It is no secret that Smart TVs, like many other devices in the so-called Internet of Things, are a true security carnival. And logically, that translates into fertile ground for certain intelligence agencies that, in the name of national security, have become the new “Big Brothers” of the 21st century. This past weekend, Wikileaks published details about Weeping Angel, a tool specifically designed to intercept Samsung Series F televisions, based on the Extending software from MI5. Would you like to see the manual...?
Wikileaks shook the world again last March after revealing the existence of Vault 7, a super package of documents loaded with data related to the CIA’s cyberwarfare and electronic espionage capabilities. Several intelligence officials (speaking anonymously) indicated that the documents appear to be legitimate, as did Edward Snowden himself, and in the middle of that month, US President Donald Trump let slip in an interview that “the CIA had been hacked”, which is equivalent to leaking classified information. The espionage techniques reach a wide range of resources, from operating systems and browsers to smartphones and cars, but Smart TVs are also mentioned, especially the Samsung Series F manufactured in 2013.
Let’s make room for Weeping Angel, probably a reference to the creature from Doctor Who. Weeping Angel was developed by the CIA as a variant of the Extending tool from the British MI5. The most interesting part is that part of the leaked information includes the Extending user manual, through which it is possible to know the configuration of the “implant”, general compatibility, and its main functions. Basically, Weeping Angel-Extended is prepared on a Linux computer and installed on the Smart TV using a USB drive, thus confirming the need for physical access to the television. The goal of the tool is to intercept the built-in microphone, and audio files can be extracted with a USB drive, or by using a WiFi hotspot within range of the television using a special SSID, while transmitting the sensation of being off.
If that is not enough for agents, there is the possibility of obtaining live conversations thanks to a secondary tool called Live Listening Tool, compatible with Windows systems. The manual is dated February 28, 2014, and it is most likely that it had some minor revision. The “UK EYES ONLY” is quite striking, and suggests that the document should be distributed internally within MI5 (and not shared with its allies), while “STRAP 2” points to a medium level of security. The Korean manufacturer decided to opt for radio silence, but if this was in use two years ago, imagine what they have now...
