The FBI Says Your TV Is Probably Spying On You

from the watching-you-watching-me dept

Like most of the infamous "internet of things," (IOT) smart TVs are a security and privacy dumpster fire. Numerous set vendors have already been caught hoovering up private conversations or transmitting private user data unencrypted to the cloud. One study in 2017 surmised that around 90% of smart televisions can be hacked remotely, something intelligence agencies, private contractors and other hackers are clearly eager to take full advantage of.

This week, the FBI, that bastion of sage privacy and security advice, issued a blog post out of its Portland field office warning cyber Monday shoppers that their smart TV is a little too smart, and likely watches you as much as you watch it. The post is filled with some handy tips to help you protect your privacy:

"Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”

Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.

If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.

Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?

Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it."

Granted such tips don't really do much to fix a broken sector where privacy and security remains an afterthought. A Consumer Reports study from last year found that things aren't really improving in the space. Government hasn't done much to pass any meaningful privacy law for the internet era. Gadget obsessed consumers are historically oblivious or apathetic to the problem. And product makers are too busy worrying about margins and the next big product launch to spend money to upgrade past sets or improve their privacy and security practices (at least not until there's another major scandal).

And if you've shopped for a TV recently, you may have noticed that it's largely impossible to just buy a "dumb" TV set without all of the "smart" internals. More specifically, most TV vendors don't want to sell you a bare-bones set because they want you to use their streaming services. Even more specifically, they want you to buy their sets with their specific streaming functionality because they want to spy on you and monetize your usage data.

So yeah, the FBI's tips are great and all, but they don't really get to the root of the market dysfunction that's plaguing the IOT space. There are plenty of fractured entities trying to help (like Consumer Reports' efforts to integrate an open source privacy and security standard in hardware reviews, or efforts at Princeton to make it clear what devices are actually doing on the network), but in terms of any kind of cohesive solution to the problem, there's little to nothing on the horizon.

Filed Under: fbi, privacy, smart tv, snooping, spying

Vizio Customers Get A Pittance In Settlement Over Snooping Televisions

from the watching-you,-watching-me dept

As we frequently note, most of the "smart" products you buy are anything but intelligent when it comes to your privacy and security. Whether it's your refrigerator leaking your gmail credentials or your new webcam being hacked in mere minutes for use in massive new DDoS attacks, the so-called "smart" home is actually often dumb as nails and potentially hazardous. So-called smart-televisions have been particularly problematic, whether that has involved companies failing to encrypt sensitive data, or removing features if you refuse to have your daily viewing habits measured and monetized.

Last year Vizio joined this not-so-distinguished club when it was discovered that the company's TVs had been spying on users for the last several years, starting back in 2014. Vizio's $2.2 million settlement with the FTC indicates that the company at no time thought it might be a good idea to inform customers this was happening. The snooping was part of a supposed "Smart Interactivity" feature deployed in 2014 that claimed to provide users with programming recommendations, but never actually did so. Its sole purpose was to hoover up your data and help Vizio sell it, without your express consent.

Vizio was also hit with a class action lawsuit over its actions, and the finishing touches on a settlement are just getting hashed out now. Lawyers representing consumers in the case state Vizio secretly tracked and sold the usage habits of around sixteen million Vizio owners for around three years. They're demanding a settlement of $17 million and a promise from Vizio that this won't ever happen again:

"Under the terms of the proposed settlement, Vizio will establish a $17 million settlement fund that will deliver money directly to consumers who bought Vizio Smart TVs that were subsequently connected to the Internet between February 1, 2014 and February 6, 2017. Vizio has also stopped tracking what is displayed on its Smart TVs unless a consumer consents to this tracking after receiving a prominent notification. And Vizio will delete the remaining contested viewing data in its possession."

What this actually means for consumers is a bit less impressive. Ars Technica took a closer look at the court filings in the case and found that consumers are likely to get all of somewhere between $13 and $31 for the inconvenience of being spied on without their permission. Lawyers will, unsurprisingly, get significantly more:

"When it’s all said and done, new court filings submitted on Thursday say each of those 16 million people will get a payout of somewhere between $13 and $31. By contrast, their lawyers will collectively earn a maximum payout of $5.6 million in fees."

On the plus side, insiders tell Ars Technica that the $17 million being doled out is more than Vizio made from selling this data, which usually isn't the case in other similar failures of trust (especially by cellular carriers, who'll often be fined millions for privacy violations that potentially netted them billions). And while Vizio's promises are good and all, many argue we need stronger public deterrents for companies that fail to respect user privacy, starting first and foremost with efforts to include privacy and security oversights in product reviews.

Filed Under: class action, privacy, smart tv, surveillance
Companies: vizio

'Smart' TVs Remain The Poster Child For Dismal Privacy, Transparency & Security Standards

from the watching-you-watching-me dept

The dumpster fire that passes for security and privacy standards in the internet of things space is by now pretty well understood. It's also pretty clear that in this sector, "smart TV" vendors have been among the laziest sectors around in terms of making sure private consumer data is adequately encrypted, and that consumers understand that their viewing habits and even some in-room conversations are being hoovered up and monetized, usually sloppily.

Recent studies have found that upwards of 90% of smart TVs can be compromised remotely, and leaked documents have made it clear that intelligence agencies have been having a field day with the lack of security in such sets, easily exploiting paper-mache grade protections in order to use TV microphones to monitor targets without anybody being the wiser.

Meanwhile, set vendors and viewing tracking firms continue to do a pretty dismal job clearly explaining to the end user what data is being collected and monetized. The New York Times, for example, recently did a profile piece on a company named SambaTV, whose viewer-tracking software is now collects viewing data from 13.5 million smart TVs in the United States. Owners of these sets will find Samba's Interactive TV software already installed, and are told that the software simply lets you receive handy recommendations and experience TV "in a whole new way":

"Interact with your favorite shows. Get recommendations based on the content you love. Connect your devices for exclusive content and special offers. By cleverly recognizing onscreen content, Samba Interactive TV lets you engage with your TV in a whole new way."

But at no point during set up does the company really make it obvious just how much data is being collected or how it's used:

"Once enabled, Samba TV can track nearly everything that appears on the TV on a second-by-second basis, essentially reading pixels to identify network shows and ads, as well as programs on HBO and even video games played on the TV. Samba TV has even offered advertisers the ability to base their targeting on whether people watch conservative or liberal media outlets and which party’s presidential debate they watched."

That's certainly something that would never be abused, right? Especially since we keep seeing story after story after story about how anonymized data isn't really "anonymous", such data isn't particularly well protected, and consumers don't actually have the faintest understanding of what's being collected and monetized in the first place. Consumer advocates say that transparency about what data is collected remains utterly lacking, as most users of this software have zero understanding it can potentially even track their political leanings:

“It’s still not intuitive that the box maker or the software embedded by the box maker is going to be doing this,” said Justin Brookman, director of consumer privacy and technology policy at the advocacy group Consumers Union and a former policy director at the Federal Trade Commission. “I’d like to see companies do a better job of making that clear and explaining the value proposition to consumers."

The FTC last year fined TV vendor Vizio $2.2 million for hoovering up the viewing data on 11 million consumer TVs without consumers’ knowledge or consent. But FTC enforcement is inconsistent, and is often slow to address how companies now use numerous devices in concert (your smart phone, your home assistant, and your TV) to deepen in-home surveillance capabilities further. The rabbit hole gets deeper still when you consider that your ISP is also cashing in on your IOT device usage without much transparency or oversight thanks to the recent attacks on privacy rules and FCC authority over ISPs.

Quite often, such data hoovering systems are actively misrepresented as being of ambiguous benefit to the end user. And because users can technically dig through Samba's 4,000 word privacy policy and 6,500 word terms of use to discover what's actually happening (something companies know users won't do and may not even understand if they did), they're technically adhering to the law. Eventually we'll get around to working together on modernizations of the law, but pretty clearly not before years and dozens of additional privacy and security scandals drive the point home.

Filed Under: privacy, security, smart tv, transparency
Companies: samba tv

Consumer Reports: Your 'Smart' TV Remains A Privacy & Security Dumpster Fire

from the internet-of-very-broken-things dept

By now it has been pretty well established that the security and privacy of most "internet of things" devices is decidedly half-assed. Companies are so eager to cash in on the IOT craze, nobody wants to take responsibility for their decision to forget basic security and privacy standards. As a result, we've now got millions of new attack vectors being introduced daily, including easily-hacked "smart" kettles, door locks, refrigerators, power outlets, Barbie dolls, and more. Security experts have warned the check for this dysfunction is coming due, and it could be disastrous.

Smart televisions have long been part of this conversation, where security standards and privacy have also taken a back seat to blind gee whizzery. Numerous set vendors have already been caught hoovering up private conversations or transmitting private user data unencrypted to the cloud. One study last year surmised that around 90% of smart televisions can be hacked remotely, something intelligence agencies, private contractors and other hackers are clearly eager to take full advantage of.

Consumer Reports this week released a study suggesting that things aren't really improving. The outfit, which is working to expand inclusion of privacy and security in product reviews, studied numerous streaming devices and smart TVs from numerous vendors. What they found is more of the same: companies that don't clearly disclose what consumer data is being collected and sold, aren't adequately encrypting the data they collect, and still don't seem to care that their devices are filled with security holes leaving their customers open to attack.

The company was quick to highlight Roku's many smart TVs and streaming devices, and the company's failure to address an unsecured API vulnerability that could allow an attacker access to smart televisions operating on your home network. This is one of several problems that has been bouncing around since at least 2015, notes the report:

"The problem we found involved the application programming interface, or API, the program that lets developers make their own products work with the Roku platform. “Roku devices have a totally unsecured remote control API enabled by default,” says Eason Goodale, Disconnect’s lead engineer. “This means that even extremely unsophisticated hackers can take control of Rokus. It’s less of a locked door and more of a see-through curtain next to a neon ‘We’re open!’ sign."

To become a victim of a real-world attack, a TV user would need to be using a phone or laptop running on the same WiFi network as the television, and then visit a site or download a mobile app with malicious code. That could happen, for instance, if they were tricked into clicking on a link in a phishing email or if they visited a site containing an advertisement with the code embedded."

Roku was quick to issue a blog post stating that Consumer Reports had engaged in the "mischaracterization of a feature," and told its customers not to worry about it:

"Consumer Reports issued a report saying that Roku TVs and players are vulnerable to hacking. This is a mischaracterization of a feature. It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.

Roku enables third-party developers to create remote control applications that consumers can use to control their Roku products. This is achieved through the use of an open interface that Roku designed and published. There is no security risk to our customers’ accounts or the Roku platform with the use of this API. In addition, consumers can turn off this feature on their Roku player or Roku TV by going to Settings>System>Advanced System Settings>External Control>Disabled."

Roku fails to mention that doing so disables the ability for consumers to control the device with Roku's own app, taking away valuable functionality from the end user (something Consumer Reports mentions in its write up). And Roku doesn't even address the other complaints in the report, including concerns that streaming hardware and TV companies aren't making data collection and third-party sales clear, aren't clearly showcasing their privacy policies, and often don't let users opt out of such collection without losing functionality (much like the broadband ISPs and numerous services and apps these devices are connected to).

Roku's response highlights the SOP approach (somebody else's problem) inherent in the IOT. As experts like Bruce Schneier have repeatedly noted, the tech industry is caught in a cycle of security dysfunction where nobody in the chain has any real motivation to actually fix the problem:

"The market can't fix this because neither the buyer nor the seller cares. Think of all the CCTV cameras and DVRs used in the attack against Brian Krebs. The owners of those devices don't care. Their devices were cheap to buy, they still work, and they don't even know Brian. The sellers of those devices don't care: they're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution because the insecurity is what economists call an externality: it's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

Schneier has repeatedly warned that we need cooperative engagement between governments, companies, experts and the public to craft over-arching standards and policies. The alternative isn't just a few hacks and embarrassing PR gaffes now and again. The influx of millions of poorly secured internet-connected devices (many of which are being automatically integrated into historically-nasty botnets) is a massive dumpster fire with the potential for genuine human casualties. It's easy to downplay these kinds of reports as just "a few minor problems with a television set," but that ignores the massive scope of the problem and the chain of security and privacy apathy that has created it.

Filed Under: cybersecurity, iot, privacy, security, smart tv

Researcher: 90% Of 'Smart' TVs Can Be Compromised Remotely

from the internet-of-very-broken-things dept

So we've noted for some time how "smart" TVs, like most internet of things devices, have exposed countless users' privacy courtesy of some decidedly stupid privacy and security practices. Several times now smart TV manufacturers have been caught storing and transmitting personal user data unencrypted over the internet (including in some instances living room conversations). And in some instances, consumers are forced to eliminate useful features unless they agree to have their viewing and other data collected, stored and monetized via these incredible "advancements" in television technology.

As recent Wikileaks data revealed, the lack of security and privacy standards in this space has proven to be a field day for hackers and intelligence agencies alike.

And new data suggests that these televisions are even more susceptible to attack than previously thought. While the recent Samsung Smart TV vulnerabilities exposed by Wikileaks (aka Weeping Angel) required an in-person delivery of a malicious payload via USB drive, more distant, remote attacks are unsurprisingly also a problem. Rafael Scheel, a security researcher working for Swiss cyber security consulting company Oneconsult, recently revealed that around 90% of smart televisions are vulnerable to a remote attack using rogue DVB-T (Digital Video Broadcasting - Terrestrial) signals.

This attack leans heavily on Hybrid Broadcast Broadband TV (HbbTV), an industry standard supported by most cable companies and set top manufacturers that helps integrate classic broadcast, IPTV, and broadband delivery systems. Using $50-$150 DVB-T transmitter equipment, an attacker can use this standard to exploit smart dumb television sets on a pretty intimidating scale, argues Scheel:

"By design, any nearby TV will connect to the stronger signal. Since cable providers send their signals from tens or hundreds of miles away, attacks using rogue DVB-T signals could be mounted on nearby houses, a neighborhood, or small city. Furthermore, an attack could be carried out by mounting the DVB-T transmitter on a drone, targeting a specific room in a building, or flying over an entire city."

Scheel says he has developed two exploits that, when loaded in the TV's built-in browser, execute malicious code, and provide root access. Once compromised, these devices can be used for everything from DDoS attacks to surveillance. And because these devices are never really designed with consumer-friendly transparency in mind, users never have much of an understanding of what kind of traffic the television is sending and receiving, preventing them from noticing the device is compromised.

Scheel also notes that the uniformity of smart TV OS design (uniformly bad, notes a completely different researcher this week) and the lack of timely updates mean crafting exploits for multiple sets is relatively easy, and firmware updates can often take months or years to arrive. Oh, and did we mention these attacks are largely untraceable?:

"But the best feature of his attack, which makes his discovery extremely dangerous, is the fact that DVB-T, the transmission method for HbbTV commands, is a uni-directional signal, meaning data flows from the attacker to the victim only. This makes the attack traceable only if the attacker is caught transmitting the rogue HbbTV signal in real-time. According to Scheel, an attacker can activate his HbbTV transmitter for one minute, deliver the exploit, and then shut it off for good."

So yeah, that internet of broken things security we've spent the last few years mercilessly making fun of? It's significantly worse than anybody imagined.

Filed Under: iot, malware, smart tv

Vizio Fined $2.2 Million For Not Telling Customers Their TVs Were Spying On Them

from the I-always-feel-like-somebody's-watching-me dept

Security isn't the only thing being ignored as hardware vendors rush to connect televisions, toasters, and tea kettles to the internet. Consumer privacy and data-collection transparency has also become a distant afterthought as companies rush to cash in on the ocean of data these connected-devices collect. The "smart" television sector has been notably problematic, with Samsung busted a few years back for not only recording customer living room conversations, but transmitting that data unencrypted back to the company mothership.

These are lessons that hardware vendors appear incapable or unwilling to learn. Case in point: this week the FTC announced that it had struck a $1.2 million settlement with discount TV vendor Vizio. According to the full FTC complaint (pdf), Vizio began using the company's smart televisions to track user behavior in 2014, without informing customers that this was happening. The FTC notes that Vizio for years heavily advertised a "Smart Interactivity" feature that "enables program offers and suggestions." But the complaint notes this feature never provided customers with a single suggestion.

But it did provide Vizio with a wonderful new way to collect and store a huge variety of consumer data under the pretense of adding consumer functionality. MAC addresses, IP addresses, nearby WiFi network names, metadata were all hoovered up and stored. And when the FTC says viewing data, it means that Vizio used pixel analysis to compile personal data on every program and device connected to the Vizio set:

"According to the agencies’ complaint, starting in February 2014, VIZIO, Inc. and an affiliated company have manufactured VIZIO smart TVs that capture second-by-second information about video displayed on the smart TV, including video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices.

In addition, VIZIO facilitated appending specific demographic information to the viewing data, such as sex, age, income, marital status, household size, education level, home ownership, and household value, the agencies allege. VIZIO sold this information to third parties, who used it for various purposes, including targeting advertising to consumers across devices, according to the complaint."

Again, this in and of itself isn't that controversial, especially in the age of location data and cell phones. The fact that Vizio chose not to tell anyone this data was being collected is where the company ran afoul of the FTC. An FTC blog post has a little more detail on just how specific this data was, and to whom it was sold:

"And let’s be clear: We’re not talking about summary information about national viewing trends. According to the complaint, Vizio got personal. The company provided consumers’ IP addresses to data aggregators, who then matched the address with an individual consumer or household. Vizio’s contracts with third parties prohibited the re-identification of consumers and households by name, but allowed a host of other personal details – for example, sex, age, income, marital status, household size, education, and home ownership. And Vizio permitted these companies to track and target its consumers across devices."

It's here that we'll remind you that the "anonymization" of data doesn't mean much. Time and time again, studies have shown that anonymized data sets aren't really anonymous, given that it only takes a few additional contextual clues (the likes of which companies that collect this sort of data already have) to ferret out personal identities.

It's not really clear how many settlements of this type it's going to take before "smart" hardware vendors acknowledge that being transparent with consumers (which frankly is neither onerous or particularly difficult for them in the 400-page EULA era) is important. And should we continue to weaken FCC and FTC privacy oversight of ISPs and hardware vendors (as is strongly implied by both agencies), that's less likely than ever to happen anytime soon.

Filed Under: ftc, smart tv, spying
Companies: vizio

Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack

from the dumb-is-the-new-smart dept

We've noted repeatedly how "smart" television sets have the same security issues plaguing the rest of the internet of broken things: namely there often isn't any security to speak of. The net result has been TVs that spy on you by recording in-home audio, and in some cases transmitting that data unencrypted around the internet. But we've also noted how these TVs -- like the rest of the Internet of Things -- can be compromised in a matter of moments by some rather rudimentary hacking, then incorporated into the historically unprecedented DDoS attacks we're now seeing around the world.

As an added bonus, your smart TV can now be infected by ransomware, too. Software engineer Darren Cauthon found this out the hard way when he awoke on Christmas Day to find that his family's LG 50GA6400 had been infected with a version of the Cyber.Police ransomware -- aka FLocker, Dogspectus, or Frantic Locker. That particular ransomware posts an image to the screen of the television pretending to originate with the FBI, and claiming that users must pay a $500 penalty to return full functionality to the television.

Cauthon quickly headed to Twitter to not only complain that his television was now demanding a payment just to function -- but that LG's online factory reset instructions for the TV in question didn't work:Worse, perhaps, Cauthon stated that when he contacted LG, he was shuffled around several support departments before being told that he might have to bring the TV in to be serviced by a technician (for a $340 surcharge):

"Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn't work. When the software engineer contacted LG, the company told him to visit one of their service centers, where one of its employees could reset his TV.

This angered Cauthon because factory reset procedures shouldn't be secret, but also because the service center visit implied a $340 bill. The ransomware asked Cauthon to pay $500 to unlock his TV.

As one commenter on Twitter pointed out, it would be cheaper to buy a new TV. "Avoid these 'smart tvs' like the plague," Cauthon added following his discussion with LG."

Ultimately LG reached out to Cauthon to help by providing the correct factory reset sequence, though the infection should have never been possible to begin with. While it's possible that the infection could have come via a dubious download from the Google app store, the design of the television should never allow an application to take complete control of the device in the first place. While these infections are rare, other LG users have complained about similar attacks, and found removal of the offending malware to be difficult -- especially given the lack of control users often have over devices they purportedly "own."

Of course, security firms like Symantec have been warning about the rise of TV infections since 2015, noting that while in some instances a factory reset will solve the issue, in many instances removing the malware can be borderline impossible for a less technical user. And like so many internet of broken things devices, these TVs often fail to include basic functionality allowing users to determine what traffic the television is sending over the network, or settings allowing users to protect their security. It's just one more example of how "smart" devices are frequently dumber than the technology they're replacing.

Filed Under: factory reset, ransomware, smart tv
Companies: lg

LG Will Take The 'Smart' Out Of Your Smart TV If You Don't Agree To Share Your Viewing And Search Data With Third Parties

from the privacy-policy-lobotomy dept

Techdirt reader Oldlad stuck this through the Submissions slot recently:

Because I will not agree to LG's Privacy Policy, I can now no longer access/use any of of the TV's network based programs: Iplayer, Skype, 3D etc.

As of the 7th May following a software update to our less than two year old LG TV. I was confronted with a message asking me to read and agree with a couple of important new documents. So like a good little citizen I read and agreed with the first doc regarding use of said TV. but having read the Privacy Doc I was not best pleased with the companies assumption that I would simply agree to their sharing all our intimate viewing details (plus what ever else they can see)with all and sundry.

Since I agreed not to hack into installed software (as if I Could)We cannot get around the block.

I think the company must be in breach of contract since the smart functions are no longer available. Surely in the uk at least you should not be able to change the goal posts at will. Any one sorted this problem yet??

Before some smart alec says "Take It back". We bought the set because it satisfied our criteria at the time. We did not expect some legal bully to come along nearly two years later and tell us to share all our information with the world OR ELSE??

Oldlad poses good questions. Does a manufacturer have the right to "brick" certain integral services just because the end user doesn't feel comfortable sharing a bunch of info with LG and other, unnamed third parties?

LG certainly feels it has the right to do this. In fact, it makes no secret of this in its long Privacy Policy -- a document that spends more time discussing the lack thereof, rather than privacy itself. The opening paragraph makes this perfectly clear.

Our Privacy Policy explains and seeks your agreement for how we collect, use, and share information that we obtain as a result of your use of LG Smart TV Services, as well as how we use cookies. You do not have to agree to the Privacy Policy but if you do not, not all Smart TV Services will be available to you. [emphasis added] In that case, we will still receive certain non-identifying information from your Smart TV that we need to provide the basic functions that will be available.

So, even if you don't agree to share information, you'll still be sharing information. To top it off, you won't be able to use many of the functions that put the "smart" into LG's Smart TV.

Here's a list of just some of the information LG grabs in order to ensure your Smart TV can be its smartest.

Viewing Information. This refers to information about your interactions with program content, including live TV content, movies, and video on demand. Viewing Information may include the name of the channel or program watched, requests to view content, the terms you use to search for content, details of actions taken while viewing (e.g., play, stop, pause, etc.), the duration that content was watched, input method (RF, Component, HDMI) and search queries.

Additional information will be collected if you use the "smart" features, most of which require the creation of an LG SmartWorld account.

For example, some of our services require that you become a member of LG SmartWorld, which may be subject to separate terms. You may join LG SmartWorld either through your LG Smart TV or by other means, such as through certain LG websites. This Membership Information may include your user ID, password, telephone number, name, date of birth, gender, email address, address, social networking service ID, security question answers, purchase history, and related payment information, such as credit card information or details of your PayPal account and more.

There's nothing particularly unusual about the LG SmartWorld data being collected, considering its tied to paid services and apps. The greater concern would be the wealth of viewing information (including "internet searches") that's collected as part of a person's non-"smart" usage.

This concern grows when you see the list of potential recipients of this information.

•When you use LivePlus, we may share certain Viewing Information, Device Information, and Basic Usage Information with third parties for advertising or analytics purposes and to enable the provision of information relevant to what you are viewing;

•To third party vendors that LGE may engage to provide services on its behalf from time to time, such as to collect payment for content you purchase or to fulfill customer service requests or to provide advertising services

LG seems very concerned that Smart TV owners won't allow it to provide them with "relevant ads." This focus on advertising might give one the impression that a Smart TV is subsidized by ad sales, rather than paid for completely by the end user.

When LG was caught sending plaintext data on files stored on customers' USB devices, it amended its policies and data collection tactics to exclude this data. This happened not on the strength of a customer complaint (in fact, LG told the customer to take it up with the store that sold him the TV) but because the UK government announced its intention to dig into LG's practices and see if they conformed with the Data Protection Act.

While it may have removed that particularly egregious bit of data slurping, it still intends to gather as much data as possible in order to deliver advertising, something almost every purchaser would be willing to see less of. Oldlad asks whether the company can, under UK law, simply "move the goalposts" at will, thereby providing customers with a product with fewer features than the one they purchased.

UK law does offer some additional protections in this regard. The Unfair Terms in Consumer Contracts Regulation of 1999 notes the following in its long list of specified "unfair terms."

enabling the seller or supplier to alter unilaterally without a valid reason any characteristics of the product or service to be provided

LG presenting customers with the false choice of a) giving up control of their data or b) losing access to a great deal of the Smart TV features could be construed as "altering the characteristics of the product." A lot would depend on the investigating agency's definition of "valid reason." LG's Privacy Policy claims that most of what it collects is essential to provide these "smart" services. Indeed, many of them are. But there's also plenty in that wording that indicates LG is collecting additional information solely for the purpose of providing ads. Whether or not that's a legally "valid reason" is still up for discussion.

In its defense, LG may point to the fact that this Privacy Notice is published online and could be accessed by anyone looking to purchase a Smart TV. While factually correct, the reality of the situation is that the same number of people who would proactively search out privacy policies and T&Cs before purchasing a product are roughly the same number that would balk at clicking the "Accept" button on a dialog box post-firmware update -- statistically insignificant. That number would leap appreciably if LG's intentions were laid bare in the Privacy Policy dialog box, stating something to the effect that agreeing to the policy meant allowing LG to collect and disseminate search terms, search queries and content viewed to third parties.

Being upfront doesn't result in nearly as much profitable data, however. And those who opt out, like Oldlad, are left with plain, vanilla TV rather than the smarter version they shelled out extra for.

Filed Under: privacy, smart tv, terms of service, tv
Companies: lg

Facing Backlash And A UK Govt Inquiry, LG Now Claims To Be 'Looking Into' Its Smart TVs' Data-Slurping Habits

from the oh,-NOW-you're-on-it dept

Before companies expend a ton of effort into managing their social media activities, they should spend some time getting acquainted with how the internet actually works. The net provides a framework for information to spread around the world nearly instantaneously. The lesson here is that there's no such thing as an "isolated incident." You can't just blow off one person's complaint simply because it came from one person. Because it's never going to be just one person. It's going to be thousands. Or millions. [There will always be time later to leverage the anniversary of the 9/11 attacks to sell products.]

Case in point #1: geek toy boutique KlearGear uses a bogus non-disparagement clause as an excuse to bill a complaining customer $3,500 and wreck her credit rating. One person who complained translated into a internet's-worth of negative press. KlearGear has no social media to "manage" anymore because it has locked down its Twitter account and deleted its Facebook presence. And it's all because they targeted one person with a supremely underhanded "contract."

Case in point #2: A blogger notices data about files on his USB storage device are being transferred to LG's servers (in unencrypted form, no less and without permission) by his LG Smart TV. He contacts LG and receives a letter blowing off his complaints and suggesting he take it up with his local retailer.

Cut to a couple of days later and LG's tune has changed completely.

[W]hen the BBC contacted LG, it indicated it was looking into the complaint.

"Customer privacy is a top priority at LG Electronics and as such, we take this issue very seriously," said a spokesman.

"We are looking into reports that certain viewing information on LG Smart TVs was shared without consent.

LG originally blew off the blogger's complaint because, hey, it was just one guy. But it's never "one guy." Not anymore. The story has now been covered worldwide and has caught the attention of the UK's regulatory body charged with enforcing data privacy laws.

The Information Commissioner's Office told the BBC it was looking into the issue.

"We have recently been made aware of a possible data breach which may involve LG Smart TVs," said a spokesman.

"We will be making enquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken."

To hugely repurpose a Bible verse, if you do this to the least of my brethren, you've pretty much done it to everyone. Companies can't afford to offhandedly dismiss single complaints. At the very least, their responses need to be tailored to specific issue rather than just a boilerplate regurgitation that lets the complainant know he or she isn't being heard.

And when implementing policies or altering terms and conditions, companies need to think each addition or subtraction through very carefully. Rather than assume no one will ever find out because no one reads T&C pages, companies need to ask themselves, "What would happen if EVERYONE found out about this?" Because the likelihood is that everyone will. And unless your social media strategy is solely composed of unplugging accounts when faced with multiple raging fires, whatever you have implemented at the moment isn't going to be up to the task should you opt to do something regrettable.

The world may be composed of individuals, but "getting screwed by a company" is a universal concept. Nothing unites people faster than outrage. Keep that in mind before you start siphoning data without permission or ruining people's credit record with fraudulent charges.

[Update: Things appear to be moving very quickly back at LG HQ. Just as this post was set to roll out the virtual door, news arrives that LG is issuing a firmware update to fix one of its data collection issues.

In a statement, LG said that its smart TVs collect viewing information like channel, TV platform, and broadcast source in order to "deliver more relevant advertisements and to offer recommendations to viewers based on what other LG Smart TV owners are watching."

The company's TVs include the option to turn off this data collection, but "we have verified that even when this function is turned off by the viewers, it continues to transmit viewing information although the data is not retained by the server," LG said.

"A firmware update is being prepared for immediate rollout that will correct this problem on all affected LG Smart TVs so when this feature is disabled, no data will be transmitted," the company said.

Now, if it can just get it to stop scanning attached drives and gathering that data as well... Until that's addressed, at least simply turning off the data transmission will keep that info from going anywhere.]

Filed Under: privacy, smart tv
Companies: lg

LG Smart TV Caught Collecting Data On Files Stored On Connected USB Drives

from the if-you-give-a-TV-an-internet-connection... dept

The growing presence of "smart" devices, each one requiring a connection to the outside world, is a bit alarming (Samsung TV zero day exploit, anyone?). The territory still remains largely uncharted and device manufacturers are still pretty much free to decide just how much data these devices will cough up when phoning home.

A blogger (and developer and Linux enthusiast) going by the name of DoctorBeet noticed his newly-purchased LG Smart TV was displaying ads on the "home" screen. He dug around and found more info on an LG corporate page that described the process in cheery let's-sell-some-ads tones.

LG Smart Ad analyses users favourite programs, online behaviour, search keywords and other information to offer relevant ads to target audiences. For example, LG Smart Ad can feature sharp suits to men, or alluring cosmetics and fragrances to women.

The endearingly sexist sales pitch attempting to sell other pitchmen on LG's "smart" ad platform/TV makes it pretty clear that LG's TV is very interested in any "interactions" you have with your device.

What the sales pitch failed to make clear is that LG will be grabbing this behavioral data no matter what.

In fact, there is an option in the system settings called "Collection of watching info:" which is set ON by default. This setting requires the user to scroll down to see it and, unlike most other settings, contains no "balloon help" to describe what it does...

At this point, I decided to do some traffic analysis to see what was being sent. It turns out that viewing information appears to be being sent regardless of whether this option is set to On or Off.

Not only was LG sucking up viewer data, it was sending the data on each interaction completely unencrypted. This isn't necessarily a huge problem if the data collection was limited to the channel watched and for what length of time. But as the increasingly creepy sales pitch above points out, LG also wants "search keywords" and a potentially unlimited amount of "other information."

At this point, LG already has a bit of privacy problem. Sending data on channel selection is one thing. Collecting and sending unencrypted web data like search terms is quite another. And it gets even worse.

It was at this point, I made an even more disturbing find within the packet data dumps. I noticed filenames were being posted to LG's servers and that these filenames were ones stored on my external USB hard drive.

DoctorBeet tested his hunch by mocking up an .avi file that would be immediately distinguishable from any other "normal" traffic. Plugging in a USB stick with the bait (Midget_Porn_2013.avi) into his TV, DoctorBeet soon saw data on his faux porn headed to LG's servers in unencrypted plain text. DoctorBeet (and his shocked wife) also watched his children's names being harvested from the file name of a Christmas video located on another connected drive. [Click picture to open a full size version in another tab.]


The implications of this data collection are huge. As DoctorBeet points out, it's simply an invasion of privacy at best. Who knows what ads LG might serve when faced with a hard drive full of porn? Who knows what it might do if it goes trolling through media files at the behest of publishers, studios and labels? It's not tough to imagine a scenario where "connected" files become bricked because of a perceived lack of license. As we've seen before, companies are seeking to patent methods of utilizing connected devices (like the now-mandatory Xbox "camera") to determine who's enjoying what content for ad-serving purposes/licensing fee extraction.

If nothing else, a "smart" TV shouldn't be gathering, much less sending, file data back home from customers' non-LG devices. The fact that LG does this in unencrypted form is also troubling. The fact that LG does this even when you specifically tell it not to is the sort of thing that becomes the basis for a class action lawsuit.

LG's pass-the-buck response to DoctorBeet's complaints makes everything so much worse.

Thank you for your e-mail.

Further to our previous email to yourself, we have escalated the issues you reported to LG's UK Head Office.

The advice we have been given is that unfortunately as you accepted the Terms and Conditions on your TV, your concerns would be best directed to the retailer. We understand you feel you should have been made aware of these T's and C's at the point of sale, and for obvious reasons LG are unable to pass comment on their actions.

We apologise for any inconvenience this may cause you. If you have any further questions please do not hesitate to contact us again.

Kind Regards

Tom

LG Electronics UK Helpdesk
Tel: 0844 847 5454
Fax: 01480 274 000
Email: cic.uk@lge.com

In other words:

"Sorry" if you misunderstood the Terms and Conditions you were compelled to accept if you wanted to use your new purchase. "Sorry" these same terms and conditions nullified your preferences on sending data without your permission. Oh, and by the way, not our fault -- the helpful people with the name tags at your local electronics store should have been intimately familiar with the Terms and Conditions of our entire product line and ensured that potential customers knew they were purchasing a SPY TV rather than a SMART TV.

If you have any other questions about our intrusive data collections, please don't hesitate to fuck off and die.

LG's representation may not care (at the moment) whether DoctorBeet feels LG's watching him more than he's watching its TV, but as this story continues to spread across the internet, I would imagine its tune will change. And when that changes, hopefully it will alter the Terms and Conditions as well.

People don't implicitly surrender their privacy when they attach a "smart" device to the internet. There are responsible ways to collect data and responsible ways to protect this data and, from what's being shown here, LG is doing neither.

Filed Under: information sharing, privacy, smart tv, usb drives
Companies: lg