After exposed routers, wide-open cameras, and the famous “Insecure Internet of Things”, it’s time to talk about Smart TVs. Security consultant Rafael Scheel developed an attack based on the DVB-T digital television standard used in Europe, Africa, Asia, and Oceania. The attack exploits vulnerabilities in Flash and built-in browsers, enabling root access without touching the device. The worst part? Besides having persistence, it can serve as a bridge to attack other devices on the local network, or turn the Smart TV into a surveillance system.
Do you have a Smart TV connected to the internet? Technically that’s what the manufacturer wants, because there’s always the possibility of offering new services and receiving updates. But there’s a small asterisk on the record of Smart TVs, indicating that security is not a priority. From a certain point of view, a Smart TV is just another computer with a web browser, and if updates aren’t frequent, some bugs can linger, just as happened to the Nintendo Switch. That brings us to one of the most important conflict points: the vast majority of users see them as televisions, which don’t need protection mechanisms. (Ed. note: The demo starts at 31:15)
How the Attack Works
All an attacker needs to take control of a Smart TV is a low-cost digital television transmitter (averaging a hundred dollars), based on the popular DVB-T standard. If the TV tunes for a moment to the signal with malicious code, is connected to the network, its built-in browser or the available Flash version has some old vulnerability (most likely it does), and is compatible with the HbbTV hybrid broadcasting standard, it could be exposed. According to Rafael Scheel, creator of the exploit, nearly 90 percent of Smart TVs use DVB-T and HbbTV. Furthermore, the transmission is one-way, so any attempt to trace the attacker would be extremely difficult.
What an Attacker Can Do
The first vulnerabilities associated with HbbTV were reported in 2014, but the consortium responsible for regulating the standard ignored them because the threat didn’t seem that serious. What could a malicious agent do with this attack? Turn the Smart TV into a zombie for DDoS attacks, spy on users, attack nearby WiFi networks (as long as the TV is within range), extract any personal data on the device, inject ads... the list goes on. Some of the protections Scheel suggests are forcing certificate checks on web pages visited with HbbTV, creating a registry of authorized HbbTV portals, and declaring all content arriving via DVB-T as “unsafe”. In more extreme cases... don’t connect the Smart TV to the internet. Insecure protocols and web browsers in appliances, a great idea. (?)
