3 ms·

What sucks is that none of this will work once the manufacturers figure out DoH.

by somat 5y ago

deleted 5y ago
[deleted]
1MachineElf 5y ago
FWIW, AdGuard is a Pi-Hole alternative, and it has DoH blocking.
- margana 5y ago
  How would it work to block some addresses and not others though? Only way I can think of is to block all DoH traffic, and hope it falls back to conventional DNS, and then selectively block that. If there is no fallback, you might as well disconnect it from the internet, the effect will be the same.
KerrAvon 5y ago
Are the number of people who do this numerous enough for them to make the effort? (edited to add) I feel like the real problem will be when they start adding wireless connectivity that you can't disable. I can keep my LG off the network today by refusing to configure networking for it. I can't do that if it doesn't use/require my network...
- burnt_toast 5y ago
  I was bored a few months ago and opened up my samsung tv to see if I could unhook the wifi antennas. Turns out there wasn't actually any in there but I was able to desolder the wifi chip. It was a small separate board mounted by 8 or so pins off the motherboard that I had to use low temp solder on. TV still works (minus the streaming services). If you try to open the network settings the screen just shows a loading icon indefinitely.
  - tartoran 5y ago
    Would just not giving the TV access to wifi be enough or is it constantly bugging you with pop ups?
    - Nextgrid 5y ago
      Some people might be paranoid that the TV would automatically connect to any unencrypted Wi-Fi in range, but I think it's an urban legend as I've never seen it properly demonstrated and documented.
  - QuarterReptile 5y ago
    People so often fail to remember this as an option. I once wanted an Android device for listening to podcasts at the gym, but the device couldn't have any cameras or radios or microphones because of the gym's policy. I just popped it open, unsnapped a few connections, and problem solved.
  - Nextgrid 5y ago
    You got very lucky that the lack of expected hardware didn't crash the boot process. If anyone is considering doing this, I'd suggest tampering with the analog part of the wireless radio instead, so that the OS still sees a Wi-Fi chip, just that it's no longer able to receive anything.
- Nextgrid 5y ago
  > I feel like the real problem will be when they start adding wireless connectivity that you can't disable This gets raised all the time but I just don't see it being necessary - the vast majority is happy to voluntarily provide it with an internet connection. The ones like us who fight it is a very small minority not worth spending on including cellular modems (& the associated data plan) in every TV.
k4ch0w 5y ago
They would need to have a fallback in case people block DoH. I think this is way further out than people may realize. I've done pentesting in a lot of different office networks and 53/UDP is open for all, but not 443/TCP unless you're a known device.
- somat 5y ago
  Can you reliably block DoH? I guess if you can figure out the DoH endpoint someone is using you can block that. On 443 blocking: Doesn't that defeat the purpose of having a "smart" streaming tv. If you are willing to blanket deny 443 you might as well just block the whole address and turn it into a dumb tv. And on that note. I have set up unsecured wifi access points before and seen the neighborhood samsung tvs eagerly use it to send their nefarious spyware payload.
- 1over137 5y ago
  >They would need to have a fallback in case people block DoH. How do you block DoH?
  - danielheath 5y ago
    Block port 443 and configure machines to use an http proxy with a cert installed?
    - RedShift1 5y ago
      The 90's called, they want their technology back >:-(
      - 0x0000000 5y ago
        Zscaler is a multi-billion dollar company, and the comment you replied to basically describes their primary product. Cloudflare now has a Secure Web Gateway product. So does VMware, and Cisco, and just about any networking/security vendor who is trying to make a play in the "SASE" space. Hate to say it, but invisible TLS-intercepting proxies are more widely used today than they were in the 90s.
collsni 5y ago
time to do tls inspection at home... but wait you cant install certs on a smart tv..... im telling you these non-standard unrootable bricks companies keep creating needs to stop. need to balance security and right to own your own device!! let alone enviromental considerations.

What sucks is that none of this will work once the manufacturers figure out DoH.

by somat 5y ago

What sucks is that none of this will work once the manufacturers figure out DoH.

deleted 5y ago

[deleted]

1MachineElf 5y ago

FWIW, AdGuard is a Pi-Hole alternative, and it has DoH blocking.

margana 5y ago
How would it work to block some addresses and not others though? Only way I can think of is to block all DoH traffic, and hope it falls back to conventional DNS, and then selectively block that. If there is no fallback, you might as well disconnect it from the internet, the effect will be the same.

KerrAvon 5y ago

Are the number of people who do this numerous enough for them to make the effort? (edited to add) I feel like the real problem will be when they start adding wireless connectivity that you can't disable. I can keep my LG off the network today by refusing to configure networking for it. I can't do that if it doesn't use/require my network...

burnt_toast 5y ago
I was bored a few months ago and opened up my samsung tv to see if I could unhook the wifi antennas. Turns out there wasn't actually any in there but I was able to desolder the wifi chip. It was a small separate board mounted by 8 or so pins off the motherboard that I had to use low temp solder on. TV still works (minus the streaming services). If you try to open the network settings the screen just shows a loading icon indefinitely.
- tartoran 5y ago
  Would just not giving the TV access to wifi be enough or is it constantly bugging you with pop ups?
  - Nextgrid 5y ago
    Some people might be paranoid that the TV would automatically connect to any unencrypted Wi-Fi in range, but I think it's an urban legend as I've never seen it properly demonstrated and documented.
- QuarterReptile 5y ago
  People so often fail to remember this as an option. I once wanted an Android device for listening to podcasts at the gym, but the device couldn't have any cameras or radios or microphones because of the gym's policy. I just popped it open, unsnapped a few connections, and problem solved.
- Nextgrid 5y ago
  You got very lucky that the lack of expected hardware didn't crash the boot process. If anyone is considering doing this, I'd suggest tampering with the analog part of the wireless radio instead, so that the OS still sees a Wi-Fi chip, just that it's no longer able to receive anything.
Nextgrid 5y ago
> I feel like the real problem will be when they start adding wireless connectivity that you can't disable This gets raised all the time but I just don't see it being necessary - the vast majority is happy to voluntarily provide it with an internet connection. The ones like us who fight it is a very small minority not worth spending on including cellular modems (& the associated data plan) in every TV.

k4ch0w 5y ago

They would need to have a fallback in case people block DoH. I think this is way further out than people may realize. I've done pentesting in a lot of different office networks and 53/UDP is open for all, but not 443/TCP unless you're a known device.

somat 5y ago
Can you reliably block DoH? I guess if you can figure out the DoH endpoint someone is using you can block that. On 443 blocking: Doesn't that defeat the purpose of having a "smart" streaming tv. If you are willing to blanket deny 443 you might as well just block the whole address and turn it into a dumb tv. And on that note. I have set up unsecured wifi access points before and seen the neighborhood samsung tvs eagerly use it to send their nefarious spyware payload.
1over137 5y ago
>They would need to have a fallback in case people block DoH. How do you block DoH?
- danielheath 5y ago
  Block port 443 and configure machines to use an http proxy with a cert installed?
  - RedShift1 5y ago
    The 90's called, they want their technology back >:-(
    - 0x0000000 5y ago
      Zscaler is a multi-billion dollar company, and the comment you replied to basically describes their primary product. Cloudflare now has a Secure Web Gateway product. So does VMware, and Cisco, and just about any networking/security vendor who is trying to make a play in the "SASE" space. Hate to say it, but invisible TLS-intercepting proxies are more widely used today than they were in the 90s.

collsni 5y ago

time to do tls inspection at home... but wait you cant install certs on a smart tv..... im telling you these non-standard unrootable bricks companies keep creating needs to stop. need to balance security and right to own your own device!! let alone enviromental considerations.