Some Samsung smart TVs are sending users’ voice searches and data over the internet unencrypted, allowing hackers and snoopers to listen in on their activity.
The revelation comes 10 days after Samsung found itself in the middle of a row over the “Orwellian” privacy policy for its smart TVs, after it was revealed that it was sending user voice data to third parties.
It was believed that the information was encrypted but now a security expert has found that data is vulnerable while in transit. Samsung had stated that it uses “industry-standard security safeguards and practices, including data encryption, to secure consumers’ personal information and prevent unauthorised collection or use”, in a blog post clarifying its privacy policy.
When a user carries out a voice search using a smart TV the audio is sent across the internet to a voice recognition service that interprets the speech and sends back the results in text.
In some Samsung models, neither the audio, nor the text returned, is being encrypted, meaning hackers or snoopers can clearly see the words and phrases that users speak to the TV. The television also sends other personal information about the TV and user in the unencrypted information.
The smart TVs, which can be operated by voice commands to adjust channels, can be used with natural language search. They can be activated with hot word “Hi TV”, which the television can be set to always listen out for. Samsung uses voice recognition company Nuance to power its voice command services.
Security researcher David Lodge of Pen Test Partners who tested Samsung’s UE46ES8000 smart TV, which was released in 2012 and is still available to buy today, said: “What we can see is it sending a load of information over the wire about the TV, I can see its MAC address and the version of the OS in use. After the word buffer_id is a load of binary data, which looks audio-ish.”
“You can make out that it thinks I’ve said either Samsung, Samson or Samsong,” said Lodge.
Those looking to spy on smart TV users will need to hijack their internet connection, either through their Wi-Fi, their internet service provider or with access to the backbones of the internet, the kind of surveillance being carried out by GCHQ and other law enforcement agencies.
A Samsung spokesperson told the Guardian that “Samsung takes consumer privacy very seriously and our products are designed with privacy in mind. Our latest Smart TV models are equipped with data encryption and a software update will soon be available for download on other models.”
This is just the latest blow to Samsung’s smart TV line, which began erroneously forcing pop-up ads into third-party video apps without permission after a botched software update.
Comments (…)
Sign in or create your Guardian account to join the discussion