Consumer Reports investigation finds smart TV security flaw

CR photo

Could your TV be controlled by hackers? A new investigation by Consumer Reports found millions of smart TVs don't do enough to protect your security.

Consumer Reports has found millions of smart TVs from major manufacturers can be controlled by hackers exploiting easy to-find security vulnerabilities.

The problems affect Samsung televisions along with TV models made by TCL and other brands that use the Roku TV platform.

While evaluating smart TVs for data privacy and security, CR came across a vulnerability in some smart TVs that can be exploited by a hacker, who could write code to control the TV without the user’s permission.

CR was able to demonstrate how a hacker could potentially take over your TV- change channels, play offensive content, or turn the volume up to full blast- all without your control.

This happens because many smart TVs have a programming interface, called an API, that lets you use your smartphone or tablet as a remote control over WiFi. In some cases, CR found that this API was not properly secured and that could let a hacker control your TV.

This investigation marks Consumer Reports' first tests using the Digital Standard, which was developed to evaluate the privacy and security of products and services.

When CR reached out to Samsung and Roku, both companies said they take privacy and security seriously. TCL referred to Roku's response.

The Consumer Reports investigation includes information to help you protect your personal privacy and limit the amount of data your smart TV is collecting about you.

KOMO news reached out to the manufacturers independently, and got the following responses by email:

From TCL :

"Thanks for reaching out. Our customer’s privacy and security are always a top priority for TCL so we work closely with Roku on this. They have issued a statement and posted it to their blog .

From Roku:

"Roku takes security very seriously. There is no security risk to our customers’ accounts or to the Roku platform as stated by Consumer Reports.

Roku enables third party developers to create remote control applications that consumers can use to control their Roku devices. These applications are only accessible to those on a customer’s Wi-Fi which we recommend consumers lock.

If customers prefer, they can, turn off this feature by going to Settings>System>Advanced System Settings>External Control>Disabled.

Any characterization of this feature as a vulnerability is inaccurate."

From Samsung:

“Protecting consumer data is one of our top priorities. Samsung’s privacy practices are specifically designed to keep the personal information of consumers secure. Our Smart TVs include a number of features that combine data security with the best possible user experience. Before collecting any information from consumers, we always ask for their consent, and we make every effort to ensure that data is handled with the utmost care.

We have been in contact with Consumer Reports regarding the evaluation of our Smart TV and are looking into the specific points made. To ensure the security of any device, we continue to evaluate the feedback we receive on all of our connected products.”

close video ad
Unmutetoggle ad audio on off