Smart TVs vulnerable to a host of attacks
Smart (connected) TVs are becoming a common fixture in Western world homes, and most users consider it a handy tool and an improvement over the basic television sets of yesterday. But most of them are unaware that its integrated Internet capabilities and advanced computing abilities and connectivity also open the way for a number of attacks.
Research in this field is still in its infancy, and as a proud new owner of a Samsung ES7000 TV with HbbTV capabilities, n.runs AG researcher Martin Herfurt has decided to poke around a bit and see just what kind of attacks he can throw at it.
“Until now, most of the security researchers working with connected TVs focused on security vulnerabilities related to physical access to the device’s USB port or local network access,” he pointed out, adding that a paper published by the researchers from German TU Darmstadt addressed mostly privacy-related issues with the HbbTV standard such as WiFi eavesdropping.
His own research and that of his collaborators demonstrated that content that is requested by the Smart TV at the time the user changes the channel can be altered by attackers, allowing them thusly to make the URLs within the DVB stream to point to servers with their (potentially malicious, or simply annoying) content.
Some TV stations that are using HbbTV are using poorly configured servers which can be compromised to serve malicious content, and they are not using SSL secured connections, which means that attackers can again lead users to malicious content by deploying a Man in the Middle attack.
Other attacks can lead into the TVs becoming roped into a Bitcoin mining botnet, users seeing fake news on the news ticker (the “moving stripe” on the screen that offers headlines and stock information), and being subjected to viewing unwanted content.
But TV owners are not the only ones that can be victims of these attacks. For example, Herfurt points out that attackers could generate fake requests via proxy networks simulating real TV watchers, affecting thusly the real popularity and potentially the survival of certain shows.
Finally, attackers might use the TV to attack components in user’s LAN, reconfigure them, extract information, and so on.
“The software of currently available HbbTV devices lacks the possibility to configure security settings as this might be done in decent browsers. At the moment, the TV user has to trust the entertainment provider/broadcast station a lot,” he points out.
To at least partially mitigate the risk, the TV manufacturers would have to implement mechanisms that allow the user to control the TV’s HbbTV functionality, he says, so the users can whitelist trusted channels.