5 ms·

What's frightening is that I can see on my PiHole the huge spike of requests that happens when one of my TVs comes on. Just the standard graph in the front page

What's frightening is that I can see on my PiHole the huge spike of requests that happens when one of my TVs comes on. Just the standard graph in the front page is enough to see exactly when the kids have turned it on. Most of the requests are rejected though, maybe someone can say whether that is enough to protect me from corporate surveillance.

beckler 5y ago
Dude, no joke. My TCL Roku TV is the nosiest device on my whole network, second to maybe my work laptop. The difference though, is that TV is sitting in our bedroom mostly dormant, since my wife watches it maybe 1-4 times a week while she's getting ready for work.
contravariant 5y ago
Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance. Assuming of course you are using it as a truly 'dumb' TV and not as a client for Netflix etc.
- mschuster91 5y ago
  > Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance. That won't protect against DNS data exfiltration. Extremely low-bandwidth, but works in a lot of cases - people have even written proxy servers to get slow but working Internet on public hotspots that normally require login.
  - ezfe 5y ago
    How does that work if you block the internet at the router level?
    - mschuster91 5y ago
      Simple: most router firewalls only block traffic that has source:<IP of device> and destination:<anything in the Internet>, but traffic from source:<IP of device> to destination:<IP of router, IP range of home network> will be allowed. That is enough for the device to emit a DNS query like "pbs.12345.metricservice.example.com" to notfiy some tracking service that the device with serial 12345 just switched to a channel labeled "PBS". The router will resolve that name record at the DNS server for metricservice.example.com, which gets the request and logs it away.
      - chrisjc 5y ago
        Are you suggesting that devices connected to a network that has blocked their MAC can still make DNS requests?
        mschuster91 5y ago
        How many consumer routers go that length? For most of these, as long as they are on the network, they can communicate over DNS, using the router as "middleman".
- Markoff 5y ago
  wouldn't be easier just not set internet connection in first place? I don't think TV can hack into secure WiFi network
  - tjpnz 5y ago
    If they did it sounds like a great way for someone doing something nefarious to get off the hook. Some smart TVs are even able to act as wireless access points.
  - pnutjam 5y ago
    Give it an IP with no gateway, or a bad gateway.
  - scns 5y ago
    They have been caught trying to connect to unsecured WiFi before.
    - rosndo 5y ago
      I bet you aren’t going to be able to provide a source for this.
      - seanw444 5y ago
        Even if not, it's only a matter of time before it does happen. Not an if.
        doldols 5y ago
        I suppose the same can be said about your TV turning into a sentient killer robot.
      - emendation 5y ago
        > I bet you aren’t going to be able to provide a source for this. They can't, but I do have this saved https://web.archive.org/web/20191224122714/https://www.reddit.com/r/security/comments/bpjky4/worried_about_your_smart_tv_listening_in_simply/ https://web.archive.org/web/20191224122714/https://www.reddi...
qwertox 5y ago
It may be enough for that TV, but many devices have a custom-set DNS address and ignore the one given through DHCP, unless you set up a firewall where you block that address, then they fall back to using the one provided via DHCP. That's how Chromecast and Amazon devices are doing it.
- yardstick 5y ago
  DoH / DoT DNS privacy and security works both for and against individual users. It definitely works against network owners and operators.
  - JohnFen 5y ago
    This is why I had to set up a MITM to detect and drop DoH/DoT requests. Allowing devices and applications to evade my network management is crazy to me.
    - MandieD 5y ago
      Have you written about how you did this anywhere, or do you not want to tip off "the other side"?
Havoc 5y ago
Not just TVs...I can see my freaking lightbulbs in my pihole charts. What a time to be alive.
- MiddleEndian 5y ago
  Why give your TV and light bulbs network access in the first place?
  - Havoc 5y ago
    They need to be on the LAN so that Home Assistant can talk to them for automation. They're firewalled off & the call home address is blocked on pihole No TV in my case.
- chrisjc 5y ago
  I get that light-bulbs need to connect to receive control commands and get firmware updates, but I'm wondering what other things might there be to worry about here? Collecting usage data, sure... Amazon Sidewalk has been brought up a couple of times in this thread and it's got me thinking about how others could also bring up similar ambient/background networks that piggyback off your main network. If this were to happen, then your TVs and other devices wouldn't even need permission to connect to your main network and instead go through one of the many ambient/background networks. Perhaps there's good reason to only use zwave and zigbee smart devices instead of wifi ones.
- dunefox 5y ago
  Light bulbs?!

beckler 5y ago

Dude, no joke. My TCL Roku TV is the nosiest device on my whole network, second to maybe my work laptop. The difference though, is that TV is sitting in our bedroom mostly dormant, since my wife watches it maybe 1-4 times a week while she's getting ready for work.

contravariant 5y ago

Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance. Assuming of course you are using it as a truly 'dumb' TV and not as a client for Netflix etc.

mschuster91 5y ago
> Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance. That won't protect against DNS data exfiltration. Extremely low-bandwidth, but works in a lot of cases - people have even written proxy servers to get slow but working Internet on public hotspots that normally require login.
- ezfe 5y ago
  How does that work if you block the internet at the router level?
  - mschuster91 5y ago
    Simple: most router firewalls only block traffic that has source:<IP of device> and destination:<anything in the Internet>, but traffic from source:<IP of device> to destination:<IP of router, IP range of home network> will be allowed. That is enough for the device to emit a DNS query like "pbs.12345.metricservice.example.com" to notfiy some tracking service that the device with serial 12345 just switched to a channel labeled "PBS". The router will resolve that name record at the DNS server for metricservice.example.com, which gets the request and logs it away.
    - chrisjc 5y ago
      Are you suggesting that devices connected to a network that has blocked their MAC can still make DNS requests?
      - mschuster91 5y ago
        How many consumer routers go that length? For most of these, as long as they are on the network, they can communicate over DNS, using the router as "middleman".
Markoff 5y ago
wouldn't be easier just not set internet connection in first place? I don't think TV can hack into secure WiFi network
- tjpnz 5y ago
  If they did it sounds like a great way for someone doing something nefarious to get off the hook. Some smart TVs are even able to act as wireless access points.
- pnutjam 5y ago
  Give it an IP with no gateway, or a bad gateway.
- scns 5y ago
  They have been caught trying to connect to unsecured WiFi before.
  - rosndo 5y ago
    I bet you aren’t going to be able to provide a source for this.
    - seanw444 5y ago
      Even if not, it's only a matter of time before it does happen. Not an if.
      - doldols 5y ago
        I suppose the same can be said about your TV turning into a sentient killer robot.
    - emendation 5y ago
      > I bet you aren’t going to be able to provide a source for this. They can't, but I do have this saved https://web.archive.org/web/20191224122714/https://www.reddit.com/r/security/comments/bpjky4/worried_about_your_smart_tv_listening_in_simply/ https://web.archive.org/web/20191224122714/https://www.reddi...

qwertox 5y ago

It may be enough for that TV, but many devices have a custom-set DNS address and ignore the one given through DHCP, unless you set up a firewall where you block that address, then they fall back to using the one provided via DHCP. That's how Chromecast and Amazon devices are doing it.

yardstick 5y ago
DoH / DoT DNS privacy and security works both for and against individual users. It definitely works against network owners and operators.
- JohnFen 5y ago
  This is why I had to set up a MITM to detect and drop DoH/DoT requests. Allowing devices and applications to evade my network management is crazy to me.
  - MandieD 5y ago
    Have you written about how you did this anywhere, or do you not want to tip off "the other side"?

Havoc 5y ago

Not just TVs...I can see my freaking lightbulbs in my pihole charts. What a time to be alive.

MiddleEndian 5y ago
Why give your TV and light bulbs network access in the first place?
- Havoc 5y ago
  They need to be on the LAN so that Home Assistant can talk to them for automation. They're firewalled off & the call home address is blocked on pihole No TV in my case.
chrisjc 5y ago
I get that light-bulbs need to connect to receive control commands and get firmware updates, but I'm wondering what other things might there be to worry about here? Collecting usage data, sure... Amazon Sidewalk has been brought up a couple of times in this thread and it's got me thinking about how others could also bring up similar ambient/background networks that piggyback off your main network. If this were to happen, then your TVs and other devices wouldn't even need permission to connect to your main network and instead go through one of the many ambient/background networks. Perhaps there's good reason to only use zwave and zigbee smart devices instead of wifi ones.
dunefox 5y ago
Light bulbs?!