LG to ban residential proxies from smart TV apps
krebsonsecurity.com
krebsonsecurity.com
Also, I bought an LG soundbar to go along with it. You would think they would work well together. The soundbar sounds fine, but the synchronization drifts over time. I've tried optical, LG's enhanced optical (allows you to control the volume) and HDMI eARC. In theory optical in PCM mode works better, but then you give up the volume control. Why should an end customer know about any of this? Lip sync is a simple problem to solve (timing pulses and code slipping will always work) and they have failed at it.
Also: their remote sucks (compared with Roku).
Anyway, so no respect for LG.
Would definitely not buy with my own money. I actually really like a lot of LG's other appliances (we have a washer, dryer, and dual ovens from them that are great), but for a TV, I just want a dumb screen that I can hook an HDMI cable to and run off a computer.
Look into Digital Signage displays. You pay a brickload more money but get (much) higher quality in return.
Not anymore. The last time I checked B&H they weren't very much more expensive than comparable "smart" televisions.
https://www.lg.com/uk/lge-terms/
> i. CONSENT REQUIREMENT: You acknowledge and agree that it is your sole responsibility to obtain all necessary consents from any third parties whose voices may be captured by the Product and to notify household members and guests that their voices may be captured and processed, in compliance with applicable wiretapping, eavesdropping, and privacy laws. If anyone does not consent, you should disable the microphone or voice features in the settings. LGE disclaims any liability for your failure to obtain such consent or provide such notification
Genuinely one of the most batshit insane things I've seen a company pull, their entire board should be liquidated along with their parents for failing to raise them.
If you inform them as per the EULA, then you're still illegally spying on your tenants, but at least you gave a confession.
Basically if you have an LG TV you could go to jail.
I do not lock forward to needing to upgrade the TV.
My LG TV doesn't support Bluetooth, and it's only maybe eight years old.
Instead of simply connecting to Bluetooth headphones, you're supposed to put some LG app on your smart phone, then sync that via wifi with another app on the TV, then connect your smart phone to the headphones via Bluetooth.
Instead, I just watch less TV and will not purchase LG in the future.
(And let's stop pretending that "LG" stands for "Life's Good" like it says on the power-on splash screen. It means "Lucky Goldstar." If life was good, I'd be able to use Bluetooth headphones.)
I was put off buying one as, here in Blighty, all LG TV's come with a built in Amazon Alexa which if you don't enable it, nags you every time you turn on the TV (talk about doing the bare minimum to comply with the GDPR!).
Maybe check how many network queries the Netflix app is making on that TV set too. On mine, it makes 1,500 network queries every ten minutes. I didn't realise this until I got a Pi-hole. Even when Netflix has not been launched. As long as the TV is switched on, Netflix is sending queries to various netflix.com subdomains faster than a clock ticks and it never stops. It seems to be unique to the Netflix app on LGTV sets, and neither company cares about fixing it.
Services can dramatically reduce abuse by blocking entire IP ranges based on country of origin, organization, or type (hosting providers). But a company can't block US residential IPs if it would also cut off many of their real customers.
The US government (probably the NSA) should be cracking down hard on US residential proxy networks. They're a genuine national security threat, actual data/identity loss of American citizens, act as infra for foreign covert influence campaigns, botnets used in hacking/DoS attacks, etc.
Major US ISPs (Comcast, AT&T) should detect clearly suspicious activity coming from customer IPs and warn them to scan their computers, check their TV apps, and find whatever is turning their internet into a proxy. It's very bad for the customers too (slows things down, gets their IP banned, etc)
Is there incentive for them to? If anything, you might be paying extra for the data use and not even know it, right? They would lose money
if someone wants to knowingly host a proxy they should. stuffing it along with other apps is shady and if LG wants to disallow those apps from their store than w/e but like we don't need governmental stuff encroaching on this stuff. if LG wants to do moderation on those apps than whatever.
there was a lot of fighting over this stuff back in the early 2010s because the alternative was effectively a balkanized corponet.
smart TVs, by virtue of being devices you can write apps for, have morphed into more general purpose computing devices and keeping it as open as it can be is important. the backsliding from stuff like Android has been horrible for the ecosystem and that shouldn't be normalized, let alone as a legal requirement geez
The support costs of malware remediation fucking suck. The moment you try to implement some kind of blocker in place like this is the moment you flood your call center(s) with thousands of ignorant consumers that have zero clue what you're trying to tell them, can't comprehend that they have "a virus problem", and are not going to calmly listen to a support rep try to suddenly train them on what the issue is and how to fix it.
(Bonus points for liability on what we direct a customer to do or not do.)
all Jimbob knows is that "comcast has blocked me from getting to my pornhub" and is very angry at the rep they have on the phone.
There's a reason we used to be told to blow people off with a 'contact your local computer shop' and it's time and money and liability.
Even if no one goes to jail, the NSA could make residential proxies much harder to operate in the US simply by detecting them and reporting them to ISPs. It would be good for ISPs to then validate the reports properly, give warnings, etc.
- Malware that can record video and audio from infected devices.
- Infrastructure for foreign covert influence campaigns.
- Botnets used in hacking and DoS attacks.
Second, everybody screamed loudly when they were cracking down on file sharing traffic. You're saying spying on the citizens is ok when it's for this little reason over here, but not this one over there. It doesn't track.
Not to mention most ISP abuse mailboxes are automated these days because they are flooded with LLM-generated reports from "security" grifters.
The tech industry flooding the market with countless IoS (Internet of Shit) devices didn't help. This has moved way beyond accidentally installing spyware on your PC. People are intentionally bugging their homes with these devices.
I understand the FCC is trying to crack down on this stuff - starting with routers - but of course that gets pushback too. You can't win.
ISPs already deal with abuse reports like this, the system just isn't being operated comptently.
You actually think the actors that went to the trouble to surreptitiously set this infrastructure up are going to share it with everyone for free?
They are intentionally made hard to detect and access is sold to the highest bidder.
Most ISP abuse reports are routinely ignored. They might as well be a dead letter box.
Okay, I was being imprecise. These residential proxies aren't "open proxies" in the traditional sense, but they're usually "open" to anyone willing to pay a small amount of money to use them.
> Most ISP abuse reports are routinely ignored. They might as well be a dead letter box.
This is where regulation might play a role, or at least a change in attitude. Companies shouldn't be allowed to pollute the internet in this way when they can easily prevent it.
Unless you are doing GFW China-level traffic analysis against a blacklist, which again how do you prove?
Why do you think that? These are proxies, so they're making huge numbers of outbound connections to websites on behalf of the people operating them. They are the "exit nodes" in this setup.
You could probably just count the number of unique destination IPs they connect to each day. If the average residential user connects to 5,000, an infected machine is probably connecting to 50,000+.
But the simplest approach is to buy access to these illicit proxy services and use them to make requests to web servers you control. If you see your own unique request arrive from a residential IP, you've proven that connection is being used as a proxy.
The US government should already be infiltrating hacker groups and identifying infected American computers. Internet providers should be informing customers that hackers have compromised their devices.
Characterizing this as "mutilating the internet" is ridiculous.
Most Americans agree with this policy and don't see it as infringing on their freedom at all. Our choice is to enforce basic standards or allow our cities to become horrible places to live, and the same is true of the internet.
So yeah, it seems pretty reasonable to give people repeated warnings, then slow or pause their internet until they take basic steps to stop their connection from being used to abuse others.
Does having TLS everywhere make this much harder?
Back in the real world, you can also passively fingerprint TLS handshakes to characterise the client device. Most of these proxy networks masquerade as "normal" clients, but if the type and variety of device fingerprints for an IP suddenly changes, that's a signal too.
> But a company can't block US residential IPs if it would also cut off many of their real customers.
since when do companies care whether they cut off real customers? i've been paying for residential proxies for everyday internet browsing for nearly 6 months. because it's the only way to pass the captcha service of another famous company headquartered in San Francisco
anyway if the costs are high surely they can pay the end users. at least then there's awareness and agreement. the ones bundled in apps or software seem less ethical to me than offering them some money per month to host it.
Fix social media, and leave the consumers alone.
Also the firehose of spam will continue regardless of what you do on the consumer end.
But then, by standards of two decades ago, every website that cannot legally avoid showing a GDPR popup would be classified as malware. As it should be today. Alas, standards have changed.
I don't think you've read GDPR. In Europe (at least my part), *every* organization has a GDPR policy you need to agree to. Your child's school. Summer camps. Etc. Most are also conservative and reasonable.
What's broken is the GDPR popup with a dozen "legitimate interest" toggles for spying on you.
You only need explicit consent from the user for tracking you do not require for valid business purposes
It's like complaining that OSHA sucks because every time you visit the grocery store you have to sign a waver that if they throw you in a wood chipper, you cant sue them.
That problem is not with liability wavers!
What feels really crummy to me is how many people don't seem to know that websites cannot really prevent you from using them if you reject optional cookies, so average people are afraid that if they say no, they can't use websites.
To sue them you'd have to show some actual, concrete harm. For example you contact a site that is blocking you and they tell you it's due to a certain request and you trace that request to the proxy.
> Plus, IP addresses rotate once a day
And I would be miserable if I were subjected to the volume of captchas and blocks on my regular internet connection that I see on the occasion I use Tor.
This is for a fucking TV.
Very unfortunate.
Glad my 2007 Sony Bravia still works, even if only standard HD.
Besides, there's no shortage of dumb phones and featurephones on the market. We want the same for TVs.
I own an airgapped LG TV. Does anyone actually want to go class action/mass arb?
Probably. The LG TV I have doesn't have cellular, but does have a removeable Wifi/Bluetooth module [1]. You have to disconnect a ribbon, unscrew the module and then pop it out.
[1] https://www.manualslib.com/manual/3140596/Lg-Oled83g3-Series...
An antenna may be obvious and external (like one on the fender of a 1979 Ford Pinto), or built with very deliberate PCB traces (as with a Raspberry Pi), or incidental (some component of the device behaves as an antenna, even if unintentionally), or a combination of these things, or something else entirely.
But whatever its form: An antenna must be present or wireless RF communication simply can't occur.
I looked into this last year while researching TVs and couldn’t find anything to substantiate it.
This seems a little like worrying about getting Dodo poisoning.
I have family who get frustrated with their home Wi-fi and about every other year conclude the solution is to unsecure the connection.
This won't change unless governments create and enforce laws.
What's the difference between running a Tor exit node and a "residential proxy" except optics?
Look: I'm 100% for banning secret proxies that hide from the user, but stopping people knowingly and voluntarily running these proxies is a violation of fundamental software freedom tenets.
The article is quite clear that LG runs an "app store" where 42% of the "apps" likely contain residential proxies, and LG is going to make its "app store" developers stop doing that. From TFA:
> “A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform,” Taylor said. “If this option is not removed, these apps will be suspended.”
This says nothing about your own software installed on the TV, should that be possible.
But even if you ran your own software on your TV, would you run a proxy service? Given you already have a residential ISP, you wouldn't need to hook your TV up to a botnet and buy residental ISP access for your scrapers via your own, or other unwitting suckers', TVs.
Your hypothetical of wanting to run a Tor exit node is silly. Most Tor exit node operators run them knowingly on dedicated hardware, usually in a datacentre, not their own home, and prepare themselves legally for when they inevitably get emails from law enforcement, or worse, raided. You'd almost certainly firewall the destinations it can reach, you wouldn't let it have access to your own network, and you wouldn't run it on your TV.
There is certainly a conversation to be had regarding consumer protection laws, the nature of an appliance, and the trade-offs thereof but this is not that conversation and I don't think you engaged in good faith with the comment you replied to.
Read it again: "LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform"
It is working with developers it has a contractual relationship with, and has approved their apps for download from its "app store" -- this one: https://gb.lgappstv.com/main/tvapp
...where 42% seem to be ADDING THE TV TO A BOTNET.
LG TVs form a substantial botnet, and LG didn't appear to know or care.
This is not about a person using their own TV to add it to a botnet (WHY WOULD THEY DO THAT?), it's about "app developers" knowing that LG is lax in checking what "apps" do, and putting out trojan horse apps that, if the TV user installs them, adds the TV to a botnet, without the TV owner's knowledge.
This is entirely orthogonal to "can I run my own choice of software on my LG TV?", which is not addressed in the article at all.
It takes one look at the App Store on these TV to know all these apps are sketchy...
I do not have the smart features enabled, not do I have it connected to any networks.
A lack of enforcement actions has caused situations like this.
Why would LG do better when it's cheaper to not?
I have an LG TV, about 6 years old now. For a while it was connected to the internet. Every time I turned it on, after a ~20s delay, it would pop up asking me to install an update and I would press RIGHT + OK to select the "No" button because it worked fine and previous updates just made it slower, added ads etc.
Eventually, the remote dropped the button press for RIGHT, and just got the OK. Or maybe I just pressed the buttons too fast -- the interface is laggy and I'd developed muscle memory. This started the software update with no way to cancel from the UI. Once it updated, it made me accept a new EULA just to continue using the TV in the way I already used it (which was mostly as an HDMI display). There was no way to even get to the settings dialog to perform a factory reset without accepting the EULA. The device was held hostage until I said "Accept."
This is the level of consent implied by accepting the EULA on a TV: none. It's bullshit. Computers should never have been put in TVs, and a smart TV should never be connected to the internet.
That made a Samsung behave a little better. But giving it no network access is better.
- No Dolby Vision support, only HDR10+ - Issues with judder/micro stutter - History of nerfing TVs via OTA updates - HDMI ports randomly failing - Bad HDMI-CEC implementation - Selling completely different panel generations under the exact same model names.
Samsung is a complete mess, now charging $5/month to use smarthings with no local control. I'll never buy Samsung.
I haven’t looked at the stock Google TV home screen on any of my devices in years.
Android TV even has ads for Disney and Apple, which I never installed.
We don't need treats this badly.
LG's behavior isn't fine, but their monitors don't install crapware on Linux.
Let's not diminish LG's part in all this.
Nobody is diminishing LG's blame, LG is guilty of installing malware, and Microsoft is guilty of being grossly negligent and facilitating it. Microsoft implemented this feature knowing that it would eventually be abused for something like this, and it's bad enough to be indistinguishable from malice.
The Linux approach has the downside of not having the drivers if a vendor has not been working with the kernel community before launch (or for those who haven't upgraded to a kernel that has the driver, e.g. a LTS release).
On the other hand, the driver is maintained by kernel developers, not created by the hardware developer who is not getting paid after they sell the device. This helps avoid abandoned / vulnerable drivers, or having the hardware dev search for... alternative revenue streams, as in this case.
What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.
https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
I guess that from Microsoft's perspective, the driver itself wasn't suspicious, but it installs a questionable sidecar app they would have never vetted anyway.
It's just a device attached to a computer.
But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.
Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)
That's what I thought. It is vetted software, just like on Linux. Microsoft just doesn't care if it shows ads.
1. Yes Windows must have "approved" the drivers
2. Windows Update runs automatically and not (usually) manually
3. Automatic update can't even be disabled, only manually postponed a bit
At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.
To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.
This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing.
> Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.
Here's the thing it does: https://github.com/Raphire/Win11Debloat/blob/master/Regfiles...
I swear, OSs have become sports teams.
Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage.
There have been so many zero-click local privilege escalation CVEs I've lost track.
Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists....
You have confidence you are actually downloading the same foo as everyone else. And if there were an issue there would be pushback. Not so if you get some random exe from warez.com
Yes it isn't perfect, it's still a lot better than windows land.
Implementation bugs are not holes in the security model. Linux has plenty of those, as does Windows.
Windows security model trusts, downloads, and immediately executes arbitrary software when a new untrusted device is plugged in, without asking the user.
curl -s script.random-guy.net | sh
I even used uname as a fuzzing tool, and that broke builds spectacularly. There's now a more reasonable uname in the sandbox for builds.
and no, this is not how most software is installed
anyone doing this should really take a very very big look in the mirror
wget https://raw.githubusercontent.com/timofurrer/russian-roulette/master/russian-roulette -O - | sudo bashIncreasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows
Surely Windows Update is a vetted repo as much as arch or debian
I don't think this is the norm at all. I have seen curl/bash install scripts for tools like Claude Code, but they don't use sudo, and the expectation is that you deploy them in isolated user accounts or containers.
Why are you lying right now? This is a norm across the dev tools world for businesses to distribute dodgy curl piped to bash scripts that users install without question, popular examples: homebrew, docker, nvm, bun, deno, k3s. There is zero "expectation" given by any of these install scripts that they are isolated. Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?
Isn't it common sense? Do you want coding agents to read and possibly upload somewhere the contents of your home directory?
Also, the expectation on Linux is that you install tools like Docker from the distro's repos.
Docker provides a convenience script at https://get.docker.com/ to install Docker into development environments non-interactively.
== Homebrew ==
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)"
Paste that in the macOS Terminal, a Linux shell or WSL. The script explains what it will do and then pauses before it does it. Read about other installation options.
== k3s ==
K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at https://get.k3s.io. To install K3s using this method, just run:
These scripts have lines like
> abort "Need sudo access on macOS (e.g. the user ${USER} needs to be an Administrator)!"
> # --- use sudo if we are not already root ---
Clearly the Linux model is more secure, and Microsoft knows it. It's a good idea for Microsoft to take inspiration here. It's only a matter of time before they do containerization too, ala Flatpak. The biggest hurdle to that is Windows doesn't have native containers and the entire container ecosystem is build around Linux.
If Microsoft wanted my advice, which they don't, I think it would cost less at this point to just make Windows a Linux distro. Wine is already better at running older Windows software than Windows. Just expand Wine a bit, add in acceleration where it doesn't already exist, and boom you're done. Nobody would even notice.
And maybe then Windows on ARM wouldn't suck so much.
Apps like Chrome and Spotify have been doing it for almost 20 years, since they made their Windows apps back in 2008. Python updated their installer to install to the user profile in 2015 with version 3.5.0. VSCode started doing it in 2018. Discord did it at launch in 2015. Zoom and Teams and Slack do it and have for a long time. Its been a pretty common pattern for a long time.
> Windows doesn't have native containers
Windows supports Windows containers natively and has supported Windows containers for a decade.
> maybe then Windows on ARM wouldn't suck so much.
Windows on Arm these days really isn't bad. It definitely sucked a lot several years ago with tons of compatibility issues (along the timeframe you said you last used it seriously), but they've made massive improvements since.
I’m very cynical about windows. Mostly because windows is bad in almost every way software can be bad.
So something most desktop Linux users don't do.
It’s really only arch with the AUR and some others where completely untrusted packages are used. This is legitimately a better model than what windows does, although Microsoft has been trying to change this with winget.
I guess with more and more consumer devices running Linux based OSes (SteamOS, Android, Bazzite, Silverblue, ..) that becomes more and more interesting.
And unfortunately the "I'm safe on my non-windows-system" argument doesn't count for long, as the 99% muggle crowd justifies a shift to a world where our non-certified (=> 'insecure') systems are not supported by big companies anymore, as it's currently happening on Android.
It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.
This is also a misrepresentation. Microsoft has provided LG with a certificate to sign its driver packages with, and allows LG to upload packages to Windows Update, which includes a feature to install sidecar applications. Now, the spirit of this feature is that any application is meant to provide genuine configuration functionality or some graphical front end to the driver's configuration knobs.
LG then abused that feature to provide adware. Now, there are millions of hardware vendors. One can't expect that every driver package submission from every vendor is thoroughly vetted every time, this is a matter of trust and respect.
Sometimes one actually wants the app that comes with the device, like AMD's and NVIDIA's configuration trays.
Even so, I fully expect that after this debacle MS will disable this stuff. There is precedent for this. Synaptics/ELAN/Alps touchpad tray applications largely disappeared after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs. Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
Apple seem to do a pretty decent job of just that
At least on Windows, the most you get is a scare screen saying 'this app is from an unidentified developer'. I know what I'd rather have.
Well that and side-loaded LG adware
> after MS implemented precision touchpads somewhere in 2015, and suddenly Windows touchpads became as precise as those on Macs.
There’s still a world of difference between a MacBook touchpad and a windows one. My work laptop (18 month old dell XPS) can’t hold a candle to my 6 year old MacBook’s trackpad.
> Likewise with RGB peripherals. Even GPU driver applications have increasingly become less useful as the most important features—power control, adaptive sync, HDR, etc have moved into native Windows settings.
The peripherals still need the addons though; I have ASUS armory crate, Corsair iCue and MSI center for my Motherboard, cooler and GPU respectively. They all suck.
Oddly I've found otherwise (Dell Precision notebook from 2021, and Surface Laptop). It might be macOS's animations and smoothing interfering here, but I've found that my Windows touchpads are much more responsive, especially when swiping between desktops.
> The peripherals still need the addons though
Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
> Ugh, this is annoying. Hardware vendors need to be banned from writing lousy, inefficient, unsafe software.
Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software. I work in games and a few years ago the biggest correlation we had between unexplained crashes/performance problems in the wild was users having MSI Afterburner installed. Users thought it did great things and fixed a bunch of games but it absolutely thrashed everything we worked very hard to do and caused no end of issues doing so.
Other overlay apps like discord https://www.reddit.com/r/discordapp/comments/1jncrlc/new_ove... have similar issues - the way they work is by drive hooks and drawing over the application; depending on how close you are to the limit and how the game loop is coded this can very easily (and often does) cause micro stuttering, and in cases like discord causes massive performance problems regularly.
Well, this is the whole market on its own. It's entrepreneurship. No different than every web SaaS startup trying to capture some entry-level piece of computer use and then constrain it so it interoperates only with their "net of trusted partners".
They get away with it because everyone is happy and making money - the users, notably, are not part of the group here, and have no voice. The users are resources to be exploited. Same as on the web, and on most markets these days.
The latest Dell trackpads are quite bad. Price or the product being premium or not unfortunately does not tell you if it will have a good trackpad or not. And it changes over time (Dell XPS used to have really good trackpads)
Basically you have to go to a store and try or find reviews that actually pay attention to this.
If you're going to allow 3rd parties to install software on potentially billions of computers with far reaching privileges then you better have something in place other than 'just trust me bro'.
Hard to get worked up over "3rd parties" when even 1st parties cheerfully stomp all over the interests of their users. That ship sailed, caught fire, and sank to the bottom of the ocean the day Candy Crush appeared in the goddamned Start menu.
Maybe not, but LG has violated this trust and should therefore be either fined or severely restricted by Microsoft. Banning will likely cause more problems than solutions, but they shouldn't get away with this.
Adware was a huge problem during the Windows XP era, can't believe it's coming back now through Microsoft's official channels.
Also I doubt there's actually millions of hardware vendors. But that aside, Microsoft has a duty to vet everything that they offer through their channels. If it's too expensive for them to do, do like Apple did and have those that want to make use of their distribution network (and trust) pay them.
Almost certainly correct because there are only 2^16 USB manufacturer IDs, of which (warning, Google AI quick result...) only 3400 are used. Tiny vendors of e.g. USB drives often seem to use the vendor and device ID of the interface chip manufacturer, but that's probably a good filter for really unimportant ones. Of course not every device has USB, but most major hardware vendors implement USB somewhere and have an official USB vendor ID.
My point here is simply that it's not the monitor that is installing this. Neither the malware nor the URLs to malware exist on the device - they get fetched as part of normal OS-side auto-provisioning, which is the part that was compromised.
And it's not like MS is too poor to do anything useful for their customers. They just don't want to unless the cost-benefit analysis pans out in their favor. The customer is worth as much as their wallet.
They are downloading and installing something without the users consent.
It's nice to have drivers work without any intervention, same with "helper software" but along side the ease of use they also took on the responsibility.
If I download some random .exe from the net; I have to confirm that I want to run it, sometimes I even have to right click and unblock it to allow it to run, because it is "untrusted".
Their signature key, their auto-run system, everything done for ease of use means they own this.
Otherwise what does "trusted" mean?
Isn't the debacle over? MS know about this by now. What's stopping them from killing it today?
A late resolution is barely a resolution at all. None of this functionality needs new Windows features.
Why not? Microsoft isn't a struggling startup. They can afford to do just that.
And if you really can't act responsibly "at scale" then you shouldn't be allowed that scale.
Self signing a driver should mean just that, not a driver, and a load of other things we feel like foisting on the user.
Half the reason I moved to Linux is because I just wanted to print something without getting a load of advertising from a printer company.
Kinda agree but let's call it "misinformed" or something, instead of a lie.
Of course the details are important on some level. But that doesn't make everything else not matter and it doesn't turn an incomplete explanation into a lie.
This difference tells you that, for example, you cannot fix the problem by fixing the monitor, because the problem does not exist in hardware. It's actually entirely external to the hardware you own, because it exists entirely "in the cloud" (i.e. on MS and LG servers).
The hardware alone is not sufficient for this to happen, but if you were to modify or "fix" the monitor (specifically its firmware) so that it no longer identifies as an LG monitor, then it would no longer cause these ads to be shown.
In other words, if A causes B and B causes C then it is correct to say that A causes C.
The manufacturer implemented choices to deliberately install the software when the monitors are connected. The mechanism is not important to why this is outrageous.
A tech YouTuber showing this off and all the anti consumer behavior. I’m assuming this threads article is for an LG PR piece trying to redirect anger at the app developers to hide the fact that they are engaged in the same behavior themselves.
https://old.reddit.com/r/pcmasterrace/comments/1v1pkbs/lg_sp... ← examples of others who ran into the same shit
The INNOCN knockoff is the INNOCN 28C1Q. Likely the same panel.
https://www.amazon.com/dp/B0BWDMYK83?peakEvent=4&dealEvent=1...
https://www.newegg.com/p/3D4-007R-00003
Out of stock on Amazon and Newegg
No transcoding, no weird codec issues, just the raw files direct streamed from the underpowered Unraid box, into the back of the AVR where the audio is handled correctly and the video is sent to the screen.
But yeah external stick is much safer solution, then even tvs like TLC are a great brand.
The consumer demand was/is for cheaper, and data mining is how OEMs got there. The general public got what they want, and OEMs got to keep their margins: "win-win".
It's the same thing with (US?) airlines: people wanted cheaper, and that's what was offered and they chose.
Admittedly this doesn't stop the presumed screenshotting and microphone use and worse
You need to hook something up to a network, and another device would have similar risks.
Setting up a sandboxed VPC or auditing traffic is beyond the means of the average TV owner.
Do you think an Apple TV and a Walmart special TV have same risks? I don't. I give the Apple device my network credentials and the TV never sees them.
Another device might not give the free reign for all shitty malware like they do. Apple TV for one wouldn't.
But the replies are missing the point that most people aren't techies and won't go do this. They go to big box store, buy the tv, ask if it has netflix, done.
They won't (and shouldn't need to) install a ATV.
No thanks, I prefer owning my media in a way that corporations can't just take it away whenever they feel like and where I can use (open source) players of my choosing.
Other than the TV, most people really have only one device (Roku, AppleTV, etc). Why do you need so many?
> I only need one remote for all the apps and sound,
True with Roku.
>>True with Roku
Can the Roku remote change the input source on the TV?
Is the NAS TV related? Why do you need these? My media is all on my PC, and I don't consider maintaining that as part of my TV burden. I have to maintain it anyway.
And what maintenance do you need for the PS and XBox? You just turn it on when you use it, and let it auto-update.
> Can the Roku remote change the input source on the TV?
Fair point.
Normally, I change the source only once during a whole session, so I do that right in the beginning if I need to.
The other solution for those who have a flat white wall (or are willing to install a projection screen) and which I used for years and years: use a dumb projector. There are plenty of perfectly fine dumb projectors and they're very cheap too (compared to the equivalent TV). This also made for the largest diagonal I ever had, in a huge living room, which was really great: basically turning the living room into a mini home theater. I painted the walls etc. accordingly, including a special paint for the white projection wall and black for the side and back walls. This was a better experience than any $$$ TV.
Sadly atm I can't use my projector for my wall ain't flat and I can't install a projection screen and I've got nowhere to put my projector: I could use a short-throw one but the place ain't mine and I'm not allowed to drill holes etc.
So atm it's... Pressing the button on the power strip that powers the LG TV. I know, I know: doesn't help much when the TV is on.
Next thing to do is separate all the junk devices (TV, smartphones [the ultimate spying device btw, much more than your TV], smartwatches, tables, etc.) from your proper stuff (e.g. your important PC running Linux/FreeBSD/etc.). I use different physical LANs (and a bridge/router) but VLANs would do too.
Many cheap home routers also by default offer at least a "guest" network: a perfect place the TV and your relatives' devices when they visit and want access. Set usage quota on the guest network too.
At some point all these devices shall use other networks than yours, so you'll be sorry out of luck anyway. But as long as they don't come with their own battery, pressing the button on the power-strip is some kind of giant low-cost "hack this" middle finger.
Spur says these SDKs can keep running after the app is closed and only stop when the user deletes the app or opts out. LG says developers must remove them or have their apps suspended, but the article doesn’t say whether that disables existing installs. If it doesn’t, LG needs to tell affected users which apps to remove.
Does webOS have any way to kill an installed app remotely?
I remember seeing privacy guides for smart TVs over the years, does anyone know a place with up to date info?
Most 55inch monitors are now "smart" sadly, so are most "digital signage" products. So there is no longer a way to get a true dumb panel at least over 50 inch
EDIT I am in Australia, there might be products that are available elsewhere but cannot be bought/shipped here
I’m starting to wonder if a monitor and a soundbar with an external tuner is possible.
A decent-ish TV-sized panel with at least a single HDMI input really is all I need.
I got myself a normal, non-smart Philips 49" TV some ten years ago, it's good, but I don't expect to be able to find something similar anymore.
If you want a very specific example, the original nintendo DS can only connect to WEP connections, which meant that when I was there I was able to play parts of DS games that wouldn't have been accessible in the west
And when I've tried navigating in large cities (Tokyo included) and found that my stupid tablet's GPS relied on getting the ephemeris data from the internet, and never through the GPS itself, I couldn't start navigating until I connected to something.. and I spent hours trying to find an open network, unsuccessfully. Happened twice, the second time in Nagoya. No open networks. Well, Starbucks have that, but then you need to find one.
Anyway, intent matters. This probably wouldn't be found criminal unless there was malicious intent.
I have yet to receive a software update on any of my smart TVs that brought in any positive feature.
Yeah, the PS and Xbox OSes show you ads, and they have telemetry. But both companies also have an extremely important core functional need of keeping them secure, because possible fuckery with the OS could result in game piracy/DRM bypasses and a direct threat to their revenue models.
Consoles are sometimes sold at a loss, but the revenue model is different. Playstation plus/game pass, a cut of game sales and microtransactions, exclusives, and accessories.
No one should ever connect their TV to the internet. There just isn't any reason to, get access to your streaming apps another way.
https://www.howtogeek.com/its-not-just-streaming-content-you...
What a wild experience 2026 is. But I do feel like a wizard.
This also means that DoH effectively sends all your queries to CloudFlare on FF. Chrome is slightly smarter and tries to map your DNS provider to a DoH implementation if known.
Guess what though? resolv.conf doesn't have syntax to specify DoH.
The best way to deal with a TV you don't trust is what no one wants to hear.
Open up the back and disconnect the wifi antenna. It is easy to open them up and everything is pretty simple and obvious once you do.
Upvoted. This is precisely the kind of thing I expect to read on HN.
There is the power board (AC to DC conversion for electronics and leds), video input board (where you plug in HDMI etc) and a t-con board, which takes a single video signal in from the input board and drives the LCD screen.
Then there are a few ancillary components like speakers, maybe a roku module etc. There are easy to find and everything is modular. You can take the speakers out and use them somewhere else if you want. You can just disconnect the wifi antennae on the smart tv board and be done with it. You can also find the IR led connection that the remote sends signals to.
This does not provide any meaningful protection against data exfiltration. The TV is very possibly using public DNS or outright phoning home through stable IPs.
Not to say it couldn't happen - but it wouldn't be a backdoor thing, it'd be very up front. All that's needed is for ISPs to create/join some SSO-like standard that lets you use ISP credentials as smart TV credentials (e.g. Your Xfinity account is automatically your Vizio account, sign on with your Xfinity account to get free streaming deals now).
I feel like if TVs start doing that, they'll display a network ID and signal bars at the top of the screen like cell phones do, so the TV maker doesn't get blamed for ISP problems.
The cafe I live above in Denmark just has an open network.
(And made way more sense 15 years ago when smart TVs were just starting to become common and open WiFi without captive portals actually still existed).
Since Roku like other smart TV companies makes money off of user data captur, it's not incentivized to enable those conditions for a downstream device, especially if not specifically advertised as a feature.
There's esp-idf examples from espressif for doing bridging on an esp32 if you have one with a MAC and a PHY and/or spi mac+phy.
Or for wired ethernet, they could include a three port switch IC.
I guess that might make me more trackable?
I thought residential proxies are already banned from SmartTV apps by virtue of practically every APK under the sun being subject to the Google Play terms of service.
The platforms in question here are webOS and Tizen, neither of which are Android or use the Google Play Store.
Not so much for the rest of them that have operating systems with names like Roku TV OS, Tizen, WebOS, and Fire TV OS. They do their own things.
Also this is the reason you down download random crap onto your devices.
I have an LG that is connected on its own network with bare minimal apps (netflix, prime, etc) because it's too convenient for my family. I actually bought it because it didn't display ads on the home screen like the other smart TVs I'd researched. Thought LG was the lesser evil, turns out they're all a bad as each other.
Of course DOH would break that but I don't get the feeling it's bypassing it.
https://www.cbsnews.com/newyork/video/how-smart-tvs-may-be-s...
I've been running the same Samsung UE40C6530 since 2010. It's 16 f'ng years and the thing works flawlessly like the first day. No other electronic device in my life worked so well, during so long.
But I'm about to move to a new home, and it feels like it's about time to get something more modern, at least a 4k TV.
But I'm honestly totally lost at what to buy. I do not want a "Smart" tv that's slow to start, bloated with crap, installing updates every day, and maybe even spying on me.
I want a plain, old, normal TV. If possible without Android or any advanced operating system. Just a TV. I'll plug external content myself, either via a Chromecast device, or something similar. I don't want my TV to be a full fledged computer.
Is there such a thing? What would you buy nowadays? It seems you're forced to get yet another computer to maintain and be worried about whatever you buy.
Apple TV I got them few years ago just sits there unused.
By doing this you basically get a subsidized TV without paying with your data :D
If any of the HN crowd reading this are tech reviewers, make privacy and security a first class feature of the things you review. If it has a network connection then ask hard questions of the manufacturer about how they are managing that massive responsibility and what promises they have about how they will, and won't, use it. Ask what qualifies a 'trusted partner' and get a list of them so you can dig into them and report on how much those partners can or can't be trusted.
I really don't care how bright the screen is if this type of stuff happens. I'd rather watch nothing.
Lg, Samsung… I mean are there any companies that make a non-smart monitor? This monitor I have was highly recommended on many review sites. Are we just accepting the fact that we don’t truly get to own or control these devices? It’s so frustrating.
Eh, so even sources as reliable as Krebs on Security sometimes engage in bad statistics.
This is a statistic that feels significant, but actually tells you nothing. For all we know, "42% of all apps" can mean a single spray-and-pray campaign with a few hundred downloads in total, with the vast majority of users only downloading apps from the top10, which are all unaffected. Or maybe the problem is widespread across the entire distribution of app downloads, with the majority of users having at least one infected app. We don't know either way, because "42% of apps" is a completely meaningless statistic.
Note that the same applies for the other privacy invasive webos features. But since that doesn't harm big tech's monopoly they will conveniently avoid mentioning it.
i've got 2 expensive lg tvs and i bought them because you don't need to use their remote, it just turns on and shows the picture.
Those cheap/discount tv brands make soo much sense these days
I'm, frankly, a bit annoyed by this whole thing; I'd rather have USB adapter RF wireless because it is simpler to deal with vs Bluetooth, but actually I can't even find other Bluetooth keyboards that are as compelling as this K830 and worse yet, they don't even make the K830 anymore. I don't really mind KDE Plasma with just some minor customizations but I don't really like any of the options like Kodi. Maybe Plasma BigScreen will eventually be what I want for that. And finally, HDMI CEC is a pain in the ass. For reasons, I actually use an adapter to get CEC support on a normal PC platform, because most PC HDMI ports can't do it. And also, it's just a bizarre and overly complicated thing. I have it working reliably, but it took some time to iron out all the kinks, particularly because my TV responds quite differently depending on how recently it was powered off.
I really just want a big monitor and to basically just use DPMS... Like a computer does, but large computer monitors tend to be expensive and don't always have remote controls, which admittedly are handy.
> no mouse buttons
Failed at the first sentence.
As for remote control - why would you want one for the monitor. For the PC I'm using an Air Mouse which is just a remote gyro-based mouse with keyboard buttons with a driverless USB dongle that acts like any other USB HID. I also have a miniature no-name wireless keyboard with a touchpad but rarely need to use it.
> As for remote control - why would you want one for the monitor.
It certainly isn't strictly necessary, but it remains useful for input switching, and as a convenient backup option for power/volume. In the presence of a good fullscreen UI, I could see it being useful for basic directional input as well.
You can of course go the other way and handle input switching and all else via the PC, but that does mean if the PC isn't on nothing else works at all.
Gamers Nexus"
-
TCL and now LG are to be fully avoided, Samsung isn't to be trusted (a future update if you allow it can lead to what happened here with LG). Samsung probably has the best hardware, but too bad.
If we don't vote with our wallets the enshittification of everything tech will march over and trample us that much faster.
Only LG themselves should be able to have this kind of invasive control over your television.
puck, man; how are ppl so stupid
Plenty of uninformed people let their tv on the network, they shouldn’t. A separate box should instead. Tell me I'm wrong?
[1] Let's just forget for a second they are famous for low quality software full of security bugs
>A Pac-Man smart TV app from Bright Data offers users the choice between viewing ads in the game or agreeing to allow their TV to serve as a residential proxy node.
I don't know how "join your users to a botnet" became some kind of legitimized monetization scheme. Ads are bad enough. What's next? "Participate in a DDOS in order to use our app?"
If there are proxy apps that only do the latter sort of work than I'm actually in favor of them existing and being widespread.
There's all kinds of things that malicious actors want to do where they value coming from an ordinary (comcast, charter, centurylink, shaw cable, whatever) residential IP.
I'm surprised Comcast or some other ISP doesn't step in with a claim of tortious interference. Reselling or granting access to the ISPs services like this is almost always against the ISPs terms of service.
The consumer is in no place to consent to this exchange.
At the very least, consumer connections explicitly disallow "Commercial Use". That means that you can't use them to run a business. You can't use them to turn a profit. You can't use them to generate revenue. That means no running servers, and that means no "reselling 2% of your bandwidth" for a few pennies because some Euro-Trash-Stranger wants to borrow it!
And that's really bad! Far more than reselling, you should very much be able to run a website from home!
No, it’s fair, and probably federally regulated.
You wanna run a business? Then get a business license, pay your business taxes, and sign up for a business Internet connection. That’s what they’re made for. Then run your servers to your heart’s content.
But I'd say it's fundamentally a market segmentation. ISPs don't want consumers running servers on consumer connections. Think about it. This allows ISPs to plan deployments better. Consumers should be, well, consuming downloads and content rather than distributing it upstream. Therefore, for example, my DOCSIS connection is 10x downstream vs. upstream. And an ISP's consumer-level backbone can be planned much more effectively when consumers are consuming downloads.
If you wanna run a server then go colocate it, or run it as a legit business. You've got to accept some market segmentation here.
I purchased a new HP printer recently, and it's firmly a SOHO printer. Perhaps more powerful than I really needed. And guess what? I found out that it's not really supported by Chromebook or Android drivers. So... I've got to bounce all my print jobs through Linux! Ah well!
but aside from that, hosting a website or email server or newsgroup or game server with friends isnt necessarily hosting a business, not everything is a transactional relationship