Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack
from the dumb-is-the-new-smart dept
We've noted repeatedly how "smart" television sets have the same security issues plaguing the rest of the internet of broken things: namely there often isn't any security to speak of. The net result has been TVs that spy on you by recording in-home audio, and in some cases transmitting that data unencrypted around the internet. But we've also noted how these TVs -- like the rest of the Internet of Things -- can be compromised in a matter of moments by some rather rudimentary hacking, then incorporated into the historically unprecedented DDoS attacks we're now seeing around the world.As an added bonus, your smart TV can now be infected by ransomware, too. Software engineer Darren Cauthon found this out the hard way when he awoke on Christmas Day to find that his family's LG 50GA6400 had been infected with a version of the Cyber.Police ransomware -- aka FLocker, Dogspectus, or Frantic Locker. That particular ransomware posts an image to the screen of the television pretending to originate with the FBI, and claiming that users must pay a $500 penalty to return full functionality to the television.
Cauthon quickly headed to Twitter to not only complain that his television was now demanding a payment just to function -- but that LG's online factory reset instructions for the TV in question didn't work:
Family member's tv is bricked by Android malware. #lg wont disclose factory reset. Avoid these "smart tvs" like the plague. pic.twitter.com/kNz9T1kA0p
— Darren Cauthon (@darrencauthon) December 25, 2016
"Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn't work. When the software engineer contacted LG, the company told him to visit one of their service centers, where one of its employees could reset his TV.Ultimately LG reached out to Cauthon to help by providing the correct factory reset sequence, though the infection should have never been possible to begin with. While it's possible that the infection could have come via a dubious download from the Google app store, the design of the television should never allow an application to take complete control of the device in the first place. While these infections are rare, other LG users have complained about similar attacks, and found removal of the offending malware to be difficult -- especially given the lack of control users often have over devices they purportedly "own."
This angered Cauthon because factory reset procedures shouldn't be secret, but also because the service center visit implied a $340 bill. The ransomware asked Cauthon to pay $500 to unlock his TV.
As one commenter on Twitter pointed out, it would be cheaper to buy a new TV. "Avoid these 'smart tvs' like the plague," Cauthon added following his discussion with LG."
Of course, security firms like Symantec have been warning about the rise of TV infections since 2015, noting that while in some instances a factory reset will solve the issue, in many instances removing the malware can be borderline impossible for a less technical user. And like so many internet of broken things devices, these TVs often fail to include basic functionality allowing users to determine what traffic the television is sending over the network, or settings allowing users to protect their security. It's just one more example of how "smart" devices are frequently dumber than the technology they're replacing.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: factory reset, ransomware, smart tv
Companies: lg
Reader Comments
The First Word
“Subscribe: RSS
View by: Time | Thread
Does anyone sell an "Ethical" tv?
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Maybe the security briefings were politically biased so as to delegitimize the rightful owner who won the TV fair and square.
[ link to this | view in chronology ]
Re:
Their called dumb TVs. Or a DIY Linux media box if you want smart and ethical.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
I'd gladly skip $100 or more to get a stripped down TV...
[ link to this | view in chronology ]
Re:
I get all of my programming from the web and OTA (no cable).
I have a single remote control that actually controls everything rather than a table covered in them and a 4 step procedure to turn on the TV, select a channel, and hear sound.
My TV is updated and working every day (it updates automatically in the early hours of the day).
News is available any time (including Facebook and Twitter).
Internet Radio is available when I want music.
I am not a huge fan of everything being connected to the internet, but a smart TV is actually one of the things that really has made things more convenient and better for me.
[ link to this | view in chronology ]
Re: Re:
Give me a "dumb" TV and an HDMI port to plug in my smart app box of choice.
[ link to this | view in chronology ]
Re: Re: Re:
Anyone know how this guy got infected? What features did he use? Email? Browser? Google store?
[ link to this | view in chronology ]
Re: Re: Re: Re:
Found the answer to my question on kim komando's site:
Frantic Locker was first reported to spread via spam text messages and malicious web links. To avoid getting your Google TV infected, be careful when visiting websites using the built-in TV web browser. Additionally, checking email and clicking unknown links through your TV can also put it at risk. However, in Cauthon's case, it appears that his TV was infected by a rogue app. It goes without saying, please refrain from downloading and installing apps from unofficial and unknown app sources.
Don't install 3rd party apps, don't browse the web, don't check your email on your 'smart' TV. In short - don't do stupid stuff.
[ link to this | view in chronology ]
Re: Re:
I also have one remote control to control everything, and while I do have a smart TV, it has no data connectivity outside HDMI cables.
My one remote control controls a HTPC that does everything except displaying the actual image. It plays movies on the HTPC out to the TV, music, free-to-air TV, it records that TV if I want to time-shift it. If I want to surf the net using my TV as my display, I do, but the surfing occurs on the HTPC using a wireless (or wired if i feel like it) keyboard, mouse, or the remote control which is a wireless pointer as well. I can play games without switching devices (Civ, Battlefield and whatnot). I can update video and audio codecs on the HTPC whenever I need to to play the latest and greatest format, without having to worry about the TV vendor refusing to update its codec set in the hopes I'll buy a complete new TV just to get the latest codecs. I can use the latest software, browsers, and whatever else I want.
The only time I need to replace the TV is when either the screen breaks, or there have been significant changes in dislay hardware technology. E.g. CRT -> 720p/1080p Plasma -> 1080p LED backlit LCD -> 4k OLED HDR. Not every time there is a minor software technology or hardware change like xVid -> x264 -> x265. USB 2 -> 3 -> 3.1 (Type A or C) gen2, or 100Mb -> 1Gb (hopefully soon! -> 2.5Gb -> 5Gb), or wireless A/G -> N -> AC , and so on.
[ link to this | view in chronology ]
Re:
Yeah, not a silly question all att, but unfortunately if you want a large screen, an equivalent "dumb" TV is not +$100, it's more likely twice-or-more the price.
This, though, is exactly my "smart" TV has been dumbed-down since purchase to being just a screen for rather smarter devices.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
When I was a kid, a TV was like a fridge or washing machine - you'd buy a new one every decade or so. Maybe have a 2nd smaller one for the kids, which is most likely a hand-me-down from when the main TV was upgraded to an OMG 68cm so the 48cm it was replacing was moved off to the kids room.
But by incorporating many unnecessary technologies in the TV - media players, web browsers, players for specific eco-systems (netflix, amazon etc) that aren't upgradeable, or that they only support for a year or 2 with upgrades (like a mobile phone), there are more opportunities to foist upgrades on users.
[ link to this | view in chronology ]
Gee you'd think that the data they suck out of the smart tv's that gets them paid would offset the cost of just keeping a plain web page up with the instructions.
Of course this was one of the older abandoned Google Smart TV's where the 'don't be evil' corporation could have forced this magical sequence be available to consumers, but that would have made LG sad.
There seems to be little actual benefit for having a smart tv - you pay a premium price, you get spied on, you get special advertising, you get zero support unless you pay a huge fee....
Just because you can, doesn't mean you should. It really is high time people start voting with their wallets & avoiding corps that insist they have to spy so they can make more off of you.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Extra $$$ for Samsung
[ link to this | view in chronology ]
Re: Re: Extra $$$ for Samsung
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
class action suit - negligence and fraud
[ link to this | view in chronology ]
reason they dont want that reset out there
haha smart indeed making it flashable
[ link to this | view in chronology ]
Leak coming
In an upcoming 'leak from the Russians', LG is shown to be infecting its own TVs with Ransomware.
"Either we get the $500 from the ransom or we get just over $300 at one of our service departments to fix the problem. Either way it is win-win and our stock is at an all time high." -leaked internal LG memo
[ link to this | view in chronology ]
[ link to this | view in chronology ]
not connect to the net
can you truly not connect to the 'net? is there wireless capability that can bypass your efforts?
you say your home router is password-protected and so are your neighbors'? hah.
[ link to this | view in chronology ]
Re:
You simply just do not plug up the patch cable or configure WIFI. TV stays dumb that way.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
I would not be surprised to find out there are hidden undisclosed wifi transmitters in many everyday devices which are used to spy on you.
[ link to this | view in chronology ]
Re: Re: Re: Re:
*popcorn*
Please, go on...
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
got a smart phone?
[ link to this | view in chronology ]
and yet
Unfortunately these "smart" tv's REQUIRE network access in order to enable/configure their highest picture quality settings (i.e. download the latest HDR patch which fixes some HDR video gameplay or 4K BluRay video flaw).
Look! Someone wrote the word "Gullible" on the ceiling!
[ link to this | view in chronology ]
Re: and yet
Look on the bright side, after enough people die, real security will become a reality.
I hate to be there bearer of bad news, but humanity kinda requires massive death and destruction to get motivated to do the right things. Or have you not looked at history and its many wars?
[ link to this | view in chronology ]
Re: and yet
[ link to this | view in chronology ]
This angered Cauthon because factory reset procedures shouldn't be secret, but also because the service center visit implied a $340 bill.
What if he decided to sell it and wanted to make sure his personal information was off the set? Would LG expect this guy to take it to a service center, pay $340 for them to reset it, only to sell it for say, $250?
Fuck you LG.
Fuck you very much.
[ link to this | view in chronology ]
Re:
- LG
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
During which time it gets pwned again.
[ link to this | view in chronology ]
Re: Re: Re:
Just a crazy thought, but maybe they could spend a little more time testing the firmware and release something that isn't broken from the start?
[ link to this | view in chronology ]
I hope...
[ link to this | view in chronology ]
Re: I hope...
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Worth noting - media attention was required
[ link to this | view in chronology ]
[ link to this | view in chronology ]
The problem is, when it comes to TV's you tend to hold onto them for many years. Hell I have a couple 50" Panasonic Plasma's that I love and have no plans to replace anytime soon and I've already owned them quite a few years already. They're dumb TV's. Just how I like them. I think it's much better to just buy a nice AppleTV, or a ROKU box or something like that to get the so called SMART stuff. It'll be faster, far better supported, and if you want to upgrade, it's simple to swap out a box to something else. Maybe put the old box to some other older TV you may happen to have.
This crap built into your TV doesn't get supported and so it gets laggy, and app's slowly stop working because they don't get updated. Security is a joke. It really doesn't make much sense and if I had a choice, I would get a DUMB TV. Just give me something with a nice picture and I'll hook up what I need to it to display what I want. The TV should just work!!!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
That's because the TV manufacturers get paid by the streaming services to include their crappy apps on the the TV. Like the ways PC manufacturers get paid to pre-load crapware on new PC's. So the price of the TV is subsidized by the crapware and that's why it can cost more to get a TV without it.
[ link to this | view in chronology ]
This is just the Internet of Shit
Few companies have the expertise to do this. In particular when it comes to security and, as mentioned above, have no incentive at all to provide support for a product where there is no ongoing profit. With their well known razor thin profits these devices can add the feature(sic) with an out of date SoC which might well be lacking the necessary hardware to provide modern protection.
There is no possibility of solving this. The smart TV is now the default for many. The OS of choice is Android, which supports their store. That is where the mighty malware lives.
Don't buy smart TVs.
[ link to this | view in chronology ]
More reason to call them idiot boxes.
[ link to this | view in chronology ]
As an added bonus, your smart TV can now be infected by ransomware, too.
https://8ball-pool.io
[ link to this | view in chronology ]