Hacker News Reader

Comment by lordnacho | Hacker News Reader

What's frightening is that I can see on my PiHole the huge spike of requests that happens when one of my TVs comes on. Just the standard graph in the front page is enough to see exactly when the kids have turned it on.

Most of the requests are rejected though, maybe someone can say whether that is enough to protect me from corporate surveillance.

View on HN

Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance.

Assuming of course you are using it as a truly 'dumb' TV and not as a client for Netflix etc.

wouldn't be easier just not set internet connection in first place? I don't think TV can hack into secure WiFi network

They have been caught trying to connect to unsecured WiFi before.

I bet you aren’t going to be able to provide a source for this.

Even if not, it's only a matter of time before it does happen. Not an if.

I suppose the same can be said about your TV turning into a sentient killer robot.

> I bet you aren’t going to be able to provide a source for this.

They can't, but I do have this saved

https://web.archive.org/web/20191224122714/https://www.reddi...

they can still hack into open networks around you and monitor the SSIDs to get a sense of your position.

That sounds illegal and awaiting lawsuit to me, device connecting to unsecured network by itself without my knowledge doing there whoever knows.

Imagine my neighbor has unsecured WiFi network set for himself, I'm pretty sure he could call police on anyone connected to his network abusing his connection just because it's not locked.

By this logic you can steal unlocked car with key in engine or unlocked bike and that's what these TV would be doing.

You would be probably excused if TV done by itself, but it would land the brand lot of negative publicity and you could try to reimburse defense lawyer expenses on them. They would probably argue you agreed with terms of service when first launching TV, so don't do that if you want dumb TV.

Amazon Sidewalk is what worries me for the long term.

That would be illegal. However people here sometimes report that they connect to any nearby open wifi network even if you don’t explicitly connect them to your own.

Fair, though you might want to make some exceptions at some point. Or prevent it from randomly connecting to an unsecured wifi.

If they did it sounds like a great way for someone doing something nefarious to get off the hook. Some smart TVs are even able to act as wireless access points.

Give it an IP with no gateway, or a bad gateway.

> Blocking the MAC address from making connections outright seems like a more sensible way to prevent surveillance.

That won't protect against DNS data exfiltration. Extremely low-bandwidth, but works in a lot of cases - people have even written proxy servers to get slow but working Internet on public hotspots that normally require login.

How does that work if you block the internet at the router level?

Simple: most router firewalls only block traffic that has source:<IP of device> and destination:<anything in the Internet>, but traffic from source:<IP of device> to destination:<IP of router, IP range of home network> will be allowed.

That is enough for the device to emit a DNS query like "pbs.12345.metricservice.example.com" to notfiy some tracking service that the device with serial 12345 just switched to a channel labeled "PBS". The router will resolve that name record at the DNS server for metricservice.example.com, which gets the request and logs it away.

Are you suggesting that devices connected to a network that has blocked their MAC can still make DNS requests?

How many consumer routers go that length? For most of these, as long as they are on the network, they can communicate over DNS, using the router as "middleman".

Not just TVs...I can see my freaking lightbulbs in my pihole charts. What a time to be alive.

Why give your TV and light bulbs network access in the first place?

They need to be on the LAN so that Home Assistant can talk to them for automation.

They're firewalled off & the call home address is blocked on pihole

No TV in my case.

I get that light-bulbs need to connect to receive control commands and get firmware updates, but I'm wondering what other things might there be to worry about here?

Collecting usage data, sure...

Amazon Sidewalk has been brought up a couple of times in this thread and it's got me thinking about how others could also bring up similar ambient/background networks that piggyback off your main network.

If this were to happen, then your TVs and other devices wouldn't even need permission to connect to your main network and instead go through one of the many ambient/background networks.

Perhaps there's good reason to only use zwave and zigbee smart devices instead of wifi ones.

Light bulbs?!

It may be enough for that TV, but many devices have a custom-set DNS address and ignore the one given through DHCP, unless you set up a firewall where you block that address, then they fall back to using the one provided via DHCP. That's how Chromecast and Amazon devices are doing it.

DoH / DoT DNS privacy and security works both for and against individual users. It definitely works against network owners and operators.

This is why I had to set up a MITM to detect and drop DoH/DoT requests. Allowing devices and applications to evade my network management is crazy to me.

Have you written about how you did this anywhere, or do you not want to tip off "the other side"?

Dude, no joke. My TCL Roku TV is the nosiest device on my whole network, second to maybe my work laptop.

The difference though, is that TV is sitting in our bedroom mostly dormant, since my wife watches it maybe 1-4 times a week while she's getting ready for work.

Reply on news.ycombinator.com