14 ms·

LG Smart TVs log USB filenames and viewing info to LG servers

297 points by Amadou 13y ago

Spearchucker 13y ago
How can't it be disabled? It needs a network connection to do that. I imagine there is a use case compelling enough to encourage the user to hook it up (YouTube?) but I doubt it has satcoms. Sooo... just don't configure the network. That notwithstanding, I see boxes like Apple TV and Xbox One becoming the way that people interact with their TVs, making the whole problem somewhat moot anyway.
- primelens 13y ago
  Isn't network connectivity kind of the point of a smart tv?
  - pja 13y ago
    Yes, but reporting back every program you choose to watch to the TV manufacturer certainly isn't. Naturally they bury this little fact deep in the T&Cs where you won't even get to read it until you get the TV home, and who reads T&Cs? Almost nobody & the LG knows it. How well do you think this TV would sell if they had to emblazon "This TV will report what you watch to LG so that they can sell that information to anyone" across the front in the store?
    - primelens 13y ago
      > Yes, but reporting back every program you choose to watch to the TV manufacturer certainly isn't Of course, I agree. My point was that since the buyer wants a "smart" tv, they probably mean to connect it to the network. So instead of not configuring the network, blocking the "phone home" ips might be a more realistic (although probably too technical for most) solution.
  - ds9 13y ago
    I've been shopping for a TV, and while the network-enabled features may be the point of calling certain models "smart", it is not necessarily something the buyer wants. It may appeal to many people - if they don't realize that the software may be buggy, security-compromising, or soon outdated and hard to update. For me it's only unwanted bloat, like 3D. IOW, I may buy a "smart" TV, but if so it's only for the other features like screen size and quality. Nontechnical people have to be educated that the network features may compromise privacy and LAN security - but AFAIK you can always opt out, as the grandparent points out. At least I assume it needs a cable or a wifi key - if it actually seeks out wireless and connects without permission, it's lawsuit time.
    - VLM 13y ago
      >hard to update Usually intentionally impossible to increase sales.
- koralatov 13y ago
  My TV (not an LG, thankfully) has really very good LoveFilm and BBC iPlayer apps built right into it, both of which require a network connection and are quite compelling reasons to use said network connection. I could watch both of these things via my Xbox, but then I'm needlessly powering the TV and the Xbox, rather than just the TV as in scenario one. I don't think I should have to double my power use just to avoid being spied upon.
- vidarh 13y ago
  As I posted to his blog, I think he should contact the Information Commissioners Office. The TV appears to be sending cookie information, which makes it likely that not presenting him with the information in a clear way runs afoul of the infamous EU cookie law. Expecting people to read T&C's for a TV is nonsene. There are also potentially other issues with the UK Data Protection Act, such as if they were to collect any personally identifiable information, which is likely that they will at times do if it snarfs data from attached USB devices at will. And I'd love to see how they respond if he serves them with a Subject Access Notice (in the EU we have a legal right to see what data companies hold on us in most cases).
r0h1n 13y ago
If the data sending wasn't creepy enough, LG's response to the author's letter takes the cake - they tell him to contact the retailer! "The advice we have been given is that unfortunately as you accepted the Terms and Conditions on your TV, your concerns would be best directed to the retailer. We understand you feel you should have been made aware of these T's and C's at the point of sale, and for obvious reasons LG are unable to pass comment on their actions."
- pfortuny 13y ago
  Next time I buy a loaf of bread I shall ask for the terms and conditions, just to be sure...
  - amirmc 13y ago
    You joke but I can totally imagine a future where there are embedded sensors in the bread that transmit local conditions and (after ingestion) health/medical data. Such a loaf could be given away free if the data collected could be repackaged and access to it sold to the highest bidder (I'm thinking pharma companies might pay). A (imho insidious) way to get this accepted by the public would be to target humanitarian efforts first. Tracking health and disease in refugee populations is a real problem, so this system could offer tangible benefits. The refugees aren't really in a position to complain about privacy aspects and it'd be unpalatable for anyone to try a cost/benefit analysis when considering immediate survival against future privacy concerns (esp when it's framed from the point of view of saving a child -- as it usually is). Once this is considered 'normal' in such situations, it could be a short hop (or slippery slope?) to the supermarket. If you think this is ridiculous, please remember that there was once a time when having robots read our email was considered hugely invasive by much of the public (Gmail launch).
    - pfortuny 13y ago
      Never said it was ridiculous. Just joking about today. Of course it will become mainstream but by then we shall all be conscious of it. I hope... The 'save the children' attitude will kill us all, yes.
stedaniels 13y ago
I've got one of these TV's and annoyingly I think it's great. I'm likely going to have to set up some routing/dns/proxy rules to defeat this. Might even have some fun with it by sending it lots of channel changes, pen drive details and the rest.
- hellweaver666 13y ago
  could you get a small USB device (Rasberry Pi?) and set it up to show as a USB storage device and randomly generate file names while it's plugged in? That would flood their servers with dummy data :)
  - hrrsn 13y ago
    It would be easier just to write a script that makes repeated requests and running that since it's just HTTP anyway
    - pritambaral 13y ago
      Perhaps the upper post imagines reverse engineering the HTTP API is too difficult. I'm sure his suggestion was the same in spirit/principle.
  - andygates 13y ago
    It would be far easier to set that Pi up as an XMBC instance with RaspBMC and treat the TV as a dumb output device.
  - talmand 13y ago
    And I'm sure that you'll get a nice letter in the mail accusing you of breaking some sort of law that attempts to protect them from such shenanigans.
nodata 13y ago
The first comment on that page is important: contact the ICO. But it's interesting and worrying that this problem would not have been found if LG was using SSL.
- raverbashing 13y ago
  Well, I doubt they would be using certificate pinning. So you could bypass it easily
  - nodata 13y ago
    How would I get a SSL certificate issued for an lg domain from an issuer that the LG tv trusts?
    - raverbashing 13y ago
      Best case is, they left the "--no-check-certificate" option on for debugging purposes. Or maybe you can import a certificate somehow.
      - sk5t 13y ago
        No certificate checking is quite likely unless the TV also has a method to update its CA trust list, and maybe even handle CRL/OCSP depending on the client library.
kidmenot 13y ago
What's funny is that they think they can make their TVs phone home and get away with it.
- prof_hobart 13y ago
  Well they have mostly so far. What do you think is going to stop them getting away with it?
  - alextingle 13y ago
    Erm, the law?
    - prof_hobart 13y ago
      Let me know how that works out for you...
  - tonyplee 13y ago
    class action lawsuit?
pja 13y ago
Time to put a packet sniffer on my home network & see whether our Panasonic smart TV does the same!
- Jayschwa 13y ago
  Let us know if you turn up anything interesting :-)
smegel 13y ago
Why does he assume that 404 means there isn't something on the server slurping the submissions...
- himal 13y ago
  Absolutely, The server can do whatever it wants with the data and return a 404 header.
  - robmcm 13y ago
    Yup, this actually saved me in the past when a statistics logger was returning an internal error (PHP) but Apache was logging the requests, so we could just parse the logs to get the info needed :)
    - ajtaylor 13y ago
      Been there, done that too! Less than 2 weeks ago at that.
ccozan 13y ago
I worked for a system like this, but for Philips. Could be that the company ( cannot tell the name!) sold the solution to LG. Actually this was meant to display channel suggestions, not ads. Seems like since last time they twisted it. Quite a shame. It was an opt out system, every TV got a unique ID, but it was anonymous - Philips didn't knew who you were. If someone watched something more than 15 mins, it was send to the DB and was profiled. After a while, the system learned your preferences - also depending on the watching hour - and started to show, per request, recommandations what to watch - which channel was the most close to your preferences. It worked like a charm. But indeed, no personal data was collected so I don't really understand the fuss. Same for this case, LG sens anonymous data, and returns best ads for you. A little better than Google, i might say.
- nnnnni 13y ago
  You had us until "but indeed".
- kaoD 13y ago
  > LG sens anonymous data, and returns best ads for you Thanks! I always love it when I get the best ads!
- cjrp 13y ago
  >But indeed, no personal data was collected so I don't really understand the fuss. Filenames on USB sticks attached to the TV could quite easily include personal data. That and the lack of (working) option to disable the feature entirely.
  - russellsprouts 13y ago
    It sounds like this solution was for cable shows, not every piece of media that is played.
- incongruity 13y ago
  I'm sorry, but every detail of what I do or my family does within the privacy of our own home is personal. I do not expect my TV to be spying on me in any form.
aunty_helen 13y ago
Just started looking at what my Samsung is dialing up. http://54.241.140.58/api/tvp/1.0 http://54.241.140.58/api/tvp/1.0 + huge url param string is one thing that jumps out. Resolves to 'Samsung AdHub Portal' Only seems to be transmitting back when using the smart tv stuff though. The request params and some of the stuff I can decipher. request? id=<some id> s=220x124 dt=03 did=<device id> pt=04 pv=T-INFOLINK2012-1003 nt=10 coc=<country> lnc=<language> ts=1384856584858 <timestamp> tz=<time zone> scr=1280x720 <screen size> dy=2012 md=12_X10PLUS mf=Samsung HTTP/1.1\\r\\n
- pestaa 13y ago
  Have you tried blocking the IP and see what that might break?
- goatforce5 13y ago
  I have a Samsung "Smart TV" and fortunately as their frontend is a piece of shit I never use their "smart" features. Unfortunately for me my cable and internet provider (Bell Canada) has decided to start tracking usage habits to target ads: http://montreal.ctvnews.ca/bell-to-start-tracking-customers-web-history-tv-viewing-unless-they-opt-out-1.1508083 http://montreal.ctvnews.ca/bell-to-start-tracking-customers-...
csmuk 13y ago
That scares me. I'm going to fire up wireshark on my Sony Bravia tonight and see what that sends off as well.
csmuk 13y ago
Actually perhaps the most annoying thing I can see is that after paying a fuck-load for the television, they dare to show me adverts on the guide! LG is instantly on my shitlist for this and the channel and media data leaks.
- chrislomax 13y ago
  Do you know what, this actually annoyed me about my Panasonic TV, it does exactly the same. When I go into the "Internet" function, it shows me ads at the bottom. Why am I seeing these ads? For example, in the UK we pay the TV license to BBC to NOT see ads. We are paying for a TV so why am I still seeing ads? If I was renting a TV at a reduced cost or some type of freemium model then I would expect it, takes the biscuit a little I say.
  - csmuk 13y ago
    I'd have taken it back. My Bravia EX has no adverts but I don't entirely trust it.
    - dlhavema 13y ago
      i have an NX Bravia and in the Channel Guide there are ads.. what about yours?
      - csmuk 13y ago
        Not a thing. No ads at all anywhere. I'm in the UK though so it might be different and this unit is 3 years old now.
  - topbanana 13y ago
    You can turn this off. There's a setting somewhere, I forget which
  - dominicgs 13y ago
    Samsung smart TVs are the same. I'm normally happy to view adverts if I am benefiting from whatever they fund - TV advert breaks paying for the content that I'm watching, in-app ads because I got the app for free, etc. With the adverts on the Samsung SmartHub all I can see is the software that I have already paid for. Of course, the demo mode doesn't have advertising, so there is no way to know about it beforehand. Potentially relevant link: http://www.samsungadhub.com http://www.samsungadhub.com
hiby007 13y ago
someone should DDOS these servers. Or may be pass wrong info. JK. These is very bad For LG, And Samsung. These wrongful data collection should stop.
- yashodhan 13y ago
  JK but not really
nnnnni 13y ago
So when this sniffs the viewing habits of someone who is under 13, does it run afoul of CIPA or COPA or whatever it's called?
- icebraining 13y ago
  I don't think so, because COPPA only applies if the service is directed at children and/or asks (directly or indirectly) the user's age.
  - nnnnni 13y ago
    What about when it starts showing ads for things kiddie shows?
jamesrom 13y ago
Dear TV manufacturers, No one want's your shitty software, it's not a competitive edge. No one has ever been impressed by the software their TV comes with, and for every person that found your software easy to use, there is a thousand who are still trying to figure out what that one button does on their remote. You wanna know what people are care about? Picture quality. That's it. That's always been the key. I don't know why you constantly fail to understand that. Why can't you just make a dumb screen? You know desktop monitors? Like that. No sound, minimal software, but if you really want to get fancy, maybe a nice small remote to turn it on and off. Everything else, from sound to color profiles can, and have already for years now, be handled by external devices smarter than you. If you make this, and you focus on picture quality instead of figuring out ways to confuse and exploit the customer, I promise you, I absolutely promise you, every AV nerd I know will buy one. And they will love it. And they will recommend it, and share it, and buy them for their loved ones. And blog about it. Tweet about it. Podcast, vlog and sing about it. And you'll disrupt the old model. You will be the company that brings about the next revolution in television. You've been looking to do that for so long haven't you? And while you always secretly knew it wasn't IPTV or 3D that was going to start the next revolution, what you didn't know is how easy it would be to disrupt the current incumbents. The customer is waiting, cash in hand.
- hrrsn 13y ago
  Alternatively, just throw Android in there and let me hack away. That would at least be fun.
- netcan 13y ago
  Tangent: I think there's room for an 'Android of TVs.' This may or may not be Android, which is kind of the problem. The most likely contenders here (Apple, Google, MS, Sony) have a dog in the race & incumbent problems. They committed to an approach or a technology too early. They have a market (eg itunes), complementary products or ecosystems to protect. What does TV software really need in order to be significantly better than the average smart TV? A handful of core apps (Youtube, Netflix), some local ???Players (these could be introduced market by market) and some experimental/novelty apps (eg Skype, spotify). That's it. That's a good start. Crappy games and access to 99 upstart content marketplaces is not necessary. An app marketplace could come second. *Vanilla android is not the answer. If it's going to be android it needs to be android for TV.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
eonil 13y ago
Actually, there's real good and simple method to determine which one is a shit or not. If it has a word SMART on its name, that's a shit. SMART - it's a magic word to identify shits. Because I never saw stupid companies can make great stuff with more computing power and accessibility. When they have more freedom, they always make a bigger shit. And sometimes it becomes deadly huge. Real nice product doesn't advertise such smart shit stuff, and only focus on the feature what you actually need and use. Even such computing features made you happy, they know that's not a feature to be advertised. Just don't buy any SMART stuff. Whatever they ADVERTISE, they're saying on advertisement are all bullshit.
DanBC 13y ago
A nice write up for the Information Commissioner would probably be a good idea. I'd suggest doing a short cover letter, a simple-English write-up, with a detailed technical appendix. I'd ask if LG are registered to collect data, and if their registration covers this data. And if any of this information leave the EU etc. Thanks for the write up! It's interesting. I wonder if rooting the telly to replace this functionality is legal? I never know what the laws are about reverse engineering stuff now.
- justincormack 13y ago
  I can't even find LG Electronics UK Ltd on the data protection register...
mikro2nd 13y ago
I wonder what the names/IP addresses of those servers are that this TV is contacting? Has anyone sniffed the data and figured out a way to spam their servers with bogus data? Feels to me like they're inviting something like this.
acqq 13y ago
Now who can suggest the best software to install on the home router to block the connections based on the URLs? Ideally it would be a transparent solution -- the client computers shouldn't need any additional configuration. I have an OpenWrt based router. Another question is how to handle https requests?
- draugadrotten 13y ago
  > software to install on the home router to block the connections based on the URLs? tinyproxy does what you want. http://wiki.openwrt.org/doku.php?id=oldwiki:proxy.tinyproxy http://wiki.openwrt.org/doku.php?id=oldwiki:proxy.tinyproxy
  - acqq 13y ago
    Theoretically. But I've found out that it doesn't work on small Linuxes like OpenWRT -- the guy who took over maintenance obviously only works with big desktops and servers, he even removed the mechanisms for proper cross-compiling, at least the last time I looked, a couple of years ago. It looks like the people who use such distros aren't particularly interested in URL-based blocking? We are really making it easy for all the companies that do the same that LG does.
    - draugadrotten 13y ago
      Ah, didn't realize it wasn't supported for openWRT anymore. Perhaps you would be happier with a script like https://gist.github.com/aarmot/5730468 https://gist.github.com/aarmot/5730468 There's also http://block.si/ http://block.si/ cloud service but I haven't tried that. Pretty sure there's a small dns blocker app for openwrt/pineapple as well, but don't remember the name of it right now.
- icebraining 13y ago
  URLs or domains? If the latter is enough, you could just install a DNS resolver like dnsmasq and configure those domain to redirect to 0.0.0.0 or so. Example config: address=/[banned domain]/0.0.0.0 Then either configure your dhcp server or clients to use the router as the DNS resolver.
orbitingpluto 13y ago
Anyone have a link to LG's Terms and Conditions that reveal they will be collecting data? Furthermore, there's an issue of going further down the rabbit hole with smart TVs. What about the terms and conditions of use of software that you may never even use that is still collecting data? I have a LG dumb TV with DLNA and wired connectivity only. LAN only setup does not work. It has to have a full Internet connection.
ChikkaChiChi 13y ago
Auto manufacturers do the same thing. Stop giving me a button to talk to your shitty computer and have it be a bluetooth command action for Siri or Google Now. My phone is smarter than you.
rem1313 13y ago
I'm currently in the market for a new TV 50-55", preferably the least smart, the better. Any suggestions? I can't seem to find any non-smart TVs that are reasonably current with at least 3 HDMI ports.
- nicolsc 13y ago
  Why non-smart especially ? You're free not to connect it to the internet. That's exactly what most customers do with their 'smart' tvs : not plugging them or getting their hands dirty with the wifi settings.
  - dpedu 13y ago
    I've never tried this but knowing Samsung/LG/etc, you would get constant nag screens...
  - Silhouette 13y ago
    Why non-smart especially ? You're free not to connect it to the internet. Until they get "smart" enough to connect via someone else's WiFi hotspot within range. If you think this is a joke or some sort of silly conspiracy theory, please consider the scheme BT already operate across the UK where you can piggy back on other people's home broadband to get wireless Internet access. On my fairly typical residential street, I already have several homes within range of this computer that are part of that scheme, which any wireless device in my home could be connecting to without my knowledge or consent, including those with access to my home network or that include equipment like cameras and microphones. I expect BT could make a tidy profit from making deals with these kinds of companies so they can phone home using their built-in wireless without depending on the customer's own Internet provision, and given their track record, I have no reason to believe they would object to their networks being used for the purposes of intrusive surveillance. I am hoping that laws against these in-home privacy intrusions will arrive before it becomes the norm for consumer products to use the national wireless spynet for this kind of purpose, but given the way the market is going, I am not happy about our prospects on this one.
deleted 13y ago
[deleted]
bobdvb 13y ago
I've worked in the consumer electronics business for quite some time so let me present some information for your consideration, I don't expect you to like it but it will explain context: 1) Adverts: These are often used to subsidise features and capabilities. Sometimes good EPG data needs to be paid for, sometimes you need to justify the running of applications stores. This is a business choice that the manufacturer has to make, be off-putting or lose money. Targeted advertising does increase acceptance of advertising over non-targeted advertising, however if you hate advertising your just not going to get a subsidised product (if it is economically feasible to make one). 2) Viewer tracking: This has many uses a) product improvement: by knowing how users use products you can improve your designs. However this isn't usually done in such a scatter gun approach. b) You can sell anonymous information to agencies who use it to understand viewing habits and increase the value of traditional TV advertising. 3) Third party content tracking - This could be used a) to identify working and non-working content formats, not all encoders are the same and it is a nightmare debugging all the strange formats the people of the internet generate. b) to deliver improved titling, indexing and other metadata. Above all remember Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity.": 1) LG's response from their CS department was composed by a minimum wage agent who got a response from their mid-level supervisor who enquired with someone in product management who badly translated that from some Korean discussions. 2) Most Koreans don't care about content piracy, it is rife in Korea, especially with their excellent bandwidth. 3) Most of these policies were probably written by someone more interested in making the best product for the least money and probably not someone from the west. I would hope that LG might pick up on this and make a better statement, but it won't change their attitude. Finally, personally as someone who makes a lot of set-top boxes I would happily see more dumb TVs, but the business of TVs is loss making. None of the big brands has made money in the TV business in ages, most people do it either for turn-over or brand recognition. Making basic large "monitors" is a difficult business to make a profit in because you are selling something very basic in a mature market.
- kevinpet 13y ago
  "just not going to get a subsidised product" What subsidized product? I just paid hundreds to thousands for something you advertise as a smart tv.
grecy 13y ago
I wonder what would happen if I had a movie on my USB stick I wanted to watch, and it happened to be in the same folder as a few documents that happened to be named with my personal identifying data. My name, address, tax number, drivers license number, passport number, etc, etc. Now they've slurped that off my drive without my permission, and transmitted it in the clear. Can I sue them for "unauthorized access" or identity theft? What if the file name was some industry secret under NDA or other protection? (For example Apple_iPhone_7_2015_design_spec.pdf or NSA_POTUS_PHONE_LOGS_2013_TOP_SECRET.csv )
- russellsprouts 13y ago
  Trade secret information is not blanket protected. For example, the recipe for Coke is a trade secret, but you can still try to reverse engineer it. You cannot try to steal it, or pay someone to give it to you. It seems that the user agreed that the TV would give that information, in some sort of license agreement, and plugged that data into the TV also. I don't think it would count as a fraudulent way of getting the data. With regard to TOP SECRET info, I think that the person plugging the data in is at fault, if they were under an obligation to keep it protected, and they failed by letting it go to a private server. Identity information could be a liability for them, I think. By instituting this feature, they open a possibility of collecting private information, which they should have a duty to protect.
deleted 13y ago
[deleted]
wnevets 13y ago
Guess which TV brand I wont be buying this black friday?
hayksaakian 13y ago
TVs need a tomato or ddwrt Some alternative OS they can install that doesn't suck.
- vdm 13y ago
  http://openlgtv.org.ru/wiki/index.php/Wiki_index http://openlgtv.org.ru/wiki/index.php/Wiki_index
joering2 13y ago
> I think it's important to point out that the URL that the data is being POSTed to doesn't in fact exist, you can see this from the HTTP 404 response Is it possible that they do indeed collect it, but are faking 404? Step now would be implement technology into the TVs. check Step two would be to accept payload, however perhaps they are in waiting period to see if news like this one will come up, and then how much damage, if any, it will create. If none, then Step two: check. What's step 3? Agreement with RIAA or Holywood to sell this data? It could help in litigation by giving more ammunition to plantiff. What is LG TOS of the TV says? Mentions anything about it? Thank you for the post BTW. While they are tens of TV brands, its good to know which one to stay away from.
jt884 13y ago
Thanks for the heads up. That's the last time I buy from LG. Ever. Period.
lignuist 13y ago
Why do these companies seem to always get away with violating their customers privacy? Why don't they have to pay huge fines for that, or even better, go to jail (those who made such decisions)? Seriously, what they do is criminal.
priz3 13y ago
Found this info on the company behind the LG data collection: http://www.theregister.co.uk/2013/09/02/cognitive_lands_lg_as_its_first_tv_oem/ http://www.theregister.co.uk/2013/09/02/cognitive_lands_lg_a... http://vimeo.com/22276085 http://vimeo.com/22276085

297 points by Amadou 13y ago

How can't it be disabled? It needs a network connection to do that. I imagine there is a use case compelling enough to encourage the user to hook it up (YouTube?) but I doubt it has satcoms. Sooo... just don't configure the network. That notwithstanding, I see boxes like Apple TV and Xbox One becoming the way that people interact with their TVs, making the whole problem somewhat moot anyway.

primelens 13y ago
Isn't network connectivity kind of the point of a smart tv?
- pja 13y ago
  Yes, but reporting back every program you choose to watch to the TV manufacturer certainly isn't. Naturally they bury this little fact deep in the T&Cs where you won't even get to read it until you get the TV home, and who reads T&Cs? Almost nobody & the LG knows it. How well do you think this TV would sell if they had to emblazon "This TV will report what you watch to LG so that they can sell that information to anyone" across the front in the store?
  - primelens 13y ago
    > Yes, but reporting back every program you choose to watch to the TV manufacturer certainly isn't Of course, I agree. My point was that since the buyer wants a "smart" tv, they probably mean to connect it to the network. So instead of not configuring the network, blocking the "phone home" ips might be a more realistic (although probably too technical for most) solution.
- ds9 13y ago
  I've been shopping for a TV, and while the network-enabled features may be the point of calling certain models "smart", it is not necessarily something the buyer wants. It may appeal to many people - if they don't realize that the software may be buggy, security-compromising, or soon outdated and hard to update. For me it's only unwanted bloat, like 3D. IOW, I may buy a "smart" TV, but if so it's only for the other features like screen size and quality. Nontechnical people have to be educated that the network features may compromise privacy and LAN security - but AFAIK you can always opt out, as the grandparent points out. At least I assume it needs a cable or a wifi key - if it actually seeks out wireless and connects without permission, it's lawsuit time.
  - VLM 13y ago
    >hard to update Usually intentionally impossible to increase sales.
koralatov 13y ago
My TV (not an LG, thankfully) has really very good LoveFilm and BBC iPlayer apps built right into it, both of which require a network connection and are quite compelling reasons to use said network connection. I could watch both of these things via my Xbox, but then I'm needlessly powering the TV and the Xbox, rather than just the TV as in scenario one. I don't think I should have to double my power use just to avoid being spied upon.
vidarh 13y ago
As I posted to his blog, I think he should contact the Information Commissioners Office. The TV appears to be sending cookie information, which makes it likely that not presenting him with the information in a clear way runs afoul of the infamous EU cookie law. Expecting people to read T&C's for a TV is nonsene. There are also potentially other issues with the UK Data Protection Act, such as if they were to collect any personally identifiable information, which is likely that they will at times do if it snarfs data from attached USB devices at will. And I'd love to see how they respond if he serves them with a Subject Access Notice (in the EU we have a legal right to see what data companies hold on us in most cases).

r0h1n 13y ago

If the data sending wasn't creepy enough, LG's response to the author's letter takes the cake - they tell him to contact the retailer! "The advice we have been given is that unfortunately as you accepted the Terms and Conditions on your TV, your concerns would be best directed to the retailer. We understand you feel you should have been made aware of these T's and C's at the point of sale, and for obvious reasons LG are unable to pass comment on their actions."

pfortuny 13y ago
Next time I buy a loaf of bread I shall ask for the terms and conditions, just to be sure...
- amirmc 13y ago
  You joke but I can totally imagine a future where there are embedded sensors in the bread that transmit local conditions and (after ingestion) health/medical data. Such a loaf could be given away free if the data collected could be repackaged and access to it sold to the highest bidder (I'm thinking pharma companies might pay). A (imho insidious) way to get this accepted by the public would be to target humanitarian efforts first. Tracking health and disease in refugee populations is a real problem, so this system could offer tangible benefits. The refugees aren't really in a position to complain about privacy aspects and it'd be unpalatable for anyone to try a cost/benefit analysis when considering immediate survival against future privacy concerns (esp when it's framed from the point of view of saving a child -- as it usually is). Once this is considered 'normal' in such situations, it could be a short hop (or slippery slope?) to the supermarket. If you think this is ridiculous, please remember that there was once a time when having robots read our email was considered hugely invasive by much of the public (Gmail launch).
  - pfortuny 13y ago
    Never said it was ridiculous. Just joking about today. Of course it will become mainstream but by then we shall all be conscious of it. I hope... The 'save the children' attitude will kill us all, yes.

stedaniels 13y ago

I've got one of these TV's and annoyingly I think it's great. I'm likely going to have to set up some routing/dns/proxy rules to defeat this. Might even have some fun with it by sending it lots of channel changes, pen drive details and the rest.

hellweaver666 13y ago
could you get a small USB device (Rasberry Pi?) and set it up to show as a USB storage device and randomly generate file names while it's plugged in? That would flood their servers with dummy data :)
- hrrsn 13y ago
  It would be easier just to write a script that makes repeated requests and running that since it's just HTTP anyway
  - pritambaral 13y ago
    Perhaps the upper post imagines reverse engineering the HTTP API is too difficult. I'm sure his suggestion was the same in spirit/principle.
- andygates 13y ago
  It would be far easier to set that Pi up as an XMBC instance with RaspBMC and treat the TV as a dumb output device.
- talmand 13y ago
  And I'm sure that you'll get a nice letter in the mail accusing you of breaking some sort of law that attempts to protect them from such shenanigans.

nodata 13y ago

The first comment on that page is important: contact the ICO. But it's interesting and worrying that this problem would not have been found if LG was using SSL.

raverbashing 13y ago
Well, I doubt they would be using certificate pinning. So you could bypass it easily
- nodata 13y ago
  How would I get a SSL certificate issued for an lg domain from an issuer that the LG tv trusts?
  - raverbashing 13y ago
    Best case is, they left the "--no-check-certificate" option on for debugging purposes. Or maybe you can import a certificate somehow.
    - sk5t 13y ago
      No certificate checking is quite likely unless the TV also has a method to update its CA trust list, and maybe even handle CRL/OCSP depending on the client library.

kidmenot 13y ago

What's funny is that they think they can make their TVs phone home and get away with it.

prof_hobart 13y ago
Well they have mostly so far. What do you think is going to stop them getting away with it?
- alextingle 13y ago
  Erm, the law?
  - prof_hobart 13y ago
    Let me know how that works out for you...
- tonyplee 13y ago
  class action lawsuit?

pja 13y ago

Time to put a packet sniffer on my home network & see whether our Panasonic smart TV does the same!

Jayschwa 13y ago
Let us know if you turn up anything interesting :-)

smegel 13y ago

Why does he assume that 404 means there isn't something on the server slurping the submissions...

himal 13y ago
Absolutely, The server can do whatever it wants with the data and return a 404 header.
- robmcm 13y ago
  Yup, this actually saved me in the past when a statistics logger was returning an internal error (PHP) but Apache was logging the requests, so we could just parse the logs to get the info needed :)
  - ajtaylor 13y ago
    Been there, done that too! Less than 2 weeks ago at that.

ccozan 13y ago

I worked for a system like this, but for Philips. Could be that the company ( cannot tell the name!) sold the solution to LG. Actually this was meant to display channel suggestions, not ads. Seems like since last time they twisted it. Quite a shame. It was an opt out system, every TV got a unique ID, but it was anonymous - Philips didn't knew who you were. If someone watched something more than 15 mins, it was send to the DB and was profiled. After a while, the system learned your preferences - also depending on the watching hour - and started to show, per request, recommandations what to watch - which channel was the most close to your preferences. It worked like a charm. But indeed, no personal data was collected so I don't really understand the fuss. Same for this case, LG sens anonymous data, and returns best ads for you. A little better than Google, i might say.

nnnnni 13y ago
You had us until "but indeed".
kaoD 13y ago
> LG sens anonymous data, and returns best ads for you Thanks! I always love it when I get the best ads!
cjrp 13y ago
>But indeed, no personal data was collected so I don't really understand the fuss. Filenames on USB sticks attached to the TV could quite easily include personal data. That and the lack of (working) option to disable the feature entirely.
- russellsprouts 13y ago
  It sounds like this solution was for cable shows, not every piece of media that is played.
incongruity 13y ago
I'm sorry, but every detail of what I do or my family does within the privacy of our own home is personal. I do not expect my TV to be spying on me in any form.

aunty_helen 13y ago

Just started looking at what my Samsung is dialing up. http://54.241.140.58/api/tvp/1.0 http://54.241.140.58/api/tvp/1.0 + huge url param string is one thing that jumps out. Resolves to 'Samsung AdHub Portal' Only seems to be transmitting back when using the smart tv stuff though. The request params and some of the stuff I can decipher. request? id=<some id> s=220x124 dt=03 did=<device id> pt=04 pv=T-INFOLINK2012-1003 nt=10 coc=<country> lnc=<language> ts=1384856584858 <timestamp> tz=<time zone> scr=1280x720 <screen size> dy=2012 md=12_X10PLUS mf=Samsung HTTP/1.1\\r\\n

pestaa 13y ago
Have you tried blocking the IP and see what that might break?
goatforce5 13y ago
I have a Samsung "Smart TV" and fortunately as their frontend is a piece of shit I never use their "smart" features. Unfortunately for me my cable and internet provider (Bell Canada) has decided to start tracking usage habits to target ads: http://montreal.ctvnews.ca/bell-to-start-tracking-customers-web-history-tv-viewing-unless-they-opt-out-1.1508083 http://montreal.ctvnews.ca/bell-to-start-tracking-customers-...

csmuk 13y ago

That scares me. I'm going to fire up wireshark on my Sony Bravia tonight and see what that sends off as well.

csmuk 13y ago

Actually perhaps the most annoying thing I can see is that after paying a fuck-load for the television, they dare to show me adverts on the guide! LG is instantly on my shitlist for this and the channel and media data leaks.

chrislomax 13y ago
Do you know what, this actually annoyed me about my Panasonic TV, it does exactly the same. When I go into the "Internet" function, it shows me ads at the bottom. Why am I seeing these ads? For example, in the UK we pay the TV license to BBC to NOT see ads. We are paying for a TV so why am I still seeing ads? If I was renting a TV at a reduced cost or some type of freemium model then I would expect it, takes the biscuit a little I say.
- csmuk 13y ago
  I'd have taken it back. My Bravia EX has no adverts but I don't entirely trust it.
  - dlhavema 13y ago
    i have an NX Bravia and in the Channel Guide there are ads.. what about yours?
    - csmuk 13y ago
      Not a thing. No ads at all anywhere. I'm in the UK though so it might be different and this unit is 3 years old now.
- topbanana 13y ago
  You can turn this off. There's a setting somewhere, I forget which
- dominicgs 13y ago
  Samsung smart TVs are the same. I'm normally happy to view adverts if I am benefiting from whatever they fund - TV advert breaks paying for the content that I'm watching, in-app ads because I got the app for free, etc. With the adverts on the Samsung SmartHub all I can see is the software that I have already paid for. Of course, the demo mode doesn't have advertising, so there is no way to know about it beforehand. Potentially relevant link: http://www.samsungadhub.com http://www.samsungadhub.com

hiby007 13y ago

someone should DDOS these servers. Or may be pass wrong info. JK. These is very bad For LG, And Samsung. These wrongful data collection should stop.

yashodhan 13y ago
JK but not really

nnnnni 13y ago

So when this sniffs the viewing habits of someone who is under 13, does it run afoul of CIPA or COPA or whatever it's called?

icebraining 13y ago
I don't think so, because COPPA only applies if the service is directed at children and/or asks (directly or indirectly) the user's age.
- nnnnni 13y ago
  What about when it starts showing ads for things kiddie shows?

jamesrom 13y ago

Dear TV manufacturers, No one want's your shitty software, it's not a competitive edge. No one has ever been impressed by the software their TV comes with, and for every person that found your software easy to use, there is a thousand who are still trying to figure out what that one button does on their remote. You wanna know what people are care about? Picture quality. That's it. That's always been the key. I don't know why you constantly fail to understand that. Why can't you just make a dumb screen? You know desktop monitors? Like that. No sound, minimal software, but if you really want to get fancy, maybe a nice small remote to turn it on and off. Everything else, from sound to color profiles can, and have already for years now, be handled by external devices smarter than you. If you make this, and you focus on picture quality instead of figuring out ways to confuse and exploit the customer, I promise you, I absolutely promise you, every AV nerd I know will buy one. And they will love it. And they will recommend it, and share it, and buy them for their loved ones. And blog about it. Tweet about it. Podcast, vlog and sing about it. And you'll disrupt the old model. You will be the company that brings about the next revolution in television. You've been looking to do that for so long haven't you? And while you always secretly knew it wasn't IPTV or 3D that was going to start the next revolution, what you didn't know is how easy it would be to disrupt the current incumbents. The customer is waiting, cash in hand.

hrrsn 13y ago
Alternatively, just throw Android in there and let me hack away. That would at least be fun.
netcan 13y ago
Tangent: I think there's room for an 'Android of TVs.' This may or may not be Android, which is kind of the problem. The most likely contenders here (Apple, Google, MS, Sony) have a dog in the race & incumbent problems. They committed to an approach or a technology too early. They have a market (eg itunes), complementary products or ecosystems to protect. What does TV software really need in order to be significantly better than the average smart TV? A handful of core apps (Youtube, Netflix), some local ???Players (these could be introduced market by market) and some experimental/novelty apps (eg Skype, spotify). That's it. That's a good start. Crappy games and access to 99 upstart content marketplaces is not necessary. An app marketplace could come second. *Vanilla android is not the answer. If it's going to be android it needs to be android for TV.

deleted 13y ago

[deleted]

deleted 13y ago

[deleted]

eonil 13y ago

Actually, there's real good and simple method to determine which one is a shit or not. If it has a word SMART on its name, that's a shit. SMART - it's a magic word to identify shits. Because I never saw stupid companies can make great stuff with more computing power and accessibility. When they have more freedom, they always make a bigger shit. And sometimes it becomes deadly huge. Real nice product doesn't advertise such smart shit stuff, and only focus on the feature what you actually need and use. Even such computing features made you happy, they know that's not a feature to be advertised. Just don't buy any SMART stuff. Whatever they ADVERTISE, they're saying on advertisement are all bullshit.

DanBC 13y ago

A nice write up for the Information Commissioner would probably be a good idea. I'd suggest doing a short cover letter, a simple-English write-up, with a detailed technical appendix. I'd ask if LG are registered to collect data, and if their registration covers this data. And if any of this information leave the EU etc. Thanks for the write up! It's interesting. I wonder if rooting the telly to replace this functionality is legal? I never know what the laws are about reverse engineering stuff now.

justincormack 13y ago
I can't even find LG Electronics UK Ltd on the data protection register...

mikro2nd 13y ago

I wonder what the names/IP addresses of those servers are that this TV is contacting? Has anyone sniffed the data and figured out a way to spam their servers with bogus data? Feels to me like they're inviting something like this.

acqq 13y ago

Now who can suggest the best software to install on the home router to block the connections based on the URLs? Ideally it would be a transparent solution -- the client computers shouldn't need any additional configuration. I have an OpenWrt based router. Another question is how to handle https requests?

draugadrotten 13y ago
> software to install on the home router to block the connections based on the URLs? tinyproxy does what you want. http://wiki.openwrt.org/doku.php?id=oldwiki:proxy.tinyproxy http://wiki.openwrt.org/doku.php?id=oldwiki:proxy.tinyproxy
- acqq 13y ago
  Theoretically. But I've found out that it doesn't work on small Linuxes like OpenWRT -- the guy who took over maintenance obviously only works with big desktops and servers, he even removed the mechanisms for proper cross-compiling, at least the last time I looked, a couple of years ago. It looks like the people who use such distros aren't particularly interested in URL-based blocking? We are really making it easy for all the companies that do the same that LG does.
  - draugadrotten 13y ago
    Ah, didn't realize it wasn't supported for openWRT anymore. Perhaps you would be happier with a script like https://gist.github.com/aarmot/5730468 https://gist.github.com/aarmot/5730468 There's also http://block.si/ http://block.si/ cloud service but I haven't tried that. Pretty sure there's a small dns blocker app for openwrt/pineapple as well, but don't remember the name of it right now.
icebraining 13y ago
URLs or domains? If the latter is enough, you could just install a DNS resolver like dnsmasq and configure those domain to redirect to 0.0.0.0 or so. Example config: address=/[banned domain]/0.0.0.0 Then either configure your dhcp server or clients to use the router as the DNS resolver.

orbitingpluto 13y ago

Anyone have a link to LG's Terms and Conditions that reveal they will be collecting data? Furthermore, there's an issue of going further down the rabbit hole with smart TVs. What about the terms and conditions of use of software that you may never even use that is still collecting data? I have a LG dumb TV with DLNA and wired connectivity only. LAN only setup does not work. It has to have a full Internet connection.

ChikkaChiChi 13y ago

Auto manufacturers do the same thing. Stop giving me a button to talk to your shitty computer and have it be a bluetooth command action for Siri or Google Now. My phone is smarter than you.

rem1313 13y ago

I'm currently in the market for a new TV 50-55", preferably the least smart, the better. Any suggestions? I can't seem to find any non-smart TVs that are reasonably current with at least 3 HDMI ports.

nicolsc 13y ago
Why non-smart especially ? You're free not to connect it to the internet. That's exactly what most customers do with their 'smart' tvs : not plugging them or getting their hands dirty with the wifi settings.
- dpedu 13y ago
  I've never tried this but knowing Samsung/LG/etc, you would get constant nag screens...
- Silhouette 13y ago
  Why non-smart especially ? You're free not to connect it to the internet. Until they get "smart" enough to connect via someone else's WiFi hotspot within range. If you think this is a joke or some sort of silly conspiracy theory, please consider the scheme BT already operate across the UK where you can piggy back on other people's home broadband to get wireless Internet access. On my fairly typical residential street, I already have several homes within range of this computer that are part of that scheme, which any wireless device in my home could be connecting to without my knowledge or consent, including those with access to my home network or that include equipment like cameras and microphones. I expect BT could make a tidy profit from making deals with these kinds of companies so they can phone home using their built-in wireless without depending on the customer's own Internet provision, and given their track record, I have no reason to believe they would object to their networks being used for the purposes of intrusive surveillance. I am hoping that laws against these in-home privacy intrusions will arrive before it becomes the norm for consumer products to use the national wireless spynet for this kind of purpose, but given the way the market is going, I am not happy about our prospects on this one.

deleted 13y ago

[deleted]

bobdvb 13y ago

I've worked in the consumer electronics business for quite some time so let me present some information for your consideration, I don't expect you to like it but it will explain context: 1) Adverts: These are often used to subsidise features and capabilities. Sometimes good EPG data needs to be paid for, sometimes you need to justify the running of applications stores. This is a business choice that the manufacturer has to make, be off-putting or lose money. Targeted advertising does increase acceptance of advertising over non-targeted advertising, however if you hate advertising your just not going to get a subsidised product (if it is economically feasible to make one). 2) Viewer tracking: This has many uses a) product improvement: by knowing how users use products you can improve your designs. However this isn't usually done in such a scatter gun approach. b) You can sell anonymous information to agencies who use it to understand viewing habits and increase the value of traditional TV advertising. 3) Third party content tracking - This could be used a) to identify working and non-working content formats, not all encoders are the same and it is a nightmare debugging all the strange formats the people of the internet generate. b) to deliver improved titling, indexing and other metadata. Above all remember Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity.": 1) LG's response from their CS department was composed by a minimum wage agent who got a response from their mid-level supervisor who enquired with someone in product management who badly translated that from some Korean discussions. 2) Most Koreans don't care about content piracy, it is rife in Korea, especially with their excellent bandwidth. 3) Most of these policies were probably written by someone more interested in making the best product for the least money and probably not someone from the west. I would hope that LG might pick up on this and make a better statement, but it won't change their attitude. Finally, personally as someone who makes a lot of set-top boxes I would happily see more dumb TVs, but the business of TVs is loss making. None of the big brands has made money in the TV business in ages, most people do it either for turn-over or brand recognition. Making basic large "monitors" is a difficult business to make a profit in because you are selling something very basic in a mature market.

kevinpet 13y ago
"just not going to get a subsidised product" What subsidized product? I just paid hundreds to thousands for something you advertise as a smart tv.

grecy 13y ago

I wonder what would happen if I had a movie on my USB stick I wanted to watch, and it happened to be in the same folder as a few documents that happened to be named with my personal identifying data. My name, address, tax number, drivers license number, passport number, etc, etc. Now they've slurped that off my drive without my permission, and transmitted it in the clear. Can I sue them for "unauthorized access" or identity theft? What if the file name was some industry secret under NDA or other protection? (For example Apple_iPhone_7_2015_design_spec.pdf or NSA_POTUS_PHONE_LOGS_2013_TOP_SECRET.csv )

russellsprouts 13y ago
Trade secret information is not blanket protected. For example, the recipe for Coke is a trade secret, but you can still try to reverse engineer it. You cannot try to steal it, or pay someone to give it to you. It seems that the user agreed that the TV would give that information, in some sort of license agreement, and plugged that data into the TV also. I don't think it would count as a fraudulent way of getting the data. With regard to TOP SECRET info, I think that the person plugging the data in is at fault, if they were under an obligation to keep it protected, and they failed by letting it go to a private server. Identity information could be a liability for them, I think. By instituting this feature, they open a possibility of collecting private information, which they should have a duty to protect.

deleted 13y ago

[deleted]

wnevets 13y ago

Guess which TV brand I wont be buying this black friday?

hayksaakian 13y ago

TVs need a tomato or ddwrt Some alternative OS they can install that doesn't suck.

vdm 13y ago
http://openlgtv.org.ru/wiki/index.php/Wiki_index http://openlgtv.org.ru/wiki/index.php/Wiki_index

joering2 13y ago

> I think it's important to point out that the URL that the data is being POSTed to doesn't in fact exist, you can see this from the HTTP 404 response Is it possible that they do indeed collect it, but are faking 404? Step now would be implement technology into the TVs. check Step two would be to accept payload, however perhaps they are in waiting period to see if news like this one will come up, and then how much damage, if any, it will create. If none, then Step two: check. What's step 3? Agreement with RIAA or Holywood to sell this data? It could help in litigation by giving more ammunition to plantiff. What is LG TOS of the TV says? Mentions anything about it? Thank you for the post BTW. While they are tens of TV brands, its good to know which one to stay away from.

jt884 13y ago

Thanks for the heads up. That's the last time I buy from LG. Ever. Period.

lignuist 13y ago

Why do these companies seem to always get away with violating their customers privacy? Why don't they have to pay huge fines for that, or even better, go to jail (those who made such decisions)? Seriously, what they do is criminal.

priz3 13y ago

Found this info on the company behind the LG data collection: http://www.theregister.co.uk/2013/09/02/cognitive_lands_lg_as_its_first_tv_oem/ http://www.theregister.co.uk/2013/09/02/cognitive_lands_lg_a... http://vimeo.com/22276085 http://vimeo.com/22276085