Smart TVs have become extremely common in the last few years; it is even difficult to buy a new TV without smart functionality. Having Netflix streaming built into your TV can be convenient, but connecting your TV to the internet might not be the best idea. The FBI issued a warning this week regarding smart TVs and the risks associated with including your TV in the often poorly secured Internet of Things pool. The warning includes successful attack results ranging from minor annoyances like attacker being able to change the channel to major privacy invasions such as being able to record video and sound of you and your home.
An attacker having the ability to change the volume and channels on your TV would be annoying, but the greater danger stems from more advanced attacks. As TVs have started integrating with 3rd party services, like Amazon Alexa and Google Assistant, some manufacturers have started including microphones and video cameras into their devices. As TVs are often located where people most commonly hang out, often these sensors provide an interesting target to attackers looking to eavesdrop on private conversations or steal personal information. Some manufacturers may even utilize these sensors for marketing and research purposes depending on the privacy policy and device settings. Automatic content recognition technology designed to analyze and report your viewing habits is also included in many smart TVs.
Beyond using the TV to spy on you an attacker may just use it as a starting point into your private network to attack other devices containing more valuable information. Smart TVs fall into the IoT device category which includes a history of poorly secured and vulnerable devices. Some botnets, like Mirai, targeted IoT devices specifically due to their security reputation. Some TVs create their own wifi or Bluetooth network to enable file sharing or control from proximity devices. These can provide a bridge of sorts for a local attacker onto a network they shouldn’t have access to.
The FBI has several recommendations to mitigate the risks associated with putting your smart TV on the network. The first tip is to look through the TV settings to disable the camera and microphone if possible. Along with this, they recommend reading through the privacy policy and opting out of any data collections options included with the TV. If it is not possible to disable the camera via software, they suggest the low tech method of placing a piece of tape over it. Consumers should research the security history of devices they are thinking of purchasing and try to buy from reputable companies to increase the likelihood of future security updates.
Sources
• https://threatpost.com/smart-tvs-cyberthreat-living-room-feds/150713/
• https://fbi.gov/contact-us/field-offices/portland/news/press-releases/techtuesdaysmart-tvs