4 ms·

I'm probably missing something here but why not just disconnect the TV from the ethernet/wifi? Are these things connecting themselves to the network?

by lgl 7y ago

ygjb 7y ago
Many of them throw continuous error messages and warnings about connectivity, and some features just plain don't work without it.
- DoofusOfDeath 7y ago
  I believe you. That's part of the value proposition: the company would know the impact of their changes to various TV models, and you could factor that into your buying decision.
imglorp 7y ago
In theory, that's not enough to keep them offline, if coded deviously enough. If your neighbor, for example, has a syndicated WIFI like Fios or Xfinity, your TV can try those. Also, it has 24/7 free time to sit there and break passwords, if needed. Even a slow CPU would score some eventually. And finally, the room is probably full of other devices which themselves may have connections; a TV can communicate ultrasonically with those to exfiltrate your data. https://security.stackexchange.com/questions/113502/how-to-prevent-iot-devices-from-phoning-home-via-the-neighbors-wifi https://security.stackexchange.com/questions/113502/how-to-p... https://www.aircrack-ng.org https://www.aircrack-ng.org https://www.securityweek.com/stealthy-data-exfiltration-possible-headphones-speakers https://www.securityweek.com/stealthy-data-exfiltration-poss...
- close04 7y ago
  I don’t see a TV doing 24/7 password cracking. Most WiFi passwords are now relatively complex out of the box and a TV would never have a realistic chance of cracking one. And while collecting data is maybe immoral, hacking passwords is as illegal as it gets. It would be orders of magnitude cheaper and safer to build in 4G connectivity and use it to upload the relatively small payloads.
  - imglorp 7y ago
    > build in 4G I wonder how many already have. Are we going to need a spectrum analyzer to watch this junk?
    - Animats 7y ago
      In the 5G era, probably. TVs will come with 5G connectivity built in and always on. At initial power-up, you'll have to log in with your "television provider". Like the way CBS online works now.
  - bduerst 7y ago
    The TV wouldn't need to crack a password if it's an XFinity wifi router next door, for example. Those are typically open to all Comcast customers by default, if I remember correctly.
    - Grazester 7y ago
      How is your TV going to get onto a wifi connection that needs an Xfinity customer login(yes there are open to all customers as in they can use the wifi connection but not without supplying a login)?
      - Drakim 7y ago
        By striking a deal with Xfinity?
  - rtkwe 7y ago
    Wouldn't even really need 4G, 3G or even lower would work if you're just sending text analytics of shows watched. Even the more nefarious spying efforts could go out through text if they bundled a speech to text converter on board.
    - close04 7y ago
      4G was more of a catch all for mobile connectivity. But actually some networks are turning off their 2G and 4G might have a better chance of working for years to come, since a TV is not really replaced that often.
- mnm1 7y ago
  We need laws to prevent this kind of shit. However, we have some laws already. If the TV is cracking passwords, who goes to jail? Oh, wait, I forgot laws like the CFAA and other shit like that are only enforced when regular people break them, not when companies break them to make money.
soylentcola 7y ago
I'd imagine a big part of this is because people like watching Netflix or Prime Video via the nifty apps built right into their TVs. To many owners, disabling those would be like disabling the cellular and WiFi radios on a smartphone. A big selling point (for better or worse) is not requiring you to buy more boxes or hook up wires. Just as you see with cheap IP cameras which neglect to steer users toward secure setup and only tout the "easy wireless setup! Just point to the picture on your iPhone screen!" It's the flip side of the ubiquitous marketing bullet points: Easy! No wires! Apps!
- gkfasdfasdf 7y ago
  > people like watching Netflix or Prime Video via the nifty apps built right into their TVs I fall into this camp - I really like using the physical remote w/physical buttons to play/pause/rewind, change volume, etc. I used to be a heavy chromecast user but switched for these reasons.

I'm probably missing something here but why not just disconnect the TV from the ethernet/wifi? Are these things connecting themselves to the network?

by lgl 7y ago

I'm probably missing something here but why not just disconnect the TV from the ethernet/wifi? Are these things connecting themselves to the network?

ygjb 7y ago

Many of them throw continuous error messages and warnings about connectivity, and some features just plain don't work without it.

DoofusOfDeath 7y ago
I believe you. That's part of the value proposition: the company would know the impact of their changes to various TV models, and you could factor that into your buying decision.

imglorp 7y ago

In theory, that's not enough to keep them offline, if coded deviously enough. If your neighbor, for example, has a syndicated WIFI like Fios or Xfinity, your TV can try those. Also, it has 24/7 free time to sit there and break passwords, if needed. Even a slow CPU would score some eventually. And finally, the room is probably full of other devices which themselves may have connections; a TV can communicate ultrasonically with those to exfiltrate your data. https://security.stackexchange.com/questions/113502/how-to-prevent-iot-devices-from-phoning-home-via-the-neighbors-wifi https://security.stackexchange.com/questions/113502/how-to-p... https://www.aircrack-ng.org https://www.aircrack-ng.org https://www.securityweek.com/stealthy-data-exfiltration-possible-headphones-speakers https://www.securityweek.com/stealthy-data-exfiltration-poss...

close04 7y ago
I don’t see a TV doing 24/7 password cracking. Most WiFi passwords are now relatively complex out of the box and a TV would never have a realistic chance of cracking one. And while collecting data is maybe immoral, hacking passwords is as illegal as it gets. It would be orders of magnitude cheaper and safer to build in 4G connectivity and use it to upload the relatively small payloads.
- imglorp 7y ago
  > build in 4G I wonder how many already have. Are we going to need a spectrum analyzer to watch this junk?
  - Animats 7y ago
    In the 5G era, probably. TVs will come with 5G connectivity built in and always on. At initial power-up, you'll have to log in with your "television provider". Like the way CBS online works now.
- bduerst 7y ago
  The TV wouldn't need to crack a password if it's an XFinity wifi router next door, for example. Those are typically open to all Comcast customers by default, if I remember correctly.
  - Grazester 7y ago
    How is your TV going to get onto a wifi connection that needs an Xfinity customer login(yes there are open to all customers as in they can use the wifi connection but not without supplying a login)?
    - Drakim 7y ago
      By striking a deal with Xfinity?
- rtkwe 7y ago
  Wouldn't even really need 4G, 3G or even lower would work if you're just sending text analytics of shows watched. Even the more nefarious spying efforts could go out through text if they bundled a speech to text converter on board.
  - close04 7y ago
    4G was more of a catch all for mobile connectivity. But actually some networks are turning off their 2G and 4G might have a better chance of working for years to come, since a TV is not really replaced that often.
mnm1 7y ago
We need laws to prevent this kind of shit. However, we have some laws already. If the TV is cracking passwords, who goes to jail? Oh, wait, I forgot laws like the CFAA and other shit like that are only enforced when regular people break them, not when companies break them to make money.

soylentcola 7y ago

I'd imagine a big part of this is because people like watching Netflix or Prime Video via the nifty apps built right into their TVs. To many owners, disabling those would be like disabling the cellular and WiFi radios on a smartphone. A big selling point (for better or worse) is not requiring you to buy more boxes or hook up wires. Just as you see with cheap IP cameras which neglect to steer users toward secure setup and only tout the "easy wireless setup! Just point to the picture on your iPhone screen!" It's the flip side of the ubiquitous marketing bullet points: Easy! No wires! Apps!

gkfasdfasdf 7y ago
> people like watching Netflix or Prime Video via the nifty apps built right into their TVs I fall into this camp - I really like using the physical remote w/physical buttons to play/pause/rewind, change volume, etc. I used to be a heavy chromecast user but switched for these reasons.