4 ms·
I recently collected a bug bounty from Samsung on a crypto implementation flaw I found in some of their software. The fix is still being rolled out and given t
by patcheudor 12y ago
I recently collected a bug bounty from Samsung on a crypto implementation flaw I found in some of their software. The fix is still being rolled out and given the impact I'm not going to disclose right now, rather I'll let Samsung handle that when the time is right. Anyway, the team at Samsung was responsive and they seemed like they genuinely cared about security. However, based on what I've seen in their products and those from their competitors the first thing I would do is pen-test the voice recognition feature, then turn it off no matter the outcome. The fact is, if it must communicate with a back-end server to work, then it becomes incredibly hard to lock the solution down. Even if the TV is properly validating the public cert of the server when doing the TLS handshake, there's got to be a mechanism on the TV for updating the trusted root store because at the end of the day, certs need to expire and thus must be updated. On a few non Samsung smart TV's I've looked at over the years, updating the trusted root store on the TV is as "easy" as man in the middling (MitM) the network the TV is on so that web traffic goes to a site I own which has a link to the my.cer root CA that I generated and am using in my TLS MitM solution. From there I just bring up the web browser on the TV, click on the my.cer link and go through the prompts to install the root CA. After that point all traffic from the TV can be decrypted on the wire.
Now it is fair to say that the attack I just described requires the ability to MitM the network and have physical access to the device, however, remember that these TV's use an IR remote & all an attacker needs is visual access to the TV. If it can be seen through a window it can be controlled through a window and these things typically don't require a password to modify the WiFi settings. Some smart TVs also have proxy settings which again, typically don't require a password to modify.
Given what I just covered, think hotel. From a risk perspective that's what I'd be most worried about. I wonder how many are installing smart TVs with voice recognition? For all other scenarios basically the situation in many cases on the ground is that you are secure because no one is targeting you. In the case of a hotel, someone could be targeting everyone. Such an attack could prove valuable, especially if done in executive suites near financial centers.
- themodelplumber 12y agoWow. This combined with the fact that economic espionage has been receiving state sponsorship for a long time now is kind of unsettling. Cell phones are bad enough, but TVs...and really anything else that can use voice control (alarm clocks are my personal favorite) could be huge for spies.
- patcheudor 12y agoAlso imagine how many companies are going to eventually purchase these for their conference rooms. I imagine some already have. In pen tests my team always considers how to hide bugs, mostly wireless keyboard sniffers & network taps these days. These TVs offer the ability to hide in plain sight and with no out of pocket expense beyond paying Amazon for a cloud service to run a proxy.
- skybrian 12y agoWould a bug be more practical? Then they don't have to worry about which brand of TV it is.
- patcheudor 12y agoIt depends. If the target is a high security facility that happens to have periodic bug & unauthorized WiFi sweeps this could be a great side-channel vector which could go unnoticed. Of course I'd hope the management of such a facility would know better than to put a smart TV in a conference room, let alone hook it up to the network but honestly nothing surprises me anymore. I've seen older smart TVs in secure areas not connected to the network, but within a hands reach of a network port.
- skybrian 12y agoThat seems like a rather specialized worry since your average hotel isn't going to do any of this? It seems like you might as well go for a walk in a park to have any real conversation.
- netflix_blows 12y agoI was telling a friend, I wonder if samsung are listening to our private conversation via their smart TV, when they said "no we are not, don't worry!" via the speakers. Which was reassuring. Oh wait....
- rodgerd 12y ago> I wonder how many are installing smart TVs with voice recognition? Most of the hotels I've been to have stripped-down TVs (special Samsung and Panasonic models seem to be the most common). That could change, of course.
- saryant 12y agoSome are catching up. I stayed in a hotel last year that had a Mac Mini hooked up to a smart TV with a wireless keyboard.
- roel_v 12y agoWhy go through all that trouble when you can just put a microphone in a smoke detector? That has been possible for decades, yet how often has it been done to people who are low-profile targets?