5 ms·

I could see this also becoming useful with Smart TVs. I don't want my TV to be having Ethernet-over-HDMI or other non-video/audio connection to any hardware tha

I could see this also becoming useful with Smart TVs. I don't want my TV to be having Ethernet-over-HDMI or other non-video/audio connection to any hardware that I connect to it (EG laptops). I'm not sure how much of a concern this is, but I don't trust the security of them, nor do I trust the manufacturers intent.

javajosh 4y ago
Oh I see, you're worried that the TV manufacturer could hack your laptop if you connect it via HDMI. This is the point at which I have to wonder: what on earth can HDMI do?? What is the vector? I assume you have to break out of the target driver, which is probably OS/version specific. Then I suppose normal hackery applies, in terms of planting something on the disk. I assume that the HDMI driver does NOT have any legit API for writing to arbitrary locations on disk. I assume.
- michaelmior 4y ago
  I know nothing about the HDMI spec, but according to other comments, Ethernet over HDMI is a thing. So in theory perhaps the TV could present itself as a network device and then MITM your traffic. Not sure if that's actually possible though.
nix0n 4y ago
This might not be adequate for keeping your TV off the Internet, they've been rumored to connect to unsecured WiFi.
- lancesells 4y ago
  Has anyone ever confirmed this? I did a search and only found a thread on HN asking the same question: https://news.ycombinator.com/item?id=25275350 https://news.ycombinator.com/item?id=25275350
  - netsharc 4y ago
    Feels like some beliefs like this are like the Korean superstition that leaving the fan on while you sleep will kill you.
    - closewith 4y ago
      In the UK, BBC vans drive around with unsecured WiFi networks to see if any houses have smart TVS connect, and then fine them if they don't have a TV licence.
      - kllrnohj 4y ago
        Source? That sounds both fascinating and fake.
        closewith 4y ago
        It was a joke, based on the alleged unlicensed TV detector vans that have roamed for decades and which are nothing more than a scare tactic to get people to pay the TV license. As of 2016, the BBC still claimed they work, though, even for non-TVs: > 1.37 The BBC’s final detection and enforcement option is its fleet of detection vans. Where the BBC still suspects that an occupier is watching live television but not paying for a licence, it can send a detection van to check whether this is the case. TVL detection vans can identify viewing on a non‐TV device in the same way that they can detect viewing on a television set. BBC staff were able to demonstrate this to my staff in controlled conditions sufficient for us to be confident that they could detect viewing on a range of non‐TV devices. From: https://www.nao.org.uk/wp-content/uploads/2016/07/British-Broadcasting-Corporation-Television-Licence-fee-Trust-Statement-for-the-Year-Ending-31-March-2016.pdf https://www.nao.org.uk/wp-content/uploads/2016/07/British-Br...
        techdragon 4y ago
        "TV Detection" is actually just a civilian use of Radiation Intelligence, the kind of RF emanation that the USA has the entire TEMPEST hardening requirements https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) in order to prevent nation state attackers from being able to snoop data from their electronic equipment. This is a very real security principle and plenty of demonstrations out there to show how much information can be leaked from unshielded systems. You can check out gr-tempest which uses modern software defined radio hardware https://github.com/git-artes/gr-tempest https://github.com/git-artes/gr-tempest. You can see pretty good demo of it here https://old.reddit.com/r/RTLSDR/comments/q59ofn/i_was_finally_able_to_get_grtempest_working_with/ https://old.reddit.com/r/RTLSDR/comments/q59ofn/i_was_finall... The basic truth is that over time it got harder and harder to build "simple" detectors to work out if people were using their TVs to watch the BBC (and this is the tricky part, a valid argument is "I don't watch the BBC", so they need to detect BBC channels being displayed on the TV and not detect other channels) and so it gradually became a less and less directly useful tool for the license enforcement teams to use, so it has sort of transformed from a genuine relatively accurate tool that doesn't need too much equipment, into a sort of mythical boogeyman that gets used to scare people into paying for the license, potentially backed up by cutting edge signals intelligence type equipment to occasionally prove it can be done and maintain the story. The wikipedia article is actually pretty good for explaining how the older detection mechanisms worked https://en.wikipedia.org/wiki/TV_detector_van#Detection_techniques https://en.wikipedia.org/wiki/TV_detector_van#Detection_tech...
kllrnohj 4y ago
Nothing uses Ethernet-over-HDMI. It doesn't actually exist outside of a spec proposal. Even though in theory it'd be really cool. Imagine if your receiver could also be the network switch for all the devices. I'd actually pay money for such a thing. But, yeah, not actually a thing it turns out. So you definitely don't need to worry about your smart TV using it any time soon.
- Uehreka 4y ago
  It would be super silly and probably against every spec ever written, but I’d love to be able to plug a digital signage Raspberry Pi into a TV and not need any other cables thanks to Power-over-Ethernet-over-HDMI.
  - asojfdowgh 4y ago
    on the flip side, USBC does all 3, so the future is already here! RPi4 should support power and network through its usbc plug, however you'll still need another cable for video currently. the frame.work "SBC" would allow all 3 through the same connector, but, you'll be looking at ~400+ per SBC just to achieve this, but the key thing is, its 100% doable if you get the hardware combination right
    - andrewaylett 4y ago
      The RPi might not quite manage it, but any USB-C Mac and many Windows machines can. Maybe. Just make sure you know whether you're expecting to use Thunderbolt over USB-C or USB-C alt modes, and make sure you're within the power budget of a PoE -> USB-PD adapter. And I suspect you'll need to fudge the monitor power supply somehow too. The different bits will locally need a number of wires to join them together, but you might manage to run the whole thing off a single ethernet cable.
- alerighi 4y ago
  It would be super convenient to avoid having a mess of cables and a switch behind your TV, or having to use Wi-Fi, that has its limitations, especially these days with higher and higher bitrates.

javajosh 4y ago

Oh I see, you're worried that the TV manufacturer could hack your laptop if you connect it via HDMI. This is the point at which I have to wonder: what on earth can HDMI do?? What is the vector? I assume you have to break out of the target driver, which is probably OS/version specific. Then I suppose normal hackery applies, in terms of planting something on the disk. I assume that the HDMI driver does NOT have any legit API for writing to arbitrary locations on disk. I assume.

michaelmior 4y ago
I know nothing about the HDMI spec, but according to other comments, Ethernet over HDMI is a thing. So in theory perhaps the TV could present itself as a network device and then MITM your traffic. Not sure if that's actually possible though.

nix0n 4y ago

This might not be adequate for keeping your TV off the Internet, they've been rumored to connect to unsecured WiFi.

lancesells 4y ago
Has anyone ever confirmed this? I did a search and only found a thread on HN asking the same question: https://news.ycombinator.com/item?id=25275350 https://news.ycombinator.com/item?id=25275350
- netsharc 4y ago
  Feels like some beliefs like this are like the Korean superstition that leaving the fan on while you sleep will kill you.
  - closewith 4y ago
    In the UK, BBC vans drive around with unsecured WiFi networks to see if any houses have smart TVS connect, and then fine them if they don't have a TV licence.
    - kllrnohj 4y ago
      Source? That sounds both fascinating and fake.
      - closewith 4y ago
        It was a joke, based on the alleged unlicensed TV detector vans that have roamed for decades and which are nothing more than a scare tactic to get people to pay the TV license. As of 2016, the BBC still claimed they work, though, even for non-TVs: > 1.37 The BBC’s final detection and enforcement option is its fleet of detection vans. Where the BBC still suspects that an occupier is watching live television but not paying for a licence, it can send a detection van to check whether this is the case. TVL detection vans can identify viewing on a non‐TV device in the same way that they can detect viewing on a television set. BBC staff were able to demonstrate this to my staff in controlled conditions sufficient for us to be confident that they could detect viewing on a range of non‐TV devices. From: https://www.nao.org.uk/wp-content/uploads/2016/07/British-Broadcasting-Corporation-Television-Licence-fee-Trust-Statement-for-the-Year-Ending-31-March-2016.pdf https://www.nao.org.uk/wp-content/uploads/2016/07/British-Br...
        techdragon 4y ago
        "TV Detection" is actually just a civilian use of Radiation Intelligence, the kind of RF emanation that the USA has the entire TEMPEST hardening requirements https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) in order to prevent nation state attackers from being able to snoop data from their electronic equipment. This is a very real security principle and plenty of demonstrations out there to show how much information can be leaked from unshielded systems. You can check out gr-tempest which uses modern software defined radio hardware https://github.com/git-artes/gr-tempest https://github.com/git-artes/gr-tempest. You can see pretty good demo of it here https://old.reddit.com/r/RTLSDR/comments/q59ofn/i_was_finally_able_to_get_grtempest_working_with/ https://old.reddit.com/r/RTLSDR/comments/q59ofn/i_was_finall... The basic truth is that over time it got harder and harder to build "simple" detectors to work out if people were using their TVs to watch the BBC (and this is the tricky part, a valid argument is "I don't watch the BBC", so they need to detect BBC channels being displayed on the TV and not detect other channels) and so it gradually became a less and less directly useful tool for the license enforcement teams to use, so it has sort of transformed from a genuine relatively accurate tool that doesn't need too much equipment, into a sort of mythical boogeyman that gets used to scare people into paying for the license, potentially backed up by cutting edge signals intelligence type equipment to occasionally prove it can be done and maintain the story. The wikipedia article is actually pretty good for explaining how the older detection mechanisms worked https://en.wikipedia.org/wiki/TV_detector_van#Detection_techniques https://en.wikipedia.org/wiki/TV_detector_van#Detection_tech...

kllrnohj 4y ago

Nothing uses Ethernet-over-HDMI. It doesn't actually exist outside of a spec proposal. Even though in theory it'd be really cool. Imagine if your receiver could also be the network switch for all the devices. I'd actually pay money for such a thing. But, yeah, not actually a thing it turns out. So you definitely don't need to worry about your smart TV using it any time soon.

Uehreka 4y ago
It would be super silly and probably against every spec ever written, but I’d love to be able to plug a digital signage Raspberry Pi into a TV and not need any other cables thanks to Power-over-Ethernet-over-HDMI.
- asojfdowgh 4y ago
  on the flip side, USBC does all 3, so the future is already here! RPi4 should support power and network through its usbc plug, however you'll still need another cable for video currently. the frame.work "SBC" would allow all 3 through the same connector, but, you'll be looking at ~400+ per SBC just to achieve this, but the key thing is, its 100% doable if you get the hardware combination right
  - andrewaylett 4y ago
    The RPi might not quite manage it, but any USB-C Mac and many Windows machines can. Maybe. Just make sure you know whether you're expecting to use Thunderbolt over USB-C or USB-C alt modes, and make sure you're within the power budget of a PoE -> USB-PD adapter. And I suspect you'll need to fudge the monitor power supply somehow too. The different bits will locally need a number of wires to join them together, but you might manage to run the whole thing off a single ethernet cable.
alerighi 4y ago
It would be super convenient to avoid having a mess of cables and a switch behind your TV, or having to use Wi-Fi, that has its limitations, especially these days with higher and higher bitrates.