Post by douger on Nov 20, 2013 10:56:38 GMT -5
So put down the porn already.
There's no reason this is limited to LG brand televisions.
There's no reason this is limited to LG brand televisions.
The unidentified blogger, whose twitter profile described him as a "developer, tweaker and Linux enthusiast" living in UK county of Yorkshire, said the LG Smart TV model is LG 42LN575V and was manufactured May 2013. He provided screenshots of data packets he said he captured showing the information his TV sent unencrypted over the Internet. The data appeared to show a device ID unique to his set, along with the name of the channel it was tuned to. In his tests, the information was sent in the clear every time the channel was changed. Even more remarkable, he said, the smart TV sent the data even after he waded through the system preferences and set the "Collection of watching info" setting to "off" (it was on by default).
But the logging didn't stop there. Included in the traffic sent over the Internet were the names of files stored on a USB drive connected to the LG television. For dramatic purposes and to ensure he chose a file name not likely used by the firmware, he created a mock video file called Midget_Porn_2013.avi, loaded it onto a USB drive and plugged it into his TV. Sure enough, the file name was transmitted unencrypted in HTTP traffic sent to the address GB.smartshare.lgtvsdp.com. In some cases, he said, file names for an entire folder were transmitted, and other times nothing at all was sent. He never determined the rules that controlled when data was or wasn't sent.
But the logging didn't stop there. Included in the traffic sent over the Internet were the names of files stored on a USB drive connected to the LG television. For dramatic purposes and to ensure he chose a file name not likely used by the firmware, he created a mock video file called Midget_Porn_2013.avi, loaded it onto a USB drive and plugged it into his TV. Sure enough, the file name was transmitted unencrypted in HTTP traffic sent to the address GB.smartshare.lgtvsdp.com. In some cases, he said, file names for an entire folder were transmitted, and other times nothing at all was sent. He never determined the rules that controlled when data was or wasn't sent.
