LG smart TVs actively scan home Wi-Fi networks and log other connected devices, while vulnerabilities in the webOS operating system let attackers secretly record audio even when the screen appears off. Notebookcheck reports, citing an investigation by the YouTube channel Gamer Nexus.
The creators of the more than two-hour-long investigation brought in independent cybersecurity researchers to test several LG smart TV models, including the G5. Network traffic and software analysis showed the TVs actively scan the local wireless network. In the process, they log other nearby devices too — smartphones, smartwatches, computers, and other gadgets with no connection to the TV itself.
The researchers found the TVs collect internal IP and MAC addresses, individual device names, and signal parameters. They also gather data on nearby Wi-Fi networks, including their names, signal strength, and channels. That kind of data set can be used to identify devices and estimate their location. The team notes they couldn’t decrypt all the traffic, so the contents of every transmitted packet remain unknown.
The investigation also covers automatic content recognition (ACR), a technology that turns audio and video data — including screenshots or audio snippets — into digital fingerprints and matches them against media databases to identify what’s being watched. According to the researchers, this telemetry can keep working even when an external source is connected via HDMI.
Follow Mediasat on Google News: the latest in TV, telecom and tech
The collected data is processed by LG Ad Solutions, the company’s targeted-advertising unit. LG has roughly 216 million smart TVs in use worldwide, and once the other devices they scan on home networks are counted in, the company effectively has data on close to 363 million devices in the US alone. That lets it serve ads at a scale matching its actual user base. LG TVs also track what owners are watching to fine-tune ad targeting, using selective capture of the video and audio playing on the device.
The investigation’s most serious finding isn’t about the built-in ACR feature at all — it’s about webOS vulnerabilities. The researchers say these flaws can be exploited to make a TV record audio through its connected microphone even when the screen looks off. With the network connection cut, the recording was stored locally, and after reconnecting, the researchers were able to access it by exploiting the vulnerabilities. That doesn’t prove LG routinely records conversations and sends them to its servers by default, but it does point to a serious security flaw in webOS.
Some of the vulnerabilities found, including ones tied to remote code execution, are going through responsible disclosure, so technical details aren’t public yet. The researchers recommend disconnecting LG TVs from the network and using separate devices for online services.
