Infosec researchers pwned Comcast's voice-activated remote control so it could snoop on household chit-chat

A voice-activated TV remote can be turned into a covert home surveillance device, according to researchers from infosec firm Guardicore who probed the device to show that a man-in-the-middle attack could compromise it. Guardicore discovered an attack vector on US telco giant Comcast's Xfinity XR11 voice remote – of which …

[John Smith 19]

It's got a mic and s**t security

Welcome to "Open mic" night in your home.

[RM Myers]

Re: It's got a mic and s**t security

Wait until you get that new internet connected smart toilet! That will put a whole new meaning to sh*t security. And they come with mic's!

https://www.digitaltrends.com/home/best-smart-toilets-ces-2019/

[Korev]

There's a reason my Samsung TV is blocked on my firewall. (It's on the network so I can watch things on my NAS)

[Gene Cash]

This has nothing to do with InternetOfTwats... this is a simple insecure RF link.

[Anonymous Coward]

I surprised a Sky drone when I refused an offer for replacing my actual device with a Sky Q - when I said "I don't want a f*******g microphone listening in my living room!"

Even my smartphones are not there.

[Tom Chiverton 1]

You have to at least press a button to make it start listening

[Mike 16]

Have to press a button

Well, that's what they _say_, but then, that's what they would say.

Do you feel _lucky_?

[Henry Wertz 1]

In case you wondered

In case you wondered, WTF is the point of this? My parent's Dish Network remote has this setup (but hopefully better security.) The way it works stock, it doesn't listen to a thing until you hit a microphone button on it (the button looks like an old timey barrel mic). I'd like to think it's this way for security; I guess that's possible, but let's face it, it was probably done that way just because running a mic on a remote 24/7 would run the batteries down too fast. (Google, Amazon, I'm looking at you -- having your little assistants spying 24/7 supposedly just to listen for "Hey Google" or "Hey Alexa"? No thanks, give me a button!) I don't use the mic, my dad LOVES hitting the button and saying "history channel" or "BBC America" or whatever to it.

[Drew Scriver]

Re: In case you wondered

The way it works stock, I hope it doesn't listen to a thing until you hit a microphone button on it.

[Lord Elpuss]

Re: In case you wondered

Simple way to tell. Need to replace the batteries once a week? It's listening. If they last for months/years, it's not.

[fidodogbreath]

A voice-activated TV remote can be turned into a covert home surveillance device

I'm shocked. Shocked, I tell you.

[Drew Scriver]

At least one of the top-10 banks in the US has issued a Cyber policy mandating that all "smart devices" within earshot are turned off if you work from home. I'm pretty sure they have a very good reason for this rather unpopular policy.

[Cliffwilliams44]

Yet, none of their web sites use 2FA security. Yeah, we so where their priorities are.

[John Smith 19]

Guess people haven't learned much in the 7 years since Edward Snowden

These days I think I'd just tap the broadband line/phone line out of someones house.

Bound to be some device that a)Has a mic b)Sends it to a server c)Can have their security (or the data stream they are sending 24/7/365) compromised.

Do all those extra microphones and cameras in your house make you feel "safe"

Or just watched.

[Gene Jones]

Been telling people for years any microphone or camera in their home is ripe for hacking by both government and drive-by snoops, and it's harvest season 365 days a year.