cross-posted from: https://lemmy.world/post/51634640
A new Gamers Nexus investigation found a retail LG TV actively scanning the local network for phones, laptops, smartwatches and other connected devices, while also capturing microphone audio when the screen appeared to be in standby. The investigation found voice data being stored locally even after the TV was disconnected from the network, with the queued data uploaded once connectivity returned. Researchers also uncovered webOS vulnerabilities that could potentially turn the television into a remotely controlled surveillance device. The really unsettling part isn’t just the advertising angle. It’s the fact that a consumer television can sit inside your trusted network, enumerate other devices, access a microphone, store collected data locally and communicate with external infrastructure. Put that same device in a corporate office, hospital, hotel or conference room and the security implications become considerably more serious. I went through the investigation in detail, including the network scanning, microphone behavior, ACR, webOS attack surface, offline data collection and practical mitigations
Don’t connect TVs to your network.
And according to the article the data collection runs even if it’s disconnected. So, don’t ever connect it to the network. As soon as you do everything gets uploaded.
Could I burn a hole through a WiFi chip with a soldering iron?
Only one way to find out.
Oops I meant to reply to the person saying Gamer’s Nexus found LG televisions connect without permission to any insecure Wi-Fi networks within range in your neighbourhood. Otherwise it’d seem a bit extreme to burn a hole through it :p
My TV is too old for this to matter yet but I’d research a way to physically disable network hardware before buying any specific model next time.
This would’ve worked just a few years back but due to shitty “age verification” laws, even TV manufacturers willl force users to create an account the very least for the TV to even start up. They may also implement an always-online model and they’ll justify that it’s necessary to monitor users for “age verification purposes”. ATP better to get a good monitor and use it as TV cuz cable or satellite boxes are either way gonna be provided by the network companies so that’s there
This would’ve worked just a few years back but due to shitty “age verification” laws, even TV manufacturers willl force users to create an account the very least for the TV to even start up.
Surely only for “smart” features but without enabling any of that shit, you shouldn’t get any age verification prompt.
I could see them doing it anyway as OTA broadcasts include rating data.
That said, if it’s a family TV, you’re never going to put everyone on it, just the oldest one anyway.
Impossible - no one would buy them, and that idea would die.
Although usb stick firmware updating is super annoying
The TV should just act as a TV with input ports. Why update the firmware?
I’ve had to update for ALLM support and such. So feature support. I don’t care for the TV’s OS updates
Works for now, but my fear is when that may not broadly be the case.
This is the only correct answer. Discussion over.
So I should connect it to someone elses network?
I wonder if any of such devices use nbiot or alike…
“We own the glass, we own the TV, we own the living room. We know who is in an LG home.” –LG President of Ads
These are the Gamers Nexus videos these articles are referencing btw. Support them and their work. Get some cool shirts and physical media while you’re at it.
I’m watching the main one right now (your second link). Holy shit.
It’s not just LG. It’s all of them.
And, the cheaper the TV, the more often and intrusive these settings are.
It’s honestly better to just have a bare wall and a projector.
It’s honestly better to just have a bare wall and a projector.
Consumer projectors come with the same “smart” shit as TVs these days. Just don’t connect either to WiFi. Problem solved.
Apparently not solved. They can connect to open (and hidden) networks without your consent.
Per the marketing chief at LG; (paraphrased, from memory) “we own the glass, and we know everything beyond the glass.”
They can connect to open (and hidden) networks without your consent.
That’s a wild claim and either I accidentally skipped a paragraph in the article or you should cite a source. Quick googling doesn’t show up anything of that sort for me.
It’s in the 2h long Gamersnexus video. The TVs aren’t connecting to open WiFi networks but connecting to other LG TVs within range. That forms some sort of mesh network that lets the TV access the internet. Apparently it’s not illegal wardriving because “they own the glass”.
I don’t have any specific evidence on hand, but I do know a lot about the technology and companies involved from working in adjacent fields (cloud architecture) and it is absolutely plausible that they can and do. If they are not doing it already (and I believe it is highly doubtful that at least some devices do not already do this) then it is certainly on their roadmap. Many consumer IoT/media devices have invisible, hidden wireless networks built in and have for years. If it’s advertised, it may boast some sort of “quick connect”, “auto configuration” or other convenience feature, it may be genuinely required for low-latency/quality-of-service (for example on most modern TV services which supply the channels by IPTV behind the scenes), but it’s always on, it’s always listening, and it’s only a friendly partnership agreement away from being used for whatever “legitimate” purposes a company may dream of.
Tech surveillance is extremely out of hand and has gone so far beyond anything would consider reasonable, I understand that you would instinctively reject it as too extreme to be believable. But in the industry it’s completely normalized and they don’t even give it a second thought, it’s just business as usual.
I’m looking for a source as well. The “apparently” I used was supposed to cover the whole comment, but I can see how it didn’t.
The video goes into detail, and could be staged, but comments seem to support the idea anyway.
Amazon devices are known to do this with other Amazon products to create a mesh.
It’s not outside the realm of possibility.
Look for articles about amazons sidewalk network and devices that connect to it without any kind of authorization from users.
That shit has been around since the echo came out and it’s open to any manufacturer.
There’s are lots of articles but my phone is too slow to load them at the moment.
I looked for but didn’t find any about LG TVs, the actual topic here and what the wild claim was made about.
I’m not sure if LG connects to it, but it’s an open standard and like LoRa, has a decent range, so there doesn’t seem to be anything stopping them from adding it to their TVs.
Plus from the article:
It also picks up the SSIDs and signal strengths of neighboring Wi-Fi networks visible to its wireless radio, building a rough map of the surrounding area, and includes location data tied to those network identifiers in what it collects.
This is active scanning, not passive listening: the television initiates the queries, processes the responses, and packages the results into structured data. The researchers confirmed the behavior happens out of the box, with no extra configuration needed, and found no setting that disables the LAN sweep on its own, separate from other smart features.
It doesn’t mention connecting automatically to unsecured networks, but it sounds like one OTA update away from that capability (The sidewalk network works this way, which is why I mentioned it). LG is already lying about the transcriptions taking place, so there’s no reason to trust them, which I think the point of this thread was.
It’s hard to find a dumb TV.
Monitors and projectors are going the same way. Not connecting them might not be enough.Time to learn how to use a soldering iron.
modern ones are soldered directly to the board and integrate bluetooth into the same chip and removing that chip form the board could remove the ability to use bluetooth functions and the remote, however!!! most have usb ports!!! lets make new operating systems and fucking delete their file system, load a new os that lacks the abilities these manufactures have.
The hardware is whatever but if we remove the file systems that its preloaded with it won’t be able to load any of its preinstalled shit. If we mod the operating system we can mod some of the shit the hardware is capable of doing through the software and coding. Kinda like how windows 11 is known for lowering ram speed.
Why are you concerned with the USB ports?
I think he’s suggesting said OS could be installed using them.
Thanks, threw me for a loop when they recommended trying to unsolder a chip from the sbc and expecting it to still work as a tv at all.
It is like trying to find a new car that doesn’t have one of those fucking screens instead of a real console.
I keep my tv dumb by not connecting it to a network.
deleted by creator
Bosch fucking dishwashers do this, once connected there is no way to disconnect them so I sink all its outgoing traffick at the router level
Complete garbage
Yeah, what kind of idiot wants an internet-connected dishwasher?
How about an AI-powered pair of chopsticks?
In a perfect world?
I’d love access to diagnostic data. Is the filter starting to clog? Is any part not working as intended? I’m a big fan of preventative maintenance, but also really bad at sticking to an arbitrary recurring schedule (e.g., clean the filter every 6 months). This could also be accomplished with Bluetooth and an offline-only app on the phone.
In the real world? Nobody provides this, and the privacy risks aren’t worth it.
I do have my dishwasher on a ZigBee power meter to 1) track energy use and 2) give me a good-enough estimate of time remaining by starting a 2h timer after it starts.
You CAN do this with a few products of diff companies with the help of home assistant and plugins BUT many companies are pulling off support OR restricting features to its own app and giving free access to the bare minimum voa protocols like matter and all. I read somewhere on reddit that a robovac company had matter access technically but only the vac on off switch access was there and none of the other basic functions. For that you need their app. But again, still some companies do support all it’s features on home assistant. Many light fixtures, switches, ACs and much more support it. So yes you can run them locally BUT it all depends on the manufacturer how much control they are willing to provide openly
This could also be accomplished with Bluetooth and an offline-only app on the phone.
But WHY! If those diags are important, then just put them in the local display of the machine itself.
That costs money.
exactly! it’s so useless they had to hide regular features under the wifi connection to force customer’s hand
Why would you connect a dishwasher to the internet? Setting a timer can tell you just as well if the dishes are clean.
Sadly, the only way to change most of the settings or running a cleaning cycle is via the app. It’s insane.
No way in hell id buy that. Soon as the app is dead so is your dishwasher, at the whim of the manufacturer
Planned obsolescence is great isn’t it. /s I try to keep my appliances on life support as long as I can.
Mh. What about… creating a guest network, connecting that abomination to that and deleting the guest network? Hopefully it can remember only one…
Why wouldn’t a company this dedicated to advertising just install a cheap cell network modem in them? You’re talking pennies on a device that costs hundreds of dollars.
While this is possible, ongoing network costs are involved with that. Also, hard to hide a cell network modem.
Not so sure if that is done when many people connect their device to their WiFi anyway, if they are forced to because some settings can be changed only with the app?
My TV is wired to the router but blocked from WAN access.
Only connected to the internet to install jellyfin on it.
Imagine when it’s turned on…
This is why I don’t let my TV watch porn.
… Well great, now I have to check whether my television has a goddamn microphone for some reason. I didn’t think to check because it’s a television.
Never connected it to the Wifi though.
Doesn’t anything with a speaker have an inherent shitty microphone?
Does it have voice command capability?
My LG TV is blocked from my network and always has been. However, the andriod tv connected to it is a different thing, so it’s more or less lost cause anyways and I haven’t had enough incentive to block the android box from the rest of network since it’d need some tweaking so that casting and other occasionally used features still work. And even if I’d block the android tv box there’s still our cellphones gathering all the data, so I’m pretty much just running things on hopium that EU offers at least some protection on my data.
Well, if you watch the Gamers Nexus video, you’ll see that even if you don’t connect your tv to the internet, you’re still not safe.
If you are going to have smart devices, put them on their own VLAN. They should not have access to the rest of your network. TVs shouldn’t be connected at all. Use a PC or android box if you want to stream stuff.
The issue in this case is that they apparently use text to speech locally, store that information on the device itself, and then if at any point in the future gets connected to the internet for any meaningful length of time (be it by a subsequent owner) it will then be sent on to LG… for safekeeping of course /s
The deep-dive by GamersNexus is pretty in depth.
In that case, it should be disposed of like an SSD that contains sensitive information. Find the flash chips and either drill holes through them or smash them into dust with a big hammer.
Just desolder the mic
That would work if you can open the case without breaking it. Modern TVs are usually clipped together and the bezels are really thin. It’s very easy to crack the panel when trying to get the case apart.
Is it not the mic inside the magic remote?
So get power strips and turn them off when you’re not using the TV.
Also keep them off wifi/network and you should be good unless they’re smart enough to try to connect to any open network they can find like some sort of malware
unless they’re smart enough to try to connect to any open network they can find like some sort of malware
Uhhhhhhh, bad news there. Many companies have been found to have their stuff make hidden networks and share info these days. I am sure you could figure out a work around if you are savvy enough, but the normal dood? Fucked and pretending this is normal.
Which is why I said just get a power strip. Can’t hack a TV that’s not plugged in.
Yeah maybe there’s way to make a file explorer for them. Maybe there’s ways to jailbreak them. We focus on phones a lot, webos was on the hp bought out palm phones back in the 2010’s.
We find out the operating systems, we jailbreak them and completely remove their programming and then, in-turn we can mess with hardware settings.
So let’s start making a TV Linux that doesn’t suck or make an Ubuntu TV version or a KDE TV version.
They can’t force people into using their OSes forever. The only thing I know is it’s like Pandoras battery trying to disable the wifi from the hardware.
Many? I heard a rumor about one Samsung TV connecting to an open Wi-Fi network, but I’ve never heard of many companies creating hidden networks.
Is this anything a VLAN and Pihole can’t fix?
Edit: looks kind of impossible to prevent, if it can access an open Wi-Fi nearby.
Possible that they are piggy backing on other hidden networks. I remember there was a whole thing with Samsung years ago with their stuff doing something like that, and there are a few patents around that propose hidden networks from the “internet of things” days.
I just don’t want to even truck with this nonsense, where the fuck is the line before we just stop using these things? I know there must not be a line, since we are talking about circumventing our shit spying on us like it is normal.
All of this needs to be illegal, but piggybacking especially does. Circumventing the will of the end user (aka the person who should be considered the owner) as for what the product in their possession, home, and use does shouldn’t be tolerated
For now the only known thing to do that works is for it to never to be connected to any network.
Also if a smart tv was connected to the WiFi there is a possibility it won’t forget that until factory reset.
Is this anything a VLAN and Pihole can’t fix?
You can simply put it on a guest WiFi network that cannot see any other networks and just put a password on your main network, it is not that difficult.
That’s what I do at home with a Ubiquiti setup. Seperate network with client isolation enabled.
Others do too
I was radicalized when a Roku TV told me I needed to be online to change an input name from HDMI1 to Xbox. Motherfucker WHAT.
I want to care… I really do… But untill ceos and those who decided this was OK are killed, it will continue. Money means nothing to these evil people.
Probably safe to assume every other smart TV brand is doing the same, but just no one has gone to the effort to check…
Remember: all that is done simply to give LG executives, like, a few dozen bucks over the device’s lifetime.
Customer privacy means nothing at all to them. They sell it for pocket change.