Your TV is spying on you - Find out how, and turn it off!

Category: N/A

Transcript

00:00

Imagine paying $800 for a giant surveillance device, proudly mounting it on your living room wall, and then thanking it for spying on you. Congratulations, you probably own a smart TV.

But they're not just TVs anymore. They're ad machines, data

00:16

vacuums, and microphones with a side hustle showing you Netflix. Smart TVs promise endless entertainment, but they also deliver targeted ads, data collection, and security vulnerabilities and sometimes literal eavesdropping.

But hey, at least you get yellow jackets

00:32

in 4K and HDR. Welcome back to Dad Ruins Everything.

Recently, I ruined online job applications and ATS's, third party VPN service claims, and even bossware, corporate spyware that watches you work.

00:48

Today, I ruin equipment that watches you when you're done working. Smart TVs and their surveillance.

If you thought your boss spying on you was creepy, wait until you realize your TV is spying on you 24/7 in your den, bedroom, or anywhere else you have one of these things. And they don't even pay your

01:04

salary. Let's dive in.

When smart TVs took off in the 2010s, the pitch was simple. No more separate Roku box or running apps on your Blu-ray player.

Instead, you get built-in Netflix, Hulu, and Amazon Prime Video without messing with two remotes. That was enough to

01:20

seal the deal for most people. But wait, there's more.

You got voice assistance so you could yell, "Play Breaking Bad," instead of fussing around with the remote. Later, we got personalized recommendations and also free streaming channels.

All of that sounded

01:36

futuristic, but there's a reason these TVs are suspiciously affordable compared to their dumb predecessors. The real money isn't in selling you the TV, it's in selling you.

If you've wondered why a 75 in 4K smart TV costs less than your

01:52

smartphone, it's because the hardware is subsidized. A smart TV is a display panel, a backlight of some level of sophistication, unless it's OLED or microLEDD, and a single board computer.

That single board computer is responsible for the internet

02:08

connectivity and video decoding. It even has enough processing power left over to spy on you.

Can't let those extra ARM cores go to waste. At this point, the manufacturers make their real money from selling your data, taking cuts of ad revenue, pushing subscription services,

02:23

and running sponsored recommendations. Think about that.

You didn't just buy a TV. You bought into an ad tech ecosystem.

Why just make money off of selling the TV once when you can make money over the entire operational life of the thing?

02:39

Voila, your living room has officially joined the surveillance economy. If you buy a new smart TV and speedrun the setup, here's what's happening.

Automatic content recognition or ACR. TVs like Samsung, LG, Vizio, and Roku

02:55

use ACR. Some makers have their own systems, or they can use thirdparty systems like those from Samba, Inscape, Grace Notenote, or Neielen.

The TV generates audio and video fingerprints from what's on your screen. You'd probably expect that it would do this from its streaming apps, but it gets

03:12

everything else, too. Overtheair ATSC, even your video input ports sweeping up your game systems, external streamers, attached PCs, and legacy video players like DVD, Blu-ray, and even VHS.

It compares those fingerprints to those in a database, identifies what you're

03:29

watching, and logs it along with when you watched it and for how long. The result, they know exactly what shows, movies, and ads you consume, when you watch, and how often.

It also knows if you think Die Hard is a Christmas movie. It is.

Yes, your TV is basically

03:47

shazaming everything you watch all of the time. For what it's worth, some people have really overstated what ACR sends back to these remote services.

In the interest of science, I enabled ACR on one of my TVs and watched the data go across Wire Shark on a mirrored switch

04:04

port. The payload varied, but always appeared to be between 17 and 20 kilobytes of data per minute.

Is that one fingerprint? Is it multiple?

While I've read that it's sets of fingerprints, I've not actually seen that confirmed. Due to the data being

04:19

encrypted, it's not easy to verify this claim. If someone wants to sponsor me reading the data straight off of the SOC, I'm game.

Otherwise, I'll just assume a worst case scenario of all 20 kilobytes of that data being budgeted to a single image. I'm not even trying to

04:35

determine how much of the payload is metadata and audio. In terms of assumptions, I knew that the compression was going to cut the effective resolution anyway.

Considering this, I think it's safe to assume that the output resolution is rescaled prior to compression. I'm going to use 640 by

04:51

360. This becomes this.

So, the claim that ACR is sending over down sampled and blurred fingerprints is true for the moment anyway. Some newer ACR systems are working with actual

05:07

frame grabs for logo and ad detection. Why does this matter?

After all, your streaming provider already knows what you're watching. Sure, but there may be things that you're watching on your TV that are nobody's business.

Also, what if you've got a PC or laptop hooked up

05:23

to your TV? If you've got all of your passwords on the screen in Notepad, is that really fair game for capture?

But hey, if you're doing that, I've got a good video on password managers in the top right corner. This is a rapidly evolving uh feature with Samba bragging

05:40

that their ACR collects 7200 images per hour. It's really just best to disable ACR completely.

I mean, it doesn't really present any value to you, and it's really best to tighten up your trail of data that's being sold and shared. Here's how you go about turning

05:56

off ACR on some common TVs. If you don't see your TV here, you can dig through your menus and find it.

They bury it and make you work for it, but it's there. If you have a different kind of TV, please share with a class and drop the menu path in the setting in the

06:12

comments below. Next up, we have always on microphones.

Voice assistant features mean that many smart TVs are listening and some of them do it all of the time. Samsung, LG, Sony, TCL, High Sense, and Vizio are

06:27

among the manufacturers that incorporate microphones. Some implementations put the mic into the remote where it may be pushed to talk while others put Farfield always on mics into the TV itself where it's more like an Alexa or Google device.

They promise it only activates after the wake

06:43

word, unless it doesn't. One version of Samsung's terms of service warned.

Please be aware that if your spoken words include personal or sensitive information, that information will be among the data captured and transmitted to a third party. Translation: Don't

06:59

talk about your past, present, or future crimes near your TV. And then there's targeted advertising.

Roku, Samsung, LG, and Vizio all push ads into menus, recommendation lists, and free channels. Some even overlay ads on content you

07:15

already paid for, which I can't imagine anyone actually wants. You bought the TV, but they're still renting your eyeballs to the highest bidder.

Yuck. Then there's data sharing and reselling.

TV companies sell this data to advertisers and data brokers. It gets

07:30

linked with your phone, tablet, and shopping history. Congratulations, your binge watching of The Hunting Wives just got bundled into a marketing profile that advertisers can buy and resell.

Some people shrug and say, "Who cares if Samsung knows I like Love Island?" Well, here's why it matters.

07:47

Your TV habits reveal your politics, religion, income, and even stress levels. If you have them, this applies to your children's data, too.

Kids viewing patterns are tracked and monetized via IP linking. Your TV data can be tied to your phone, tablet, and online shopping.

If none of that moves

08:04

you, there's always the creep factor. This is supposed to be your private space, and instead your living room is another node in the surveillance economy.

To give you a more tangible example, a family talks about planning a vacation while watching TV. Suddenly, they start getting targeted ads for

08:20

flights and hotels. A gamer plugs in their console, thinking it's private.

Nope, the TV still fingerprints the gameplay and sells the data. A smart TV microphone picks up background chatter which accidentally gets uploaded to a cloud server.

It's like Alexa and Tik

08:36

Tok had a baby and it's bolted to your wall. And remember, every data set gets breached eventually.

When it does, your viewing history is just another spreadsheet for hackers to sell. In case you think this is overblown, there are lawsuits and scandals.

This isn't

08:51

paranoia. TV companies have already been caught red-handed.

In 2013, LG collected viewing data even when users disabled the setting. Oops.

In 2015, Samsung said, "Don't say personal stuff near the TV." And the privacy policy went viral.

09:08

2017, Vizio was fined $2.2 million by the Federal Trade Commission in the United States after secretly tracking 11 million TVs and selling the data. Roku, to this day, is constantly flagged for aggressive tracking and injecting ads into menus.

Amazon Fire TV devices have

09:25

been caught installing forced ads even on purchased devices. Pattern is clear.

Surveillance first, privacy later, usually after a fine that's smaller than their quarterly marketing budget. Another important point is that this is a security dumpster fire.

Smart TVs are

09:42

designed to display content, host apps, and spy on you. Somewhere further down the list, they're also meant to be secure network devices.

However, when something isn't one of your top priorities, it is revealed in your actions. Smart TVs are often insecure.

09:58

The main cause is outdated software. Many smart TVs run modified Android or Linux builds that stop getting updates after a couple years.

These TVs also have hackable features. Security researchers have shown TVs can be hijacked to show fake alerts, install

10:13

malware, or spy through webcams. The CIA even made a tool called Weeping Angel to turn Samsung TVs into eavesdropping devices.

Your TV might be a member of a botnet. Compromised smart TVs have been used in distributed denial of service or

10:29

DOS attacks, turning your living room into part of a cyber crime ring, and your TV can be compromised in different ways, like being turned into a cryptocurrency mining node or being used as a pivot to attack other devices on your home network. The reality is that

10:44

your smart TV ages like milk. To deal with this problem, some manufacturers have started to improve their support policies.

Samsung will provide up to seven years of Tyizson OS updates. LG said that some of their models will get up to 5 years of web OS updates.

Amazon

11:00

four years. Highense up to 8 years of VAS updates.

Roku, TCL, Vizio, Sony, Panasonic, and others don't even bother articulating a policy. To be fair, even for the manufacturers that have stated a support window, it's not like we know

11:16

how vigilant or effective they will be with their updates. What we know is that the day you buy your TV, the surveillance is cutting edge.

Before long, though, it's an insecure, unsupported liability. And that's if it didn't start out being that way in the first place.

So, what can you actually

11:33

do? If you already have a smart TV, and let's face it, you probably do.

Here's how to fight back. First, disable ACR.

Hunt through the settings and turn off viewing data, live plus, smart interactivity, or whatever they've called it. It's buried on purpose.

Also,

11:52

disable all other tracking and telemetry. You can use a solution like Pi Hole, Adguard Home, NextDNS, OpenWRT with Adlock or Diversion, or Technidium.

These solutions can help if your TV accidentally sends data when it's not

12:07

supposed to or if the spyware settings reset to on after every update. Let me know if you want a video on selecting and setting up one of these solutions on your network.

Also, you can change or delete your advertising ID periodically. This one might hurt, but it may be best

12:24

to not connect your TV to Wi-Fi or Ethernet and instead use a streaming stick, Apple TV, or some other external streamer. They're easier to update, easier to replace, and a $20 Roku or chcast is easier to ditch than a 75 in wall ornament.

Mute the microphone. Turn

12:41

off voice recognition or block the mic physically if you're paranoid. You can segment your network, putting your TV on a guest or IoT VLAN network with client isolation or PVL, so it can't snoop or try to compromise other devices.

If you are going to use a smart TV,

12:58

update when possible. If the manufacturer still offers patches, apply them.

If not, then that's the time to disable the smart functionality altogether and go with an external streaming device. At that point, you should just treat your TV as a dumb monitor.

13:14

The bottom line is smart TVs aren't really TVs. They're surveillance platforms with screens attached.

They spy on what you watch. They sell your data to advertisers.

And they push ads into devices you've already paid for. stop getting security updates long before you're likely to stop using the

13:30

TV. So, if a product is suspiciously cheap or if it keeps showing you ads after you bought it, congratulations.

You're the product. So, I hope smart TV surveillance is sufficiently ruined for you or for someone you're about to forward this to while they proudly watch

13:45

their free channel that's really just one long ad for a car they've coincidentally been checking out on their phone. Weird.

If you found this educational or just horrifying, please like the video, subscribe to the channel, and drop your weirdest smart TV story in the comments. Thanks for

14:01

watching Dad Ruins Everything.