FBI PORTLAND OFFICE
Oregon FBI Tech Tuesday: Securing Smart TVs

Yes, I said your TV. Specifically your smart TV...the one that is sitting in your living room right now. Or, the one that you plan to buy on super sale on Black Friday.

Smart TVs are called that because they connect to the Internet. They allow you to use popular streaming services and apps. Many also have microphones for those of us who are too lazy to actually to pick up the remote. Just shout at your set that you want to change the channel or turn up the volume and you are good to go.

A number of the newer TV’s also have built-in cameras. In some cases, the cameras are used for facial recognition so the TV knows who is watching and can suggest programming appropriately. There are also devices coming to market that allow you to video chat with grandma in 42” glory.

Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home. A bad cyber actor may not be able to access your locked-down computer directly, but it is possible that your unsecured TV can give him or her an easy way in the backdoor through your router.

Hackers can also take control of your unsecured TV. At the low end of the risk spectrum, they can change channels, play with the volume, and show your kids inappropriate videos. In a worst-case scenario, they can turn on your bedroom TV's camera and microphone and silently cyberstalk you.

[OCS: Smart hackers can always find a way to access your unsecured and secured devices. Just ask the government, banks, or other large companies who have spent millions securing their systems only to be laid by an unknown “zero day” exploit.

So can government investigators on a fishing expedition and without a valid probable cause or warrant.]

TVs and technology are a big part of our lives, and they aren’t going away. So how can you protect your family?

• Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”

[OCS: Many devices have hidden features which are used for maintenance and repair – and are hidden from consumers. Some are accessed with specific key sequences which allow you to access hidden settings, information, and features.]

• Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.

[OCS: This means nothing as we have seen time-and-time again where vendors, app-suppliers, and others have bypassed user settings to access devices directly.]

• If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.

[OCS: Some devices have infrared sensors which can scan the room independently of the camera and can yield images.]

• Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?

[OCS: If the manufacturer can access and update your device, with or without your permission, they own your hardware and software and can do anything they want with or without your permission.]

• Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it.

[OCS: This is a joke – privacy agreements and terms of service are unilateral, one-sided agreements that are provided on a “take it or leave it basis.” Most contain provisions that they can access and use your data to improve your user “experience” or help them improve their products (using you as guinea pigs). In many cases, they claim the right to sell “anonymized” data, which when combined by other data may allow third-parties to identify individuals. And, of course they claim no responsibility for damages and often preclude class action lawsuits by demanding “arbitration.”

As always, if you have been victimized by a cyber fraud, be sure to report it to the FBI’s Internet Crime Complaint Center at www.IC3.gov or call your local FBI office. <Source: FBI>