- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
Hacker reverse engineers his Samsung TV and finds on-device AI listening for your dog and baby, watching what you watch, and borrowing your soundbar’s mic if the TV doesn’t have one. Then OpenAI banned him for reverse-engineering it.
Source:
I have a related question: how feasible is it that a smart TV with wifi turned off can access the wifi connection of connected devices? E.g. a firestick, in my case.
I’m a web developer by day, my gut says a TV probably shouldn’t be able to override a literal on/off setting, but I also know that a software setting is barely enforceable at all.
Well, a quick peak at the HDMI specification doesn’t show any path for the TV to send control signals to the device connected to it via HDMI, stuff is supposed to flow from the connected device to the display, not the other way around.
(EDIT: as pointed out by @[email protected], there is a bidirectional Ethernet channel in the HDMI HEC, so I was wrong in what I wrote above).
If connected via USB, it really depends on the USB implementation being used. For example, USB devices for controlling stuff (so, remotes, mice, keyboards and so on) implement USB-HID which has no facilities to send data the other way around beyond led light status (which is how the keyboard LEDs for things like Caps Lock ON are controlled).
That said, a USB device can have multiple interfaces with multiple protocols, so it’s perfectly possible that Samsung brand devices have additional USB interfaces with either a custom protocol or some appropriate standard protocol so that the USB Host (which in this case would be the TV) can control that connected device and, for example, use that device to send data out via the Internet.
That said, what’s more likely IMHO is the TV using open Wi-Fi network access points visible to it to send data out. Also realistic would be for ANY network connected device from that manufacturer to have an unlisted WiFi access point or backdoor on a seemingly password protected WiFi access point usable by devices from the same manufacturer to receive control from the “mothership” and/or exfiltrate data or worse.
In other words, the most likely scenario is that any networked Samsung device connect to that TV by a bidirectional protocol (such as USB) could have code to help other Samsung devices exfiltrate data and receive commands back from Samsung itself, and ditto for any Samsung networked device with wireless capabilities in your house or in radio range of you house (so, that means your neighbours or people just passing on the street). It’s even technically feasible for Samsung to have added mesh-networking or receive and forward messaging so that multiple Samsung devices with wireless networking but without a connection to the Internet can pass data onwards until a Samsung device with an Internet connect is found) though these things will have less data bandwidth than a direct connection.
The point is that all this shit being closed-source and even very purposefull encrypted so that people can’t easilly reverse engineer it, and given the abundance of Samsung devices out there, it’s perfectly feasible (let’s just say that there being a will, technically it’s not hard) that Samsung has code in all kinds of their devices with wireless connectivity for cooperative surveillance, data extraction and even to be remotelly controlled.
It’s also possible that multiple manufacturers have cooperated in doing this kind of shit, which is less likely, though pressure from for example a nation state - * cough * US, China, South Korea * cough * - for something like this would make it totally feasible.
There is literally a 100Mbps Ethernet channel in the HDMI HEC specification.
Exactly this. How do I control my Amazon Fire TV using my Samsung TV remote? It’s through this spec.
No, that’s HDMI CEC.
It’s one thing to have just a protocol for remote commands to go the other way around - which is very little data - a very different thing is what [email protected] pointed out, which is a massive generic data pipe.
I’ve edited my original post to point that info out.
Thanks for pointing this out.
I’ve edited my post to include that info.
Yeah, but I don’t think most cables have the HEC functionality built in. I think it’s a variant of HDMI in the same way that not every HDMI supports the same max resolution and frame rate.
I think this only works with specifically HDMI HEC cables. This is separate from the CEC functionality used, e.g., for one remote to control both devices. I don’t think most HDMI cables have HEC, and I don’t really think Amazon/Google/Roku have a ton of incentive to help TV manufacturers compete with them for user data, so the included or directly attached cable on most devices probably doesn’t have HEC support.
I would say that the lack of incentives (that we know of) would apply to USB connections too.
Of course, for Samsung to have code in their devices to help other Samsung devices not connected to the internet to work around that lack of connection has nowhere near the same “lack of incentives” barrier as there would be for different manufactures to cooperate in such a thing hence my extended post (which I wrote as I thought about the technical feasibility of doing so and figured out how easy it is and pondered on how exactly would I go around doing such a thing if I was Samsung and made and shipped the kind of devices Samsung does).
As I see it, Samsung phones are by far the devices more likely to be setup to allow other Samsung devices to “talk to the mothership” when the users have denied them Internet connection.
You can definitely send arbitrary data from host to device and the other way around with USB HID. Many keyboard/mice have programmable macros. That is only possible because the host can send arbitrary data in a proprietary format (to save the macros on-device) and the device can too (to tell the software what the macros contain)
That’s not part of HID, it’s a second, usually custom (though it can also be a different USB standard that allows for uploading data to the device, such as USB-DFD), USB endpoint on the device.
In the USB-HID spec the only data that you can send from Host to Device is indicator status (used for example to determine which keyboard LEDs are ON)
Why assume the Firestick isn’t doing spying of its own?
It may well be, but (1) it almost certainly lacks a camera or the ability to screenshot regular cable, and (2) you can unplug it and obliterate it with a hammer and only be out $40.
Who knows? Without the ability to audit that the software is doing by yourself, you just have to trust whatever it is that they say the switch does. Maybe it disables some minor functionality while still doing the majority of the privacy invasion stuff. Maybe it does absolutely nothing whatsoever.
This is the whole reason behind the Free Software movement and everything Richard Stallman has been preaching for the past 40 years. If you don’t have the ability to control the software on the devices you own, they will be used against you.
Gamers Nexus on YouTube made a whole series of videos on LG smart TVs and yea it’s that bad. Check them out if you get the chance.
Who said they have to use your wifi?
My neighbor watches some really weird stuff on the nights my wife isn’t home.
I would guesstimate that the connected device would have to expose and share the wifi connection first, then that would somehow need to be achieved over hdmi with a device such as the fire stick, so, hopefully unlikely
A device like a Fire stick connects over HDMI and sees the TV as a monitor, so there’s no networking there.
The Fire stick could advertise a passwordless adhoc WiFi network that other devices could connect to, but that would only invite trouble.
It would be trivial for Amazon and Google to add HDMI HEC to their devices, and charge TV manufacturers for the privilege of plumbing TVs through them to their Internet connection as a reach around.
Is there any evidence they have done so?
I’m not aware of any.
My reasoning is the main barrier to its widespread use is the premium cost of HEC capable cables, but the sticks that connect directly into the HDMI port eliminate that, and make it much more feasible, technically, to extablish this standardised comms channel.
I’d be surprised if this isn’t already being explored and negotiated for newer models of both.
One counter to it would be a HDMI condom that prevented HEC from being established.