back to article Samsung's spying smart TVs don't encrypt voice recordings sent over the internet – new claim

Not only is your Samsung smart TV snooping on what you say, it sends recordings of your voice over the internet unencrypted – leaving it open to eavesdropping and mischief – security researchers say. Samsung insisted last week that its TV voice-control technology isn't half as creepy as its terms and conditions suggested. But …

  1. phil dude
    WTF?

    Hollywood is responsible....

    I keep having this dream that we are living on the set of the Last Action Hero of some other reality distortion.

    I wonder what the S.I. units of Incompetence are?

    P.

    1. Anonymous Coward
      Anonymous Coward

      Re: S.I.Unit of Incompetence.

      The Spencer (Frank)?

      1. Doctor Syntax Silver badge

        Re: S.I.Unit of Incompetence.

        My immediate thought was the Hacker (Jim) but the term's already overloaded. But how about the firkin as in "two firkin bad"?

        1. Fooen Mahf
          Joke

          Re: S.I.Unit of Incompetence.

          The Firkin is already in daily use as the SI unit of excess.

      2. DropBear

        Re: S.I.Unit of Incompetence.

        I could see the Drebin (also Frank) catching on too...

    2. Big-nosed Pengie

      Re: Hollywood is responsible....

      "I wonder what the S.I. units of Incompetence are?"

      5 Samsungs = 1 Microsoft.

      1. Anonymous Coward
        Boffin

        Re: Hollywood is responsible....

        Having considered this in depth for nearly three nanoseconds, I'd suggest that one milli-Spencer is an average human's level of stupidity, with corporates rating between 1 Spencer and one Mega-Spencer. Suggest the unit is abbreviated to Sf to avoid confusion with seconds, and nicely allows one to invent pithy phrases like 'silly fools' or perhaps other somewhat harsher ones depending on circumstances.

        1. Anonymous Coward
          Anonymous Coward

          Re: Hollywood is responsible....

          "[...] nicely allows one to invent pithy phrases like 'silly fools' [...]"

          For smaller denominations of "Sf" it could be "Sb" - "Silly boy".

          1. Matt 21

            Re: Hollywood is responsible....

            Don't tell him, Pike!

      2. Rufus McDufus

        Re: Hollywood is responsible....

        If we're talking ancient unpatched versions of OpenSSL with glaring security flaws then 100 Microsofts = 1 Apple.

  2. Haku
    Facepalm

    Thanks Samsung.

    I now have a headache from an appropriate force facepalm after reading this article.

  3. Anonymous Coward
    Anonymous Coward

    I'll be recommending a ban on all Samsung devices of any kind in all corporate meetings.

    Who knows when Samsung devices wake up and what they stream out.

    I don't think Samsung are a trustworthy company; this goes well beyond the usually greedy profiteering that (say) Apple gets accused of.

  4. Dan 55 Silver badge

    Knox Knox

    Samsung may be incompetent at developing everything else but I'm sure their methodology for Knox is completely different.

    1. Anonymous Coward
      Anonymous Coward

      Re: Knox Knox

      Samsung's software prowess is legendary - just look at the extra added value Samsung ships with every phone. And look at their Smart TVs built with your security in mind, keeping you safe, checking you haven't said anything silly.

      I'm sure you've nothing to worry about with Knox. Or maybe, Dan 55 (which probably isn't even your real name), you've got something to hide... Yes, that's it. I bet you're the sort of person who sneers at DRM, because, Dan 55, home taping really is killing music...

  5. dan1980

    This is what you get when governments are more concerned with collecting personal and private information from the public than they are with protecting it.

    Ideally, there should be laws that require any company sending any personal data over the Internet to encrypt that data. So too should there be laws restricting what personal data can be collected in the first place, as well as maximum retention periods. Those laws should say that only the minimum data that is essential to the provision of the core service or function being used can be collected and any additional, non-essential data that a service might collect - or want to collect - MUST be entirely opt-in and the provision of services and functionality must not require such extraneous information to be provided nor be degraded or curtailed if it is not*.

    That is what the laws would look like if our governments actually cared about the privacy of the people.

    But no, they are happy for all this data to be collected and retained and transmitted insecurely because they want to get their hands on it too. When governments are even considering the idea of restricting (much less banning) encryption then their goals, their attitude towards the public and their technical competence is laid bare.

    If they respected the public and their privacy then they would ensure that they understood the technical details and any ramifications. They would consult in good faith with academics and professionals outside the sphere of government, rather than just their spy agencies and police forces, from whom a one-sided view is assured.

    What a world that would be - if governments actually respected the people instead of throwing away our money and destroying our rights and privacy.

    In such a world, Samsung would be over a barrel for such irresponsible and anti-consumer practices which have continued

    Sigh.

    * - These kind of devices and applications are a package deal - you generally can't choose, for example, to use your TV to directly access online content such as Youtube or Netflix or 'catch-up' TV services but not to capture and transmit all your viewing data for non-connected, free-to-air broadcasts and then sell it on to advertisers, for whom that information is a treasure-trove. Or to store it where it can be accessed by law enforcement and spy agencies - usually without a warrant.

    1. James Loughner

      Can we send all our friendly Representatives a new Samsung TV as a token of our esteem. They deserve it

  6. Anonymous Coward
    Anonymous Coward

    An internet of thing with no bloody security whatsoever. Quelle surprise.

    1. dan1980

      Why bother?

      There are no regulations to force them to, mainstream media never cares to put the word out, people are generally rather apathetic on this front and, even if they weren't, all the other companies are the same anyway.

      The only way to fix this is government regulation because the industries involved are just not going to do it themselves.

      A pity that is rather unlikely to happen.

      1. solo
        Trollface

        Re: A pity

        "Even if you are paying, you are a product now"

        [sorry for being repetitive, but, I really want this phrase out in media]

    2. VinceH

      "An internet of thing with no bloody security whatsoever. Quelle surprise."

      And this is just one reason why it is the Internet of Unwanted Things - iOUT!

      (In theory, an internet connected TV has the potential to be a good thing - and therefore something we'd want - but they fall firmly in the iOUT camp when companies like Samsung do shit like this.)

  7. Kevin McMurtrie Silver badge
    Big Brother

    Jail time

    Just wait until Sony and Hollywood find out that Samsung is transmitting illegal copies of movie audio every time somebody says, "Hi TV."

  8. P. Lee
    Trollface

    If you want to mess with them

    Say, "Hi TV" and press DVD->Play

    1. MrDamage Silver badge

      Re: If you want to mess with them

      Or, just say "Hi TV" before opening up their own Youtube app, and starting one of the many anti-samsung rant clips.

    2. Adam 1

      Re: If you want to mess with them

      Or, you know. Fire up curl and send random crap in the right structure.

      The binary blob is likely to be one of the standard formats.

  9. hazzamon

    If they aren't encrypting data...

    Then perhaps they don't sanitise inputs either. To paraphrase xkcd:

    "Hi TV'); DROP TABLE SearchQuery;--"

    1. Adam 1

      Re: If they aren't encrypting data...

      Obligatory...

  10. Mark 85

    I'm waiting to see how they backpedal out of this one like they've done with every other revelation about their StupidTV. Pass the popcorn please.

  11. Anonymous Coward
    FAIL

    From the Samsung Gear S product page: "Stay in touch and stay connected even away from your phone".

    I now realise they mean stay in touch and connected to Samsung and your government, not to your friends.

  12. Anonymous Coward
    Anonymous Coward

    Tech News:

    Electronics company Samsung have warned that smart TVs forced to listen to your constant stream of trite, facile yap are now showing signs of severe depression.

    The company has caused controversy after it was revealed that their internet-connected SmartTV’s could record user’s personal conversations and send them to third parties.

    Now Samsung claims that having to listen to the banal, drawn-out bollocks you constantly spout is making the TV’s clinically depressed.

    “Having to listen to customers insipid waffle has caused many TVs to become lethargic and show genuine signs of anxiety and sadness every time you walk into the room and start prattling on about every boring aspect of your humdrum life,” said a spokesman from Samsung.

    “We urge customers to say more interesting things or just be quiet – in some extreme cases the TV’s have chosen to explode rather than face another minute of listening to your endless stream of vapid drivel.”

  13. Joe Harrison

    Says it all

    http://www.joyoftech.com/joyoftech/joyarchives/2104.html

    1. Anonymous Coward
      Anonymous Coward

      Re: Says it all

      brilliant...

      Thanks for the DNS for the server it goes too - can add that to the firewall.

  14. Magnus_Pym

    Only Samsung?

    As I understand it only Samsung admit to this in their TAC's but the use of outsourced voice recognition is quite common. So many many things could be transmitting what you say over the internet.

    1. Lee D Silver badge

      Re: Only Samsung?

      I'd be quite impressed if my Samsung TV was doing that. It's not plugged into the network. Not that that would stop COLLECTION, but certainly DISTRIBUTION of my private information.

      There is a reason my systems have mics on mute, not connected unless they need to be, voice recognition is switched off wherever I go, etc.

      The question really is: How long before some police force subpoena's Samsung for what suspected criminal X might have said in front of their TV?

      You know when you all loved Siri, and "OK Google", etc.? Yeah, I was cringing even then. I'm by no means a conspiracy theorist, but just a computer scientist grounded in reality - if you give an app permission to record voice and transmit to the cloud, then you're giving it permission to record your voice and transmit to the cloud. Sure, it's "only so it can translate while I'm abroad" or whatever. But I bet you don't turn it off, revoke permissions or uninstall once you're done with that single legitimate use.

      Least privilege principle, people. And your TV really doesn't need the capability to record the sounds of your living room 24/7 and upload them live to a cloud provider.

    2. Dan Paul

      Re: Only Samsung? NO, Magnus Pym

      Microsoft Cortana, Apple Siri, Google Voice all come to mind as voice recognition over the internet.

      They all have to use a remote server in order to work on your smartphone.

      Are any of these companies any more trustworthy than Samsung?

      1. Mark 85

        Re: Only Samsung? NO, Magnus Pym

        "Are any of these companies any more trustworthy than Samsung?"

        For some value of "trustworthy".... uh... no.

  15. Truth4u
    Big Brother

    Hi TV what time is the anti police state march today

    There will be no march today Dave.

    Hi TV what's the quickest way into central London

    I have locked the doors, the police are on their way Dave

  16. Evan Essence
    Devil

    Dumb, dumb, dumb

    "Smart TV" is an oxymoron. My TV is dumb, and will stay that way.

    1. Lee D Silver badge

      Re: Dumb, dumb, dumb

      I don't get why a TV needs to be smart. My Samsung TV is deliberately dumb - purchased in the height of the flat-screen/smart TV fad to go on the wall of my new house at the time, I fought to get a dumb TV without all the junk.

      In fact, half of the dumb features, I don't even use. Give me a TV with power, ten HDMI sockets and a remote to switch between them and change the volume and that's me done on the display front. I just don't need anything else in a TV.

      What I connect it TO is another matter, and at least that gives me a choice of devices, and I can pick a suitably dumb device at will. As such, I have connected to my TV:

      - a DVB-S box that has no network connection

      - a Blu-Ray/DVD player that has no network connection (I'm told some of my Blu-Ray can go online, update, show content from the web etc... why the hell would I want that?)

      - a cable box that has a network connection but only because you can't do cable without it (red-button, etc.) and it's part of the cable installation (it gets iPlayer, VoD, etc. over the coaxial cable with an in-built cable modem so I can't really stop that).

      - I have a Freeview box but the TV has Freeview built-in and I've never watched either, so I don't bother with the box.

      - A Wii that has no network connection.

      - A spare HDMI lead to connect a laptop or whatever device a guest might bring.

      - A dumb, £5 HDMI switch to connect all of the above as I power a new device up.

      None of them can do anything other than what's required for their job, and all of them are replaceable in a heart-beat if I suspect foul play. And many of their functionalities are duplicated among the devices - I can supposedly do iPlayer, YouTube, Skype etc. on the DVD player, the cable box, the Wii and the laptop. So I'm sure I can use the one that's most convenient and least privacy-destroying if I ever wanted to do that (iPlayer, possibly, but YouTube or Skype? Skype on a TV must be like having a conference call while your family are trying to have dinner).

      The TV should be dumb. Put the smarts into your content devices, if that's what's required, and keep the TV dumb. There's no need for it, and it can - as demonstrated here - cause problems.

      The TV is JUST a display device. The Blu-Ray player JUST takes a disc and outputs the video and audio. I call it the UNIX philosophy, as applied to my home appliances. One thing does one job, and does that job well.

  17. deive
    WTF?

    Did their programmers think that by using port 443 they would be magically encrypted or something?

    If you are using your own random port then it should be above 1024!

  18. Squeezer

    Outsourced voice recognition is indeed common, but both the outgoing voice signal and the incoming recognised text are usually encrypted for obvious reasons which seem to have evaded Samsung...

    1. Truth4u

      but they used the https port, LOL

      Kind of like sending your mail in an acetate envelope and marking it with Private and Confidential.

  19. Furbian
    Joke

    TV - Off.

    Once this is implemented, will they issue advertisement and programme makers a guide so as to avoid the lines like:-

    "You going out? Turn the TV off before you leave"

    "This TV Offer is out of this world"

    "I used to watch TV often when I had nothing better to do"

    "Get that TV off my foot, it hurts"

    etc. ad infinitum

    I have no idea if 'TV Off' already exists, my Samsung 59" TV is dumb and defective (they won't fix it, despite confirming warranty via an e-mail they doubt they sent), and my Smart (semi?) 65" Hi-sense has no ears to listen with.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like