Key points
- A YouTube channel spent $70,000 testing LG TVs
- The set listed 38 devices on their network
- Voice transcripts were stored in plain-text logs
- Advertising gives TV makers a recurring revenue stream
LG says its televisions don't record the conversations in your living room. Gamers Nexus spent about a month and roughly $70,000 investigating what the sets actually collect, working with Level1Techs and three security researchers. Their video, 216,000,000 Spy TVs, separates what a compromised television can do from what the tested sets do normally. The ordinary behavior is troubling enough.
Their set took inventory of the network. It found 38 other devices, including staff phones, printers, smartwatches, switches and thermostats. It collected display names, internal addresses and hardware identifiers, which the channel shows from about 17:08. It also logged nearby Wi-Fi network names and signal strengths, information that can help locate a television without GPS. Some device information appeared in packet captures of traffic leaving the set. Other traffic was encrypted, so the researchers couldn't read everything it sent to LG.
Forget the microphone for a second. A conference-room screen that identifies other devices on the network and regularly contacts a long list of domains deserves a place in the security review. One researcher's assessment was blunt: state-backed hackers "would be very comfortable inside LG TV."
Now the listening, which is where the reporting has to be careful. LG sets run automatic content recognition, which takes a fingerprint of what is on the screen and what comes out of the speakers, in pieces of about six seconds. Gamers Nexus estimates its television sent about 4 gigabytes of that recognition data alone to LG in a month, which is its own measurement of traffic it identified as ACR, not the set's total network use.
Separately, when somebody says the wake phrase, the microphone stays open for another 10 to 15 seconds after the talking stops, and whatever it picks up gets turned into text and written into a log stored on the set itself, which the channel reads out from about 46:17. The channel caught two of its own staff that way, talking about work behind the television, with no idea it was on. Steve Burke, who runs Gamers Nexus, called the captured data "an egregious invasion of privacy." The microphone heard someone speaking normally from 40 feet away. Finding those transcripts on the set is not the same as showing them being uploaded, and the channel doesn't claim it caught them leaving.
The clips everyone is passing around, the ones where the screen is dark and the network cable is out and the thing is still recording, came after the researchers took over the television. That matters. Burke says so himself in the video. "But that requires an adversary, which sounds scary," he says. "What we think is scarier is LG itself." They also found remote code execution flaws, which they're sitting on while LG patches them.
