LG TVs Caught Spying Even When Offline or On Standby (theverge.com)
- Reference: 0185528568
- News link: https://yro.slashdot.org/story/26/09/08/1634205/lg-tvs-caught-spying-even-when-offline-or-on-standby
- Source link: https://www.theverge.com/tech/991190/lg-tv-spying-standby-recording-wi-fi-scanning-gamers-nexus
> Gamers Nexus partnered with fellow YouTubers Level1Techs and independent security researchers for the investigation, which involved testing retail LG OLEDs. Packet captures showed the TVs scanning the local area network for nearby hardware like phones or smartwatches, as well as logging location data and details of nearby Wi-Fi networks, and feeding the information back to LG Ad Solutions. Perhaps more concerningly, the TVs were capable of recording microphone audio when in standby; this continued even after the TV was disconnected from the internet, with audio files stored offline and uploaded once a connection was restored.
Earlier this year, LG was found to be [3]silently installing an adware-like app on Windows PCs that ran pop-up ads for other LG apps and even McAfee antivirus.
[1] https://www.youtube.com/watch?v=6IFVTcM28KA
[2] https://www.theverge.com/tech/991190/lg-tv-spying-standby-recording-wi-fi-scanning-gamers-nexus
[3] https://hardware.slashdot.org/story/26/07/20/1736218/lg-monitors-silently-install-adware-like-app-on-windows-pcs
Nope (Score:3)
TV can't do much in the way of spying if I don't connect it to the internet now can it ?
Run it through other hardware ( assuming you trust it ) that is internet connected and let
said hardware simply pass the audio / video to your TV.
Re:Nope (Score:4, Insightful)
Until they get an edge TPU to process the locally gathered data and send the results (now much reduced in size compared to the raw data) to the mothership, using 4G/5G. Like modern cars are already doing.
Re: (Score:2)
No standard consumer TVs has a built-in secret 4G/5G modems.
Wifi is in all the modern "smart" TVs", and there are plenty of companies that sell Wifi access to businesses. These can be a hidden SSID or a broadcasted one (easier detection) with known access rights. But I have zero data on if any of these TVs are paying to access that wifi loophole.
My "smart" TV pings me to connect to the Internet and warns me that my software may be "at risk" if I do not update it immediately. Tricking end-users into connecti
Re: (Score:2)
"No standard consumer TVs has a built-in secret 4G/5G modems."
Oh, so you've personally audited every tv on the market for this tidbit? Last time i checked, TV's use off the shelf ARM SoC's meant for low end phones and tablets, most of which have built in 5G radios now.
Now, most TV's may not have said radio active, but how would you know? The TV certainly isn't going to tell you.
Re: (Score:2)
They use cheaper version of the SoC with no modem. Even the iPad has no cellular modem (in its wifi version) because of the costs savings.
Also, even if the modem was there built-in to the SoC (and not disabled by eFuses and not binned out from a smartphone batch because of defects), you still need RF transceivers, power amplifiers, filters, antennas... these are hard to hide, especially if you don't have a cellphone tower just out of your living room's window.
Re: (Score:2)
Given the price point of these TV's I suspect 4G or 5G service is going to be prohibitively expensive to enable. I suppose if they thought the total lifetime revenue they'd be able to earn by snagging your data exceeded the cost to gather it, they'd do it.
Personally, I just don't allow TV's to talk to my local network at all. If for some reason I felt the need to do so, they'd be on a separate vlan with no access to a gateway to the outside world.
Google and Amazon are already doing the same thing along wi
Re: (Score:2)
I can't play from my server if my TV isn't connected to the network.
Re: (Score:2)
Why is it not sub-netted to a non externally routable address ?
Re: (Score:2)
Why not an HDMI cord from server to TV?
Re: (Score:3)
> TV can't do much in the way of spying if I don't connect it to the internet now can it ?
The problem is the app for the same streaming service might be better on the TV than it is on the cable box. I've given up on the "upgraded" cable box I've had for about a year. The built-in apps generally suck, poorer performance then the old box that was replaced. Most of the apps stutter. The DVR playback stutters. Switch to the corresponding apps on ApplyTV or a Firestick and they are fine.
Re: (Score:3, Interesting)
> TV can't do much in the way of spying if I don't connect it to the internet now can it ?
The TV they looked at tried to connect to the neighbor's Wifi. So it could if it found a public (or badly configured) access point.
FTA (Score:2)
From what I've heard, they scan for open WiFi networks and auto-connect to upload data. They don't tell you that they are doing this.
Re: (Score:2)
> TV can't do much in the way of spying if I don't connect it to the internet now can it ?
And yet if you actually watch the in depth discussion, the TV very much may find its own way on the internet, even if you don't connect it to anything yourself. A good portion of the story is dedicated to those people who think using them as offline dumb TVs is okay, being wrong.
Good time to mention Plasma Bigscreen (Score:2)
[1]https://plasma-bigscreen.org/g... [plasma-bigscreen.org]
Unfortunately it doesn't appear to be a drop in replacement for smart TVs, but you can get most of the way there regardless.
I don't trust any smartTV providers. LG may be the target of this story, but I'm sure all of them are guilty of this to various degrees.
[1] https://plasma-bigscreen.org/get/
Re: (Score:2)
The problem with Linux is that most streaming services cap your streaming res at 720p or 480p
Re: (Score:2)
My mother's basement gets pr0nHub at 1080p minimum, you insensitive clod!
Re: (Score:2)
Well that's a different, and entirely solvable, problem.
Hoist the colors, ye scallywag!
Re: (Score:2)
The smart TVs run Linux. The problem is, that you need a intact secure boot chain for the CDM to certify that your device is "safe" (against you ripping the stream).
Sorry Costco ... (Score:2)
Sorry Costco, I've reconsidered that LG you've been offering. You might want to have a talk with that supplier so you do not get tainted in all this.
Location of microphone (Score:1)
I do not trust any mechanism provided by LG to disable the microphone, I am tempted to physically disable the microphone. An important question is where the microphone is. The Magic Remote has a microphone, if it is the only microphone for the TV then I can just stop using it. If the TV has a microphone in it then covering the opening for it might muffle it sufficiently. Otherwise the TV must be opened to get to the microphone. I am not asking for help, I am saying this in case it helps others.
Re: (Score:2)
> I am tempted to physically disable the microphone.
I am far, far more tempted to not buy LG products, or any TV that requires any kind of network connections whatsoever. When I can long get a dumb TV, I will stop watching TV entirely. It won't be much of a loss.
Re: (Score:2)
I am curious why a tv even has a microphone.
Re: (Score:1)
> I am curious why a tv even has a microphone.
It is to issue verbal commands.
Or rather, it lets you issue verbal commands, and their on-box marketing provides that as the reason it exists.
Clearly it isn't the only reason.
I got a free firetv in some silly contest and remember it came with a remote that had a mic for the same purpose.
The remote had few other buttons, mostly it was a direction pad interface for navigating menus.
The voice recognition was far better than using the on-screen keyboard!
They didn't use a 'wakeup word' but a button to hold down
Re: (Score:2)
Not one, multiple. Even if you didn't have a TV with a multi-AI client including LG's own "Hello LG" AI assistant, there's still microphones for things such as sound correction and DSP from the shitty shitty little speakers in these things.
And that's before you get into the nefarious things such as content fingerprinting.
Re: (Score:2)
You keep using that word "microphone" in a singular. No the TV doesn't have a microphone. It has microphones. Multiple. The story even covered the relative different sound qualities from the various microphones using a jailbroken LG TV.
I wonder whether that is just the US version (Score:2)
In the EU, this ranges from highly illegal (under the GDPR) to actively criminal with personal penalties.
Re: (Score:2)
in the US, this is called "monetizing" and is business as usual. If you disagree you are just a communist who likes big government regulations. Also corporations can legally buy politicians in the US. Again if you disagree you are just a communist who likes big government regulations.
Re: (Score:2)
Yes. That is why I am asking.
Re: (Score:2)
GDPR is about processing not about recording. It is illegal under the laws for covert surveillance devices that require destroying "smart" puppets that can talk to children and similar stuff you won't expect to have microphones. While the TV is advertised to have one, at least guests may have a reasonable expectation that most TVs don't have one, so there is a good case for a lawsuit.
Re: I wonder whether that is just the US version (Score:2)
It's about collection also. You can't collect without consent. "Opt out"-type consent is illegal. Only data you need for the service you are providing can be collected (you can't collect data "just in case it'll be handy in the future"). Lots of stuff like that. None of this would be legal under GDPR. And the fines would be huge too, typically calculated as a percentage of revenue (not profit!).
Break that shit company up (Score:2)
"LG Ad Solutions" should not be a thing.
So what actually was it doing? (Score:1)
I'm not interested in watching some youtube rant/ad for two and a half hours, so I tried to skip to the local network activity. I think I found it, but all they're talking about is mDNS and a service scan, which makes perfect sense for a modern TV. Their last video about LG was a load of crap, and this one looks like another.
Seriously, an "interceptor" to sniff network traffic? Fancy name for a laptop with Wireshark, or a frikkin firewall. And showing off their poor network hygiene wasn't the most cl
Re: (Score:2)
Maybe you shouldn't have skipped the rest of the video then, and you could have understood the issue in its entirety
Re: So what actually was it doing? (Score:2)
What where they rooted the tv then said "sEe LoOk WhAt ThE tV iS cApAbLe Of!!!ii!11". At no point did they actually prove LG TVs indeed spy on you. I believe they do, but this video does not provide an inch of proof.
The video is a joke if you actually want to waste an hour of your life.
Re: (Score:2)
You mean other than actually demonstrate that the TV is taking logs of everything and sending 9MB of text per hour (which were the logs of everything) to a 3rd party? Yeah other than that it's nothing.
> At no point did they actually prove LG TVs indeed spy on you.
They... didn't... need to. They linked to examples where LG were directly telling their partners that they are spying on you and were proud of knowing every device in your house. There's no burden of proof once the accused party comes out and flat out admits guilt. Like what do you think LG is selling to partn
Re: (Score:2)
> I think I found it, but all they're talking about is mDNS and a service scan, which makes perfect sense for a modern TV.
You didn't find it. You found the thing they flat out said makes sense to do. Keep watching.
Neighbor (Score:2)
If it connects to your neighbor WiFi, even better. It will think your neighbor is watching everything and target them and their devices.
Re: (Score:3)
"Hey LG, find my remote"
"According to our surveillance records, you left it in the bathroom again. It's under the red towel."
"Thanks LG!"
Looks like Goldstar ran out of Luck. (Score:2)
I have an LG TV from before 'connected smart' was a thing. Plenty of connections, still works, a bit small by modern standards. I am usually loyal to a company with a product that works for so long without issues - so much for that.
McAfee Antivirus? (Score:2)
I'm unaware of this McAfee Antivirus.
I thought McAfee was a virus in and of itself. It certainly acts that way
Re: (Score:2)
John McAfee agrees with you. And he has an excellent video on how to remove the anti virus software from your PC.
At what point someone goes to jail? (Score:2)
Individuals can be charged for voyeurism. Why not corporations?
Re: (Score:2)
Because of corporate greed and "freedumbs" ...
Re: (Score:2)
> Individuals can be charged for voyeurism. Why not corporations?
No voyeurism is only a crime without consent. You gave consent when you clicked "I agree" (despite not reading the thing you agreed to).
Re: (Score:2)
My VIZIO has never been connected to the Internet. When new, it asked for me to agree to terms and conditions, but allowed me to select "Later". It needs this connection to download and display terms and conditions. About once every 6 months, it gives the same popup, but with no option to bypass. A factory reset takes care of that for the next 6 months. Nothing in or on the packaging says "needs an Internet connection".
> No voyeurism is only a crime without consent.
There are a few pre-teens running around in my house. Playing Captain Underpants for all
Re: (Score:2)
Unless you can pay $1 Million to have a seat at Trumps coronation...you have no such input into the system.
Who's making the dumb ones? (Score:2)
I hear wal-mart's TV's are sold at such slim margins that some might actually be at a loss for obvious advertisement reasons...
But there are plenty of commercial displays out there set up in mosaic mode that are obviously not smart...
Who's making "TV"'s that are dumb? Sure, I could get a monitor set for HDMI 1, but I don't know of many that are 55" and have even half "decent" sound
Never connected (Score:2)
This isn't entirely new. Bits have been discussed before, but this seems to be a more through investigation.
This is why my LG has never been connected to the 'net, and it's always been used as a simple screen.
But still, frak LG for all this.
Why should the NSA hack you (Score:2)
When you spend money for the surveillance devices to put them into your living room?
LG Phone Home? (Score:2)
I have a LG WebOS TV. I do not care who knows what I am watching but I would prefer not to have anyone listening to my conversations or reading transcripts of same.
I don't think I've ever displayed my login password on this TV, but I have probably displayed my wifi password, and probably other passwords. A clever program running on this TV could conceivably give away my secrets even though I've never connected it to a network.
Someone do Samsung next I guess, that's the other basically competent brand in thi
1984 (Score:2)
Apparently, it was a good instruction manual.
Water is wet (Score:3, Insightful)
you didn't really think that TV was worth $199 for 75" of 4K HDR?
Re:Water is wet (Score:5, Informative)
That doesn't mean drawing outrage and attention to it isn't useful. If bad corporate behavior isn't verified and amplified, no action will be taken against it.
Re: (Score:3)
This has been industry standard practice for 10 years. We've been complaining for that long. We're just ignored.
Re: (Score:2)
It seems like a LOT of effort is being put into it.
Scanning for WiFi/devices seems almost beneficial to the user. It's like 'preloading connections' in case you want to display something.
Delaying the report until you're online also seems like a standard reliability feature. (ignoring the content for now.)
But other parts of the report, like "recording audio when you're playing through other devices" sounds completely illegal, and 'over the top.'
Are there a lot of EULAs that you have to click through to tu
Re: (Score:1)
Usefor for grandma, who doesn't understand wifi or connections. Except that i deliberately don't give my TV my wifi password or connect its ethernet. But I can't control the neighbors leaving their guest wifi unprotected, so my data can still be exfiltrated.
Re: Water is wet (Score:1, Offtopic)
Aluminum foil that shit bruh
Re: (Score:2)
The scanning is beneficial. Any modern TV looks for local media sources, just like every phone looks for things to which you may want it to stream. This video treats mDNS and service scans like something malicious. That makes me suspicious of all of their other claims.
Re: (Score:1)
Yes, it's obviously malicious. No media device needs to enumerate all devices in the local network and send the list to the mothership.
Re: Water is wet (Score:3)
LG allows you to revoke consent to terms and policies. When you revoke consent you lose access to features, including up to all smart features.
You must accept terms of service to basically do anything, but you can for instance revoke all microphone consent and avoid any concerns of your audio being sent to LG.
Still a shitty company for putting ads on a $3000 tv.
Re: (Score:3)
I never wanted any of the "smart" shit on my television in the first place. If they disable everything and leave me with a "dumb" display I'll be all the happier for it.
Re: (Score:2)
Let me connect an external hard drive full of music and movie files - that's all the smart I need. Otherwise, HDMI input and ATSC.
Re: (Score:2)
> but you can for instance revoke all microphone consent and avoid any concerns of your audio being sent to LG.
Trusting LG to stop spying on me by telling them "stop spying on me" requires a level of trust I simply do not have. Does anyone really believe that LG will honor any of your choices?
I seriously hope no one thinks that clicking a checkbox actually turns off the LG spy features, because I'm pretty sure it doesn't.
Re: (Score:1)
so my LGTV just updated a few days ago. I use it mostly as a dumb monitor, but it also needs connection to my LAN for some home automation stuff. Bottom line is, when I tried to open one of the "apps" directly on the TV, I was asked to agree to their TOS. The problem is, there are several listed, including the most egregious of them all, but sadly, there was NO WAY to only approve the basic TOS agreement without agreeing to all of them. I didn't, then blocked all the outgoing and incoming data on my route
Re: (Score:2)
Yes, the EULAs for LG TVs are extensive. They present you with multiple pages of agreements and track your acceptance of each one. If an agreement is updated, they prompt you next time you turn on your TV and track your re-acceptance of that agreement. You can't use the TV without accepting, although you can generally opt out of agreements for specific features and advertising in a straightforward manner. It's been a few years since I had an LG TV but I remember being impressed by the robustness of the soft
Re: (Score:1)
You're just data... accept it.
Welcome to the new. You read every word in your cell phone contract and Terms Of Service, right? Same for your ISP? It's all spelled out in them.
Hate to tell ya, as long as any of your devices are connected to the 'Net (or cell network)... forget about privacy.
Re: (Score:2)
All the reason to scream louder. I'm all for it.
Re: (Score:2)
Just tell people it's like having a Flock camera in their living room. For whatever reason the same people who put up with all of the other spying shit seem to hate Flock cameras, so the best way to convince them that this is a problem is to liken it to that.
Re: (Score:2, Insightful)
Yes.
Your TV sucks up like 20-25% of its power consumption even when its turned off. Before I even got this TV, I used a device between the TV and the wall, to I turn it off when I'm not using the TV (easy with a smart speaker).
When I am using the TV I use a separate device (Chromecast), not the TV itself, so they can't spy on me through the TV itself. Also, the TV lacks Internet.
Tell me again why getting a cheap TV was a bad thing.
Re: Water is wet (Score:2)
Oh but they can spy on you and they do. They record what is shown on the screen, often as periodic snapshots, to determine what you are watching. It does not matter that you use chromecast; as long as it displays on your screen, the TV Can record it.
Re: (Score:2)
> Oh but they can spy on you and they do. They record what is shown on the screen, often as periodic snapshots, to determine what you are watching. It does not matter that you use chromecast; as long as it displays on your screen, the TV Can record it.
And they sneak in and swap out a memory card when you're not home?
Re: Water is wet (Score:2)
No, but there are reports of TVs scanning for unprotected WiFi networks and connecting automatically using those, if available. Nowadays, I also wouldn't be surprised if the unit contains a 4G transmitter to send data over the mobile network.
Re: (Score:2)
What's that called, Automatic Content Detection? Sadly, every TV does it.
Re: (Score:2)
And the TV does not have my WIFI password and the MAC address is blocked on my router from both obtaining an IP address and on the outbound firewall rule.
Re: (Score:2)
LOL, you use a smart speaker. Intentionally allow companies in, while claiming to protect yourself from them. Oof.
Re: (Score:1)
If you connect your television to the Internet, you get what you deserve.
Don't be stupid. Problem solved.
Re: Water is wet (Score:2)
The summary says they were testing OLEDs, so you need multiply that price by ten. ;-)
Re: (Score:2)
I didn't think it would be spying even if I never connected it to a network. I don't know yet whether it still is somehow, because I'm precaching the video to make sure I get to watch the whole thing. It would have to have a cellular modem in order to report anything back in my neighborhood since there's no open APs, unless of course it hacked something. That would be exciting.
Re: (Score:2)
> you didn't really think that TV was worth $199 for 75" of 4K HDR?
The models they were testing were $3000 TVs, not your bargain basement rubbish.