Many people will find a smart TV under their tree this year. Smart TVs are like regular televisions but with an internet connection. The global smart TVs market is expected to reach 249.9M units by 2024. And all those smart TVs may be spying on you. A while ago I wrote about Vizio (VZIO) getting caught invading your privacy by collecting and selling your personal data. Despite the fact that Vizo had to pay a $2.2M fine, smart TV manufacturers continue to spy on their customers.
ZDNet reports that that smart TVs send user data to tech titans including Facebook (FB), Google (GOOG), and Netflix. These devices are spying on you even when they are idle. U.S. and UK researchers say smart television sets produced by popular vendors including Samsung (005930), Apple (AAPL), and LG (LGLD), alongside content and app streaming devices such as Amazon (AMZN) FireTV, and Roku, are sending out information potentially without the knowledge or consent of users.
Financial Times
Your Smart TV is Spying On You
In a paper titled, “Information Exposure From Consumer IoT Devices” (PDF), the team said that 34,586 controlled experiments found that 88% of devices send information to firms other than the device manufacturer; 56% of U.S. devices and 83.8% of UK devices send your info overseas. They also report every device they studied exposed some kind of information in plain-text.
The researchers from Northeastern University and Imperial College London found that 37% could “reliably inferred” user and device behavior from eavesdropping on the user’s interactions with television sets and other household IoT products.
The study found that almost half of the tested devices contacted Amazon. That includes devices not manufactured by Amazon. David Choffnes, one of the authors of the paper warns that Amazon has a lot of information about what you are doing in your home.
According to the paper location data and IP addresses were commonly sent by our IoT devices to third parties in the cloud including Netflix, Spotify, Microsoft (MSFT), Akamai (AKAM), and Google.
When it came to smart TVs, however, almost all of the devices included in the study would contact Netflix — whether or not a TV was configured with an account for the content streaming service. “This, at the very least, exposes information to Netflix about the model of [a] TV at a given location,” the paper reads.
Some of the tech titans collecting your data responded to the researchers.
- Facebook said that it was “common” for services with Facebook integrated into them to send data to third-party services.
- Netflix said that data transfers were “confined to how Netflix performs and appears on screen,” and
- Google said user preferences and consent levels dictate how publishers “may share data with Google’s that’s similar to data used for ads in apps or on the web.”
Internet-connected smart TVs combined with streaming services like Netflix and Hulu seem to be a cord-cutter’s dream. But like anything else that connects to the internet, it opens up smart TVs to security vulnerabilities and hackers. But as is the case with most other internet-connected devices, manufacturers often don’t put security as a priority. Not only that, many smart TVs come with a camera and a microphone that attackers can access.
FBI warning
Because manufacturers don’t put security as a priority, the FBI issued a warning about the risks that smart TVs pose. The FBI warned that hackers can take control of your unsecured smart TV and in worst cases, take control of the camera and microphone to watch and listen in.
… TV manufacturers and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home … your unsecured TV can give him or her an easy way in the backdoor through your router.
TechCrunch notes that some of the biggest attacks targeting smart TVs were developed by the CIA, but were stolen. The files were later published online by WikiLeaks.
rb-
If you are interested in inspecting the IoT network traffic in your smart home, Princeton University has developed and released an open source tool called IoT Inspector. The software uses ARP spoofing to analyze what IoT devices are connected to the Internet, how much data is exchanged, and how often information is traded.
Related Posts
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.
The Godzilla Christmas Tree! The King of the Monsters is wrapped up in lights and equipped with glowing red eyes and the ability to breathe fog machine smoke while wearing a Santa hat.
