10 ms·

Spoofing the Samsung Smart TV Internet Check

198 points by lelf 13y ago

runeks 13y ago
This just reaffirms my impression of Samsung as a decent hardware company and a poor software company. I was thrilled to switch from my Samsung Galaxy S3 to my Nexus 4. The S3 had horrible Samsung-equivalent apps for everything: email, chat, a browser, and a lot of system services that I couldn't uninstall. It also had some specially built update mechanism, separate from Google Play, that would drain my battery, until it was fixed. I like Samsung though, as long as they stick to producing hardware. My ARM Chromebook is a lovely device: Samsung hardware with Google software on it.
mnkypete 13y ago
I really don't like how Samsung handles this.. I couldn't use my TV all morning to watch Youtube (I know, problems..), just because they think "If Samsung is down, don't bother opening the Youtube app". Seriously, what the heck... Also, this is not the first time this happens.. I mean their data center was on fire (www.engadget.com/2014/04/20/samsung-com-outage-sds-fire/), but isn't there some failover?
- madeofpalk 13y ago
  Apple devices also had a similar problem a while back http://www.zdnet.com/what-went-wrong-with-ios-6-wi-fi-7000004598/ http://www.zdnet.com/what-went-wrong-with-ios-6-wi-fi-700000... When iOS or Mac connects to wifi, it hits a similar URL to Apple to check if the device is stuck behind a captive wifi network. If the check failed, it attempts to throw up the networks login page. But Apple's check server went down, and therefore peoples iPod touches, Macs and iPads got stuck in a nasty cycle of trying to throw up a non-existant login page.
  - 0x0 13y ago
    Actually it wasn't that the server was down, it was that it was misconfigured and returned unexpected 404 responses which made it look like a captive portal.
benmarks 13y ago
Single points of failure everywhere. This is not the future we were promised. At least the fixes are in our hands.
- scrollaway 13y ago
  Custom and open operating systems are the only way forward against this sort of bullshit. It's not just crappy engineering, it's also TVs doing analytics on what you watch, always-on cameras, etc.. As long as we have the power to root these devices and install our own software on it, we will be fine. But for how long is that going to keep up?
  - xrjn 13y ago
    The question isn't necessarily about rooting, seeing as the vast majority of people don't know what that even means. They shouldn't be tracking what we watch in the first place. Reminds me of this story from a year or two ago, where LG continued collecting data even after the feature had been disabled on their TVs.
    - scrollaway 13y ago
      I agree, but we need proper technical and social solutions. Tracking will be done. Yes, it's disgusting that some of this is legal in the first place, but even if it were illegal there would be companies doing it and we would need solutions against these.
  - userbinator 13y ago
    > TVs doing analytics on what you watch, always-on cameras Who's doing the watching now? That sounds ridiculously Orwellian... > As long as we have the power to root these devices and install our own software on it, we will be fine. But for how long is that going to keep up? The most interesting part of this is that "rooting" often relies on finding and exploiting a vulnerability, something that would be considered detrimental to security and normally thought of as a bug. In other words, this power is coming from having not-so-secure devices. Imagine if this TV was more secure; it used DNSSEC and HTTPS to authenticate/encrypt communications, and was designed to be resistant to tampering via hardware (secure processor, encrypted memory, etc.) -- ostensibly for things like DRM. Do suggestions like "all Internet traffic should be encrypted" start to look less appealing now? To say it plainly, in this case "insecurity is freedom."
amirmc 13y ago
If we don't start building (and pushing for) more distributed/decentralised systems then this is the future we can expect more of. Aside from this, why should my TV need to dial home at all?
- sjtrny 13y ago
  Why? To confirm connectivity. Welcome to HN, where answering a question gets downvoted.
  - amirmc 13y ago
    My browser doesn't do that so there's really no need for a TV to do that.
    - andybak 13y ago
      Are you sure your browser doesn't do that? There's usually some code that checks for 'captive portals' - i.e. wifi providers that want you to login before giving you a real internet connection.
      - amirmc 13y ago
        What I mean is that my browser (Safari) doesn't dial home (Apple) to decide whether or not it can try serving me content (HackerNews). NB That doesn't mean it never connects to Apple without my knowledge (or elsewhere), but rather that it's not a point of failure. Edit: I'm making a distinction between what my browser does vs the OS and wifi. In any case, your home TV doesn't really have to deal with captive portals.
        nwh 13y ago
        Your Mac does exactly that actually. http://blog.erratasec.com/2010/09/apples-secret-wispr-request.html http://blog.erratasec.com/2010/09/apples-secret-wispr-reques... Apple broke the page once and everybody's wifi broke in response. Single point of failure.
akandiah 13y ago
I assume Samsung is using Linux as the underlying OS here. If so, does Linux have a "Network Awareness" API? I understand that Windows has one. More info: http://technet.microsoft.com/en-us/library/cc766017%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc766017%28WS.10%...
- LeonidasXIV 13y ago
  Well, NetworkManager can tell you whether you are connected to some network. But verifying you are on the internet is outside of its scope.
- runeks 13y ago
  As far as I can see, this issue exists because, fundamentally, there is no such thing as "Internet access". If a device can access only 50% of hosts on the Internet, does it have Internet access? What about 1% or 99%? Consequently, it makes no sense to make "Internet access" a binary variable that a software system uses to determine whether it has access to all Internet sites. One would think the YouTube app would have a built-in mechanism for handling a failure when connecting to youtube.com. It's entirely possible that samsung.com could be up, but youtube.com down. I assume the YouTube app gracefully handles this, and this would render Samsung's binary state "Internet present?" variable useless at best. TL;DR: Having a system-wide "Internet available?" variable is meaningless because individual apps need to be able to handle not being able to connect to a particular host anyway (eg. youtube.com, netflix.com).
  - zachlipton 13y ago
    Well, the system-wide "internet available?" variable isn't completely useless from a user perspective. If youtube.com happens to be down for whatever reason, there isn't much the user can do about it except wait, so there isn't much for the YouTube to do besides display a standard error message and call it a day. But in the more common case where the user's internet connection is unavailable or misconfigured, there are troubleshooting steps the user can take (make sure it's plugged in, try turning the router off and on again, check network settings, etc...). I suspect the design was to help users get their TVs connected to the internet by providing more useful diagnostics when they are offline. To do that, you need some kind of system-level check for connectivity. Now, there are certainly better ways they could have implemented the feature, ways that didn't involve a single point of failure where a fire at one building means that millions of TVs can't access Netflix or YouTube for no good reason, but the intent wasn't completely meaningless.
thejosh 13y ago
Oh boyo. We have samsung smart tvs at home, which Plex runs on top of... looks like I'm going to have to implement something like this with openWRT in future..
kenrose 13y ago
Devices that infer that connectivity to one site implies connectivity to the Internet are flawed. Having connectivity to one site means only that a route exists between you and the remote host. That's it. It says nothing about any other site. It's generally not good to do "Internet connectivity" checks. Just check to see if the site you want to connect to is responding. In the case of Samsung, who cares if samsung.com is down if I want YouTube. Just connect to YouTube and if that's down, then tell me. The only useful exception to the above that I've seen is for Wi-Fi hotspot detection (e.g., checking a known response from Microsoft NCSI). The key difference here is that if the NCSI server is down or not responding, the user is not blocked from trying to connect.
- deleted 13y ago
  [deleted]
- EvanAnderson 13y ago
  Microsoft published a description of the communications, too: http://technet.microsoft.com/en-us/library/cc766017(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc766017(v=ws.10)...
  - threedaymonk 13y ago
    It's quite useful, so implemented it in bash: https://github.com/threedaymonk/ncsi https://github.com/threedaymonk/ncsi
- kiallmacinnes 13y ago
  So, yes, they are broken when you think about them like that. But, they cover the 95% use case... That case where most people say "The Internet is down" ;) Giving the 95% a good experience should always be prioritised above giving 100% of users a mediocre experience.
  - kiallmacinnes 13y ago
    I always wish people would reply when downvoting.. A -1 without a comment could mean a million different things.. :(
dcosson 13y ago
> I overrode the DNS and pointed it to 127.0.0.1 and tried again. Is there an easy way to spoof that on your local home network?
- EvanAnderson 13y ago
  Run your own local DNS server. Virtually every lightweight router-oriented Linux distro includes dnsmasq if you don't want to run a full-blown DNS server.
  - Piskvorrr 13y ago
    Moreover, your router is very likely to already run dnsmasq under the hood.
keithgabryelski 13y ago
testing a connection for various features is not as robust as actually trying the operation you want to complete and determining if it worked. drop all the extra work and let code fail gracefully while in action.
thefreeman 13y ago
I wouldn't be suprised if it's vulnerable to XXE too ( http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion http://projects.webappsec.org/w/page/13247002/XML%20Entity%2... )
Bud 13y ago
"Smart" TVs are dumb, by design, in their very conception. TVs get upgraded perhaps once a decade or so. They don't need to have software in them, and shouldn't. Leave that to people and companies who actually know how to produce software. TVs should display an image. That's it. Nothing else. There are no exceptions.
- CSDude 13y ago
  I bet Samsung knows how to do software, it is just a minor wrong practice of implementation, it should have another URLs for failsafe. SmartTV s makes some tasks easy, at least it allows you to Skype someone on a nice and huge screen. By your logic the cellphones should not be smart too, they should only call people, nothing else.
  - Bud 13y ago
    No. Please don't put words in my mouth. :) Cellphones are an entirely different product in several ways. Most notably, they are portable, need to stand alone without other helper devices, function as complete computers, and are upgraded approximately every 1-2 years by most users. TVs possess none of these attributes. That's why it's great for a cellphone to run a full modern OS, and why it's NOT great for a TV to do so. TVs last across multiple tech generations. They should contain the bare minimum of software needed to display whatever content you pump into them. Nothing else.
    - frandroid 13y ago
      That TV above still has all the bare minimum to display whatever content you pump into it; the only part that's not functional in this post is its self-pumping, so to speak. As long as the TV can still function in dumb mode, having a smart mode is extra gravy that makes life so much easier. Now if I could pair a Bluetooth keyboard with it...
      - Bud 13y ago
        No. The part that's not functional is everything else. "Smart" TVs tend to have all kinds of idiotic things like splash screens (what? why?), ads (seriously? ads on my TV that I paid for? no thanks), stupid software vulnerabilities and instability that a TV has no business having (see the topic this thread is based on), and all kinds of other nonsense. Add in the fact that good TVs are basically always made by the companies who are the Very Worst at software (Samsung most prominently), and you have a recipe for digital heartburn. No thanks. Dumb TVs forever. Also, to respond to another comment, there's no correlation between a TV being "smart" and achieving a simple A/V setup with a single remote and a minimum of hassles. Unless you mean a negative correlation. It's very simple to achieve single-remote nirvana with a dumb TV. Plus you're not stuck with a dumb company's remote and software; you can pick your own, because a dumb TV will work with anything and not get in your way. Singled out for especially thorough beatings are those TV makers who put actual physical buttons on their remotes for websites that might be gone next week. Seriously? No. Dumb TVs forever.
logfromblammo 13y ago
This is exactly the sort of problem that made me decide to buy a regular television after having previously bought a "smart" television. It does not anger me quite so much as Microsoft trying to get me to pay them a subscription fee to access my own network hardware, but it does drive me in the direction of wanting an open-source set-top HTPC to sit at the interface between dumb viewscreen and Internet.
markomikolavcic 13y ago
Very helpful. I have the LG smart tv and i would like to know if in my case (lg) could happen the same... Just in case to know if it happens. my opinion about these smart tv's is very positive. I like to browse or watch films over netflix or others. Hope that in a couple of years it gets even smarter :)
turrini 13y ago
It amazes me that most of these "Smart" TVs don't use SSL or any sort of encryption in first place.
- mobiplayer 13y ago
  I know first hand some other brands do.
nfriedly 13y ago
Nice work! I ran into the same issue with my samsung "smart" TV, and I was starting to set up a similar hack when my wife beat me to the punch: hit the "factory reset" option in the menu, and then it loses the wifi settings and stops trying to check for updates.
voltagex_ 13y ago
So from that XML, you seem to control the URLs the TV will grab. Just a few buffer overflows away from root on the TV, and of course you don't really own the hardware you bought until you have root, right?
chavesn 13y ago
It's a good thing they didn't use HTTPS. And a good thing that something else doesn't actually rely on samsung.com (listing services, API endpoints, whatever). This is a cool hack for now but if I had to make a prediction I'd bet there's a future coming where this isn't possible, where the two are even more intertwined -- even though most of us know they don't need to be and wouldn't design our own systems that way.
nixy 13y ago
I build "smart" TV apps for a living. Samsung's connectivity check for their TVs from 2010 has a list of five domains that it checks against. Discovered this during some debugging a couple of years ago. The list, in the order pings are made, is: icq.com (not kidding) yahoo.com samsung.com google.com Some other domain I can't remember
- aqme28 13y ago
  And it requires all five to connect, rather than just one?
kdot 13y ago
I guess this explains why my Fios TV app isn't working.
beagle3 13y ago
I have a Vizio "smart tv" which is about as "smart"
ndesaulniers 13y ago
Wow now I want to buy a DRM... I mean "Smart" TV!
shavenwarthog2 13y ago
A while back I "hacked" my Samsung TV. I spoofed a DNS entry to point to my laptop, and put a tiny webserver on it. Then I could hit the "News" button on my remote and get obscene fortune cookies on my TV! Then I turned it off. Internet on TV is silly, as far as I can tell. My girlfriend's wonderful Panasonic has tons of internet features -- web, youtube. Web is nearly useless because of lack of keyboard; youtube is awkward; vimeo isn't bad. Using an Android app, selecting your youtube video, then doing "send to TV" is great when we bother to do it. The "smart" Panasonic is a dumb screen in front of Roku. The only other non-dumb features we use is the "play videos from SD card" feature, and the "play from DLNA (my laptop)" feature -- both get used quite often, and work well.

198 points by lelf 13y ago

This just reaffirms my impression of Samsung as a decent hardware company and a poor software company. I was thrilled to switch from my Samsung Galaxy S3 to my Nexus 4. The S3 had horrible Samsung-equivalent apps for everything: email, chat, a browser, and a lot of system services that I couldn't uninstall. It also had some specially built update mechanism, separate from Google Play, that would drain my battery, until it was fixed. I like Samsung though, as long as they stick to producing hardware. My ARM Chromebook is a lovely device: Samsung hardware with Google software on it.

mnkypete 13y ago

I really don't like how Samsung handles this.. I couldn't use my TV all morning to watch Youtube (I know, problems..), just because they think "If Samsung is down, don't bother opening the Youtube app". Seriously, what the heck... Also, this is not the first time this happens.. I mean their data center was on fire (www.engadget.com/2014/04/20/samsung-com-outage-sds-fire/), but isn't there some failover?

madeofpalk 13y ago
Apple devices also had a similar problem a while back http://www.zdnet.com/what-went-wrong-with-ios-6-wi-fi-7000004598/ http://www.zdnet.com/what-went-wrong-with-ios-6-wi-fi-700000... When iOS or Mac connects to wifi, it hits a similar URL to Apple to check if the device is stuck behind a captive wifi network. If the check failed, it attempts to throw up the networks login page. But Apple's check server went down, and therefore peoples iPod touches, Macs and iPads got stuck in a nasty cycle of trying to throw up a non-existant login page.
- 0x0 13y ago
  Actually it wasn't that the server was down, it was that it was misconfigured and returned unexpected 404 responses which made it look like a captive portal.

benmarks 13y ago

Single points of failure everywhere. This is not the future we were promised. At least the fixes are in our hands.

scrollaway 13y ago
Custom and open operating systems are the only way forward against this sort of bullshit. It's not just crappy engineering, it's also TVs doing analytics on what you watch, always-on cameras, etc.. As long as we have the power to root these devices and install our own software on it, we will be fine. But for how long is that going to keep up?
- xrjn 13y ago
  The question isn't necessarily about rooting, seeing as the vast majority of people don't know what that even means. They shouldn't be tracking what we watch in the first place. Reminds me of this story from a year or two ago, where LG continued collecting data even after the feature had been disabled on their TVs.
  - scrollaway 13y ago
    I agree, but we need proper technical and social solutions. Tracking will be done. Yes, it's disgusting that some of this is legal in the first place, but even if it were illegal there would be companies doing it and we would need solutions against these.
- userbinator 13y ago
  > TVs doing analytics on what you watch, always-on cameras Who's doing the watching now? That sounds ridiculously Orwellian... > As long as we have the power to root these devices and install our own software on it, we will be fine. But for how long is that going to keep up? The most interesting part of this is that "rooting" often relies on finding and exploiting a vulnerability, something that would be considered detrimental to security and normally thought of as a bug. In other words, this power is coming from having not-so-secure devices. Imagine if this TV was more secure; it used DNSSEC and HTTPS to authenticate/encrypt communications, and was designed to be resistant to tampering via hardware (secure processor, encrypted memory, etc.) -- ostensibly for things like DRM. Do suggestions like "all Internet traffic should be encrypted" start to look less appealing now? To say it plainly, in this case "insecurity is freedom."

amirmc 13y ago

If we don't start building (and pushing for) more distributed/decentralised systems then this is the future we can expect more of. Aside from this, why should my TV need to dial home at all?

sjtrny 13y ago
Why? To confirm connectivity. Welcome to HN, where answering a question gets downvoted.
- amirmc 13y ago
  My browser doesn't do that so there's really no need for a TV to do that.
  - andybak 13y ago
    Are you sure your browser doesn't do that? There's usually some code that checks for 'captive portals' - i.e. wifi providers that want you to login before giving you a real internet connection.
    - amirmc 13y ago
      What I mean is that my browser (Safari) doesn't dial home (Apple) to decide whether or not it can try serving me content (HackerNews). NB That doesn't mean it never connects to Apple without my knowledge (or elsewhere), but rather that it's not a point of failure. Edit: I'm making a distinction between what my browser does vs the OS and wifi. In any case, your home TV doesn't really have to deal with captive portals.
      - nwh 13y ago
        Your Mac does exactly that actually. http://blog.erratasec.com/2010/09/apples-secret-wispr-request.html http://blog.erratasec.com/2010/09/apples-secret-wispr-reques... Apple broke the page once and everybody's wifi broke in response. Single point of failure.

akandiah 13y ago

I assume Samsung is using Linux as the underlying OS here. If so, does Linux have a "Network Awareness" API? I understand that Windows has one. More info: http://technet.microsoft.com/en-us/library/cc766017%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc766017%28WS.10%...

LeonidasXIV 13y ago
Well, NetworkManager can tell you whether you are connected to some network. But verifying you are on the internet is outside of its scope.
runeks 13y ago
As far as I can see, this issue exists because, fundamentally, there is no such thing as "Internet access". If a device can access only 50% of hosts on the Internet, does it have Internet access? What about 1% or 99%? Consequently, it makes no sense to make "Internet access" a binary variable that a software system uses to determine whether it has access to all Internet sites. One would think the YouTube app would have a built-in mechanism for handling a failure when connecting to youtube.com. It's entirely possible that samsung.com could be up, but youtube.com down. I assume the YouTube app gracefully handles this, and this would render Samsung's binary state "Internet present?" variable useless at best. TL;DR: Having a system-wide "Internet available?" variable is meaningless because individual apps need to be able to handle not being able to connect to a particular host anyway (eg. youtube.com, netflix.com).
- zachlipton 13y ago
  Well, the system-wide "internet available?" variable isn't completely useless from a user perspective. If youtube.com happens to be down for whatever reason, there isn't much the user can do about it except wait, so there isn't much for the YouTube to do besides display a standard error message and call it a day. But in the more common case where the user's internet connection is unavailable or misconfigured, there are troubleshooting steps the user can take (make sure it's plugged in, try turning the router off and on again, check network settings, etc...). I suspect the design was to help users get their TVs connected to the internet by providing more useful diagnostics when they are offline. To do that, you need some kind of system-level check for connectivity. Now, there are certainly better ways they could have implemented the feature, ways that didn't involve a single point of failure where a fire at one building means that millions of TVs can't access Netflix or YouTube for no good reason, but the intent wasn't completely meaningless.

thejosh 13y ago

Oh boyo. We have samsung smart tvs at home, which Plex runs on top of... looks like I'm going to have to implement something like this with openWRT in future..

kenrose 13y ago

Devices that infer that connectivity to one site implies connectivity to the Internet are flawed. Having connectivity to one site means only that a route exists between you and the remote host. That's it. It says nothing about any other site. It's generally not good to do "Internet connectivity" checks. Just check to see if the site you want to connect to is responding. In the case of Samsung, who cares if samsung.com is down if I want YouTube. Just connect to YouTube and if that's down, then tell me. The only useful exception to the above that I've seen is for Wi-Fi hotspot detection (e.g., checking a known response from Microsoft NCSI). The key difference here is that if the NCSI server is down or not responding, the user is not blocked from trying to connect.

deleted 13y ago
[deleted]
EvanAnderson 13y ago
Microsoft published a description of the communications, too: http://technet.microsoft.com/en-us/library/cc766017(v=ws.10).aspx http://technet.microsoft.com/en-us/library/cc766017(v=ws.10)...
- threedaymonk 13y ago
  It's quite useful, so implemented it in bash: https://github.com/threedaymonk/ncsi https://github.com/threedaymonk/ncsi
kiallmacinnes 13y ago
So, yes, they are broken when you think about them like that. But, they cover the 95% use case... That case where most people say "The Internet is down" ;) Giving the 95% a good experience should always be prioritised above giving 100% of users a mediocre experience.
- kiallmacinnes 13y ago
  I always wish people would reply when downvoting.. A -1 without a comment could mean a million different things.. :(

dcosson 13y ago

> I overrode the DNS and pointed it to 127.0.0.1 and tried again. Is there an easy way to spoof that on your local home network?

EvanAnderson 13y ago
Run your own local DNS server. Virtually every lightweight router-oriented Linux distro includes dnsmasq if you don't want to run a full-blown DNS server.
- Piskvorrr 13y ago
  Moreover, your router is very likely to already run dnsmasq under the hood.

keithgabryelski 13y ago

testing a connection for various features is not as robust as actually trying the operation you want to complete and determining if it worked. drop all the extra work and let code fail gracefully while in action.

thefreeman 13y ago

I wouldn't be suprised if it's vulnerable to XXE too ( http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion http://projects.webappsec.org/w/page/13247002/XML%20Entity%2... )

Bud 13y ago

"Smart" TVs are dumb, by design, in their very conception. TVs get upgraded perhaps once a decade or so. They don't need to have software in them, and shouldn't. Leave that to people and companies who actually know how to produce software. TVs should display an image. That's it. Nothing else. There are no exceptions.

CSDude 13y ago
I bet Samsung knows how to do software, it is just a minor wrong practice of implementation, it should have another URLs for failsafe. SmartTV s makes some tasks easy, at least it allows you to Skype someone on a nice and huge screen. By your logic the cellphones should not be smart too, they should only call people, nothing else.
- Bud 13y ago
  No. Please don't put words in my mouth. :) Cellphones are an entirely different product in several ways. Most notably, they are portable, need to stand alone without other helper devices, function as complete computers, and are upgraded approximately every 1-2 years by most users. TVs possess none of these attributes. That's why it's great for a cellphone to run a full modern OS, and why it's NOT great for a TV to do so. TVs last across multiple tech generations. They should contain the bare minimum of software needed to display whatever content you pump into them. Nothing else.
  - frandroid 13y ago
    That TV above still has all the bare minimum to display whatever content you pump into it; the only part that's not functional in this post is its self-pumping, so to speak. As long as the TV can still function in dumb mode, having a smart mode is extra gravy that makes life so much easier. Now if I could pair a Bluetooth keyboard with it...
    - Bud 13y ago
      No. The part that's not functional is everything else. "Smart" TVs tend to have all kinds of idiotic things like splash screens (what? why?), ads (seriously? ads on my TV that I paid for? no thanks), stupid software vulnerabilities and instability that a TV has no business having (see the topic this thread is based on), and all kinds of other nonsense. Add in the fact that good TVs are basically always made by the companies who are the Very Worst at software (Samsung most prominently), and you have a recipe for digital heartburn. No thanks. Dumb TVs forever. Also, to respond to another comment, there's no correlation between a TV being "smart" and achieving a simple A/V setup with a single remote and a minimum of hassles. Unless you mean a negative correlation. It's very simple to achieve single-remote nirvana with a dumb TV. Plus you're not stuck with a dumb company's remote and software; you can pick your own, because a dumb TV will work with anything and not get in your way. Singled out for especially thorough beatings are those TV makers who put actual physical buttons on their remotes for websites that might be gone next week. Seriously? No. Dumb TVs forever.

logfromblammo 13y ago

This is exactly the sort of problem that made me decide to buy a regular television after having previously bought a "smart" television. It does not anger me quite so much as Microsoft trying to get me to pay them a subscription fee to access my own network hardware, but it does drive me in the direction of wanting an open-source set-top HTPC to sit at the interface between dumb viewscreen and Internet.

markomikolavcic 13y ago

Very helpful. I have the LG smart tv and i would like to know if in my case (lg) could happen the same... Just in case to know if it happens. my opinion about these smart tv's is very positive. I like to browse or watch films over netflix or others. Hope that in a couple of years it gets even smarter :)

turrini 13y ago

It amazes me that most of these "Smart" TVs don't use SSL or any sort of encryption in first place.

mobiplayer 13y ago
I know first hand some other brands do.

nfriedly 13y ago

Nice work! I ran into the same issue with my samsung "smart" TV, and I was starting to set up a similar hack when my wife beat me to the punch: hit the "factory reset" option in the menu, and then it loses the wifi settings and stops trying to check for updates.

voltagex_ 13y ago

So from that XML, you seem to control the URLs the TV will grab. Just a few buffer overflows away from root on the TV, and of course you don't really own the hardware you bought until you have root, right?

chavesn 13y ago

It's a good thing they didn't use HTTPS. And a good thing that something else doesn't actually rely on samsung.com (listing services, API endpoints, whatever). This is a cool hack for now but if I had to make a prediction I'd bet there's a future coming where this isn't possible, where the two are even more intertwined -- even though most of us know they don't need to be and wouldn't design our own systems that way.

nixy 13y ago

I build "smart" TV apps for a living. Samsung's connectivity check for their TVs from 2010 has a list of five domains that it checks against. Discovered this during some debugging a couple of years ago. The list, in the order pings are made, is: icq.com (not kidding) yahoo.com samsung.com google.com Some other domain I can't remember

aqme28 13y ago
And it requires all five to connect, rather than just one?

kdot 13y ago

I guess this explains why my Fios TV app isn't working.

beagle3 13y ago

I have a Vizio "smart tv" which is about as "smart"

ndesaulniers 13y ago

Wow now I want to buy a DRM... I mean "Smart" TV!

shavenwarthog2 13y ago

A while back I "hacked" my Samsung TV. I spoofed a DNS entry to point to my laptop, and put a tiny webserver on it. Then I could hit the "News" button on my remote and get obscene fortune cookies on my TV! Then I turned it off. Internet on TV is silly, as far as I can tell. My girlfriend's wonderful Panasonic has tons of internet features -- web, youtube. Web is nearly useless because of lack of keyboard; youtube is awkward; vimeo isn't bad. Using an Android app, selecting your youtube video, then doing "send to TV" is great when we bother to do it. The "smart" Panasonic is a dumb screen in front of Roku. The only other non-dumb features we use is the "play videos from SD card" feature, and the "play from DLNA (my laptop)" feature -- both get used quite often, and work well.