7 ms·
Ask HN: Has anyone seen smart TVs connect to unsecured WiFi without permission?
In IT circles I've noticed that whenever there's any discussion around Smart TVs, someone will usually say they buy a Monitor or Digital Signage TV instead as they don't have smart features.
This would be to avoid adverts, viewing habit tracking via content ID tracking or just running software without security updates on your network.
And inevitably someone will say that they'd heard that Smart TVs will connect to unsecured WiFi networks in proximity and start uploading your data.
This seems like something worth reporting to regulatory authorities at least. And also would be quite interesting to understand how it works.
But I've never heard of any specifics.
Like what brand does this? What data is it trying to send?
It's easy to spoof a public hotspot and then at least identify what domains it tries to connect to.
Failing that there might be information gleaned from wireshark.
- blowfish721 6y agoI’m curious about this one as well. However I quite fear that if they do then they will switch to 5G for newer models which will be more of a PITA to avoid.
- irjustin 6y agoHoly crap I didn't know manufacturers were looking at this. Quick search shows, of course, Huawei to release a 5G TV. How expected...
- bhickey 6y agoAlong these lines, has anyone ripped the WiFi module out of their television? I'd gladly take a soldering iron to mine to ensure it won't phone home.
- mszcz 6y agoIt's not always that easy I think. My LG TV has a Bluetooth remote and I know for a fact that it has a single WiFi / Bluetooth connectivity module (because it crapped out on me recently). Removing the module would render the remote and the TV unusable.
- ckocagil 6y agoThere's probably still an external or PCB antenna. Wrapping it in aluminum foil should do the trick.
- Nextgrid 6y agoConnecting it to ground would be better. If the aluminium foil is only around the antenna and/or connected to the antenna this might not be enough or might even improve the antenna.
- steerablesafe 6y agoIf the wifi module is soldered on the main board then I think the best thing one can do is to break the lines near the antenna pins of the wifi chip and terminate it with a suitable resistor.
- MaxBarraclough 6y agoRelated to this, where would this stand legally if your device automatically connected to your neighbour's network? In the UK, you can be arrested for unauthorised use of a Wi-Fi network, under our Computer Misuse Act law. [0] I think this would be unlikely if the network was wide open, but I believe it could still happen in principle. edit I missed this from the linked article. Looks like you can't be arrested for accidentally using an unsecured Wi-Fi network. > If the network was hacked then a crime has been committed, but our friends over at Out-Law.com confirm that connecting to the wrong network by mistake is not a crime [0] https://www.theregister.com/2008/10/30/wi_fi_arrest/ https://www.theregister.com/2008/10/30/wi_fi_arrest/
- gnfargbl 6y ago> Looks like you can't be arrested for accidentally using an unsecured Wi-Fi network. You probably haven't committed a crime if you accidentially use an unsecured Wi-Fi network, but if you deliberately use one then the situation is less clear. Section 1 of the CMA (https://www.legislation.gov.uk/ukpga/1990/18/section/1 https://www.legislation.gov.uk/ukpga/1990/18/section/1) requires only that you "[cause] a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured," that "the access [you intend] to secure, or to enable to be secured, is unauthorised" and that you "[know] at the time [you cause] the computer to perform the function that that is the case." How does a law so broadly worded translate to technical reality? Many of us in the industry don't really know, and as a result feel that the UK's computer misuse laws really are crying out for reform. See https://www.cyberupcampaign.com/ https://www.cyberupcampaign.com/ for more.
- exdsq 6y agoYeah, the Computer Misuse Act requires mens rea of intending to access a computer you know you shouldn't.
- matthewmacleod 6y agoI am pretty sceptical of this specific rumour and I suspect it's an urban legend. But regardless of that… it's totally plausible that a manufacturer could end up doing this, and as such it presents a risk vector. I can even see how it might be done semi-accidentally by a bad engineering team. An even bigger risk is corporate-owned mesh networks, like Amazon Sidewalk. It's quite possible that TVs with Alexa support will end up also having access to this network, and will use your neighbour's Echo to ship data back even without you knowing. Or even a built-in LTE/5G transceiver. Without strong regulation of privacy and consent, this will be a persistent and dangerous issue.
- croon 6y ago> I can even see how it might be done semi-accidentally by a bad engineering team. I can totally see this being done as a "usability" feature.
- girvo 6y agoAutomated telemetry, noticed by the marketing department, scooped up an analysed is how I usually picture it.
- oDot 6y ago> Without strong regulation of privacy and consent, this will be a persistent and dangerous issue. It won't be a dangerous issue because no one can force a TV inside your house/office. Meanwhile leave the rest of us the option to make this trade-off
- girvo 6y agoMy ability to watch content produced by one company should not be impinged upon because I don’t consent to frankly gross privacy violations by another entirely unrelated company. This is exactly what regulation is for. Privacy should be protected. You and I can make this trade-off. My parents? They don’t. We protect those who aren’t well versed in a topic through regulation for this reason.
- willcipriano 6y agoI believe the courts have ruled that it is still considered unauthorized access even if the target doesn't make any attempt to defend themselves (see the AT&T hack). However I wouldn't hold my breath that it would be prosecuted that way.
- randallsquared 6y agoAny charges would be brought against the device's purchaser, wouldn't it? It would be up to the owner to choose to sue the manufacturer of the product. IANAL, ofc.
- salawat 6y agoNot that my gut counts for anything, but most prosecutors unless they're just trying to make an example of someone in particular would not be wise making that assertion I think, because they'd have to pin it on the customer doing it intentionally. I'm not a lawyer, nor is this legal advice but I'd think the manufacturer that actually controls the implementation details would be a far juicier target. Otherwise, precedent would be set such that every user of that model Television would potentially be another offender waiting to caatch tge eye of law enforcement to jave a token charge thrown at them. Just seems like a massive anti-pattern to me.
- bluGill 6y agoAny lawyer who looks at taking this to court will notice that the manufacture has much bigger pocketbooks and so will do everything he can to sue the manufacture if it all possible. Getting a minimal judgement against your average "living paycheck to paycheck" person on the street isn't worth your time in court. However it is "easy" to update that to a class action lawsuit against a manufacture where the average man on the street gets $5 and you take home big money.
- fock 6y agoCan recommend the digital signage route (there's not a lot of opionions on that written down. At least I found no reviews/forum posts at all...). Got mine (Samsung QM49N) from an Amazon-clearance sale (marked down 50% - apparently they couldn't successfully break existing supply chains this iteration). Initially I was a little bit worried that it might have really bad black levels/image quality, given that it's rated for 24/7 and 500cm/m² of backlight brightness and the fact they offer a "plain" TV-like model for a little bit less. I was pleasantly suprised that these fears were unfounded and you can even adjust the actual backlight (most TVs will do this dynamically and so have fun in your sunny living room...) and it has really great viewing angles (for VA. I own a 32" VA-display as well ...). I'd say picture quality is on par, if not better than most of what I could have gotten at a similar price point (remember price was reduced from €800 to €400) and compares okish to the €900€ TV of relatives (the latter has less banding (and yes, every TV in the 3-digit range has groce banding)) So: if you see a digital-signage display marked down and are shopping for a TV (without nuisances and inbuilt-tuner). Try it. It might be a really nice experience!
- amiga-workbench 6y agoYep, I've had a much similar experience with digital signage displays. I bought a few NEC displays cheap for my old office and the picture quality is excellent. Even the no-name OEM displays I bought second hand were acceptable with solid viewing angles and colour reproduction. When my 15 year old Sony Bravia finally kicks the bucket I have my eye on a 55" 4k Iiyama commercial display to replace it. I made the mistake of buying a 2015 Sony Bravia Android TV for upstairs and it is an utterly painful experience, I don't think I've used it in nearly 8 months now. https://www.iiyama-monitors.co.uk/products/monitors/le5540uhs-b1 https://www.iiyama-monitors.co.uk/products/monitors/le5540uh...
- crtasm 6y ago> Samsung QM49N Great to hear of a model with multiple inputs (2xHDMI 2.0, 1xDVI-D/Displayport 1.2), a quick look at signage screens earlier this year only brought up ones with a single HDMI.
- 6y ago
- ffpip 6y agoI also remember reading something on r/pihole about Amazon Echo connecting to open networks. The mods took it down then as unrelated. Can't find it now. Also > And also would be quite interesting to understand how it works. What do you mean how it works? If network=open, connect and start uploading.
- dastx 6y ago> What do you mean how it works? If network=open, connect and start uploading. Except an open network does not mean there's an actual internet connection. Specifically, most "open" networks, require going through a portal to gain access, and while that used to be easy to bypass, it's not so trivial anymore as network admins have gotten wind of the issues.
- swiley 6y agoThey probably let port 53 through.
- oAlbe 6y agoI always read about the DSTVs and Monitors arguments, and every time I see it mentioned I go search for somewhere online where I could buy one (or at least look at some). But every time is a disappointment. All I can ever find is showcase pages from NEC or sellers in the US where you'd have to buy them in bulk. Is there anywhere that ships to the EU (possibly IN the EU) where I could go take a look and buy one of those DSTVS?
- alexandrerond 6y agoI rebooted my router yesterday while watching something. My Amazon Fire stick, upon losing connection with the default wlan, automatically connected to an available, unencrypted Vodafone hotspot from nearby and automatically showed a popup window offering me the different connection options in the middle of the movie. Shady and creepy as hell.
- spydum 6y agoI think amazon offers a mechanism on your Amazon linked devices of sharing wifi credentials. If you had ever fired up an amazon fire tablet or something and connected to that hotspot, the fire STICK may have accessed the wireless history and assumed it was yours to connect to.
- alexandrerond 6y agoNo, I never connected to this hotspot that I know of. In Germany Vodafone automatically enables their hotspots on the routers of people.
- chewxy 6y agoAmazon Sidewalk enabled?
- stevehawk 6y agomost likely just amazon doing what everyone else does and storing your wifi history and password in the cloud under your account. so as you switch/add devices it's easier to setup
- thatguy0900 6y agohttps://www.amazon.com/Amazon-Sidewalk/ https://www.amazon.com/Amazon-Sidewalk/
- alexandrerond 6y agoNever used
- 6y ago
- mrleiter 6y agoI recently bought a Samsung Smart TV (they simply offer good value for such a little price). Best thing to do is to never even start connecting it to a WiFi network and use an external TV receiver. That way it most certainly will not connect to any network whatsoever. I also never agreed to any terms that are on the start display, which may also add to that. Just switch to your Input channel (external device etc..) and enjoy your "dumb" TV.
- tonyedgecombe 6y agothey simply offer good value for such a little price That's the root of the problem isn't it. Unrelenting pressure on margins forces these companies to look elsewhere for revenue.
- girvo 6y agoThough even the highest end TVs have these sorts of “features” built in, so it can’t be that simple
- Dahoon 6y ago>Best thing to do is to never even start connecting it to a WiFi network That won't stop the issue mentioned here about it connecting by itself (not that I personally believe it will).
- ExcavateGrandMa 6y agoI suspect My ISP router to have aircrack embedded... My personal router got scanned by the ISP router... dunno what to assume with this now... :Ð It's like trapped at every turn :D Friendly yours.
- tjpnz 6y agoSeems like a great way of creating plausible deniability by those caught doing nefarious things (assuming the case was already weak enough).
- davb 6y agoI think a bigger risk is a partnership with something Amazon Sidewalk, where it won't be the increasingly rare unencrypted suburban WiFi AP you need to worry about but rather your neighbours digital assistant, speaker, lightbulbs, etc.
- wil421 6y agoI call BS on anyone who claims a TV is using HDMI over Ethernet or some hidden LTE connection. When I bought my Sony TV I had no idea it was an Android TV until afterwards. I’ve never connected it to my WiFi and it’s never connected up updated itself. I can easily monitor everyone connected to my network. Consumer Reports has a great article if anyone is interested. https://www.consumerreports.org/privacy/how-to-turn-off-smart-tv-snooping-features/ https://www.consumerreports.org/privacy/how-to-turn-off-smar...
- bofh23 6y agoDo you mean Ethernet over HDMI? Even though there was a standard and special HDMI cables that claimed compatibility, I don’t think any devices actually implemented it. Well perhaps one device according to this security paper[1] which basically means it’s useless. I control access by connecting a Samsung TV to my Ethernet network but keep it configured to use WiFi most of the time. I’ve never entered a WiFi password so the network is effectively disconnected until I configure the TV to use the wired connection. The TV prompts me to use the wired connection when I reboot my router and the link drops and comes back up but I can cancel switching to wired at that point. [1]: What the HEC? Security implications of HDMI Ethernet Channel and other related protocols Andy Davis, Research Director NCC Group https://research.nccgroup.com/wp-content/uploads/2020/07/44con_hdmi_ethernet_channel_andy_davis_ncc_group_slides.pdf https://research.nccgroup.com/wp-content/uploads/2020/07/44c...
- RHSeeger 6y agoHere is a report of a Samsung television connecting to the neighbor's passwordless wifi https://forum.developer.samsung.com/t/if-you-choose-to-not-connect-your-samsung-smart-tv-to-wifi-it-will-secretly-connect-to-your-neighbours-passwordless-wifi/7926 https://forum.developer.samsung.com/t/if-you-choose-to-not-c...
- dyingkneepad 6y agoI only have N=1, but I know my LG TV doesn't do that, given how my child loves to grab the TV remote and press the Netflix or Hulu buttons, which opens the app and then complains the TV has no internet access.
- yencabulator 6y agoThe topic is analytics, not video streaming.