7y ago

Samsung TVs should not be online: it’s proven you can’t trust them. It phones home and reports your usage - even every time you press the volume button. Login to Smartthings and you can see some of the data it collects.

sschueller 7y ago

How about open sourcing the code running on it or at least letting us run our own software? A lot of apps that came with my TV from Samsung have been removed over the years as they stopped supporting them. For example Skype. So I paid for a TV with Skype, now it has no more Skype.

minimaul 7y ago
No, you paid for a TV with an App Store, where there were apps (pretty much all provided by third parties). It’s not Samsung’s fault if a third party pulls their app.
- kbenson 7y ago
  It depends. If the TV was advertised with a specific application, which I see often, then the loss of that application is a loss of advertised functionality. The way I see it, if they used the availability of an app as a direct selling point, that makes them somewhat liable to it's continued functionality. If they didn't secure that contractually or with some level of assurance, they should not have advertised it.
  - JustSomeNobody 7y ago
    No, you received an implied license for the life of the television to operate it as a television. Samsung reserves the right to modify the software on said television as it so chooses.
    - kbenson 7y ago
      It's not that simple. It really does matter how it was advertised (but it also matters whether the FTC is willing to make a case).[1] 1: https://www.ftc.gov/news-events/media-resources/truth-advertising https://www.ftc.gov/news-events/media-resources/truth-advert...
    - horsawlarway 7y ago
      I think without trying this opinion before a court, you have no idea. Samsung may have reserved the right to modify the software, but I've literally seen smart tvs from Samsung that have a "Netflix" button on the physical remote. They have shipped tv boxes that clearly and prominently display the Netflix app on the tv. If the Netflix button on the remote no longer works, the tv is not doing what the user bought it to do and what it was advertised as being capable of.

amiga-workbench 7y ago

This is absolutely comical, I'm grabbing a second hand NEC commercial panel when my current TV kicks the bucket.

drspacemonkey 7y ago

I simply do not want a "smart" TV. No internet access, no apps - just a lot of HDMI inputs, CEC, and a display. Sadly, this is getting harder and harder to find. When I went to buy last time, Costco didn't have any "dumb" TVs, so all I did was refuse to hook it up to the internet. I got a Roku and a Chromecast. Those provide better "smart" functionality than any TV ever could.

tombert 7y ago
I agree; I bought a Vizio TV a few months back. It had all this smart crap built in, but it was pathetic compared to even some of the cheaper AndroidTV boxes you could buy on Amazon or Walmart for ~$40.
- behringer 7y ago
  I use my Vizio TV for my computer monitor. That's all it ever does is be a monitor. Except when my computer breaks and I have to repair it. For a day or two, that built in netflix app is a wonder :)
- xeonoex 7y ago
  New Vizio's are pretty much dumb TVs with built in Chromecasts. Which is exactly what I want. Every Smart TV interface I've used is worse than using my phone as a remote, or Google Home voice commands to control my TV. The experience isn't perfect, but it's pretty good.
deleted 7y ago
[deleted]
radiorental 7y ago
TCLs are 'dumb' tv's with a Roku built in. They're quite popular so I might be missing why these are to be avoided and/or network disabled and Roku over HDMI is preferred?
- kevin_thibedeau 7y ago
  They're superior to a standalone Roku for ease of use, at least until the hardware goes unsupported which will be a while. One annoyance with mine using the RokuTV speakers is that speakers drop out and don't maintain a consistent volume level whenever the WAN connection is lost. Something is taking up too much processor time trying to connect to the outside world. The speakers are unfortunately the only way to get AGC in a stereo system because the TV itself can't do it for whatever reason.

Someone1234 7y ago

Conceptually embedded devices shouldn't even have writeable storage for malware to persist. This doesn't require a special operating system or a kernel patch, Linux (which is popular for these types of devices) natively supports read only storage. You can have a small read/write volume where update bins are placed. Upon reboot, a pre-boot environment checks the bin's cryptographic signature, and if it passses it then extracts the bin, overwriting the the read only filesystem and a second reboot occurs allowing normal boot into the updated OS where the file system is again read only. This is how e.g. the Playstation works. Amongst several vehicle manufacturer's infotainment units. Even Windows uses a pre-boot environment to write certain "hard lock" files and registry areas. This is not wild "pie in the sky" thinking, this is an industry norm or was. Why does a smart TV that's meant primarily for streaming content directly from the internet need a R/W file system? Settings? Couldn't that be stored in a micro-volume without execute flag and SELinux limits?

behringer 7y ago
And what if the cryptographic hashes are broken, stolen, or whatever? Once you're in the system, if there's rewriteable storage at all, it can be compromised. If you want to stream, the apps need to be updated as streaming service providers update their systems from time to time.
- Someone1234 7y ago
  > And what if the cryptographic hashes are broken, stolen, or whatever? You've still improved the scope of exploitation from: - Need an RCE (remote code execution) in any service on the device for a persistent threat To: - You need an RCE in any service on the device - You also need to be able to generate a cryptographically signed update which will install for persistent threat That's a win. That's a BIG win. Particularly as regular updates can replace compromised cryptographic credentials. You're essentially arguing the "if the solution is imperfect, we should do nothing" fallacy. You haven't proposed a better alternative, just argued that no action is better than an action that falls below perfection. > If you want to stream, the apps need to be updated as streaming service providers update their systems from time to time. Which may require a reboot. It is unfortunate, but makes the device more secure and less susceptible to hardware originated data corruption (since the volumes can be completely verified for correctness, compared to the source images which can also be verified for correctness via HMAC). There's no specific set standard for how bin updates work. They can range from complete file system updates to incremental updates.

tombert 7y ago

Things like this are why I kind of despise the "smart TV" movement. I can't blame people for using them, they're convenient as hell, but at some level I have trouble seeing why the TV needs to have the computer built into it. To me, a TV should be a more-or-less "mechanical" device that does one thing and one thing only: display video. Obviously, though, this only defers the error over to AppleTV or AndroidTV or whatever computer you have plugged in. I guess with the (admittedly awesome) advent of streaming-all-the-things, stuff like viruses are an inevitability.

rietta 7y ago
In my experience, a SmartTV can stream and HAS ONE REMOTE. Every family member who is not an IT professional has struggled deeply with any TV/AV setup where two or three remotes are needed. This same customer is also not going to have an easy time on their own setting up some yet another third party universal remote.
- tombert 7y ago
  You know, that's a pretty fair point. I guess not seeing that as an issue is a consequence of an engineer running AV setup at home. More remotes = more to lose. None of my stuff seems to do this, but isn't there something for HDMI that allows bidirectional stuff to allow a device to control the volume and whatnot?
  - flyinghamster 7y ago
    CEC. It's nice, but if and only if all of the relevant functions on your device can be controlled from the TV remote. My Sharp dumb TV (actually a Hisense since Sharp quit the US market) has several buttons that ought to be sent to a device but aren't, which limits CEC's usefulness with my Kodi setup. I ended up putting an IR receiver in the box (a Raspberry Pi running OSMC) and using an RC6 remote instead.
    - bootlooped 7y ago
      And if it does't all work then that is even more cognitive load on the user: "you can use remote A for everything devices A and B do, except functions C-D, for those you need to use remote B, but use A for everything else, got it?"

MobileVet 7y ago

Not news to this crowd... but I think it is pretty significant that a major consumer electronics manufacturer would come out and say this to the mainstream public. What can a hacked tv do besides relay viewing information or connect to Hoolinet? Clearly it could be added to a botnet, but would Samsung be liable for that? Do the TVs have microphones or cameras... that would open Samsung up for a lawsuit. What is to gain from this announcement?

hombre_fatal 7y ago
> Clearly it could be added to a botnet This is why I believe in metered data plans. Certainly not ridiculously expensive ones, but not "unlimited" access either. If your IoT devices become open relay DDoS machines, it should show up on your bill. I'm convinced it's the only solution that aligns incentives correctly.
- okmokmz 7y ago
  That does not at all seem like an appropriate solution to the problem
- justwalt 7y ago
  Seems like a bit of a silly solution. Personally, I wouldn’t need financial incentive not to have devices on my network be associated with illegal activity.
- verisimilitudes 7y ago
  So, people shouldn't have ''unlimited'' access to the Internet, because they've had IoT garbage forced upon them and its their ''responsibility'' to manage it, when they usually can't actually control it anyway? Not only that, but a DDoS is usually only an issue for a large central location that is perhaps part of this manner of problem, anyway. They can go to Hell.
  - 0xffff2 7y ago
    Nobody has had IoT garbage forced upon them. They bought it and connected it to the network, therefore it's their responsibility to manage it. Ignorance of basic network security is no more a defense against allowing malicious code on your network than ignorance of the law is a defense in court.

aphextim 7y ago

Surprised they don't come pre-loaded with McAfee

lozaning 7y ago
They do though, https://www.howtogeek.com/406177/samsung-is-bloating-everything-with-mcafee%E2%80%94even-smart-tvs/ https://www.howtogeek.com/406177/samsung-is-bloating-everyth...
- aphextim 7y ago
  That made my day. Thank you.

dewey 7y ago

I wish there was a company selling TVs without any “smart” software on it. 100% of the time I use my TV through the Apple TV and even the changing of input to switch to a console is done through HomeKit. I guess it would be way more expensive if they can’t subsidize the price without all the stock apps and ads they ship with it.

mrweasel 7y ago
We do the same, the AppleTV is really the only device with the right apps here in Denmark. We had to get a SmartTV, but we simply don't use that part, the TV is not allowed on the internet. The Philips remote have a big ass Netflix button right in the center, but we just use the Netflix app on the AppleTV, because using any of the apps on the TV is an unpleasant experience. I can sort of understand the idea of a smart TV, but the TV manufactures do not have the organisation, infrastructure, developers nor the hardware to deliver good and up to date apps, so I don't understand why they keep insisting on building smart TVs. Companies like Samsung must know that their app suck.
0xffff2 7y ago
Isn't this basically a monitor (with built-in speakers)? A quick look at Newegg suggests you can get a 43" monitor for pretty a pretty reasonable price.
- dewey 7y ago
  Yes but 43” is not really TV size material. They are made for different use cases.
  - 0xffff2 7y ago
    What is TV size material to you? A friend of mine has a 60" TV and it's huge. I really can't imagine that most people have TVs that big. You can go even bigger with monitors, but the selection is thinner so it's hard to tell if it's really economical. The whole point of my comment is that average size aside, they really don't seem to be different use cases at all for a lot of people.

awalton 7y ago

This is precisely why my "smart TV" isn't allowed on my network. Millions of dollars of work to theoretically save the user on a $10 HDMI cable (but, more honestly, just to make consumers buy new TVs every couple of years regardless of whether they need one or not, simply because the "smart" unit is out-of-date). Sometimes this industry needs a boot to the head.

rietta 7y ago
Despite all the trying I have, I cannot get my mom or grandmother to ever understand switching HDMI sources. The SmartTV has most functions built in with a single remote control. This is crazy significant to the appeal.
- awalton 7y ago
  My cable box has a remote that's able to turn off and on my TV and switch the TV's sources. I haven't taken the TV's remote out of its original packaging. It's 2019 - this is a solution in search of a problem.
  - hombre_fatal 7y ago
    Seems by your posts you're assuming everyone already has a cable box + service since you think the TV saves you a mere HDMI cable. Meanwhile I'm not sure I've even had roommates or been to someone's house my age (25-40) in the last 5 years that had cable service. It's always the same: everyone just navigates to the TV's built-in Netflix/HBO/Amazon/etc. app and puts something on. If you think everyone in the world has a cable box, then I understand why you don't understand smart TVs. But your premise is mistaken.
  - scarface74 7y ago
    Then you have to program the remote and make sure you are in the right mode. Have you compared the typical cable remote with the Roku remote for smart TVs with Roku built in? Not to mention remote listening where you listen to audio on your phone from your TV. But part of the purpose of having a smart TV is that you don’t need cable.

kevinherron 7y ago

I'm sad that the next TV I buy will probably have to be a "smart" TV. I went out of my way to find a dumb one the last time around, and I had to settle for a lower end model because all the higher end ones have a "smart" component. All my apps are via an attached Apple TV. Oh well. As long as it works without being connected to my network I guess it's fine.

pharrington 7y ago

The obvious solution is to write an ad-blocker for your TV.

jethro_tell 7y ago
Don't have a smart tv, but I assume something like PieHole would do the job

flexie 7y ago

How do I check my Samsung TV with my Samsung remote?

anm89 7y ago

It's funny to me how clear the divide is in terms of valuing this technology vs being scared of it for people working in tech vs not

tomc1985 7y ago

"A better solution would be for Samsung to automatically update its operating system for you." An even better solution is to stop making unnecessary appliances "smart" and not handing bad actors a surface area to attack when companies aren't willing to invest in security But of course this runs contrary to the bread-and-circuses mode of operation that dominates tech "innovation" nowadays. Nobody is content making a really good TV anymore; now they've been infected by the same featureitis that corrupted software development decades ago

PopeDotNinja 7y ago

My approach to a smart TV was just to buy a PlayStation. Anything I've wanted to do on my TV was available as an app in the PlayStation store, with the exception being Google Play Music. I had previously tried using a Google Chrome, but eventually got sick of its lack of local storage & native remote.

mikepurvis 7y ago
> lack of local storage Ironic, given the subject of this thread. Though obviously the point stands that there's no need for execute permissions on an area being used for config settings and media storage.
- saagarjha 7y ago
  You would need an OS and hardware that understands such protections, of course.
  - monocasa 7y ago
    These things run full Linux distros.
    - saagarjha 7y ago
      Do their processors support memory protection?
      - monocasa 7y ago
        Yep, at least an MPU is a requirement for full Linux.
bobbyi_settv 7y ago
I try to use PS4 Pro as my "smart TV", but I end up having to use the TV itself (which runs Roku) sometimes because of its larger app base. You can't watch Starz through PS4. You can watch Amazon Prime, but not in 4k.

diminoten 7y ago

Or else what? Not exactly the end of the world if my TV is pwned as long as I can still, you know, use it. The ability to move laterally in my home network is about as valuable to anyone sophisticated enough to use it as walking around my apartment complex would be to a real life Danny Ocean. Could Danny get into my house and take my PII? Sure, but like, why the fuck would he? It's not wonderful to potentially be contributing to some botnet, but that's on Samsung not me.

mmahemoff 7y ago
One consequence is having your accounts compromised if you choose to login to Netflix, YouTube, etc on the device. That could be especially problematic if there are marketplaces involved, such as on-demand video (scams like this where the attackers operate a selling account https://www.denverpost.com/2017/04/10/amazon-third-party-sellers-hackers/ https://www.denverpost.com/2017/04/10/amazon-third-party-sel...)
saagarjha 7y ago
I would rather my device not contribute to a DDoS, especially as there may be legal implications to allowing this, but you do you I guess…
- diminoten 7y ago
  I've never heard of a single person in this specific scenario getting into any legal trouble whatsoever, let alone enough people for me to reasonably worry about the likelihood being high enough to register on the list of things that could actually happen to me.
- Cannibusted 7y ago
  You do you? I would lose that ridiculous phrase. It's super condescending and not needed. No one needs your permission to be themself, or even a 'reminder'.
Raphmedia 7y ago
Most smart TVs have built-in microphones. You don't want microphones on a compromised device in the middle of your living room.

retrac98 7y ago

Is there a market out there for a modern dumb TV? A good panel, decent speakers and a load of I/O in a slick enclosure? I think I’d buy this.

scarface74 7y ago
No because just like Windows PCs. They operate on small margins and make money by bundling software in the case of consumer Windows PCs or selling viewing data in the case of TVs.
- retrac98 7y ago
  I know there’s not a mass market for it, but I think a lot of privacy conscious folks would pay extra not to have apps on their TV.
kevin_thibedeau 7y ago
Industrial TVs are like this minus the speakers.
majewsky 7y ago
I have a 40" 4K PC monitor for this purpose. Works reasonably well.
ericskiff 7y ago
I buy these. I'm pretty easy to please, their 1080p is great, a little bright at the corners but I truly don't care, it looks great when watching actual shows/movies. https://www.walmart.com/browse/electronics/sceptre-tvs/3944_1060825_1939756_5735890 https://www.walmart.com/browse/electronics/sceptre-tvs/3944_... Cheap / Dumb display panels. Bring your own apple/chromecast/retropie whatever
0xffff2 7y ago
At this point, don't most people primarily use their dumb-TVs either by hooking up a cable box, game console, etc? A quick look a Newegg suggests that plain old LCD monitors can be had up to 43" for quick reasonable prices.

oflannabhra 7y ago

The reason TV manufacturers want to have connected TVs is not to provide utility to the user, but so that they can monetize a user's data. The "smart" part runs recognition software to identify what content you are watching, how long you watch it, records it, uploads it to the manufacturer's service, and then the manufacturer can aggregate it and sell it off. The Verge interviewed Vizio's CEO [0], who stated > This is a cutthroat industry. It’s a 6-percent margin industry, right? I mean, you know it’s pretty ruthless. You could say it’s self-inflicted, or you could say there’s a greater strategy going on here, and there is. The greater strategy is I really don’t need to make money off of the TV. I need to cover my cost. And then I need to make money off those TVs. Apple had to directly fight this when they brought their TV app over to smart TVs. It's also why I will never let a TV on my network, and will always use a separate streaming box. [0] - https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit-vizio-tv-bill-baxter-interview-vergecast-ces-2019 https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit...

Illniyar 7y ago
How much can you sell it for? Really - let's say you have my entire viewing history for a year, let's say I'm from a valuable demographic, how much would that be worth? A dollar? 10 dollars? I've just bought a tv for thousands of dollars from the company, selling my data doesn't seem very cost effective, especially considering the PR backlash of some scandal that could come out of it.
- admax88q 7y ago
  It's advertising. There's tons of money to be made. Maybe your data is not worth a lot alone, but viewing data of the entire TV watching population would be huge. If you don't think there's money to be made in collecting and selling people's data how do you explain facebook and Google?
  - planb 7y ago
    Google and Facebook do not sell peoples data. They sell their eyeballs. That‘s where money is to be made.

morpheuskafka 7y ago

Why would you have a scan-based security approach? Why not just enforce code-signing of all executables like on iOS? It shouldn't be too hard for a closed, embedded platform.

saagarjha 7y ago
That sounds like extra work.

dawnerd 7y ago

This comes from the same company that pushed advertisements through their notification system and when called out they denied it like crazy until some news articles came out. Also the same company that was injecting ads into plex. Basically, don't connect your Samsung (or any tv) to the internet.

jka 7y ago

Miniature sci-fi concept pitch: A future where the world is largely a privacy-scarce melting pot of competition where individuals vie for leverage over each other based on the scraps of information they can gather, barter for, or source through a myriad of insecure networks which provide some base level of value to users (like, say, a third-party piece of software that runs on a television after the user grants it permission, accidentally or otherwise). Meanwhile, VCs and technology experts have long seen this coming and retreated to countryside enclaves where electronics are banned, and news of the world is relayed via one-time-pad-over-horseback to ensure that the next level of marginal gain for the elite is collaborated upon in safety from reprisal. That's the context at least; many possible plots from there. Basically Elysium except that the elite eschew technology because technology security is so flawed that it unintentionally sells them out every time.

im3w1l 7y ago
I don't think it will be possible to escape even for the very top.
Bakary 7y ago
Couldn't the elite just eliminate/enslave the rest of the population altogether and rely on automation?

CommanderData 7y ago

I remember reading an obsecure paper hacking a smart TV through the radio antenna after which WiFi could be turned on. It was a work of art and sounded almost fictional. In the end the attacker would turn on WiFi and control the TV for not just one, any TV in radius, or execute a payload to connect back to a CnC for tvs out of range. It would work even if the TV was in standby. Patching this particular vuln would have been difficult, though the attacker would have to craft a payload specific to the make and model. It's a nice example where adding features increases attack surface, and protecting against such hacks even for the experienced is near impossible. Would make for a good HN submission.

jethro_tell 7y ago
Man, If you have any clues about where this could be found or any other info I'd really appreciate it. I'd love to read this.
- CommanderData 7y ago
  Found. Did get some coverage in the end. PoC: https://www.youtube.com/watch?v=bOJ_8QHX6OA https://www.youtube.com/watch?v=bOJ_8QHX6OA DVB standards updated their specification after the disclosure too. [1] DVB announcement: https://www.dvb.org/resources/public/pressreleases/dvb_pr263_steering_board_approves_updates_to_prevent_man_in_the_middle_attacks_final.pdf https://www.dvb.org/resources/public/pressreleases/dvb_pr263... Someone found another vulnerability using the same vector - will post if I can find it.

fredley 7y ago

Don't buy a smart TV, don't let your family/friends buy smart TVs. Buy a dumb screen and hook it up to an Apple TV, Chromecast etc. The 'smart' software is a privacy nightmare over which you have very little control. And sure, so is the Chromecast, but I at least have more faith that wherever that data's going it's going there securely and is relatively unlikely to be breached. Also, the software on your smart TV will age much faster than the screen itself.

imgabe 7y ago
Is it even possible to buy a dumb screen anymore?
- jay_kyburz 7y ago
  Probably not, but you don't need to give it your wifi password.
  - fencepost 7y ago
    Discussion of this on reddit leads me to believe that at least some Samsung TVs would connect to any available open wifi networks.
    - Domenic_S 7y ago
      I purposefully didn't give my Sony tv (android) my wifi password. A few weeks later it prompted me to install a firmware update, and I saw it was connected to my home wifi. How? Best I can guess is another android device shared credentials with the TV. I blocked that stupid thing at the router. I don't need firmware updates for my TV.
      - imgabe 7y ago
        Is there anyone else in your house who might have put in the credentials? That seems like a big security hole if Android will just share wifi credentials with other random Android devices.

gumby 7y ago

This is what drove me off Windows (in the 1990s* ): having to spend too large a proportion of time managing my computer rather than using it (AV, disk optimizers etc). Although I love writing code and designing hardware I didn't like the "computer" experience. Nowadays nobody sysadmins their phone and barely their tablet. And TV users want to do even less maintenance. In the quest to "add value" these TV guys have lost the plot. * I assume things have improved dramatically since then. No slur against Windows implied by my comment, it's merely how things were.

yongjik 7y ago

Last year my teenage daughter decided to trip over the cord of a perfectly good TCL television, ruining it, so we ended up buying a Samsung TV. It has a slightly bigger screen and sturdier legs that wouldn't trip over so easily, but man, it's an exercise in software disaster. Simply starting Youtube is an exercise in frustration with six or seven arrow keys, and it comes with a dozen built-in advertisement channels that will start auto-playing when powered on. After I finally got fed up, I looked up how to disable them, and turns out I have to click each channel individually to disable them. Also, I don't know if it's the fault of Samsung, Youtube app, or my phone (made by Samsung, haha), but trying to cast a Youtube video from my phone is a total shitfest - sometimes it takes a minute and the streaming still doesn't start. (Come on, you guys are sitting next to each other!) It's sad to see such a great brand being ruined for shitty software, but I've had enough. My next TV won't be Samsung. Maybe it will have a slightly smaller viewing angle, but who cares.

SketchySeaBeast 7y ago
That's frustrating. My LG smart TV is one click away from Netflix and Amazon, and I've got mapped buttons to YouTube and google play - it's a half second away, and there are no built in advertising channels. The worst we have is occasionally we need to exit out of whatever Netflix or Amazon stream we're on and go back in.

scarface74 7y ago

On a related note: “The CIA Spied on People Through Their Smart TVs, Leaked Documents Reveal” https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...

achillean 7y ago

There are nearly 20,000 Samsung Smart TVs directly hooked up to the Internet: https://www.shodan.io/report/3AhBQ8hu https://www.shodan.io/report/3AhBQ8hu

wnevets 7y ago

Wanna guess which brand of tv I won't be buying when I upgrade to 4k? Is it still possible to buy "dumb" TVs with the latest display tech?

petee 7y ago

And yet Samsung stopped providing updates for my 2014 SmartTV 1 year in, so that's 4 years of NO JAVA UPDATES! Yes, it is permanently disconnected. I've complained to support and they don't seem to care much, and that I'll just buy a new TV every 2 years...

Lowkeyloki 7y ago

My TV is a 42" 1080p LG TV I've had for almost ten years now and I fear the day it gives up the ghost. I don't really care about 4K or the thinner bezels (although having a physically lighter, as in less heavy, TV would be nice). But the last thing I want is a "smart" TV. I just want a dumb box that pushes the pixels I give it. Are there any of those left out there? Will I have to sacrifice quality otherwise just so my TV doesn't spy on me or get viruses?

pard68 7y ago
Different TV, same situation. I just figure I won't ever plug it in.
deleted 7y ago
[deleted]

georgebarnett 7y ago

Years ago I switched to a dumb short throw projector. Now I get a huge clear picture connected to an Apple TV and a decent set of speakers. I do not regret my decision. No crappy smart software. Just on and off.

Sophistifunk 7y ago

Honest question - this is a technical audience, why on earth are any of you guys ever letting your TV connect to the internet?

leoh 7y ago

Dumb question: why doesn't the TV just run antivirus without user intervention?

cmod 7y ago

Somewhat tangential and not workable in all situations, but the best "TV" I've found is a projector bolted to the ceiling. It's out of the way. There's no "black mirror" taking up space or pulling on your gaze. Project against a white wall and it's like having a magic wall that turns into a cinema on demand. The fact that it doesn't work well in daylight is a forcing function to keep from watching TV / movies during the day. I have an Apple TV plugged into it, wedged into the ceiling mount, bluetooth audio to the stereo, no wires anywhere. I love it.