LG TVs caught recording audio with the screen off and snooping on the home network

LG smart TVs constantly comb through the home network, build a map of the devices on it and record microphone audio even when the TV itself appears to be switched off. This is the finding of a 135-minute investigation by the Gamers Nexus channel, produced together with Level1Techs and independent security specialists.

What they found

The researchers tested production LG OLED models, including the G5. Capturing network traffic through Wireshark showed that the TVs actively scan the local network in search of other equipment — smartphones, smartwatches and other gadgets. Besides internal IP addresses, the devices collected the names and signal strength of neighboring Wi-Fi networks, as well as location data.

All of this information flows into LG Ad Solutions, the company's advertising division. Against a claimed 216 million TVs sold worldwide, the advertising arm says it has access to 363 million “secondary addressable devices” in the US alone — by tracking other people's equipment on the same networks.

The microphone that never sleeps

The TVs also use automatic content recognition (ACR) technology: it takes digital fingerprints of the picture and sound to record exactly what the user is watching on any input. ACR has been known about for a long time, but the new tests show that the data collection goes considerably further.

On the test bench it turned out that the TV is able to record clean microphone audio while the screen is (or at least appears to be) in standby mode. When the researchers disconnected the device from Ethernet, it kept saving voice recordings locally and uploaded the accumulated files as soon as the connection was restored.

In addition, the specialists discovered vulnerabilities in webOS that allow remote code execution; these are currently going through the responsible disclosure process.

The researchers' advice

Since the TV uses broad network listeners “out of the box” and regularly scans its surroundings, the recommendation turned out to be extremely simple: disconnect LG devices from the internet and use external streaming boxes. As of publication, LG had not commented on the findings in any way.

Source: Hacker News