Hacker News Reader

They could eventually use ethernet over HDMI or simply include a cellular modem of some sort. The profit is there.

But a simpler solution that we are already seeing a bit is to simply require a network connection to function at all; for now, it's just a periodic check, but a persistent connection requirement is all but inevitable in the medium term.

Devices having cellular modems isn't something new. Many cars already ship with them, for various purposes. WiFi will likely remain in use with smart TVs for a while as video content is data intensive so not really well suited for cellular, but likely stuff like your dishwasher or your stove might include cellular modems in the near future. The data they transmit is limited and you make setup easier as you don't have to type in a WiFi password any more.

Baseband not for video streaming, but just for telemetry. I mean, this is a thing: https://www.twilio.com/docs/iot/supersim/getting-started-sup...

Difference between a car & a dishwasher is that a car is typically outside (at least during use) which would help it to get a signal.

Anecdotally inside my house, phones generally get no/weak cell service but WiFi is accessible anywhere in the house.

Obviously they could include both, but if it were relying only on cellular, my washing machine quite possibly couldn't get a connection

Carriers run IoT-specific networks[1], which are optimized for use cases such as telematics (low power consumption, low bandwidth usage, but high penetration and coverage). So it's entirely likely that your washing machine would be able to happily send along telematic data via the same carrier your cell phone can't even establish a connection to.

[1] https://www.business.att.com/products/lpwa.html

> They could eventually use ethernet over HDMI

There’s no business model where the STB wants to route Internet traffic on behalf of the TV. Ads on the TV compete with the STB.

> or simply include a cellular modem of some sort.

Yes, an ad platform running over the lower bandwidth but cheap IoT service could justify including this hardware.

Of course, leaving it unconfigured with the open access point has its own risks, given the password is hard-coded to 1111122222: https://twitter.com/silascutler/status/1354521609692995585

I have a Samsung smart TV from mid-2017 and it does not appear to be broadcasting a visible SSID, nor a hidden one. Presumably that has changed in the past couple of years?

if it remains in that terribly insecure state by default until you give it a connection to a network, unfortunately the only thing to do might be to give it the password to a $20 mikrotik wifi router (in a 20MHz 2.4GHz channel) as an AP, so as to not pollute the empty radio channel spectrum in your house, that has no connection to the outside world. What an ugly hack.

Or give it the password to a secondary ssid set up on your main wifi, that goes to a dead end VLAN with no route to anywhere.

Or desolder the (chip) antena which is usually easy notice on the board.

Aren't Samsung's QLED TV remotes Bluetooth only? Cutting the antenna would then also disable the remote and a modern TV without a remote is pretty useless.

It's clear that the only solution is not to buy a TV.

Couldn't desoldering the antenna lead to it overheating and damaging components?

Not really. 10 minutes of practice with some scrap wires would give enough soldering skills to remove it safely. The sibling comment about the Bluetooth remote worries me more

I have a dumb Toshiba TV, it's snappy, just plug in HDMI and it works. No loading times, no bloat, no ads, no Automated Content Recognition), not using my network when I don't want to...

I invite everyone to buy dumb stuff, because if we don't, there won't be any market signal, and there all be smart TV, Fridges and so on. I don't have to explain to HN audience why this poses risks, problems, and the probability of intrusive ad ecosystem causing problems with stuff that should just work.

It's important that tech communities like this one push for it.

I treat those devices and untrusted by putting them in a separate subnet that cannot talk to the subnet where I have my other devices (computer, printer, smartphones, etc).

I fear that when Amazon Sidewalk opens up to third parties, there will be no stopping devices, in fact I would imagine that Amazon could share the wifi passwords it collects with all Sidewalk devices.

Iirc, 5G is going to solve this problem: TVs will directly connect to a 5G network, without bothering the user with WiFi matters.

But who's gonna pay for the data? And what if you disconnect the antenna?

TVs will sign a deal with telcos that the latter give access to 5G to certain GUIDs hardcoded in TVs.

Yeah but it's a potentially perpetual ongoing per-unit cost that the manufacturers will incur for something they sell for a one-time payment. At some point it has to become unprofitable.

There are connected cars but iirc you have to buy a subscription or supply your own sim card to use the online features.

The connection is there so that they can have a long-lasting income from ads/snooping etc. They can share a bit of the spoils to get the meat.

If specific units are costing them beyond income, they can probably have telcos disconnect them, or just remote-disable the communication.

Amazon Sidewalk will solve this problem.

> I have about a thousand times more confidence, that if I use my smart TV as a dumb screen connected to an Xbox one or PlayStation 4, that over a multi-year period of time, Microsoft and Sony will successfully keep their operating systems automatically patched, updated, and secure. As compared to any tv manufacturer.

How do you feel about a Sony smart TV?

My perspective is that I don't really care.

If my smart TV gets hacked, what are they going to do? Take my Netflix and YouTube credentials?

I've got an LG TV, there aren't huge adverts. It's faster than switching on my PS5 to watch something.

It even has DLNA so I can listen to my music collection off my NAS.

If it starts hacking my network, what's it going to do? Public key SSH is pretty strong. And anything sensitive that could be snooped on would be HTTPS.

So this smart TV hack is going to require a second exploit to get into my windows PC? or Linux boxes?

just wait for smart TVs which are Zoom friendly and come with a camera and microphone built-in.

The TV in the article has two microphones built in!

Ultrasound 3D scanners is a thing.

In the remote, not the TV, unless I'm misreading.

> If my smart TV gets hacked, what are they going to do? Take my Netflix and YouTube credentials?

Leverage access to pwn everything else on your network?

Put the TV on its own NAT

A separate subnet is basic hygiene where it comes to IoT, but only a small fraction of IoT buyers have the capability to do that (both in terms of knowledge and having their home network set up in a way that allows this level of end-user control).

Like I said, what are they going to hack into?

And how? So they have an exploit for the smart TV and then another device as well?

Your desktop? Your laptop? Whatever you happen to have running in your LAN bound to 0.0.0.0? Quite many things still assume that your local network is more trusted than the wide Internet; breaching a smart TV gives an attacker a beachhead on your local network.

Well those things listening on the local network could also be exploited instead of the TV.

My Desktop/Laptop is supposed to be secured, and patched. Otherwise open wifi access points would be a bad idea.

Personally I think the the idea that the LAN is some walled garden where it's fine to relax security is a bad idea.

> Personally I think the the idea that the LAN is some walled garden where it's fine to relax security is a bad idea.

It is a bad idea, but it happens in practice. For instance, I can vouch for the security of my desktop (except for the times I run some random development stuff bound to 0.0.0.0, for convenient multi-machine access). I can't vouch for the security of my printer, or my IoT bridge. As long as it stays true, someone breaching a single device on your LAN is already creating extra security risk for your other devices.

> My perspective is that I don't really care.

If this screed is just about telegraphing your own wilful disregard for online safety and profound disinterest/absence of knowledge about what a locally connected hostile network device is capable of, then it’s hardly worth responding to.

However, if you’re trying to deliver an implied suggestion that “no-one should care”, then this actively harmful message deserves solid rejection. The consequences range from turning households into spam drones, to placing at-risk folks in physical peril through commoditised surveillance.

It remains an extraordinarily privileged and wonderful thing to live without fear of the capabilities of a corporate- or state-level actor. What’s not so wonderful is being reminded that many folks with this privilege lack the self-awareness to appreciate it.

You're putting words into my mouth. And changing the topic of conversation.

I was responding to someone saying that their smart TV was full of adverts and how it's a requirement to block it. Where the convenience of the utility provided is greater than seeing an advert for a film on the menu page.

You've flipped it around to vulnerable people being surveilled by corporate/state level actors.

Why are Smart TVs singled out here? There's a tons of old Android phones that people use every day with sensitive information that are vulnerable to multiple exploits that will never get a patch.

Or Routers that never get a patch from their Vendor especially if it's a whitebox from an ISP and they've replaced it with a newer model.

It seems like Smart TVs have urban legends associated with them, I asked previously about the supposed "TV connecting to unsecured WIFI" thing that always comes up and nobody had any evidence:

https://news.ycombinator.com/item?id=25275350

Once again, trying to make this topic about you personally doesn’t work, doesn’t validate lazily considered scorn, and won’t validate doubling down on either.

lol, you're the one that's trying to say that I said that “no-one should care”

I've no idea what your point is. But you do you.

Ah, so it was the first case. You have a nice day, then.

> If my smart TV gets hacked, what are they going to do? Take my Netflix and YouTube credentials?

Turn on the camera.

> I've got an LG TV, there aren't huge adverts. It's faster than switching on my PS5 to watch something.

LG TVs from the past few years involve some level of voice control, so an attacker could be able to remotely turn on your microphone and listen in on conversations.

At least on my CX Series the mic is in the remote control. I'm not sure it can be turned on without pressing the mic button.