Is Your Smart TV a Secure TV?
We tend to think of security problems as the exclusive domain of computers and all too often forget about the other devices and gadgets in our homes. Phones, TVs, tablets, hi-fi systems and any other web-connected smart home appliances are all at risk of being compromised by hackers and criminals, often without the owners even being aware of the situation.
New research by Yossi Oren and Angelos Keromytis at the Columbia University Network Security Lab has now claimed that smart and interactive TVs are the most ‘at risk’ group. The ‘Red Button’ attack can be conducted quickly and discreetly from anywhere in the neighbourhood, and could quickly take control of your printer, online accounts and Wi-Fi router to severely disrupt your life.
The report found that any television which uses the new HbbTV standard is vulnerable. With almost all of Europe using the standard and with the US slowly catching up, the problem puts hundreds of millions of people at risk.
Oren and Keromytis claim that a hacker with a $250 1-watt amplifier could cover a 1.4 sq kilometre area. Oren mapped New York City neighbourhoods by population density overlaid with the locations of big digital broadcast antennas. By positioning the retransmission gear at a good height and within line of sight of a tower (for example, on a drone or tall building), a hacker in Queens could deliver malicious content via the Home Shopping Network to a potential audience of 100,000 people. With a more powerful 25-watt amp (about $1,500) the hacker can could cover nearer 35 sq kilometres, taking the reach of the attack into the hundreds of thousands of people.
A few characteristics of the method make it extremely dangerous. Firstly, neither the TV nor its owner would be aware that they are under attack. Secondly, the virus will remain active until the TV is entirely powered off. Finally, the virus is totally anonymous and untraceable because the hackers never present themselves on the internet with a source IP address or DNS server. All this means a person might be completely unaware an attack has happened until long after the event.
What can be done? The most extreme solution would be to completely cut off internet access to all broadcast-delivered HTML content, though this is unlikely to be do-able or practical for most home users. Another solution is monitoring smart TVs as a network. A single smart TV doesn’t know that its signal is being hijacked but the incoming signal data from multiple TV sets in the same area could be monitored to show abnormally high spikes in signal strength or application usage. Something as simple as asking users to confirm the launch of an app could also work.
Broadcasters would have lots of privacy issues to work out before any solution could be chosen however, and whichever method is ultimately selected will face the difficult task of acquiring an industry-wide and government-wide consensus to implement it. Do you use a smart TV? Have you taken any precautionary security measures? Let us know in the comments below.
(Infographic Source: iYogi)
By Daniel Price