How an Internet-connected Samsung TV can spill your deepest secrets | Ars Technica

If you use a Samsung "Smart TV" that's connected to the Internet, there's a good chance Luigi Auriemma can hack into the device and access files stored on connected USB drives.

The researcher with Malta-based security firm ReVuln says he has uncovered a vulnerability in most Samsung models that makes it easy for him to locate their IP address on the Internet. From there, he can remotely access the device and exercise the same control someone in the same room would have. That includes gaining root access and installing malicious software. The attack exploits bugs in features that allow end users to install Skype, Pandora, and other types of apps. The TVs can be controlled using smartphone and tablet apps and in some cases by voice commands.

"At this point the attacker has complete control over the device," he wrote in an e-mail to Ars. "So we are talking about applying custom firmwares, spying on the victim if camera and microphone are available, stealing any credential and account stored... on the device, using his own certificates when accessing https websites, and tracking any activity of the victim (movies, photos, music, and websites seen) and so on. You become the TV."

via arstechnica.com

Comments

[Scritto da: Gianni]

Se sul router è abilitato UPnP, quando accendi un Samsung SmartTV il televisore crea una regola di port forwarding sul router che rende accessisibile il tv sulla porta 5053 dal tuo ip pubblico. L'unico difettuccio evidente che ho subito notato è questo. La porta 5053 non pare essere documentata, forse serve a Samsung per l'assistenza remota. Ci sono altre porte aperte ma rimangono protette dal nat del router, ad esclusione della 5053. E' chiaro che se le porte del tv sono accessibili tutte in trasparente da fuori.. ne puoi fare di cose..

[Scritto da: bubba]

io mi preoccuperei anche come mai una notizia del 2012 sia finita sul blog ora.