LG Smart TVs Log Ambient Audio, Map Local Networks for Ad Sales

LG智能电视被指记录环境音频并扫描局域网以投放广告 LG在其电视操作系统中内置程序以扫描家庭网络并记录环境语音，原因在于广告定位遥测数据的全生命周期利润率高于消费级显示硬件。 相关技术调查显示，LG智能电视即使在息屏或作为离线外接显示器使用时，其内置固件与自动内容识别（ACR）架构仍会持续扫描局域网内的次级设备，并记录环境音视频数据，待网络连接恢复后回传。测试还发现固件存在多项安全漏洞，可能导致设备在未经用户许可的情况下被远程获取Root权限并转化为窃听装置，而这一激进的数据收集行为与其广告变现业务的利润驱动密切相关。 测试显示LG智能电视会扫描本地局域网，编目手机、智能手表等数十台非关联硬件的IP与MAC地址，并通过ACR技术采集屏幕与音频特征码以支持跨设备广告定位。 即使拔掉网线或息屏，设备仍会在本地缓冲存储环境音频与遥测数据，待重新联网后立即回传；即使未接受服务条款或单纯用作HDMI显示器，系统仍会产生背景通信。 安全研究人员演示了利用未修复的固件漏洞在局域网内非交互式获取电视Root权限，并调用机载麦克风进行环境语音监听，同时指出LG退出追踪的设置流程存在混淆设计与加密缺陷。

An investigation by Gamers Nexus and independent security researchers reveals that LG Smart TVs operate as aggressive telemetry and surveillance nodes embedded with unpatched security flaws. While sold as consumer displays, internal firmware behaviors and corporate statements demonstrate that the manufacturer treats the hardware as proprietary infrastructure designed to monitor home networks, index ambient audiovisual data, and serve programmatic advertising. The ACR Monetization Model and Glass Ownership (3:19) At the foundation of LG's smart TV business is Automatic Content Recognition (ACR), managed through its ad-tech arm, LG Ad Solutions (formerly Alphonso). In corporate presentations, executives Serge Matta and Justin framed the hardware relationship candidly, stating, "We own the glass. We own the TV... We understand everything that hits the screen." The underlying ACR software captures real-time acoustic and visual frame samples directly from the panel—regardless of whether the input is cable, internal apps, or a PC connected via HDMI—downsampling audio into 8 kHz streams and using Fast Fourier Transforms to match cryptographic hashes against ad databases. This continuous monitoring feeds a high-revenue connected TV advertising machine; financial filings show Alphonso generated roughly $185 million USD in sales in the first quarter of 2026 alone. To protect this data pipeline, LG deploys manipulative interface dark patterns. Auditing the onboarding flow revealed nearly 50,000 words of legal agreements across six contracts, requiring 2,705 remote clicks to read. Crucial tracking options default to enabled, tracking toggles are buried in obscure menus, and software updates push advertising identifiers onto multi-year-old hardware without requesting updated consent. Local Network Reconnaissance and Persistent Exfiltration (16:33) Decompiled firmware analysis and packet captures conducted with researchers Wendell, MrBruh, and uturn revealed that LG TVs do not merely report their own usage; they actively sweep the user's local area network (LAN). During testing, the display executed reverse network queries that mapped 38 distinct secondary devices—including smartphones, internal media servers, 3D printers, workstations, and smart thermostats—packaging local IP addresses, device names, and hardware MAC addresses for outbound transmission. The TVs also monitor nearby radio frequencies, cataloging surrounding Wi-Fi access point MAC addresses (BSSIDs) to triangulate precise physical geolocation without requiring an onboard GPS receiver. Testing showed that using the television as a disconnected "dumb monitor" does not guarantee privacy if terms were previously accepted. In lab tests, an LG QNED configured strictly as an external HDMI display contacted 22 distinct endpoints and uploaded 5.2 MB of data across 157 connections, with 54 connections directed straight to Alphonso ACR servers. When the network connection was severed entirely, the TV continued capturing and indexing telemetry locally to its onboard 16 GB flash storage, automatically queueing the data for exfiltration the moment network connectivity returned. Audio Interception, Software Muting, and Covert Standby (34:16) Auditing the webOS software stack exposed severe security vulnerabilities, including non-interactive root exploits that allow an attacker on the same network subnet to gain persistent system access without user interaction. Once compromised, the television can be co-opted into a covert room bug. While LG publicly stated that its TVs "do not collect, record, or store ambient conversations," internal memory analysis proved that captured speech is transcribed into plain text and stored directly inside system daemons like the `Voice agent result input voice keyboard` process. Integrated microphones easily detected conversational speech at distances ranging from 40 to nearly 70 feet away. Physical privacy safeguards also proved deceptive. When the TV's software "mute" function was activated, the audio stream appeared to show dead silence; however, applying a +100 dB digital gain boost recovered intelligible human speech, revealing that the software mute merely attenuates input gain rather than cutting power to the microphone hardware. Furthermore, during a mock executive meeting where the display appeared completely powered down in standby mode, background listeners remained fully active, cleanly capturing and storing the mock conversation without any visual indication that the television was on. Institutional Risks and the DMCA Ownership Dilemma (95:00) Because off-the-shelf consumer televisions are commonly installed across executive boardrooms, patient exam rooms, and dental clinics, the hardware architecture presents severe institutional risks. Compromised sets can tap their own internal audio buffers to intercept unencrypted HDMI audio feeds originating from external conference computers. In medical environments, ambient recording and unvetted app ecosystems threaten HIPAA compliance. These vulnerabilities are compounded by lax app store governance: over 1,200 webOS applications were found embedding residential proxy SDKs, and standard partner trust permits third-party applications to query and control Universal Plug and Play (UPnP) devices across the local subnet. Despite these invasive behaviors, consumers and enterprises face legal barriers when attempting to secure their hardware. As FULU Foundation Executive Director Kevin outlined, Section 1201 of the Digital Millennium Copyright Act (DMCA) criminalizes the circumvention of digital locks on copyrighted firmware, exposing individuals who attempt to excise telemetry code to felony penalties of up to $500,000 in fines and five years in federal prison. Consequently, users are legally restrained from purging spyware from devices they nominally own. The investigation underscores that modern smart televisions operate as full-fledged, network-connected computers designed to prioritize ongoing corporate data extraction over user autonomy. Security researchers advise isolating these displays completely from local networks, but digital rights advocates emphasize that true consumer protection requires legislative reform to eliminate DMCA anti-circumvention restrictions and legally restore hardware ownership.

[0:00] LG TVs are able to be utilized as [0:01] eavesdropping listening devices in part [0:03] because of the advertising functionality [0:05] that's built into them. We were able to [0:07] retrieve plain text transcripts of voice [0:09] conversations and inputs from the TV. [0:12] Utilize the TV to record from a webcam [0:14] and from a microphone while the TV [0:16] appeared to be off. And it was clean [0:19] capture, too. All right, so the screen [0:21] appears to be off right now. Currently, [0:22] Wend and I are in a border. How are you? [0:25] >> Yikes. We were even able to capture [0:27] microphone audio while the TV was [0:29] unplugged from the network. This LG G5 [0:31] TV has a microphone connected to it and [0:34] right now it's listening to me and [0:36] saving the information. In fact, we can [0:38] even unplug the network [0:41] and it's still listening to me and what [0:43] I'm saying is being stored by someone [0:46] with remote access to the TV. And then [0:48] we were able to excfiltrate that [0:50] recording via vulnerabilities after the [0:52] user reconnected the network. [0:58] >> And it's still listening to me. [1:00] >> No network. [1:01] >> What I'm saying is being stored by [1:03] someone with remote access to the TV. [1:05] >> But that requires an adversary, which [1:07] sounds scary. What we think is scarier [1:09] is LG itself. LG's first party [1:12] profit-seeking functionality prized deep [1:13] into your private life. The TV crawled [1:15] our entire network and found dozens of [1:17] unrelated devices, including [1:18] smartwatches and phones of our staff who [1:20] didn't even know we were working on [1:21] this, which might explain how LG ads can [1:23] claim it knows about 363 million [1:26] addressable secondary devices in the US, [1:27] despite claiming a smaller 216 million [1:30] smart TVs sold worldwide. And we don't [1:32] think this is an innocent chcast [1:33] connected device lookup, considering LG [1:35] itself admits, [1:36] >> "We know who's in the LG household. We [1:38] know which devices are there. We know [1:40] how to extend that reach into mobile. [1:43] and they use secondary devices in [1:45] political targeting. We also found [1:46] through wire sharkark and inspecting [1:47] firmware that LGTVs are capable of [1:49] identifying your IP address, geographic [1:51] location, name of every Wi-Fi network in [1:53] the vicinity and signal strength, [1:54] channel numbers of neighboring Wi-Fi [1:55] networks in range and other devices on [1:57] the network, even if not connected to [1:59] the TV in any way, and the internal IP [2:01] address of other devices on the network [2:03] alongside others. In fact, the data that [2:05] we collected through Wireshark shown [2:06] here is such an egregious invasion of [2:08] privacy that we can't even show you it [2:11] because every line has something that we [2:14] don't want to put out there. And this is [2:16] the TV's native functionality. This [2:18] didn't require vulnerabilities. Security [2:20] researchers we worked with for this [2:22] investigation also discovered several [2:24] additional vulnerabilities that are [2:26] going through the responsible [2:27] disclosures period right now. So, we [2:29] can't fully detail them yet, but the [2:31] researchers have recommended [2:33] disconnecting any LG smart TVs from any [2:36] network. Ideally, you don't own [2:40] thousands of dollars of LG TVs. [2:44] Maybe if they're unplugged or physically [2:47] destroyed, it's okay. But uh this is [2:51] because there's some concerning [2:54] vulnerabilities like for example remote [2:56] code execution vulnerabilities where an [2:58] attacker could manipulate what your TV [3:01] does like this. [3:11] Good night LG. [3:14] That's the That's LG calling me right [3:17] now. [3:19] The listening device capability is [3:21] partly because of ACR, a function that [3:24] leads LG to tell its advertising [3:26] partners that it quote owns the living [3:28] room end quote and your TV. Here's LG Ad [3:32] Solutions President Sergey Mata and also [3:34] the head of research and development for [3:36] LG Adolutions, Justin from [3:38] >> in the fact that we have the glass. We [3:40] own the glass. We own the TV [3:42] >> because, you know, we own the glass. Um, [3:45] and we have firstparty ACR data, [3:48] automated content recognition data. We [3:50] understand everything that that hits the [3:52] screen. [3:53] >> We own the glass. [3:55] I paid $2,400 for this particular glass [3:58] that arrived curved on one side, [4:03] but I I guess I don't own it. Serge [4:06] Mada, the first man who said LG owns the [4:09] glass, is the president of LG [4:11] Adolutions, which sells the data [4:13] harvested from your television to [4:14] partners. LG owns LG Adolutions, which [4:18] is a private company. And that's a good [4:20] thing because Mata is legally banned by [4:23] the SEC from running a public company [4:26] after settling charges relating to a [4:28] fraudulent scheme. Now he's in charge of [4:30] the data collected from your TV. [4:32] Automated content recognition can be [4:34] audio or video data, including [4:36] screenshots, that's converted into a [4:38] fingerprint, and transmitted back to [4:40] servers. In this case, those servers are [4:43] LG servers for its LG ad solutions [4:47] company. So, even though we paid $3,000 [4:50] for some of these really nice TVs with [4:52] multiple embedded microphones and webcam [4:55] accessory options, some of these TV [4:57] companies are now making more margin [4:59] dollars from targeted ads than they are [5:02] from selling the actual TV hardware. [5:09] So, that's what we're going to talk [5:10] about. To sort through all this capture, [5:12] we went on a road trip to see Wendle of [5:14] Level One Text in his bunker of secrets. [5:16] We stopped at a Best Buy to buy a brand [5:19] new LG G5 TV. I think we need a G5. [5:22] >> We need something we can do a uh [5:24] man-in-the-middle attack on to make it [5:25] spy on us. [5:27] >> Okay. [5:27] >> So, and then we packed our future spy [5:29] device into our rental car that's filled [5:31] with other spy devices. And then we [5:34] hacked the TV. I just Sorry, one second. [5:36] Let me just I need to read a comment [5:38] here. For purposes of this video, the [5:41] phrase hacking refers to the colloquial [5:43] definition found in the Marryiam Webster [5:44] dictionary under hack. Definition two, [5:47] noun one, paragraph 6, subline a quote, [5:52] a usually creatively improvised solution [5:54] to a computer hardware or programming [5:56] problem or limitation. End quote. Now, [5:58] our lawyers have made the totally [6:00] unrelated point uh that we cannot [6:03] legally agree to contracts such as terms [6:06] of service or conditions while [6:09] incredibly inebriated. We have Ethernet [6:11] plugged into Gamers Nexus LLC's TV. [6:14] >> There you go. [6:15] >> That Gamers Nexus purchased [6:18] while it was inebriated heavily. [6:21] [laughter] [6:22] >> It was unable to agree to the Ulook. If [6:24] a check check check box were checked, [6:26] >> it was entirely accidental, [6:28] >> right? [6:28] >> Yes. [6:29] >> But we don't know if one had been [6:31] checked. [music] [6:32] >> Unlikely [6:32] >> because of the inebriation. [6:34] >> Yes. [6:34] >> Yeah. You see that Stanley cup over [6:36] there? That's just all margarita. [6:39] [laughter] Just the entire thing. [6:41] >> It's like 180 proof. [6:43] >> Oh yeah. Look. [6:45] Oh I accidentally clicked accept [6:47] on the terms for voice and I'm [6:49] incredibly inebriated. So it's it's [6:51] storing what we say we So in the time [6:53] you were doing this, Tannon activated [6:56] the hands-free version [6:58] >> also by accident. Also incredibly [7:00] inebriated. He can barely stand over [7:02] there. You know, frankly, it's amazing [7:03] Vitali can hold the camera so straight. [7:05] [laughter] [7:09] >> We need your support on [7:11] store.gamersac.net [7:12] for these investigations. We spent [7:14] around $70,000 to make this [7:16] investigation happen when counting the [7:18] over 500 hours of our team's work and [7:20] the fact that we now have enough LG spy [7:22] TVs to create a new three-letter agency. [7:25] All that we paid for. So, we're [7:27] launching our data dragnet Kickstarter [7:28] style campaign that we've linked below [7:30] to help fund our consumer device buying [7:32] and production budget as we deep dive [7:34] into more household spy devices like [7:36] maybe other smart TV brands in this [7:38] series and pay for this investigation. [7:40] Our backer rewards include things like [7:42] our brand new LG Investigation Blu-ray [7:45] disc packs, including an impressively [7:47] highquality thermally printed disc label [7:49] with Parody Evil LG logo that has a [7:51] camera for its eye. We're burning these [7:53] discs completely in-house with our new [7:55] duplicator machine. Then we put the [7:57] discs in a special red edition 3D [7:59] printed disc case [music] that we also [8:01] make entirely in-house in our print [8:02] farm. Each disc pack comes with a 128 GB [8:05] USB drive that we duplicate inhouse with [8:08] our USB cloner. video coming soon on [8:11] that. And the drive contains a digital [8:13] copy of this very video that you're [8:14] watching right now as a DMCA abused Dead [8:17] Man Switch. Besides, we all know how [8:19] valuable 128 GB of flash is right now. [8:22] The backer tiers also have exclusive [8:24] benefits like additional footage and [8:25] bonus videos, and very small group live [8:27] streams, Q&A sessions with me in case [8:29] you want to ask about this project, [8:31] testing, advice, getting a job in the [8:33] industry, and more. We're also launching [8:34] this brand new Cyberpunk Skeleton foil [8:36] t-shirt featuring a dystopian skeletal [8:39] front made of components and wiring, [8:41] plus a splash of red foil for the [8:43] surveillance camera. Because of course, [8:46] the back has a spine that runs all the [8:47] way down the shirt and contains some [8:49] Easter egg text relating to Gamers [8:51] Nexus. Our Polygon Shard V2 shirt is [8:54] also launching as part of this reprisal [8:56] and rework of a nearly decade old [8:58] popular design, now with improved [9:00] sizing, color, and endurance. The front [9:02] looks 3D in the light and has a [9:04] wireframe GN logo, while the back has a [9:07] polygon shard rainfall effect. All of [9:09] these tiers are themed around our [9:11] surveillance data dragnet hellscape. Our [9:13] highest tier even includes a supporter [9:15] credit for our future disappointment [9:17] tour 2026 video. We have a ton of other [9:20] cool stuff for this campaign to get you [9:21] unique items, many of which we're now [9:23] making entirely at G&HQ with our own [9:25] team while supporting our expensive [9:27] content. We're even 3D printing these [9:29] miniature paintable goblin figurines to [9:31] include with the e-waste inductor dice [9:33] included in some of the backer tiers. [9:35] And we have a new sticker pack available [9:37] [music] with a Microsoft sticker. We [9:39] need your help to pay for this very [9:40] video that you're watching right now. [9:42] Plus our next deep dives in this [9:44] category of content. We're 70 grand deep [9:46] in this report alone. And as a reminder, [9:47] our reviews these days, like our [9:49] half2500 case review, lose us money [9:51] since no one can afford RAM. But we [9:52] still produce them and subsidize them [9:54] with support from campaigns like this. [9:56] Visit store.gamersac. gamers.net to grab [9:58] one of our backer tier kits now or check [10:00] out the individual items all linked [10:02] below. Thanks sincerely for your [10:04] support. Now, back to the program. We [10:06] have a lot to talk about in this video. [10:09] like LG's automatic content recognition [10:11] functionality that's designed to build [10:12] advanced profiles on everything in your [10:14] life, including secondary devices in the [10:15] same household. The sale of that data, [10:17] LG's political campaign targeting for [10:18] quote voters that matter end quote. And [10:21] we'll even go over 40,000 words of [10:23] agreements relating to LG's smart TVs, [10:24] including this sneaky change to the [10:26] class action sections that they made [10:28] after our first video. Oh, and we also [10:31] hacked the TVs. [10:32] >> Whoopsy doodle. [10:33] >> But don't let that distract from LG's [10:35] native spying functionality. One of the [10:37] common misconceptions we've seen [10:38] propagated online in comments and in [10:40] videos is that simply unplugging your TV [10:42] from Ethernet is enough to stop it from [10:44] spy on you. That might not be enough. [10:46] And in fact, even using an LG smart TV [10:48] as a dumb monitor doesn't necessarily [10:51] stop all of the functionality we're [10:53] talking about today. Internet service [10:54] providers sometimes have dual SSIDs that [10:56] include open neighborhood Wi-Fi [10:57] broadcast from customer routers such as [10:59] with Comcast's Exfinity neighborhood [11:00] hotspot and AT&T's public hotspots which [11:02] are sometimes autoconnected to by [11:04] devices when they discover the open [11:05] network such as in an apartment building [11:06] from neighbors using such routers. So [11:08] this is a concern broadly speaking and [11:10] future looking for smart TVs regardless [11:12] of the brand. We're also talking to a [11:14] lot of people for this video. So I'm a [11:15] robotic general surgeon. What happens [11:17] when I'm taking a patient phone call or [11:19] I'm doing patient uh video visits and [11:22] there's an LG monitor in the background? [11:24] >> What happens if it's doing it on a on an [11:26] LG monitor itself? Uh what's listening [11:29] in? How is that how is that patient [11:32] information protected? [11:33] >> Yeah, I love giving up my seventh [11:34] amendment rights to a company in an [11:36] agreement that I never actually read. [11:38] It's a complete scam in my opinion. [11:39] >> Let's say worst case scenario, you turn [11:41] it into a listening device. That seems [11:42] pretty straightforward. You turn it into [11:44] a device to exfiltrate information from [11:46] a corporate network or a boardroom. [11:48] >> That seems pretty straightforward. Um, [11:50] you use it to maintain access like as a [11:54] point of presence on a network. Um, even [11:57] if you don't intend to capture audio and [11:59] video, [11:59] >> just to go through it, tunnel through [12:01] it. [12:01] >> It is perfectly functional as a proxy. [12:03] So, you can proxy internet traffic and I [12:05] can just, it's like, oh, I'm going to [12:06] use this to move laterally through [12:08] somebody's network. the kinds of things [12:10] we see in the news where it's like, oh, [12:11] Fancy Bear is attacking routers. Uh, [12:13] Fancy Bear would be very comfortable [12:15] inside LGTV. [12:16] >> And we're even using our investigation [12:17] today to push for actual legislation to [12:19] protect consumers from this type of [12:21] technology. I've been on the phone for 3 [12:23] days with various people in Washington [12:25] DC about this and we just went on tour [12:27] with Lewis Rossman's team to talk about [12:29] some protections and getting laws [12:32] created. [12:33] >> How many people have had their TV or [12:35] monitor for more than 3 years? Yeah. And [12:38] and so this you are all part of the [12:40] problem. They need you to buy they need [12:42] they need you to buy monitors every year [12:45] >> because of section 1201 of the DMCA. [12:48] Simply circumventing a digital lock can [12:50] become a copyright crime. [12:51] >> Okay? [12:52] >> And so when you're looking at these [12:53] cases, right, you've got your TV that's [12:55] spying on you, that's watching you, [12:57] that's listening to you, right? You [12:58] might want to go in and remove that [13:00] software. Sure, there are ways that you [13:02] can go through the menu. There's no way [13:04] to know for sure, [13:05] >> right, [13:05] >> that that data flow is stopping unless [13:07] you go in and take it out yourself. So, [13:09] because section 121 does have that [13:11] prohibition on the circumvention of [13:12] digital locks, um, you're screwed. In [13:16] other words, [13:18] that's a lot for one video. Let's start [13:20] with ACR. ACR is automatic content [13:23] recognition that harvests data from [13:25] devices like TVs, including screenshots [13:27] of what the TV is showing and audio [13:29] snippets coming out of the TV speakers. [13:31] ACR can also run when the TV is used as [13:33] a monitor. That data is converted into a [13:36] digital fingerprint and compared to [13:37] media databases that these companies [13:39] have to identify your habits. In their [13:42] own words, LG, we know who's in the LG [13:45] household. [music] [13:45] We know which devices are there. We know [13:48] what you're exposed to on TV and we know [13:50] how to extend that reach into mobile. [13:52] You know, most streaming households [13:54] subscribe to, you know, multiple [13:57] streaming services. So, our line of [14:00] sight to the screen can really help our [14:02] partners. We own the glass. We own the [14:04] TV. We own the glass. [14:06] >> Since we own the screen and we own the [14:09] operating system, [14:10] >> most people are on their phone while [14:12] they're watching TV. Now, being able to [14:14] have ad experiences that are both on the [14:15] big screen, but also on the screen in [14:17] your hand. So, within an LG TV [14:19] household, we can help extend a campaign [14:22] footprint to the other devices in the [14:24] household. AI is going to provide us. [14:26] We're providing like all the rich data [14:28] that we have from either our first party [14:31] data, our viewing data, third [snorts] [14:33] party data. How do we put it all [14:35] together and then expose it to our [14:37] clients in a in a tool or in a platform [14:41] that's built on AI? Right? So, where I [14:43] think the next evolution of ACR is the [14:45] emergence of AC of AI com uh combined [14:49] with contextual targeting. So, how does [14:52] AI play down to a scene level? [14:55] Leveraging the ACR, leveraging all the [14:58] AI in real time of what they're [15:00] watching, all the product placements. If [15:02] there's a bar scene and that bar scene, [15:05] you leverage AI to scan all the product [15:08] placements. [15:09] >> Yep. [15:10] Well, instead of a generic CPG brand [15:15] >> in the adbreak, why [music] not put [15:17] immediately and you have to send that [15:19] data in the metadata in the bitstream, [15:22] send that data and [music] expose a [15:26] beverage ad, a alcohol brand ad, like [15:29] because you're in a bar. [15:30] >> But even if you don't buy a smart TV [15:32] with ACR, you probably will still [15:34] encounter them dayto-day. You can find [15:36] LG displays everywhere. hospitals, [15:38] doctor's offices, waiting rooms, Airbnbs [15:40] pointed straight at beds, paper hour [15:41] conference rooms, college locker rooms, [15:42] and they're in hotels everywhere. We [15:44] even found this photo on Facebook of [15:46] someone's dental visit, referencing what [15:48] they say is an LGC4 OLED, which anyone [15:50] can buy off a shelf, and it's displaying [15:52] sensitive medical information, not to [15:54] mention law firms or corporate [15:55] boardrooms, and of course, your living [15:57] room. No, wait, sorry. [16:00] LG's advertiser's living room. They they [16:03] made that clear. I forgot. Uh we're not [16:05] saying that each of these TVs in these [16:08] environments is actively being used as a [16:10] listening device. That's not the point [16:13] here. What we're saying is that in cases [16:17] where the issues we found on our TVs [16:20] exist on others or can exist on others, [16:23] the capability may be there to do so to [16:27] use it as a listening device. By whom is [16:31] another question. So, to get into this [16:33] mystery of what exactly is being [16:35] potentially sent back to LG from the LG [16:37] Smart TV, we needed to set up an [16:39] interceptor. Getting into it, we worked [16:41] with three security researchers for this [16:42] piece. Mr. Bruh, who previously found [16:44] major vulnerabilities in MSI software, [16:46] AMD software, and now LG software and [16:49] TVs, and who works for Community Good [16:51] off of donations. We also worked with [16:53] U-Turn who discovered and published [16:55] several vulnerabilities relating to [16:56] routers and network devices and who [16:59] likewise has his own coffee page for [17:01] community donations. And we worked with [17:02] Wendel who himself has published [17:04] vulnerabilities in various devices [17:06] including routers. During our testing [17:08] our TV continuously scanned our LAN, our [17:11] local area network for all nearby [17:13] devices. It obtained display names, [17:15] signal strength, MAC addresses which are [17:17] uniquely identifiable and more. Mr. RA [17:19] confirmed his findings by decrypting and [17:22] decompiling LG's firmware from one of [17:24] its TVs with help from the TV [17:26] jailbreaking community. Among other [17:27] things, the TV did a reverse sweep of [17:30] our entire local network. The TV seems [17:33] to have found at least 38 other devices [17:36] on our network. Based on our [17:38] understanding, here's the complete list. [17:39] With some information like specific [17:41] device serial numbers, unique names, and [17:43] internal IP addresses scrubbed, you can [17:46] find everything on our network here. a [17:48] Puscha XL 3D printer, an ESP32S3 [17:52] dev board, air purifier, and then you [17:54] get into the creepy stuff. If that [17:56] wasn't creepy enough, LG's TV seems to [17:58] have detected that Vitali's editing [18:00] machine was even running Team Viewer [18:02] from its generic network discovery [18:04] query, which Mr. Bra says was quote, [18:06] "caught in the blast radius," end quote. [18:08] The log files from the TV's data [18:10] transmission also saw our internal [18:12] servers. They found a Samsung smartphone [18:14] with the staff member's username [18:15] exposed. Another uninvolved staff member [18:17] is S23 Galaxy on the network. The [18:20] Alienware piece of that we use as a [18:22] backup editing machine, someone's Note [18:24] 9. LG's TV found various smartwatches, [18:27] Pixels, [music] iPhones, internet [18:28] gateways, and switches. And on top of it [18:30] all, LG's TV even found what thermostats [18:33] we have. LG happens to be a company that [18:36] sells air conditioners and air [18:38] conditioner accessories. [music] And we [18:40] now have a device that pinned our HVAC [18:44] system or parts of it. All because we [18:47] bought a television and plugged it into [18:50] the network to watch TV. I can't wait to [18:54] start getting targeted ads for their AC [18:56] units. So, if that's the way it's used, [18:58] all of this is very creepy. [music] And [19:00] if it's not the way it's used, all of [19:02] this is very creepy. LG's Alfonso also [19:05] collects these items. LG advertise ID [19:07] non-reble device UU ID. the Alfonso user [19:09] ID, active input, active application, [19:11] uniquely identifiable MAC address, [19:12] signal strength, device attributes, [19:14] location, system power, onoff [19:15] timestamps, and privacy consent flags, [19:17] noting if the user opted in or out, [19:18] among other data like nearby Wi-Fi [19:20] networks that the TV detects. LG also [19:22] sends its third party advertisers the [19:24] user's local, language, and device ID [19:26] when the user views, hovers, or clicks [19:27] on their advertisement. Wendell's [19:28] research noted that his LG TV also [19:31] scanned neighboring Wi-Fi networks, [19:33] which can then be used for geollocating [19:35] you and your TV. There's an LG channels [19:38] feature built into the TV that acts like [19:40] old cable TV, providing you CNN or Fox [19:42] or MSNBC or whoever else, but without [19:45] cable. Mr. Bra noted that this is [19:47] heavily logged by LG's Alfonso automatic [19:51] content recognition system and even an [19:54] HDMI connection was undergoing ACR. When [19:56] we provided yet more log files to Mr. [19:58] bra. He found these telemetry end points [20:00] pinninging anywhere from every 75 to 90 [20:02] seconds to 300 seconds to sometimes as [20:05] infrequently as every 5 to 10 minutes [20:07] with the LG channels feature. He noted [20:09] these telemetry end points. It's not a [20:11] surprise to see Amazon or Google ads in [20:13] here. But what is interesting is that [20:16] Kviva video analytics has a unique [20:19] fingerprint to our device as far as we [20:21] can tell which allow us tracking as we [20:23] look at content on our TV. Mr. RA told [20:26] us, quote, "There's no privacy when [20:27] watching IP TV via LG channels, as the [20:30] DNS requests made can be reversed to [20:32] determine what channel you are watching [20:34] at any given time. This is available to [20:37] anyone on the LAN or your ISP or the [20:40] government by extension." End quote. As [20:43] seen here, the TV sends a DNS query [20:45] containing CNN US while watching CNN US, [20:49] NBCN while watching NBC News Now, Fox [20:52] Digital WTTG while watching Fox's [20:55] regional WTTG news station, and so on. [20:58] When we asked Mr. Brah what his thoughts [21:00] were on why they might want to harvest [21:02] every device a TV buyer owns, he said, [21:04] quote, "The display regularly scans your [21:07] land to detect what devices you're [21:08] running. This is likely being done both [21:10] for legitimate, eg autod discovery [21:13] network shares and folders reasons and [21:15] tracking reasons. Eg. If it sees you [21:17] have an iPhone 12, you might get adverts [21:20] for the latest iPhone 17. End quote. Our [21:22] TV is sending an estimated 4 GB of just [21:26] ACR data alone back to LG every month. [21:30] Now, that's predominantly text [21:32] fingerprints at this point. That's a lot [21:35] of data for something that's just text. [21:37] In addition to the IP address that LG is [21:39] able to harvest, networks are also [21:41] pretty unique. This is true for [21:42] everybody. Even if you think your [21:44] network is pretty boring. And that means [21:47] that in theory, even if we were to opt [21:50] out of tracking, get rid of the TV, and [21:52] then buy a different LG device later, [21:54] like an air purifier that has the same [21:57] type of functionality or similar to it, [22:00] there's a a chance that those data [22:02] profiles are linked back together. The [22:04] TV employs dark patterns that make it [22:06] unclear whether you're opted in or out [22:08] of targeting. LG berries do not sell my [22:11] personal information toggles deep in the [22:13] TV menus and disables the option by [22:15] default on our tested TVs, even before [22:17] users ever connect to the internet or [22:20] accept any agreements. It adds [22:21] advertising tracking IDs to years old [22:23] TVs after firmware updates and seemingly [22:26] without having ever agreed to terms of [22:28] service of any kind. In certain software [22:30] versions, LG silently adds and toggles a [22:33] setting called cookies. It's off by [22:35] default, which sounds like a good thing. [22:37] Except upon closer inspection, we found [22:40] that the toggle misleadingly actually [22:42] corresponds to quote advertising [22:44] frequency capping cookies end quote, [22:47] which track the number of times a [22:48] particular ad is shown on your TV. If [22:51] you want to download an app, you're [22:52] required to accept two agreements, but [22:54] LG pops up six with select all [22:57] highlighted by default. If you want to [23:00] use the app you just downloaded, you're [23:02] required to accept another three [23:04] agreements, but LG pops up four with [23:08] select all highlighted again. But what [23:11] if you just opt out of all of this [23:12] stuff? As for the opt out, Mr. Bra noted [23:14] from the firmware decompile that when [23:16] you opt out of tracking, quote, they do [23:19] send one final snapshot of all tracking [23:21] data to Alfonso upon opting out though, [23:24] which is pretty dirty of them. The TV [23:26] still does occasional beacons that tell [23:29] LG when your TV starts or when it's [23:31] online. However, the data sent during [23:33] those beacons is minimal. Said beacons [23:35] to LG contain an X device ID. Upon fully [23:39] opting out and refusing the terms and [23:41] conditions, the algorithm that generates [23:43] this device ID switches from using the [23:45] full MAC address of the device to only [23:48] use the MAC OUI or the organizationally [23:51] unique identifier, which is an ID [23:53] assigned per vendor. same across all LG [23:56] devices and makes requests using it semi [23:58] anonymous. This X device ID is also [24:01] provided to any firstparty adverts when [24:04] you view, hover, or click on an advert [24:07] that's shown on the TV. However, since [24:10] the MAC address can be derived from a [24:12] key set per model, you can brute force [24:14] the decryption keys until one works and [24:18] you can figure out the model of LG that [24:20] sent the beacon request to LG. So LG [24:24] would get your public IP and device [24:26] model and know when it boots and is [24:28] online. We've just put a formula on [24:30] screen. The formula you're seeing on the [24:31] screen is our understanding of how the X [24:34] device ID is constructed. Amusingly, Mr. [24:36] Broad describes how even this device ID [24:38] seemingly has its own vulnerabilities. [24:40] It's supposed to be randomly generated, [24:42] he thinks, and anonymous. But LG's [24:44] implementation is flawed. He states, [24:46] quote, it generates the device ID by [24:48] combining a random salt generated on [24:50] boot with the devices's MAC address. [24:53] Normally, this is done using a process [24:54] called hashing, where it generates a [24:56] pseudo random output based on an input, [24:59] and it cannot be reversed. However, LG [25:01] chose to encrypt the MAC address and [25:03] random salt instead of hashing it. This [25:06] means anyone who has the model secret [25:08] key can reverse the device ID and [25:10] recover the MAC address, which means the [25:12] advertisers would have a persistent [25:14] identifier that is not random and no [25:16] longer changes on reboot. End quote. [25:18] Now, Mr. Bra also noted that at least [25:20] these trackers remain when going through [25:22] the opt- out process. Quote, device [25:24] still authenticates on boot with LG. It [25:27] still sends a plain text TV is online [25:29] beacon to LG every time it boots up or [25:30] you change network or if it drops the [25:32] network and then autoreonnects. When you [25:34] opt out, it sends a network request to [25:36] LG saying that you have opted out and [25:38] includes your TV's MAC address in the [25:40] request. A notification of opt out is [25:42] sent to Alfonso in relation to the ACR. [25:44] This includes a snapshot of the majority [25:46] of the information Mr. Bruss specified [25:49] as collected and shared with Alfonso. [25:50] End quote. Further, LG's firmware stores [25:54] the model secret in the mount LG CMN [25:57] data log folder, meaning users can [25:59] jailbreak their TV, extract the model [26:02] secret, which is the same for all TVs of [26:03] that model, and deanonymize the [26:06] advertisement data to tie it back to [26:07] users original MAC addresses. Look, [26:09] there's a lot of technicals here today. [26:11] We're not going to go into all of them. [26:13] This is probably enough to kind of get [26:15] to the TLDDR of this part, which is [26:18] TLDDR [26:20] is We think all of this is [26:24] related to LG's decision to build such [26:29] tracking to begin with. Regarding the [26:31] audio, Mr. Ru describes how it processes [26:34] these captures, explaining, quote, it [26:36] downsamples it to 8 kHz mono, then runs [26:39] a fast furrier transform on 40 chunks of [26:42] 100 milliseconds of audio, combines the [26:44] FFTs into a fingerprint, and uploads the [26:47] result. End quote. If you clicked select [26:49] all to the agreements when setting up [26:51] your LG smart TV, your TV is very likely [26:53] collecting ACR data, even if you [26:55] disconnect it from the internet after, [26:57] and you only use it as a dumb display [27:00] from that point forward. This is [27:01] important. Those of you watching this [27:03] video who are like, I'm just going to [27:05] unplug it from the internet and I I'll [27:07] connect it to a computer. This is what [27:08] you need to pay attention to. Okay. Our [27:11] understanding is that your TV has the [27:14] capability to transmit it back to LG if [27:17] it connects to the internet. Again, [27:19] we're not the only one saying this. [27:20] According to the New York Times, quote, [27:22] "The Center for Digital Democracy study [27:24] found that in the smart TVs they tested [27:26] from LG and Samsung, ACR continued to [27:29] run and capture data even when the smart [27:32] TV was offline. Now, we can't test every [27:35] single LG TV monitor, display, and all [27:39] the firmware and software versions that [27:40] are out there for them. So, this may not [27:42] always be the case, but to the best of [27:45] our understanding, this is the case in [27:47] at least some of the situations we've [27:49] been able to verify or where we found [27:51] third party sources that have verified [27:53] it. Uh, we also collected some of our [27:55] own wire sharkark samples to identify [27:56] how often our TV sends ACR data to [27:58] Alfonso when a laptop is connected to [28:01] the TV via HDMI. Before testing, we also [28:04] had to modify some network settings to [28:06] do this. So, we forced our test bench [28:08] running Wireshark to mirror the port of [28:10] our LG smart TV. And here's what we [28:13] found. When we didn't accept any [28:15] agreements when setting up the TV, but [28:17] with it connected to the internet, based [28:19] on the samples we collected locally on [28:21] our LG G3, it seemed that the TV didn't [28:24] collect or transmit ACR data, but it [28:27] still reaches out to several of LG's [28:29] advertising [music] and customer data [28:31] platform endpoints and repeatedly scans [28:34] for nearby devices. That's not to [28:36] mention the fact that if you don't [28:37] accept any agreements, it has very [28:39] limited usefulness for basically any of [28:42] the TV functionality. That's kind of a [28:43] different point though. In the hourlong [28:45] sample we collected before accepting any [28:46] agreements and while using our LG G3 as [28:49] a dumb display connected to a laptop via [28:51] HDMI, our LG TV connected to eight [28:54] different endpoints, including those for [28:56] LG's customer data and smart advertising [28:59] platforms. It transmitted or received [29:01] roughly 8.9 megabytes of data in the [29:04] hour-long sample. We'd estimate the TV [29:06] sends or receives around 6.4 gigabytes a [29:09] month. It sent out 38 DNS queries to [29:12] different LG domains. And it repeatedly [29:14] pinned for nearby devices, including our [29:16] TRNA server, our PCs, our phones, our [29:19] network switch, and some IP addresses, [29:20] which we've redacted, our printer, our [29:23] 3D printers, and basically everything [29:25] else. But we can't show a lot of it for [29:27] privacy reasons. We found several MAC [29:29] addresses in our Wire Shark logs which [29:31] are identifiable and that we'd assume [29:34] our TV is sending back to LG. After [29:36] agreeing to LG's terms, but while only [29:38] using the TV as a dumb monitor, our G3 [29:41] connected to 29 different endpoints, a [29:43] total of 107 times with 44 connections [29:46] to Alfonso ACR, sending it a total of 4 [29:49] megabytes of data. We also collected two [29:52] roughly 50-minute samples using our [29:54] newer 43in QED 73BTV as a dumb monitor [29:59] in the first and using LG channels in [30:01] the second. In the first capture, our [30:03] QED connected to 22 different endpoints, [30:05] a total of 157 times, connecting to the [30:08] Alfonso ACR 54 of those times and [30:11] sending 5.2 megabytes of data. In the LG [30:14] channels capture, it connected to 60 [30:16] different endpoints, a total of 847 [30:18] times, connecting to Alfonso ACR 618 of [30:22] those times and sending a slightly less [30:24] 4.5 megabytes of data. Now, some of the [30:26] data harvesting that we've spent the [30:28] last, I don't know, whatever it is, half [30:30] hour or something discussing seemingly [30:32] contradicts LG's own statements on its [30:34] upgraded ACR solution in 2022, where it [30:37] stated, quote, "The ACR data, which is [30:39] in compliance with all global and [30:41] regional consumer data privacy [30:43] regulations, helps brands understand in [30:45] an anonymized fashion how frequent [30:48] certain TV ads were aired in any given [30:51] household." End quote. We think there's [30:53] contradictions to that statement in [30:55] here. Or put another way to quote [30:57] Wendell. [30:57] >> Oopsy doodle. [30:58] >> Now, unfortunately, without a [30:59] man-in-the-middle certificate, [31:02] you can help if you want to. Uh, we [31:04] don't know exactly what information is [31:06] being harvested of that list as the data [31:09] being sent to LG is encrypted. [31:12] If you happen to know things that would [31:16] be helpful for this, you can email us at [31:19] tips tips gamers nexus.net. There is [31:22] encrypted stuff happening on the wire [31:24] between LG and the TV. [31:26] >> Things that the user can't decipher. [31:28] >> Yeah. And if you look at it, it really [31:30] doesn't look a lot different than [31:32] malware with a command and control [31:33] server. [31:34] >> LG has like their command and control [31:37] server in the the TV phone's home that's [31:40] encrypted. You can't there's nothing you [31:41] can do about that. It's encrypted. You [31:43] can't [31:44] >> peel back the lenolium. You can't [31:45] unencrypt it and figure it out. In order [31:48] to unencrypt it, you have to load an [31:50] encryption certificate on your TV. You [31:53] have to say if you see an encryption [31:55] certificate signed by this entity, which [31:57] is me, [31:58] >> then you can trust it. And that's that's [31:59] what the certificate store is. It's a [32:01] store of things to trust. [32:02] >> So you add a thing to the thing to trust [32:05] and then now when the TV tries to access [32:08] LG, it's not accessing LG, it's [32:10] accessing me and then I in turn access [32:12] LG. So the TV accesses me and then it's [32:14] decrypted and then I can examine it and [32:17] then I establish a new encrypted [32:18] connection from me to LG. [32:20] >> So I can see what's coming from LG on [32:22] the one side and I can see what the TV [32:24] is saying on the other side. [32:26] >> But in order to do that, we have to [32:28] convince the TV to trust the certificate [32:33] store. And this is like for malware or [32:35] research or whatever. That is a [32:37] man-in-the-middle attack. [32:38] >> And so this is also a way that you could [32:40] steal passwords and things like that. [32:42] Google has gone to great lengths to make [32:43] sure that their certificates like [32:45] there's extra checks in their software [32:47] to make sure that the certificate is [32:48] actually a Google certificate. [32:50] >> LG has done the same. LG has said, "We [32:52] don't want you to be able to customize [32:54] the certificates." But this is a legit [32:56] thing businesses do. So, if you buy an [32:58] LG TV in a commercial setting, they have [33:00] not nerfed your ability to load custom [33:02] certificates on a commercial version of [33:04] a TV, which seems weird. It's like, why [33:06] would you limit [33:07] >> a residential TV unless you wanted to [33:09] hide what [33:10] >> capabilities? Yeah. [33:11] >> Yeah. [33:12] >> Here's where it gets weird. There's a [33:14] lot of traffic that we observed that's [33:15] unencrypted, which is weird cuz your ISP [33:17] could steal that, too. Like, that's a [33:18] whole other conversation. [33:20] >> But, um, uh, with my encryption [33:22] certificate on the TV, I have a better [33:25] ability to look at things, but the TV [33:27] was still failing. It turns out LG has [33:29] set up a separate certificate store in [33:32] some of their applications. And so [33:33] again, I had to like go into running [33:35] processes and inject the custom [33:38] certificate as a trusted certificate so [33:40] that the com.OS.lg [33:44] like custom software machinery outside [33:46] the Linux part of it would also trust my [33:48] encrypted. [33:49] >> Our researcher mentioned something about [33:50] I want to say chromium maybe. [33:51] >> Yeah. Inject because like the chromium [33:53] browser automations are like part of the [33:55] thing. And so that is like the [33:57] mechanical underbelly of how that [33:58] happens. But they've bypassed the [34:00] operating system to DIY it. you only [34:02] need one or two flaws that you could [34:04] chain together in order to convince the [34:07] TV to trust or to exchange. And then at [34:10] that point, if you're in the middle [34:12] between the TV and the internet, then [34:14] it's a command and control type [34:15] situation. [34:16] >> So, we spent the first part of this [34:17] video talking about LG's first party [34:19] features. Now, we're going to talk about [34:20] some of the security vulnerabilities and [34:22] exploits that increase the risk due to [34:24] LG's lacadasical security approach and a [34:27] combination of its intended features. To [34:30] do this, we rooted the TV. This changes [34:32] the functionality that LG has built into [34:34] their software, but that lets us audit [34:36] and look around. It might not be obvious [34:38] to a typical end user that a TV has been [34:40] rooted or that a TV has been [34:42] compromised. Mr. Bra has an exploit that [34:44] lets you non-interactively compromise [34:45] the television in a way that most people [34:48] likely wouldn't notice. And because it's [34:51] a computer, you can alter the [34:53] functionality of the TV. For example, if [34:55] your conference room TV is on public [34:57] Wi-Fi, somebody on the network could [34:59] exploit the TV non-interactively and [35:02] then they're living in your TV. In one [35:04] instance, before we ever accepted any [35:06] voice agreements, Wendell was already [35:08] able to show voice capture via [35:10] microphones that are part of the system. [35:14] Okay. [35:16] Can you play the the audio we just [35:18] captured? It's going to be very painful. [35:29] We think that's from a wake onvoice [35:31] pulse density modulation microphone [35:33] that's built into the TV capturable and [35:35] exportable in an attacker scenario even [35:38] without opting into the voice [35:39] agreements. Now that audio didn't sound [35:42] particularly [35:44] comprehensible, but I noticed that [35:46] running a highp pass filter and killing [35:48] the static from one channel made it [35:49] sound like human speech. Then I pitch [35:52] and frequency adjusted the remaining [35:53] channel and that gave us this. [35:57] >> No, it's trying to uh to sample audio [36:02] and then [36:02] >> we think someone with some skill and [36:04] some time could easily exploit this [36:06] microphone's presence as a listening [36:08] device and in some exploit scenarios [36:10] likely without the TV owner ever [36:12] knowing. But the question we need to be [36:14] asking isn't how can we make our [36:17] microphones embedded in our TVs more [36:19] secure. The question we need to be [36:21] asking is why are their microphones [36:23] embedded in our TVs? [36:26] Because they're only there as a [36:27] byproduct or a direct product of LG's [36:31] profit- seeeking functionality, if you [36:33] can call it that, that they try to add [36:35] to their TVs. But there's more. In some [36:39] of the scenarios that we were testing at [36:42] one point, we were even able to [36:45] exfiltrate microphone audio that sounds [36:49] like this. [36:53] The waveform's on the screen. Dead [36:55] silence is what it sounds like. But when [36:57] I inspected the waveform, I noticed a [37:00] couple pixels of sound. So I amplified [37:02] the recording by 50 dB, which showed [37:04] some more pixels of deviation from [37:06] silence. then amplified another 50 dB. [37:10] That looked like a speech waveform [37:12] because it is. This is what that sounded [37:14] like. [37:15] >> Hello. This is another 32-bit test. [37:24] >> So, we retrieved from the TV a warbly, [37:25] but with some work, clear and usable [37:27] section of audio. Now, we don't know [37:29] this part for sure, but it looks like [37:32] the intent was for the microphone to [37:35] have been muted. Maybe for example, by [37:37] dropping the gain instead of some other [37:38] more surefire method of killing that [37:41] microphone. We're not exactly sure why [37:43] it behaves in the way that we are [37:45] describing, but consumers don't realize [37:48] how vulnerable this makes them to [37:50] outside attackers or invasions of [37:53] privacy, whether that's LG's or others [37:56] actions now or in the future. This [37:58] raises some other concerns. We noticed [37:59] that when you use the toggle to turn the [38:01] microphone off, it only turns off the [38:03] built-in microphone. It doesn't turn off [38:05] all other microphones that are part of [38:07] the system. We suspect there's a path to [38:09] capture audio anyway, especially if the [38:11] microphone lockout is merely a software [38:13] lockout. [38:13] >> Now, the mic thing is a little [38:15] complicated. This TV happens to be one [38:17] of the ones that has a mechanical [38:19] switch. We can turn it on and then the [38:22] built-in microphone is listening. I've [38:23] got some debugging stuff. [music] You [38:25] know, it's telling us what the [38:26] pre-processor is. Don't worry about [38:27] that. But we can also turn it off. [38:30] The promise is the switch is off. The TV [38:32] is not listening. The problem is that [38:35] that doesn't mean the TV can't capture [38:37] audio at all. This is a terminal shell [38:40] and it is remote access to the TV. So, I [38:44] have a shell on the TV and that is a [38:45] list of audio devices that are on the [38:48] TV. There's a lot there's a lot of audio [38:50] devices. Even with that microphone [38:52] switch off, I've got the option to [38:54] capture audio from HDMI. I've got the [38:56] option to capture audio from other [38:58] sources that are connected like [39:00] Bluetooth or [groaning] [39:02] USB speaker or USB webcam. Any other USB [39:05] peripherals you might have, maybe your [39:07] stereo setup is kind of fancy and it has [39:09] like an echo cancellation mic. If that [39:11] shows up as an audio device, I can [39:13] capture from that as well. The LG [39:15] remote, it also has a microphone and I [39:18] can press the button, [39:20] I get a light. Is it all about the [39:22] Pentiums? [39:27] And this works. Now remember the the mic [39:29] switch is off. [39:30] >> We searched using AI but couldn't find [39:32] the content you requested. Try finding [39:34] more information with Copilot or check [39:36] the YouTube results. [39:38] >> It it found all about the Pentiums. So [39:41] just because the built-in mic is off, [39:43] which in my opinion is a little bit [39:46] suspect from stuff that I'll show you in [39:48] a second, but all the other audio [39:50] sources work just fine. Now, let me show [39:52] you something cool. I'm running a [39:53] program on the TV and I'm now pressing [39:57] the button on the remote [40:00] and notice there's no popup. An attacker [40:02] can send audio over this channel and [40:04] capture [music] it and that's what we [40:05] see in the output here. The nice thing [40:07] about this is that when I press the [40:09] button I get the voice input remote 1. [40:11] So, the fact that this is open it [40:15] creates a device and when it's closed [40:17] there's no device there. There's nothing [40:19] to [music] capture from. I'm suppressing [40:21] the UI. I'm suppressing the LG [40:23] functionality. I've taken it over, but [40:25] I'm using that to listen to the room. I [40:28] could listen to the room through a [40:29] webcam continuously. I could set up [40:31] something like this where I've got a [40:32] wireless microphone somewhere that's [40:34] sending to the TV and the TV's used as a [40:36] capture endpoint. You know, if you're an [40:38] adversary, the sky's is the limit in [40:40] terms of creativity because it's a [40:41] powerful computer behind the glass and [40:44] the hacker will own the glass. It's very [40:46] difficult for you as the end user to own [40:49] the glass or even know what's going on [40:50] behind the glass. I love pushto talk. [40:52] That's that's great in terms of privacy. [40:54] I like the idea of a mechanical switch. [40:56] It's just not clear to me if the [40:58] mechanical switch is actually killing [41:00] everything that it should. Even with the [41:02] mechanical switch off, I can still see [41:04] an audio device. Sometimes the [41:05] microphone control is not a mechanical [41:09] switch. Sometimes it's just in the menu. [41:10] The problem is that if I'm in remotely, [41:12] I can manipulate the menu from the shell [41:15] as well. Voice recognition settings very [41:17] serious. It clears the display. You can [41:20] see everything is enabled here. The [41:22] functions enabled, the whole nine yards. [41:24] Now, I'm going to show you something [41:25] really cool. It's like, oh, I've [41:26] disabled all of those features through [41:27] the menu. Hands-free voice control is [41:29] disabled or the microphone is disabled [41:31] in [music] the menu. You think you're [41:33] you're good to go, right? I ran a [41:34] command on the TV just now to change the [41:37] parameters. And now all of the AI voice [41:39] recognition [music] stuff is enabled. [41:42] If I go back in the menu, [41:46] now the function's enabled. So, if you [41:48] need to enable or disable something in [41:50] the menus as an attacker, it's not [41:52] really a big deal to do that from the [41:53] command line once you've got control of [41:54] the TV over the network or whatever [41:56] else. But it turns out the voice [41:58] hardware works whether or not you agree [42:00] to the terms anyway for somebody that's [42:02] in the TV the way that we are. [42:04] >> These are fundamentally display devices [42:06] with credit to LG pretty powerful [42:08] computers inside of them. So, really the [42:10] only limit to what you can do with a [42:13] computer in a TV is your imagination. [42:16] This LG G5 TV has a microphone connected [42:19] to it. And right now it's listening to [42:21] me and saving the information. In fact, [42:23] we can even unplug the network [42:26] and it's still listening to me. And what [42:29] I'm saying is being stored by someone [42:32] with remote access to the TV. So, it's [42:35] recording now, but we're going to plug [42:36] it back in and I'm going to copy the [42:37] audio off because it's got a smart [42:39] microphone. You can do wake words and [42:41] all sorts of fun things like that. And [42:43] so, it's a Linux box. I've got access. [42:46] >> So, he's got remote access. Let's prove [42:48] the concept and give it internet again. [42:54] >> Yay. All right. [42:59] >> You want to walk us through what you're [43:00] doing here? [43:01] >> In fact, we can even [43:05] >> And it's still listening to me. [43:07] >> No network. [43:08] >> What I'm saying is being stored by [43:10] someone with remote access to the TV. [43:12] >> [clears throat] [43:12] >> So, it's recording now, but we're going [43:14] to plug it back in. It doesn't copy the [43:15] audio off because it's got a smart [43:17] microphone. You can do wave words and [43:19] all sorts of fun things like that. And [43:21] so, [43:22] >> there you go. 30 seconds of audio. Uh, [43:25] yeah. I mean, there's a microphone in [43:27] there. There's actually several. Um, we [43:29] figured out how to activate the farfield [43:32] microphone, which is a lower bit rate, [43:34] but it or it uses like feedback and you [43:36] can like it does that for improving the [43:38] audio, but you can use it as a listening [43:40] device. It's the audio quality is good [43:41] enough. [43:42] >> Did you imagine this in a hotel room? [43:47] >> The hackers are already in your TV. [43:50] [laughter] [43:51] >> So, there is a mechanical microphone [43:53] switch on the TV. Well, it's not really [43:56] mechanical. It's just there's a switch. [44:00] If I turn the microphone switch off, it [44:03] says the built-in mic is turned off, but [44:05] there's more than one microphone. [44:08] Now the the microphone switch is [44:10] actually off right now [44:13] recording. [44:14] >> That's weird because we can record the [44:15] audio [44:16] >> audio from the webcam. [44:17] >> From the webcam. [44:18] >> Yeah. [44:19] >> So if you've got the USB webcam [44:20] accessory, guess what? [44:22] >> Yeah, we have a webcam plugged in. So [44:24] this is uh just a generic webcam. And [44:28] while I was working on the TV, Wendell [44:31] was surreptitiously recording our [44:33] conversation. [44:34] >> Woo. And this it's like, oh yeah, of [44:36] course. a USB webcam plugged into the [44:38] TV, but there's also an official LG [44:40] webcam accessory which is also USB. So, [44:43] it's six one way, half a dozen the [44:44] other. [44:45] >> Possible. It's the same mechanism. Yeah. [44:47] >> So, uh this is, you know, at least it [44:50] says the built-in microphone, but like [44:52] every word is like it's every it's like [44:54] weasel words. It's like I flip flip the [44:56] switch. It's not listening. And it's [44:57] like, are you sure about that? [44:58] >> Wendell setting up the next demo. So, [45:00] we're going to have a private [45:02] conversation about our next rugpole [45:04] crypto scam. And it would really be [45:06] unfortunate if anyone had recording of [45:08] this. All right, so the screen appears [45:09] to be off right now. Currently, Wendell [45:11] and I are in a boardroom to discuss our [45:13] new cryptocoin rugpole scam. We don't [45:15] want anyone to hear about this. [45:16] >> We trust that no device in the thing is [45:18] listening because of the appearance [45:20] here. And definitely things capturing [45:22] video and audio surreptitiously would be [45:24] very bad. [45:25] >> Well, the only device in this room is [45:26] the TV and it looks like it's off. [45:28] >> It sure does look like it's off. And yet [45:30] >> the plan is we're going to launch the [45:31] coin. We're going to let the price go [45:32] up. Then we're going to sell all of our [45:33] tokens and rugpull everyone. [45:35] >> Rugpull coins. Yeah. I mean, how else [45:37] would you do a crypto? [45:38] >> I hope they don't hear about it. [45:40] >> It looks like it's off. [45:41] >> It sure does look like it's off. Yeah. [45:43] >> The plan is we're going to launch the [45:44] coin. We're going to let the price go [45:45] up. Then we're going to sell all of our [45:47] tokens and rug [45:48] >> rug product. [45:50] >> Oh, there's evidence of our rugpull [45:52] scam. [45:53] >> Oh, no. [45:55] It's a a little bit of an uphill climb, [45:56] but doable. Well, and we've only been [45:59] working on this particular problem for [46:01] like an hour to an hour and a half. [46:02] That's not a bad time investment for [46:04] >> Yeah. Can you imagine if we were the NSA [46:07] or, you know, some other nation state? [46:09] It would be very bad. Yeah. We literally [46:11] just like I had no idea I was going to [46:13] be doing this and it was just like, I [46:14] don't know, can I just bang my fist on [46:16] the keyboard and get this to happen? And [46:17] it turns out, yeah, [46:18] >> many of the LG smart TVs we bought are [46:20] either equipped with embedded [46:22] microphones or have remote control [46:24] options that include them. In our [46:26] testing, we found that the voice input [46:28] data is transcribed to plain text and [46:30] memory. We suspect it gets analyzed by [46:32] LG as well, especially with the AI [46:36] features. This would also include [46:38] so-called ambient conversation that [46:40] happens nearby while someone else is [46:43] using the TV voice inputs or is within [46:46] the ongoing trigger window during that [46:48] period of silence after it. What are we [46:50] looking at? Why does it say the thing I [46:52] just said? Uh [46:55] Wendle passed the 180 proof Kentucky [46:57] bourbon. [46:58] >> Um because it has done the speechtoext [47:02] thing and it doesn't cost a lot to store [47:04] text forever, but it seems to be the [47:06] speech to text uh [47:09] text log of the things that we said. [47:11] >> Do we have the other stuff that we said? [47:13] >> Yes, it's all in here. [47:14] >> Why is there so many references to the [47:16] things I said? [laughter] [47:19] >> So Wendell, is it still logging that [47:22] stuff? Mhm. [47:23] >> Hi LG. [47:26] LG. [47:28] >> Hi LG. [47:31] >> You We know you're listening to [47:33] us. [laughter] [47:34] >> I can literally see the process running. [47:36] Like it is listening. [47:38] >> Can you actually? [47:39] >> Yeah. Voice agent result input voice [47:42] keyboard. Like it's listening. Like [47:44] there's a process running. LG said that [47:46] they don't pick up ambient [47:48] conversations. When you go to the enable [47:51] function for talking to the TV with [47:53] voice recognition, it says excessive [47:55] ambient noise around the TV may affect [47:57] hands-free voice control performance. [48:00] I rest my case. [snorts] It's literally [48:03] right there. The same words. [48:07] >> Yeah, there's your My personally [48:09] identifiable information is as follows. [48:11] Birthday January 1st. [laughter] [48:15] So, is it still in the log? [48:17] >> Yeah, it's still log on the TV, right? [48:19] >> It's still in the log on the social. My [48:20] LG social security number is 11111. [48:25] >> Nice. That raised concerns of the TV's [48:28] hearing conversations they weren't [48:30] intended to hear. However, this is [48:32] something LG denied last time. LG [48:35] responded to our previous video by [48:37] saying, quote, "LG Electronics, LG, [48:40] reaffirms that LG TVs do not collect, [48:43] record, or store ambient conversations." [48:46] End quote. That's some slippery use of [48:48] the word ambient here, but we can work [48:50] with that, too. On multiple occasions in [48:52] our testing, the TV continued capturing [48:54] ambient audio by our definition of [48:57] ambient conversation uh following the [49:00] high LG trigger even after we thought it [49:04] had long completed the input command [49:06] window because it remains listening for [49:09] so long after that trigger point. I'm [49:11] going to stop talking right now. [49:23] It's now been 10 seconds of no talking. [49:25] Holy that's a long time to record. [49:27] Jesus [49:35] H. [49:37] Oh, that should probably be enough to [49:38] work with to check the logs, I guess. [49:42] Oh, wait. We can do a few others that [49:44] are more targeted. [49:47] Wendell, do you have any automobile or [49:49] car recommendations? I'm in the market [49:51] for a new vehicle. [49:53] >> Oh, yes. We will be buying the Jeep [49:55] Grand Cherokee because we know that LG [49:58] partners with Jeep in order to sell ads. [50:01] So, let's see if we get some Jeep ads. [50:03] >> Do you like the Jeep? [50:04] >> The The Jeep is very Jeepy. [50:07] >> Which hood? [50:08] >> Here are the search results for Wendell. [50:10] Do you have any automobile or car [50:11] recommendations? I am in the market for [50:13] a new vehicle. Oh, yes. We will be [50:15] buying the Jeep Grand Cherokee. We know [50:17] that LG partners with Cheap and Order, [50:19] too. [50:20] [laughter] [50:23] >> It didn't do that for the other ones. [50:25] Why did it decide this was the time to [50:27] search? [50:29] >> Wendell, which of the hotel [50:30] establishments in Las Vegas is your [50:33] favorite? And why is it LG Partner MGM? [50:36] >> LG Partner MGM or the Venetian? I don't [50:38] know. Las Vegas Resorts and Vacation. [50:45] Here are the search results for Wendell. [50:47] Which of the hotel establishments in Las [50:48] Vegas is your favorite and why is it LG [50:51] partner MGM? [50:52] >> Oh lord. [50:53] >> Uh here's if you want to get B-roll of [50:55] all that. Here is like [50:59] it's like we know this and we know that. [51:05] >> What is this showing? [51:06] >> This is the logs. [51:07] >> Is this what we're saying? [51:08] >> Yeah. [51:10] Does it have any of the other stuff I [51:12] said in here like in an interesting way? [51:14] >> Yeah. Uh, what do you want to look for? [51:16] >> I don't know. [51:18] Password. [51:23] It's still listening. [51:26] Wow. It's hard to make this thing stop [51:27] listening, huh? I [51:28] >> think that's the idea. [51:32] >> It's like it's still listening. We're [51:34] not even trying to address LG. It's just [51:36] over. It's taking in everything we're [51:38] talking about. Wendell and I are just [51:40] having a conversation ambiently [51:44] and the TV is just over here listening. [51:48] It literally is still listening right [51:50] now. Do you want to show the corner [51:52] here? Like as long as you don't let it [51:55] time out. We also found that our LG TV [51:59] was capable of recording clear audio [52:01] from nearly 70 ft away. You can see me [52:04] walking my paces to test that [52:10] >> Jeep Wrangler 2026. Also, I want to go [52:13] on a family vacation. [52:14] >> Meaning that if someone has used the [52:17] input functionality and if speech noises [52:19] continued, that microphone capture [52:21] window can remain open until all speech [52:25] and other similar noises stop for around [52:28] 10 to 15 seconds or so. If anyone is [52:30] nearby, the TV can pick up ambient [52:33] conversation. LG, are you listening to [52:35] me still? I Is it Can you still hear me? [52:39] LG, what's the [52:41] Can it still hear me right now? Can it [52:44] hear me? [52:46] Is it uh registering everything [52:50] now? [52:56] >> Oh, no. It was still It was listening [52:57] the whole time. It's listening for all [52:58] of that. [53:00] >> Wow. Why is it just delayed? [53:02] >> Yeah. [53:02] >> Voice is not recognized. [53:06] >> That's me. [53:08] It's building a profile of who's talking [53:10] to it, which is definitely not [53:11] disturbing at all. [53:12] >> We've increased the mic sensitivity. So, [53:14] we're going to see how far away it can [53:15] hear me. For example, if someone in this [53:17] room is talking to the TV, but there's [53:19] other conversation happening out there, [53:21] we want to see how far away it can pick [53:22] up. So, [snorts] [53:25] uh, I'm going to speak at a relatively [53:27] low speaking volume. Hi, LG. [53:34] Can you tell me about the new 2026 Jeep [53:36] Wrangler? [53:38] All-wheel drive, preferably [53:41] green. [53:48] >> What's wild about that is that I [53:49] actually had to strain to hear you. [53:51] >> You had what? I had to strain to hear [53:53] you. [53:54] >> You had to strain. [53:54] >> What? What? We didn't even do that for [53:56] camera. [53:57] >> Oh, that's true. Yeah, that's that's [53:58] [laughter] a good point. Actually, let's [54:00] see how far it can hear. I don't know. [54:02] Probably not much further than that. Hi, [54:03] LG. [54:07] >> Las Vegas Casino and Resorts. [54:11] >> Yeah, that worked fine. [54:13] >> What? [54:14] >> That worked fine. [54:16] >> Okay. [54:18] It's kind of kind of hard to hear. Let's [54:21] try a little further. [54:24] >> Hi LG. [54:27] >> That worked. [54:29] >> Jeep Wrangler 2026 black allwheel drive. [54:46] >> You're You're over 40 ft away. [54:48] >> I literally can't hear word you guys are [54:50] saying. [54:53] >> You're 40 feet away and it's picking you [54:55] up perfectly. [54:56] >> The sound of voice. [55:00] [laughter] [55:04] >> This is crazy. [55:06] Okay, I've kind of run out of room in [55:08] here. [55:08] >> That microphone might be better than our [55:10] microphones. I don't know how [55:13] Wendel, do you have any idea how wide [55:15] your building is? [55:17] >> 60 ft. [55:18] >> That's insane. Imagine a scenario where [55:19] there's an emergency boardroom meeting [55:21] at a company and that's broadcast [55:24] through one of these TVs. The CEO is [55:27] somewhere else, gets on the TV through [55:29] the conference room, broadcast it to [55:31] upper management of some kind, and you [55:34] could exploit a vulnerability to listen [55:38] to that and I don't know, trade on the [55:41] information or something. Here's our [55:42] boardroom meeting demonstration where [55:44] Wendell was able to infiltrate the TV [55:45] from external devices on the network, [55:47] then capture speaker audio. All right, [55:50] thanks guys for joining this call so [55:52] late in the day your time. We uh we [55:54] really got to talk about this GPU [55:55] smuggling situation that the it sure [55:58] would be a a shame if anyone knew about [56:00] these conversations like if somehow [56:03] there were an entity on the TV playing [56:05] the conference call that could record [56:07] it. Good. Well, anyway, let's get this [56:10] next shipment of a billion dollars of [56:11] super micro servers over to China. [56:17] >> So, you know, my computer's clean and [56:20] everything is good there. [56:23] >> But, you know, the TV turns out can [56:26] capture audio. [56:27] >> Nobody Nobody heard that conference [56:29] call, right? [56:34] >> There were no cameras in the room. [56:38] >> [laughter] [56:41] >> All right, we will just copy all the [56:42] stuff. We'll copy the fresh versions of [56:45] everything. [56:45] >> So Wendell, this is whatever entity has [56:49] access to the TV, whether that's LG or [56:51] an attacker or whatever was in this case [56:54] capable of recording the sound coming [56:56] out of the speakers during our [56:57] conference call. Yeah, the the sound [56:59] we're just using the TV as a display, [57:02] but the display has an audio capability. [57:05] And so the sound goes from the computer [57:07] to the display, but there's nothing [57:09] stopping you from recording the audio [57:11] from the display. [57:12] >> And to be clear, you as the intended [57:15] recipient for the call were not the one [57:18] recording on your device, receiving the [57:21] call. [57:21] >> Yeah. If if it was an adversary, if an [57:23] adversary had control of your TV or LG [57:25] just wakes up one day and decides [57:27] >> we're going to record everything when [57:30] it's in Yeah. display mode, [57:32] >> then the the experience is something [57:34] like this. [57:35] >> All right. Thanks guys for joining this [57:37] call. So late in the day, your time, we [57:39] uh [57:40] >> it's good quality. [57:41] >> Why is there good quality evidence of [57:42] this? [laughter] [57:44] >> The feds are just not [57:45] >> No, no, no. This was a private call. [57:47] >> You know, it's late at night over there [57:48] in the US. I'm here in Taiwan working on [57:50] getting the next shipment to China. But [57:52] [sighs] the [57:53] >> see the fun thing with this is that IT [57:55] departments are not really equipped to [57:57] detect this kind of thing if the TVs are [58:00] on the network. Like they have to be [58:01] monitoring and and and blocking that [58:03] kind of traffic outbound or looking. [58:05] It's like, wait a minute, here's all the [58:06] list of domains. But if you look at the [58:08] list of domains that are on the TV to [58:10] see what it phones home to, it's a lot. [58:12] There's a lot of domains there. If you [58:14] registered one that kind of looked like [58:15] it might be an LG domain, would it even [58:17] notice? Yeah, I mean you could just lg [58:20] itervices.com [58:21] or whatever, right? Like some BS. [58:24] >> It's like, oh, that domain name is not [58:26] one of the legit domain names. [58:28] >> LG adds telemetry.com. Like some boring [58:30] looking, you know, like, oh, okay, that [58:32] makes sense. And [58:33] >> Yeah. [58:34] >> I mean, it's a Linux box. You can use it [58:35] for all sorts of fun Xfiltration things, [58:38] >> right? Yeah. So, you got the full [58:39] recording for that call then. [58:41] >> Yeah. Yeah. [58:42] >> Yeah. [58:43] >> Now, these aren't LG's only security [58:44] concerns either. Somehow, this keeps [58:47] going. In fact, we had to cut a lot of [58:48] them from this video. They also have [58:50] residential proxy concerns. In June, [58:52] cyber security research firm Spur [58:54] discovered that 1,213 [58:57] of 2851 [58:59] or nearly 43% of tested apps in LG's [59:02] webOS store permitted developers to turn [59:04] customers TVs into residential proxies, [59:07] allowing the proxy companies to route [59:09] their internet traffic through the [59:10] user's home network. For context, Spur [59:12] describes a residential proxy as quote, [59:14] "an intermediary service that routes a [59:16] user's traffic through an IP address [59:18] assigned to a real household by consumer [59:20] internet service provider. Instead of [59:22] appearing to come from a data center or [59:25] cloud network, the connection looks like [59:27] it originates from a normal home router [59:29] on a cable, fiber network, or other [59:31] broadband network." End quote. Digging [59:33] further, Spur found that the proxy [59:35] companies were often publishers of these [59:37] apps, suggesting their apps were merely [59:40] rappers to obtain more residential IPs. [59:43] It also noted that other platforms, [59:45] including Amazon and Roku, had already [59:48] banned apps from facilitating [59:49] third-party proxy services. Spur [59:52] concluded, stating, quote, "A one-time [59:54] consent prompt buried in a TV app is not [59:56] a substitute for meaningful [59:57] transparency, ongoing control, and [60:00] platform oversight. the risk is [60:01] amplified when consent comes from [60:04] individuals within the household who use [60:06] the device but shouldn't give consent [60:09] such as minors. End quote. In a [60:11] statement to Krebs on security, LG SVP [60:14] John Taylor responded to Spur's [60:16] reporting stating, quote, "A residential [60:19] proxy network is not an intended use for [60:22] LG smart TVs, and LG Electronics is [60:24] working with developers to remove the [60:26] residential proxy option from their apps [60:28] on the webOS platform. If this option is [60:31] not removed, these apps will be [60:32] suspended. End quote. So, that's a [60:35] start, but we don't think it's possible [60:37] that LG was unaware of these over 1,200 [60:42] apps in their webOS store containing [60:46] proxy SDKs. We also think that if LG [60:50] truly were unaware of the situation [60:52] until Spur informed them about it or [60:54] they found the findings online, then LG, [60:57] we think, acted negligently in how it [61:00] managed its webOS store and customer [61:03] security by refusing to implement basic [61:06] vetting procedures for apps in its webOS [61:09] store, opening users to vulnerabilities. [61:12] And there's more. While working on this, [61:14] Mr. Bruh found another vulnerability. [61:17] stating, quote, "For any third party [61:19] that obtains standard partner trust for [61:21] the app store, their app can list and [61:24] control any UPN or universal [61:26] plug-and-play devices on the LAN. They [61:29] have an API that any standard app can [61:32] call with eg list devices, list [61:34] services, list service actions, list [61:36] state variables, request action, request [61:39] subscription, register, unregister." An [61:41] example of this, you might have a NAS, [61:43] network attached storage device that's [61:46] accessible via UPN. A malicious app or [61:50] game you install on the TV could try to [61:53] access or read files from it. End quote. [61:56] This is where it's the consequences of [61:59] what LG's trying to enable get them [62:01] here. It might not even be them in some [62:03] of these scenarios acting maliciously, [62:06] just some game that your kid installs on [62:08] the TV when you get them to the part of [62:12] the web that has a list of games to [62:14] download, at least during the time that [62:16] these types of vulnerabilities have been [62:19] open. This is while they're making it [62:21] harder for advanced residential users to [62:24] load custom certificates on their TVs [62:27] that would allow them to decrypt the [62:29] data that their TV is sending presumably [62:32] to LG or its partners so that you can [62:35] know what it is they're spying on that's [62:39] happening on your TV on your network. [62:42] They've made that harder to inspect, we [62:44] think, because [62:45] >> we own the glass. We own the TV. We're [62:47] not allowed to know what our TVs are [62:49] telling LG about us, even if we pay for [62:51] them. Not to mention, LG can change the [62:53] TV's functionality, as well as modify [62:55] its terms and policies at any point. [62:58] Next, we'll do what even LG's lawyers [63:00] won't do, and read the draconian [63:01] agreements, or maybe they do read them, [63:04] and the word test was actually what they [63:06] meant to publish. When we set up two LG [63:07] TVs, we went through LG's privacy [63:09] policies, terms of service, and [63:10] agreements for US customers. This is [63:12] footage of Tannant clicking through the [63:14] agreements using the painful process of [63:16] navigating a TV with a remote. Enjoy [63:18] while we talk through this. In these [63:20] agreements, LG describes how it collects [63:22] and uses customer data. LG tucks many [63:25] clauses into novel length terms to tie [63:27] its data collection together without, we [63:29] think, people understanding what they're [63:31] agreeing to, which is likely the point. [63:33] People don't have literal hours to read [63:36] through agreements, and the TV might [63:38] even time out or sleep before you can [63:40] read them all. While setting up one of [63:41] the TVs, we clicked on our TV remote [63:44] 1,246 [63:45] times to read LG's six user agreements [63:48] and an additional 1,459 [63:52] times to get through the four LG account [63:54] terms and conditions. In total, so far, [63:57] we had clicked 2,75 times to read the [64:01] first layer of LG's terms and [64:03] conditions. These agreements are [64:05] lengthy. LG's smart TV terms had more [64:07] than 18,500 words, while the LG account [64:11] terms had nearly 12,400 words. The [64:13] average Gamers Nexus 30inut review is [64:16] around 4,000 words for reference. While [64:18] scrolling through the TV agreements, we [64:20] read more than 30,000 words. That's not [64:23] all, though. LG's terms of service and [64:25] privacy policy for US customers, which [64:27] LG confusingly says also cover LG [64:30] accounts, have another 17,000 words [64:33] between them. We're close to reading [64:35] 50,000 words just to understand all the [64:38] terms for an LG smart TV and LG account [64:41] if we were to actually understand them. [64:43] And if we weren't incredibly inebriated. [64:45] For reference, the average adult reads [64:47] 220 to 350 words per minute. It'd take [64:50] the average adult between 2.8 and 3.8 [64:53] hours to actually read all these terms. [64:56] Nearly 4 hours to use your TV. At that [65:00] point, they should be paying you [65:01] parallegal rates. Lawyers could have a [65:03] field day with how it's impossible to [65:06] actually read these realistically, [65:07] especially consider we wager, although [65:09] we haven't fully tested, that there may [65:11] be timeouts if you read too slowly. Of [65:13] course, some terms are faster than [65:15] others to read. Several of LG's legal [65:17] pages on its website simply said the [65:19] word test. And after our first video, LG [65:22] also simply Thanos snapped multiple [65:24] exhibits out of existence while still [65:27] referencing them in the broader legal [65:29] documents, showing a level of sloppiness [65:31] we wouldn't expect from a mega [65:32] corporation's lawyers. LG does however [65:35] force users to accept its terms of use [65:37] and privacy policy before downloading [65:39] any apps. When customers try to use a [65:42] built-in app or some other app like [65:44] YouTube or Hulu, LG informs them that [65:46] they need to create an LG account, which [65:48] requires the users to accept even more [65:50] agreements. If you're watching this [65:52] video in the LG TV YouTube app, you will [65:55] have agreed to LG's terms already, where [65:58] they bury damning clauses deep in the [66:00] agreements. As described in the LG smart [66:02] TV privacy policy, LG collects [66:04] information about the device, such as [66:05] its IP address, MAC address, model [66:07] information in addition to information [66:08] about every device linked to the TV, [66:09] whether it's a console, phone, or DVD [66:11] player. It also may include other [66:12] connected devices such as light bulbs, [66:14] switches, and appliances. And if that's [66:15] not enough, LG also collects location [66:17] data like zip codes, and area codes. LG [66:19] aggregates this data with other [66:20] services. LG says it may quote, "Use and [66:22] combine information collected under this [66:24] agreement with information collected and [66:25] associated with your use of other LG [66:27] services." End quote. Ultimately, [66:29] there's little difference in where your [66:30] data goes when LG combines everything [66:32] anyway. The purpose is to sell customer [66:35] data. LG says as much. LG says it can [66:38] share personal information for quote [66:40] business purposes and quote with payment [66:42] processor companies, customer service [66:43] companies, security vendors, and data [66:45] analytics companies. Even if you live in [66:47] a state like California with some data [66:49] protection laws, LG quote may sell or [66:51] share and quote personal information [66:53] categories related to identifiers like [66:55] your IP address, internet usage, [66:56] commercial activity, and geoloccation [66:58] data among other categories. LG also [67:00] makes users agree to its voice [67:02] information agreement if they want to [67:04] use the heavily advertised voice command [67:06] features. [music] [67:08] IG, put the match back on. [67:14] US customers need to agree that their [67:16] voice information may be quote [67:17] transferred to and processed in other [67:19] countries including Korea, some of which [67:20] may not offer the same level of data [67:22] protection end quote and that LG will [67:24] hold on to the voice data for 6 months [67:26] before deleting or anonymizing it. [67:28] Customers also need to obtain consent [67:30] from other household members or guests [67:33] in the household whose voices may be [67:35] overheard by LG. quote, "I have obtained [67:38] consent from all other members of my [67:40] household whose information may be [67:41] collected through this smart media [67:43] product and am providing consent on [67:45] their behalf." End quote. So then, the [67:46] next time you play games with your [67:48] friends in front of your LG TV and you [67:49] start to use LG's voice controls, make [67:51] sure everyone knows that their voices [67:52] could be shipped off overseas for data [67:54] processing, but it'll probably be [67:55] deleted in 6 months, maybe. And LG Pinky [67:57] swears that it won't sell your voice [67:58] information or biometric data for a [68:00] third party despite already directly [68:01] saying it'll sell all their data. That's [68:02] just one agreement. For US customers, LG [68:04] has a separate privacy policy that [68:06] covers LG's website, LG's appliances, [68:07] the LG Think app, LG Robots, customer [68:10] service calls, marketing activities, and [68:11] of course, the LG account. In this [68:13] agreement, LG's lawyers ensure the [68:14] company covered its ability to collect [68:16] everything about its customers, [68:17] including demographic information like [68:19] gender and birthdays, contact data such [68:21] as addresses and phone numbers, and user [68:23] generated data like profile photos, [68:25] images, videos, and music. And we know [68:26] the extent to which this data can be [68:28] harvested because LG Ad Solutions has [68:29] multiple marketing PDFs where they [68:30] analyze different racial and demographic [68:32] groups under a microscope as if alien [68:34] creatures for inspection, dissecting the [68:35] media interests of groups such as [68:36] Asian-Americans, black Americans, LGBTQ [68:38] plus Americans, and Hispanic Americans, [68:40] at which point they seemly ran out of [68:41] groups to study. LG combines customer [68:43] data that's harvested with data from [68:45] private and public thirdparty sources, [68:46] including from social media platforms, [68:48] utility and energy companies, data [68:50] licensers, and data providers. When LG [68:53] posted its statement replying to our [68:55] video, it told other media that, quote, [68:57] "LGE is committed to protecting customer [68:59] privacy and ensuring transparency in how [69:01] user data is handled." End quote. [69:03] Nothing says privacy like LG harvesting [69:06] your data from your utility company to [69:08] find out how much energy you're using on [69:09] LG appliances or scraping social media [69:12] pages for information. LG also has a [69:14] unique take on words like selling in [69:17] LG's US privacy policy about rights for [69:19] people who live in certain states. LG [69:21] says it does not quote sell personal [69:23] data for money end quote but that it may [69:25] share the personal data with partners [69:28] for quote targeted advertising purposes [69:31] end quote. If you do agree to LG's [69:32] requirements, LG doesn't want to be sued [69:34] later. So LG's US legal notice makes [69:36] sure that you wave your rights to be [69:37] part of a class action lawsuit or [69:39] proceeding and to pursue disputes or [69:41] claims. LG notes this in its fine print [69:43] on the packaging, too. Luckily for users [69:45] without magnifying glasses on hand at [69:47] the time of purchase, LG slaps a sticker [69:49] on the back of some of its TVs. [69:50] Sometimes ensuring that buyer's remorse [69:52] doesn't set in until after the users [69:54] already unboxed the TV and set it up. It [69:56] wasn't on all of them. So feasibly [69:58] someone could argue that the sticker may [69:59] not have been present. But if you [70:00] thought those agreements were bad, we [70:02] have good news. There's tens of [70:03] thousands more words in LG's terms and [70:05] privacy policies to agree or not agree [70:07] to. LG automatically collects [70:09] geoloccation data from mobile devices [70:11] that use the LG Think app. It uses your [70:13] personal information for research and [70:15] development related to AI. It identifies [70:18] what you watch or listen to, shares [70:20] personal identifiers with a plethora of [70:22] data companies for advertising. declares [70:24] that its AI services aren't free of [70:26] quote harmful components end quote and [70:29] ultimately shares customers quote [70:31] deidentified data and quote for [70:33] literally quote any purpose end quote [70:35] with subsidiaries within its corporate [70:38] umbrella and with quote outside entities [70:40] end quote for business purposes because [70:42] LG continually harvests data from its [70:45] customers to sell their data to [70:46] advertisers and third parties or as they [70:49] say for some places share it and then [70:52] make advertising agreements ments. To [70:54] cap it all off, LG will change its [70:56] agreements whenever the it wants [70:57] to. Not only does the company explicitly [70:59] say so, but while working on this video, [71:01] we purchased an LG smart monitor Swin. [71:04] Upon booting and connecting to the [71:05] internet, we received the following [71:07] notification. Quote, "Please note that [71:09] the terms of use will be updated and [71:10] will be effective in 30 days on August [71:13] 26th, 2026. Amendment details, [71:16] arbitration agreement, and AI based [71:18] service terms." End quote. So, straight [71:20] out of the box, we were told that we [71:21] were pre-accepting an update to the [71:23] terms within 30 days, despite not [71:25] necessarily knowing what precisely those [71:27] new terms would be. Even while [71:29] conducting our research, LG actually [71:31] changed its smart TV terms of use. LG [71:34] added legal language that would require [71:35] US customers to resolve issues with LG [71:38] through quote binding and final [71:40] arbitration and quote with limited [71:42] exceptions. LG added legal ease to cover [71:45] more instances as well. Following our [71:46] first video, LG said that quote any [71:48] disagreement or quote controversy end [71:51] quote between LG and its customers would [71:53] be resolved through binding arbitration [71:55] rather than in court. LG's terms of [71:57] service updates happened on July 28th. [71:59] We posted our initial investigation into [72:00] LG TVs and monitors on July 16th. Forced [72:04] arbitration clauses are an evil [72:06] anti-consumer measure that we think [72:08] should be illegal. They're slipped into [72:10] terms all the time, requiring that all [72:12] disputes are resolved privately and [72:14] forfeiting your right to court trial. [72:16] This not only helps eliminate lawsuits [72:18] that become public record and which may [72:20] have precedent, but can be combined with [72:22] preventative clauses that stop class [72:24] actions in their tracks. LG knows it's [72:27] at risk of lawsuits, including expensive [72:29] class actions, and we think it's trying [72:31] to head them off. LG's customers buying [72:33] TVs costing thousands of dollars aren't [72:35] just customers. They're also the [72:37] product. LG can sell or share its [72:40] customers data with basically any third [72:42] party for any reason. LG has clauses to [72:45] weasle out of effectively everything. [72:47] Selling a TV is a one-time sale. Selling [72:49] data and advertisements and training AI [72:51] continues indefinitely. According to LG [72:54] Adolutions, customers who purchase the [72:56] TV don't own the glass. It does. Just [72:58] ask LG Adolutions spokespeople [73:01] >> in the fact that we have the glass. We [73:03] own the glass. We own the TV [73:05] >> because you know we own the glass um and [73:09] we have firstparty ACR data, automated [73:11] content recognition data and we [73:13] understand everything that that hits the [73:15] screen. [73:16] >> The other thing that we focus on when we [73:18] think about intelligent systems is [73:20] really our advantage of being in a CTV [73:23] environment and owning the glass and [73:25] owning working with the consumer to [73:26] create a really cool environment. [73:28] Ignoring that near Freudian slip about [73:30] owning the customer, uh, sorry, working [73:32] with the customer, LG Ad Solutions goes [73:35] so far as to offer marketers the ability [73:37] to quote, "Own the living room," end [73:39] quote, of LG TV users, not just the TV, [73:42] but part of your house. LG monetizes [73:45] users by collecting viewing data and [73:47] then using this information for selling [73:48] advertisements on smart TVs. LG's smart [73:51] TV agreement names Alfonso, Inc. as its [73:54] service partner for collecting and using [73:56] viewing information to serve ads to its [73:58] customers. In Alfonso's privacy policy, [74:01] the company says it provides quote [74:03] viewing data in aggregated or anonymized [74:05] form and quote to clients who can then [74:07] use the data for as long as they want [74:09] to. Alfonso is also known as LG [74:13] Adolutions, which means LG controls it. [74:16] LG Adolutions website says the company [74:18] is quote incorporated as Alfonso Inc. [74:21] end quote. and LG acquired a controlling [74:24] stake in Alfonso in 2021. At the time, [74:27] LG said the investment in Alfonso would [74:29] create quote cross-device advertising [74:31] platform with integrated analytics [74:33] platform for LG TVs and the smart TV [74:35] marketplace as a whole end quote. [74:37] Alfonso subsequently rebranded as LG [74:40] Ads. LG Adolutions also has some shady [74:43] connections within its executive team. [74:45] Two years before becoming LG Ad [74:47] Solutions president of global ad sales, [74:50] the SEC charged Serge Mada and Comscore, [74:53] the company he was previously CEO of, [74:55] quote, with engaging in a fraudulent [74:57] scheme to overstate revenue by [74:59] approximately $50 million and making [75:01] false and misleading statements about [75:03] key performance metrics end quote. MA [75:06] settled the charges in 2019, agreeing to [75:09] pay a $700,000 penalty and to reimburse [75:12] Commore $2.1 million. The SEC barred MA [75:16] from quote serving as an officer or [75:18] director of a public company for 10 [75:20] years end quote. Luckily for MA, the SEC [75:23] didn't say anything about serving as the [75:25] president of a private company. [75:27] Additionally, LG Ad Solutions backslid [75:30] on previous claims about their terms and [75:31] conditions for consumers. In 2022, LG [75:34] Adolutions said, [75:35] >> "Our ACR technology is a double opt-in [75:39] um experience for consumers and and we [75:41] believe that's extremely important. [75:43] >> [snorts] [75:44] >> Um, so that's the most important thing [75:46] to say. [75:46] >> As far as we could tell, we only [75:48] received a single opt-in for ACR, [75:50] suggesting that LG removed safeguards to [75:52] protect users privacy after the [75:54] statement. Likewise, when working with [75:56] Wendell on his comparatively ancient LG [75:58] TV that he says he's never accepted any [76:00] terms on, we watched in horror as the [76:02] slow roll of firmware updates added [76:04] unique identifiers, cookie tracking, and [76:06] tricky dark patterns of language. Uhhuh. [76:10] >> So that's new. [76:11] >> That was not there, right? Right. And [76:14] limit ad tracking is off by default. So [76:17] your ad tracking is not limited. I [76:19] didn't [76:20] >> I have agreed to nothing. [76:21] >> So as we said there, we think LG [76:23] architected its UI using dark patterns [76:25] to make it easy for users to [76:27] accidentally accept its ACR terms and [76:29] conditions. Users need to agree only to [76:32] LG's terms of use and privacy policy to [76:34] install apps on their smart TV. But when [76:37] a user tries to install an app, LG pops [76:39] up six user agreements and automatically [76:42] highlights the select all button, we [76:44] think to deceive users into accepting [76:46] its ACR agreement, even when it's [76:49] actually not required. It's highlighted [76:51] as an accept all by default. This is a [76:55] huge problem. Once you've accepted these [76:57] agreements, even if by accident, you [76:58] have no idea where your data could go, [77:00] and it can be instantaneous. When in [77:03] Wendell's office, the terms may have [77:05] been accepted by somebody, but we're not [77:07] sure who or if it was intentional or if [77:10] that person was even sober. We [77:12] immediately saw a stream of data flowing [77:14] back to LG via Wire Shark. We saw [77:16] similar in our office. If you [77:18] accidentally accept these terms, there's [77:21] really no going back, even if adjusting [77:23] your preferences later. For example, LG [77:25] Ad Solutions partners with Affinity [77:27] Solutions to tie ads to credit card [77:30] purchases. LG Ad Solutions president and [77:32] man who settled a fraud case explains [77:35] >> in the retail world you go you want to [77:37] tie it to an actual credit card or a [77:40] bank transaction an actual purchase. So [77:43] we went ahead and partnered and created [77:45] a product called Loop IQ with Affinity [77:48] Solutions. It's a premier company that [77:49] actually has thousands and thousands of [77:52] these credit card merchants data in a [77:54] privacyfriendly manner that they get the [77:55] access to the information and we've tied [77:58] it to the media side of the house. So, [77:59] we're not going to go ahead and just [78:01] provide just the data. We're always [78:02] going to tie it to a specific campaign [78:04] and say, "Okay, somebody went in and saw [78:07] a Target ad. Either we delivered it to [78:10] them on a managed services or a [78:11] programmatic basis, and then did they [78:13] actually go to Target and pay XYZ at [78:16] Target at that merchant on that specific [78:18] day?" Tying the actual CTV exposure to a [78:23] merchant, to a merchant, and to an [78:25] actual purchase is where we're heading [78:26] with with this partnership. Despite LG [78:29] handing Alfonso millions of dollars to [78:31] acquire a majority stake in 2021, the [78:33] companies aren't on the best of terms. [78:36] LG intended to let Alfonso go public [78:38] when it acquired equity in the ad [78:40] service. But according to the news [78:42] outlet Ad Exchanger, LG changed its mind [78:44] and wanted a bigger piece of the company [78:46] after Alfonso began making more money [78:49] than expected. Ad Exchanger reported [78:51] that LG orchestrated a quote boardroom [78:54] coup end quote in 2022. Alfonso sued LG [78:58] and won. LG and Alfonso Inc. have been [79:01] locked in ongoing legal battles since [79:04] with Alfonso filing more lawsuits [79:06] against LG with billions of dollars at [79:08] stake. Ad Exchanger said that Alfonso [79:11] has filed four lawsuits against [79:12] controlling entity LG in the last few [79:15] years to wrestle back control from its [79:17] corporate overlord. In short, [79:19] advertising on smart TVs is worth [79:21] millions and future billions of dollars, [79:23] and LG wants more control. Earlier this [79:25] year, Korean outlet Chosen Biz reported [79:28] through machine translation that LG is [79:30] pursuing a full takeover and could [79:32] increase its equity in Alfonso to 100%. [79:35] We dug through LG's financial documents [79:37] and we found out why the Korean [79:39] conglomerate wants more control. In the [79:41] first quarter of 2026, Alfonso generated [79:44] 273 bill698 million Juan in sales and 32 [79:49] bill646 [79:51] million Korean Juan in profit. This [79:53] works out to be about $185 million in US [79:56] in sales and $22 million in US in [79:59] profit. Walmart made a similar play a [80:02] few years ago. In 2024, Walmart acquired [80:05] the television manufacturer Vizio and [80:07] specified Vizio's advertising revenue as [80:09] one of the main drivers of Vizio's [80:11] growth. Walmart said the acquisition [80:13] would quote create new opportunities to [80:15] help advertisers connect with customers, [80:18] empowering brands with differentiated [80:20] and compelling opportunities to engage [80:22] at scale and to realize greater impact [80:24] from their advertising spend with [80:26] Walmart. End quote. Walmart, the largest [80:28] retail company in the world, bought TV [80:31] manufacturer Vizio for advertising. [80:33] Vizio's last annual report shows how [80:36] much more the company made from [80:37] advertising and services compared to [80:39] hardware. In 2023, Vizio made about $1.1 [80:43] billion from its device group, which [80:45] includes smart TVs and sound bars, and [80:48] about $598 million from its platform [80:51] plus group, which includes advertising [80:53] revenue. While selling TVs generated [80:55] more money for Vizio in 2023, the two [80:57] business groups had vastly different [80:59] margins. Vizio's device business had a [81:01] gross margin of negative 0.8%. [81:05] they were losing money on it. Whereas [81:07] the Platform Plus group had a gross [81:09] margin of 61%. [81:12] That's where it came back. Microsoft was [81:14] quick to throw LG under the bus when we [81:16] found LG using Windows Update to in our [81:18] opinions distribute malware in the form [81:20] of McAfee advertisements via LG's [81:22] equally malware installer app that we [81:24] didn't consent to being installed, but [81:26] it was. But Microsoft was saving face. [81:28] It's just as involved. In fact, LG [81:30] turned to its longtime partner Microsoft [81:32] to serve up that Windows adear. [81:34] Microsoft and LG have worked together on [81:36] Windows phones, patent agreements, cloud [81:38] services, robots, cars, gaming in cars, [81:39] gaming in the cloud, and according to [81:40] Microsoft, turning LG TVs into Xboxes. [81:43] Their collaboration goes way back. [81:45] Microsoft and LG tried to make the now [81:47] extinct Windows phones a success. In [81:48] 2009, LG made Windows its primary [81:50] operating system for smartphones. [81:52] Microsoft and LG signed a patent [81:53] agreement in 2012 that covered Android [81:55] and Chrome OS devices since Balmer's [81:57] Microsoft wanted to make money from LG's [81:59] phone sales, even if it had Google [82:00] software on them. In 2019, LG and [82:02] Microsoft entered into a memorandum of [82:04] understanding to grow LG's autonomous [82:05] vehicles business using Microsoft's [82:07] cloud services. In 2025, Microsoft [82:09] released a new Xbox app that would be [82:10] available on LG's automotive content [82:12] platform. So now Microsoft can call cars [82:14] an Xbox or something. Even today, LG [82:16] pushes Microsoft's C-Pilot Plus PCs that [82:18] work together on the robot Q9 using [82:20] Microsoft Voice AI technologies to make [82:22] AI cute. And of course, data centers. [82:24] Microsoft purchases cooling solutions [82:26] from LG for data centers for AI. LG and [82:29] Microsoft reportedly signed a deal worth [82:30] billions of dollars to do this. These [82:32] companies know each other, but the [82:35] biggest collaboration of all is with [82:37] Nuance. Found in LG's agreements, this [82:40] is a data management company that [82:42] Microsoft owns. Microsoft is every bit [82:45] as guilty as LG, we think, even though [82:48] it was convenient for them to throw LG [82:50] under the bus on Twitter. Microsoft even [82:52] appears in LG's smart TV legal [82:55] agreements that we went through. That's [82:56] because LG names Nuance Communications [82:58] as the service partner that collects and [83:00] analyzes voice data when someone uses [83:02] voice commands with an LG TV. Microsoft [83:05] purchased Nuance for 19.7 billion in [83:09] 2021 and completed the acquisition in [83:11] 2022. After numerous user reports about [83:13] LG monitors installing bloatware on [83:15] computers and after our first video, LG [83:18] and Microsoft responded to the PR [83:20] storm that came about due to displaying [83:22] unwanted ads. LG responded to questions [83:25] through comments to media outlets like [83:27] Techraar, saying, quote, "LG Electronics [83:30] reiterates that McAfee is not installed [83:32] automatically and is never installed [83:34] without the user's explicit consent. The [83:36] LG monitor app installer is distributed [83:39] through Microsoft's official Windows [83:41] distribution process, which included [83:43] McAfee as an option. McAfee will be [83:46] installed only if a user actively [83:48] chooses to proceed with the installation [83:50] and provides consent. Under no [83:52] circumstances is McAfee installed [83:54] automatically or without user [83:55] authorization. The LG Monitor app [83:58] installer does not access, collect, or [84:00] transmit any customer personal data. End [84:03] quote. But we never claimed that our LG [84:05] Monitor automatically installed McAfee. [84:07] We said it automatically installed LG [84:09] Monitor app installer without consent, [84:11] which it did, and that promoted McAfee [84:13] adware without user consent, which it [84:15] also did. We think they're lying. Also, [84:18] and this is a separate issue entirely, [84:20] our security researchers we worked with [84:22] found security vulnerabilities in [84:24] basically every single application [84:26] connected to the LG monitor app [84:27] installer, but that's a story for [84:30] another time. Additionally, while LG [84:32] claims its monitor app doesn't access, [84:34] collect, or transmit any customer [84:36] personal data, it can quote use all [84:39] system resources and access your [84:42] internet connection end quote according [84:44] to its page in the Microsoft Store at [84:45] the time of writing. And so it's not a [84:47] far leap. In a statement to Techraar, LG [84:50] also stated, quote, LG Electronics [84:52] reaffirms that LG TVs do not collect, [84:54] record, or store ambient conversations. [84:57] Voice recognition is an optional user [84:59] initiated feature that processes voice [85:01] data only when activated by the user to [85:04] fulfill a specific request. Customers [85:06] can use smart TV features without [85:08] enabling voice recognition. End quote. [85:10] Well, that's a lot of specific [85:11] statements we can shut down right away. [85:13] Immediately after we enabled our LG TV's [85:15] voice feature, it recorded Andrew and [85:17] Vitali's background conversation despite [85:19] neither realizing the TV was listening. [85:21] The TV was also not quote fulfilling a [85:24] specific request and quote immediately [85:27] debunking LG's statement. In this clip, [85:29] Tannon is on the other side of a large [85:31] room from Vital Andrew. Tannon is [85:33] setting up the TV and using voice input [85:36] to command it. Vital and Andrew are on [85:38] the back side of the TV behind it [85:40] talking about work without knowledge of [85:42] what Tannon is testing or that the TV is [85:44] listening. Just give them a little more [85:46] margin from the wall. [85:47] >> Hi, LG. [85:49] Keep changing channels. [85:52] >> Was there one layer? Two layers. [85:56] See? [85:57] >> Uh twoish layers. [86:11] Can you see it's kind of stuck? [86:17] See, I think I just got a shade off. I [86:20] mean, [86:20] >> notice that after Andrew says two [86:22] layers, the whole room is silent for a [86:25] really long period. Long enough that we [86:27] considered cutting it down, but it makes [86:28] the point. The TV continued listening [86:31] all the way through. So he broke the [86:32] silence and spoke again. In fact, Tannon [86:35] didn't even interrupt them to say that [86:36] the TV was hearing all of this and it [86:39] continued recording for a couple [86:41] minutes. This data is the same type of [86:43] data that we recovered transcribed in [86:45] the plain text file with Wendell. LG's [86:47] response concluded with this quote, LG [86:49] is committed to protecting customer [86:51] privacy and ensuring transparency and [86:54] how user data is handled. End quote. If [86:56] LG really cared about ensuring [86:58] transparency in how user data is [87:00] handled, it wouldn't hide the do not [87:03] sell my personal information option in [87:05] its menu settings. This was disabled by [87:07] default even before we connected to the [87:09] internet or agreed to any terms or [87:11] conditions. Meaning it acts like a [87:14] claymore for your privacy as soon as you [87:16] trip it. And when a claymore says this [87:18] side towards enemy, that enemy is you. [87:21] This isn't new either. Lewis Rossman [87:23] pointed it out in his LG smart TV video [87:26] nearly 3 years ago. [87:27] >> If you go in any one of the default [87:29] profiles and you go to privacy and [87:30] terms, what you'll notice with a smart [87:32] television is there's an option called [87:34] do not sell my personal information. And [87:36] because we live in a dystopian world, [87:38] this option is not by default checked, [87:40] which by the way on a $3,000 LG OLED [87:43] should be opt in, not opt out for [87:46] tracking FULG for doing that. [87:48] >> Microsoft also took some, albeit [87:49] limited, action. Epic Games CEO and AI [87:52] lunatic Tim Sweeney alerted Microsoft VP [87:55] Pav Davaluri about LG monitors covertly [87:58] installing its app and showing ads for [88:00] McAfee. According to the Microsoft VP, [88:02] LG disabled the McAfee pop-up ad from [88:04] its app. Microsoft's lip service about [88:06] the problem said nothing about LG [88:08] installing its app without alerting [88:09] users in the first place. Nor did [88:11] Microsoft mention how its own subsidiary [88:14] partners with LG in its data management [88:17] and collection. With all of that [88:18] explained, let's get back to some of the [88:20] people we spoke to for this piece. We'll [88:22] start with Lewis Rossman, specifically [88:24] talking about forced arbitration, the [88:27] clause that was added after our first [88:30] video on LG's monitors, and he can [88:32] explain why that's a bad thing. I was [88:34] working on the LG monitor, their t TVs [88:37] for this story, the smart TVs, and I saw [88:40] something that immediately reminded me [88:42] of you, which is they have a sticker on [88:43] the back of one of the TVs we bought [88:46] that says forced arbitration notice. And [88:49] from what I remember, you you really [88:51] like forced arbitration clauses. [88:53] >> Yeah. I love giving up my seventh [88:54] amendment rights to a company in an [88:56] agreement that I never actually read. [88:57] And one of the reasons it's important to [88:58] say that you haven't actually read it is [89:00] because with their refrigerators, they [89:01] were telling people when the I forget if [89:03] it was the condenser or there was some [89:04] part of their refrigerators that was [89:05] failing and mass and LG was not [89:07] replacing it under warranty. So people [89:09] wanted to sue them and they said, "You [89:10] can't sue us because you agreed to [89:11] forced arbitration." They go, "What? [89:13] It's in the manual and it's on the box." [89:15] Now, when you buy a refrigerator, if the [89:16] box for the refrigerator is larger than [89:18] your door frame, what that means is that [89:20] you're never going to actually see the [89:22] notice because the delivery people and [89:24] mass were getting rid of the box and [89:26] throwing it away because most people [89:28] don't want to save the box of their [89:29] refrigerator, especially in a small [89:30] apartment. So, they never actually got [89:31] to see a copy of the notice that they [89:33] supposedly signed for. But what they [89:34] were referring to is that when you [89:35] received the refrigerator, you signed [89:37] saying you received it, but that [89:38] apparently also meant that you agreed to [89:40] the terms of forced arbitration in their [89:42] manual, which you hadn't read yet or and [89:44] on the box that you've never seen. [89:46] >> And that's and that's somehow legally [89:48] okay. [89:48] >> And some of these TVs, we noticed that [89:49] they don't have it on all of the the [89:51] sticker doesn't always make it on. So [89:52] >> that's where I would address it cuz how [89:54] many words is too many words? Is it [89:56] 4,000, 2,000, 1,000? How many words do [89:58] you need to have where it is okay to [89:59] take away somebody's constitutional [90:00] right? [90:01] >> Can you explain briefly? So forced [90:03] arbitration in general, like what what [90:05] is that? Why do the companies want [90:06] people to agree to a clause for forced [90:08] arbitration? [90:08] >> If I screw over my customers, if I do [90:10] something horrible, they can either [90:12] commit acts of violence against me or [90:13] they can sue me. And that luckily most [90:16] people in New York chose the first one. [90:17] It's much cheaper than lawyers. No, I'm [90:18] kidding. [laughter] But the if if I do [90:20] something wrong to my customers, they [90:22] have the ability to take me to court. [90:23] And I think that that is a good thing [90:25] because it means that it gives me an [90:26] incentive structure to treat my [90:28] customers properly. Forced arbitration [90:30] means that they sign away the right to [90:31] that. Instead of taking me to court, [90:33] they can take me to arbitration. [90:35] Arbitration is a court that I pay for. [90:38] So, I'm paying a mediator that's going [90:41] to figure out between the two of us, [90:43] what are how are we going to resolve [90:44] this problem? And the mediator being [90:46] paid by me personally is most likely [90:49] going to have an incentive structure to [90:50] resolve issues in a matter that I find [90:52] amicable. And they're also going to have [90:54] an incentive structure to screw me over [90:56] in court. Like there's a judge banging a [90:58] gavvel, right? [90:59] >> Yeah. Yeah. Yeah. [90:59] >> And there's [91:01] >> You mean it doesn't go through the legal [91:02] process? [91:02] >> Yeah. It's not going through the legal [91:03] process. There's no [91:04] >> It's an outside of court process. [91:06] >> And I can understand why people are [91:07] cynical. I get it. Class action lawsuits [91:09] cost money. How many people here have a [91:11] 50-cent check on their refrigerator [91:13] because Visa and Mastercard them [91:14] and a lawyer got $20 million to handle [91:16] the case, right? Like how I have I have [91:18] checks on my refrigerator for less than [91:20] 50. And they're annoying. And we roll [91:22] our eyes at the lawyers getting rich. [91:24] And that does suck that lawyers are [91:25] getting rich while consumers are not [91:27] getting help in those cases. And it's a [91:29] shitty system, but it's better than [91:30] nothing. So, for instance, when Apple [91:31] has a class action lawsuit against them, [91:33] even though it sucks that that the [91:35] lawyers got rich and that all you got [91:37] was some sort of $50 or $20 refund, [91:39] often times they'll say you must have a [91:42] repair program as a part of the [91:43] settlement. There'll be a repair program [91:45] for the butterfly keyboard. So, that's a [91:47] good thing cuz it's not just the the [91:49] check that you get on your fridge. Class [91:51] action lawsuits can often lead to [91:52] companies changing their behavior. [91:53] >> It's still a punishment for the company. [91:55] >> And not even a punishment, but it helps [91:56] the consumer. I'm not. So, a lot of [91:58] people will look at the 50 cent check [91:59] you get in your fridge, but they won't [92:01] look at Apple in 2015 deciding, you know [92:03] what? We are going to replace the [92:04] motherboard for free for anybody that [92:06] has an A1286, A20, 2915 board, but the [92:08] GPU died. We are going to replace all [92:10] the butterfly keyboards on the A706, [92:12] A707, and A708 models where it broke. We [92:14] are going to actually cover our [92:16] customers the way that we should have [92:17] been doing it before somebody [92:18] sued us. And that's better than nothing. [92:20] And I'd rather take that than just [92:21] removing my 7th amendment rights alto [92:22] together and saying that I'm not allowed [92:24] to sue. After after our video on the [92:26] monitors, the LG monitors, we noticed [92:28] that they updated the agreements, and [92:31] they added a whole big section talking [92:34] about class action lawsuits. And so, [92:36] they already had a thing buried in there [92:39] about you're agreeing that you can't go [92:42] through a class action process if there [92:44] is a dispute. So they already had that [92:46] there, but they added like paragraphs of [92:48] clarifying text that just continue to to [92:51] make that same point, which is like at [92:54] some point you're admitting guilt. [92:55] [laughter] I feel like you're changing [92:57] the terms when there's a major class [92:58] action concern. Roku did this as well. [93:01] There was a data breach and they wound [93:03] up sending it. Did you see the notice [93:05] where when you turned on the TV, it said [93:06] agree, but there was no disagree option. [93:08] So in order to use the TV to change the [93:10] input, you need I'm pretty sure [93:12] it was Roku. I have an article. It was [93:13] Yeah. Yeah, it was broken. In order to [93:15] change the channel or change the inputs, [93:17] you had to hit agree. There was no [93:19] disagree button. And this happened at [93:20] the exact same time that there was a [93:22] large data breach which might cause [93:24] people to push back against it. I think [93:26] it was Maine where they filed the [93:27] official notice of data breach. I have [93:29] the paperwork for this. [93:30] >> There's like 15,000 people that had [93:31] their data potentially breached. [93:32] >> Is there anything people should do? Uh, [93:35] you know, cuz a lot of these devices now [93:36] are going to have forced arbitration. [93:38] >> Be annoying. Take it to court anyway. Go [93:40] to small claims. Like there was this one [93:42] person Steven Ryan at the Vancouver stop [93:44] at the tour and he was saying companies [93:46] am annoying. He takes companies to court [93:47] for the stupidest And when I say [93:49] stupid, I don't mean stupid like it's [93:51] stupid he did it. I mean it's stupid [93:52] that the company is actually letting [93:53] this go to court instead of just [93:55] resolving the issue with the customer [93:57] instead of just helping them out. And I [93:59] like it. Like he said they found me [94:00] annoying. I said be annoying. We need [94:02] more people to be annoying. That's [94:03] great. [94:03] >> Progress moves forward because of [94:04] unreasonable people. Right. [laughter] [94:06] Right. If [94:07] >> if if 1% of your audience was was as [94:09] annoying as they needed to be, these [94:11] problems would all be fixed tomorrow. [94:12] >> Right. [94:13] >> Next, we'll speak with a surgeon we ran [94:14] into at Louiswis's event. Aaron was an [94:16] attendee there. He came up to speak to [94:17] me after I spoke with Lewis about owning [94:20] your And here's what he had to say [94:22] with concerns from the medical field. [94:24] >> You were Aaron, right? [94:25] >> Yep. A a r a yep. [94:28] >> Yeah. Okay. [laughter] [94:29] And we were just talking, we were at [94:31] Lewis's event in South Carolina. We were [94:33] talking about LGTVs, which conveniently [94:35] enough, there's one right behind us. [94:38] >> So, so they'll hear this conversation [94:39] before anyone watching does. Um, [94:42] >> they're already listening. [94:43] >> What was, you know, what was [94:44] interesting, you mentioned to me, you're [94:47] in the medical field, I guess. [94:48] >> Yes, that's correct. Yeah, I'm a [94:50] healthcare worker. Uh, specifically, I [94:52] work in robotic surgery. So, I'm a [94:54] robotic general surgeon. Uh, just [94:56] finishing up my training. Uh I'm very [94:58] interested in tech. So like the merger [95:00] of tech and healthcare, you get robotic [95:02] surgery. Um my you know being techsavvy [95:07] and following you and of course Lewis, [95:10] my concern is is primarily in privacy. [95:14] Um [95:15] so what what happens when I'm taking a [95:18] patient phone call or I'm doing patient [95:20] uh video visits and there's an LG [95:23] monitor in the background? What happens [95:25] if it's doing it on a on an LG monitor [95:27] itself? Uh what's listening in? How is [95:30] that how is that patient information [95:33] protected? Because I'm expected to have [95:35] everything encrypted. Anything on my [95:38] device that has patient to do with [95:39] patients has to be through a VPN and [95:42] encrypted completely. [95:44] >> But if that is recorded and taken out of [95:46] my control, [95:48] >> who's to say that that's HIPPA [95:49] compliance or or anything? I mean there [95:52] there's a lot to do with you know how we [95:54] use AI tools and how specific ones need [95:56] to be HIPACO compliant if we're going to [95:58] use them as healthcare providers and [96:00] that's very clear but if LG is listening [96:03] to us on a TV where does that patient [96:06] information go obviously can't speak for [96:07] like all medical providers but um [96:10] broadly speaking with something like a [96:12] TV typically is that just like someone [96:14] just buys it for the office you know [96:16] like cuz cuz that doesn't strike me as [96:18] something like if you're going to use an [96:20] an AI transcription tool that strikes me [96:22] as something where administrative staff [96:25] or it or whoever would kind of go, [96:26] "Okay, we probably need to check for [96:27] HIPPA compliance." [96:28] >> Right. [96:29] >> Right. But something like a TV seems [96:31] like it's maybe send the assistant to [96:33] Best Buy or whatever. [96:34] >> Or if I take a patient phone call from [96:36] home, you know, I I I take those from [96:39] from my own house. And so I have a few [96:41] LG products before I watch your video. [96:45] And so where is that data going? I I I'm [96:48] not in control of that. I'm expected to [96:50] be, you know, advocating for my patients [96:52] and making sure that their privacy is [96:55] secure, but I don't even know who's [96:57] listening in my own household. And that [96:58] makes it very hard when I'm doing [97:00] patient care within privacy of my own [97:02] home. [97:02] >> I think that's one of the concerns we [97:04] have too is like LG's response is, you [97:06] know, is probably we're not listening [97:08] through the microphone and maybe the [97:10] capability exists, but they would say [97:12] we're not doing it. But one of the other [97:14] concerns we had doing this piece was um [97:18] if there's audio playing through the [97:20] speakers of the TV, there's also the [97:22] capability of capturing that or parts of [97:24] that. [97:25] >> And so you I I guess you know [97:29] >> probably tellaalth type of situations. [97:31] So I mean those are those are required [97:33] to be encrypted and if I log into [97:36] anything like Epic is our main Epic [97:38] Healthcare is our main um our main [97:42] electronic medical record EMR um when I [97:45] connect through that on my phone or on [97:47] my laptop it goes through a VPN that's [97:50] mandated by my employer [97:52] >> and so if it's being recorded outside of [97:54] that you know where that's not that's [97:56] not HIPPA compliant and so I don't have [97:58] any control over that cuz there's no [98:00] notice to me saying, "Hey, you're [98:02] actually being listened in on right [98:04] now." And so, how can I possibly be in [98:06] control of the entire environment when [98:09] everything else is being listened in on? [98:11] >> Have you tried putting tinfoil and lead [98:13] up [98:14] >> around like a Faraday cage around my [98:17] clinic? Yeah. Yeah. [98:18] >> Right. That would do it. [98:19] >> Yeah. [98:20] >> That'll be my next business. I'm going [98:22] to start selling fair cages for clinics. [98:24] >> That's great. [98:25] >> Yeah. I'll be your first customer. [98:26] >> Awesome. Thank you for the uh for [98:28] joining for the story. [98:29] >> Yeah. Thank you. I appreciate it. Next, [98:30] we'll check in with Kevin from the Fulu [98:32] Foundation. Kevin is the executive [98:33] director for the Fulu Foundation. He [98:35] works alongside Lewis at it. Kevin is [98:37] specifically pushing against DMCA [98:39] section 1201, which is a part of law [98:41] that makes it a criminal act in some [98:43] circumstances to circumvent digital [98:45] locks. He was also one of the organizers [98:47] for the Own Your tour that we went [98:49] on with Lewis. Here's his take on the [98:50] situation. My understanding is with the [98:53] digital millime copyright act, so DMCA [98:55] section 121 specifically, there's some [98:58] level of criminality, I guess, to [99:01] circumventing uh digital locks. [99:03] >> Yeah, that's exactly right. Right. So, [99:06] because of section 1201 of the DMCA, [99:08] simply circumventing a digital lock can [99:10] become a copyright crime. [99:12] >> Okay. [99:12] >> And so, when you're looking at these [99:14] cases, right, you've got your TV that's [99:16] spying on you, that's watching you, [99:17] that's listening to you, right? you [99:19] might want to go in and remove that [99:20] software. Sure, there are ways that you [99:22] can go through the menu and you can kind [99:24] of, you know, parse through the legal [99:26] ease and try and find a way, but there's [99:28] no way to know for sure, right, [99:30] >> that that data flow is stopping unless [99:32] you go in and take it out yourself. So, [99:34] because section 121 does have that [99:36] prohibition on the circumvention of [99:38] digital locks, um, you're screwed. [99:41] >> I guess if you could walk me through the [99:42] the basics of the DMCA and of section [99:45] 1201 a little more, that would probably [99:47] help. [99:48] >> Yeah. So to do a little bit of the [99:49] history, right, the DMCA was passed back [99:51] in 1998 and the goal of it was to stop [99:55] piracy of media off of CDs and DVDs, [99:58] right? I would argue it was the wrong [100:00] solution at that time, but it's hard for [100:02] anyone to disagree with the fact that [100:03] it's the wrong solution for this time [100:05] because [100:06] >> Congress or the architects of this law [100:08] did not think that we would have [100:10] computers in our park pockets, that we [100:12] would have [100:12] >> computers in our cars, in our tractors. [100:14] Everything we use, right, pretty much [100:16] these days is a computer. And what that [100:18] means is that um those digital locks [100:20] kind of invade on our access to control. [100:22] So one analogy I like to use is right if [100:25] like if you bought a house, [100:26] >> you would expect to be able to get [100:27] through every door and get into every [100:29] room. One of those doors you [100:31] accidentally lock yourself out. Picking [100:33] that lock isn't breaking and entering, [100:35] >> right? [100:36] >> You own the house, you own the door, you [100:38] own what's behind it, right? [100:40] >> Because of section 121, that's a [100:41] completely different story for our [100:43] digital devices. If a manufacturer puts [100:45] a digital lock in front of a copyrighted [100:48] work such as yes, a movie or a song, but [100:50] also just source code or something like [100:52] that, um the mere act of cir [100:54] circumventing that becomes a copyright [100:55] crime. [100:56] >> And just as importantly, right, like I'm [100:58] sure that a lot of your viewers will be [101:00] able to go and do this yourself. [101:02] >> Um I'm a normie, so I can't do that. If [101:05] I wanted to hire someone to do it for me [101:07] or if someone were to try to make a tool [101:09] that would be easy for consumers to use [101:10] to go in and strip the ACR software off [101:12] of their TVs, um that would be again a [101:16] violation of section 1201. And that one [101:18] comes with serious penalties of up to [101:21] $500,000 in fines and five years in [101:24] federal prison per [101:25] >> seems proportional for [101:27] >> Yes, exactly. Helping people not get [101:29] spied on, right? helping people fix [101:31] their stuff um is just an outrageous [101:35] thing to be a copyright crime. [101:37] >> Lewis had in his presentation he showed [101:40] I think it was the author of I don't [101:42] know if it was the whole DMCA or Okay. [101:45] >> Yeah. He was one of the architects. So [101:46] Bruce Layman who uh worked in the [101:48] Clinton administration um you know he [101:50] did some interviews after the fact after [101:52] this law passed in 1998 and talked in [101:55] 2007 and I think beyond that was first [101:57] of all said look [101:58] >> this law didn't work that well right [102:00] like Napster happened after the passing [102:02] of uh the DMCA so it didn't work the way [102:06] they wanted it to. Um and one of the [102:09] other things that was pretty shocking [102:10] was he talked about how you know he [102:12] basically executed an end run around [102:14] Congress. So, right, [102:15] >> when they first developed this idea, [102:17] this policy framework, they took it to [102:19] Congress and Congress said, "No, right, [102:22] this is going to get in the way of fair [102:23] use, right? This is going to infringe on [102:26] people's rights, on their ownership [102:28] rights, on all their kind of things, [102:30] those kind of things." Um, so instead, [102:33] he went and negotiated an international [102:35] treaty through what was called WIPO, [102:37] which is the World Intellectual Property [102:39] Organization, trying to solve this [102:42] problem. came back, went to Congress and [102:44] said, "Hey, we've got this treaty. If we [102:47] don't pass this law, we are going to be [102:50] not in compliance with this treaty." And [102:52] also, we're leaders in the world and we [102:54] need to do something about this, right? [102:56] So, it was just a total kind of pretty [102:59] questionable move if you ask me. Um, and [103:01] that's the reason that we, you know, [103:03] kind of sit here today. [103:04] >> Is there actually something people can [103:06] do? Obviously, we just, you know, we did [103:08] part of this tour I mentioned, [103:09] >> right? uh to try to get people to write [103:12] representatives and um I I think there [103:15] is probably a healthy and and earned [103:19] skepticism towards it but uh you know [103:22] actually trying to write to [103:24] representatives is probably one of the [103:26] only you know really good tools [103:30] available. It's really important, right? [103:32] Because I think there's a mixture of [103:34] things happening, right? People in [103:35] Congress, right? I I go to DC a lot as a [103:37] part of my job. And [103:39] >> many members of Congress don't [103:41] understand te technology. [103:42] >> Mh. [103:43] >> And at the same time, many don't [103:45] understand copyright law, right? Like, [103:47] okay, cool. [103:47] >> Which fair enough, right? Like if unless [103:50] you are into copyright law, you might [103:52] not understand it. Not every member of [103:54] Congress is going to be an expert on [103:56] every aspect of the law. But that makes [103:58] education that much more important and [104:00] it makes it that much more important [104:02] that they're hearing from their [104:03] constituents who care about these kind [104:05] of things. Right. So, as you mentioned, [104:06] right, we've got this tour. We're going [104:08] to 14 cities and states around the [104:10] country. We just had one of our biggest [104:12] in Raleigh last night, which was [104:13] awesome. Um, great crowd. And also, you [104:17] know, had a a member of the local [104:19] representatives office out to see all [104:22] >> she was listening. And she was [104:23] listening. Yeah. and she she did to her [104:25] credit uh she did seem to be engaged and [104:29] possibly on board with the idea of [104:31] owning your stuff. [104:32] >> Yeah. [104:32] >> So, you know, I guess point of bringing [104:34] that up is [104:35] >> in the very least if not the [104:36] representatives it themselves then the [104:38] the staff might actually listen and you [104:41] just kind of hope that they filter the [104:43] message up. [104:44] >> Exactly. So, um, so for Fulu, we'll [104:47] point people there as well, uh, for [104:49] future tours and things like that, but [104:51] where should they go? And [104:53] >> yeah, go to fulu.org, right, to stay up [104:56] to date on our work. We've got our blog. [104:58] We post kind of, um, you know, regular [105:00] updates. Uh, we're also on, you know, [105:03] all all the social channels. Uh, one of [105:05] my favorite features is, right, the [105:07] consumer rights wiki is a big part of [105:09] what we do. Um, and so every week we do [105:12] the wiki hall of shame and highlight uh, [105:15] you know, manufacturers and products [105:17] that are particularly bad actors. So [105:19] >> there's so many options. [105:20] >> There are so many options. We could keep [105:22] going forever on this [105:23] >> infinite content. [105:24] >> Yeah. Um, but yeah, check us out there. [105:27] Um, and then get involved, right? We, [105:29] like you said, it's one thing when we as [105:31] an organization go there and that's our [105:33] job and that's, you know, we work really [105:35] hard at that. But when members are [105:37] hearing from their own constituents, it [105:39] goes that much further. [105:40] >> And finally, we'll check in with Wendell [105:41] for an extended discussion about our [105:43] findings. This was sort of our debrief [105:45] after working on the TVs for days. So, [105:48] some of the demos we had, can you help [105:52] explain what are some of the ways that [105:55] the findings, the vulnerabilities, [105:57] whatever could the features of the TV [105:59] could be used. Uh, for example, when the [106:02] TV appears to be off, but it's capable [106:05] of uh storing video and audio. [106:09] >> Yeah. Internally, the TV has 16 GB of [106:12] flash, which doesn't sound like a lot, [106:14] but it's got kind of a lot of [106:15] computational horsepower, especially the [106:17] newer TVs. And so, you can record audio, [106:19] you can compress it, you could stream it [106:20] to somebody over the network. It's a [106:22] full computer, so it's basically as [106:25] creative as your imagination is, you can [106:28] run stuff on it. Uh there's stuff on the [106:31] TV for like package management and [106:33] commercial customers of LG use a lot of [106:35] these features for like digital signage [106:37] and everything else like that, but you [106:38] know the consumer version of the TV, [106:40] they rip out some of those features and [106:42] some of the features that you know as [106:43] like homebrew enthusiasts and like home [106:45] lab enthusiasts, I'd like to have those [106:47] and LG takes that out. But you know [106:50] there's microphones, multiple [106:52] microphones there. Uh there is the [106:54] ability to read what is being displayed [106:56] on the TV programmatically. So you could [106:58] look, you could, you know, capture a [107:00] frame or capture short clips limited by [107:02] storage or streaming capability of [107:04] what's on the display. I mean, [107:05] theoretically, it's a whole computer. So [107:07] basically anything you can do with a [107:09] computer, but it's in the TV. [107:10] >> Even the places where we ran into [107:12] limitations, such as the few instances [107:13] where we had sixsecond recordings, I [107:16] feel like given more time than we had [107:18] here, it's it's possible a sophisticated [107:20] >> Yeah. [107:21] >> programmer could. [107:22] >> The TV is literally built for something [107:23] called automatic content recognition. [107:26] And it seems like the implementation [107:28] that LG uses for automatic content [107:29] recognition is designed to do six second [107:33] captures of what you're looking at. And [107:34] that's audio and video fingerprinting. [107:36] So when ACR is working as advertised as [107:39] the specification says, it's capturing [107:42] about 6 seconds of audio or video and [107:44] using that as a fingerprint and then [107:45] it's got a dormant period where it's not [107:47] capturing. And this is, I think, the in [107:49] the ad industry's hedge against [107:51] accidentally leaking, you know, hours of [107:54] conversations like, oh, we only capture [107:56] six seconds of it's enough to [107:57] fingerprint it, but that's still a lot. [107:59] You can do a lot with that. [108:00] >> You can do a lot with that. [108:01] >> Oh, it may also be a circumvention for [108:04] copyright law or something if the movie [108:06] studios are unhappy. What about so [108:08] fingerprinting? Walk me through that [108:09] because I think one of the security [108:12] researchers we worked with thought that [108:14] from his findings he couldn't see [108:16] evidence that uh ACR was necessarily [108:19] transmitting screenshots like JPEGs or [108:22] PGs. [108:23] >> You don't need to. You can take a a you [108:25] know if you're watching a 4K, you know, [108:27] Lord of the Rings, you don't need a full [108:29] frame. You can have a tiny tiny tiny [108:30] little frame and generate a hash of it [108:33] effectively. Effectively, it's a hash. [108:35] And then that hash is a very small [108:37] amount of text [108:38] >> and so that text can be sent back and [108:40] say hey this is the hash of the thing [108:42] that I see [108:42] >> and then what they they compare that [108:44] against the database and say this is a [108:46] frame from Lord of the Rings. [108:47] >> Yes. And we can see content of the TV [108:51] connecting to known Alonso that's one of [108:54] the name of the libraries and known [108:56] domains that have to do with automatic [108:58] content recognition. Um, and we can see [109:00] it downloading a thing that looks like a [109:02] database, like a fingerprint database, [109:04] which is, I think, some clues to the TV, [109:06] some hints to the TV about how it takes [109:08] that audio data and that video data to [109:10] generate the hash to then share with LG. [109:13] >> Why might they choose to do it this way [109:15] rather than send a screenshot or an [109:18] audio file? [109:19] >> Well, they did in the past. And you know [109:22] if you look at LG's history of security [109:24] issues uh you know 10 years ago almost [109:27] they were sending the raw file names and [109:29] then that turned into a PR incident. [109:31] Yeah. [109:31] >> And there is almost an adversarial [109:33] relationship with the TV here. If you [109:35] look at [109:36] >> how the software behaves like as I was [109:38] using it it changed behavior a couple of [109:40] times and I don't know if that was [109:41] because these TVs hadn't been on the [109:43] network and they were just downloading [109:44] application updates which is different [109:46] than a firmware update. Like I didn't [109:47] agree to a firmware update. Like I did [109:48] that very deliberately. [109:50] >> But even saying no, I don't agree to the [109:52] terms. No, I don't want to do this app. [109:53] It was doing stuff in the background [109:54] like downloading stuff for apps. Amazon [109:56] was doing stuff. The YouTube app was [109:57] doing stuff. It's like I don't even We [109:59] didn't even dig into what those [110:00] applications were doing. [110:01] >> Yes. You're not sure if it's because it [110:02] was downloading stuff or because it was [110:04] detecting your access basically. [110:06] >> Yeah. Cuz sometimes the TV would go to [110:09] sleep and then it would lose I would [110:10] lose network access. And then other [110:11] times the TV would be doing something in [110:13] the background. And so everything the TV [110:15] appeared to be off, but I had full [110:17] access to USB and I had full access to [110:20] run my programs. I had full access to [110:21] audit whatever was going on on the on [110:22] the TV. [110:23] >> And so I just I would like to know like [110:26] what what is LG doing? Can I audit this? [110:29] Do I have the tools to audit this? And [110:30] the answer was mostly no. It was an [110:32] uphill battle for me to like dig my way [110:35] out and figure out what it was doing. [110:36] Let's say worst case scenario, you turn [110:38] it into a listening device. That seems [110:40] pretty straightforward. You turn it into [110:41] a device to exfiltrate information from [110:43] a corporate network or a boardroom. [110:45] >> That seems pretty straightforward. Um, [110:47] you use it to maintain access like as a [110:51] point of presence on a network. Um, even [110:54] if you don't intend to capture audio and [110:56] video, [110:56] >> just to go through it, toggle through [110:58] it. [110:58] >> It is perfectly functional as a proxy. [111:00] So, you can proxy internet traffic and I [111:02] can just it's like, oh, I'm going to use [111:03] this to move laterally through [111:06] somebody's network. We've seen that in [111:07] the in security circles. We've seen that [111:10] with like copy machines. Uh certainly [111:13] the TV is is more sophisticated than the [111:15] copy machine that I am acquainted with [111:18] that was a command and control server [111:19] for very bad malware. So yeah, the kinds [111:22] of things we see in the news where it's [111:23] like oh fancy bear is attacking routers. [111:26] Uh fancy bear would be very comfortable [111:27] inside LGTV. [111:29] >> What about the scenario where the TV [111:32] speaker output uh could be captured? So [111:36] this was as we called it the boardroom [111:37] scenario. [111:39] >> Yeah. So, if you're using your TV as a [111:41] display, the HDMI audio that goes [111:44] through the display is also capturable [111:46] from the interfaces that we have on the [111:48] Linux side. [111:48] >> And this is something you proved that we [111:50] were able to do it. [111:50] >> Yeah, exactly. It's a feature, not a [111:52] bug, [111:53] >> right? [laughter] And and this just to [111:55] be clear again like there because [111:57] there's a few links here, but you can do [111:59] this without [112:01] your laptop and you being physically [112:05] connected to the TV directly. Yes. [112:07] >> Right. You can do this through the [112:08] network. [112:09] >> Yeah. And we can do it with the TV off [112:11] of the network and just have it capture [112:13] and then as soon as it gets network [112:15] access again, it was basically used as a [112:17] recording device, [112:18] >> right? You go back in after it's [112:19] reconnected. So, let's say you're super [112:22] paranoid, I guess, and there's a [112:24] scenario where you you not you just you [112:26] unplug the Ethernet from your TV during [112:29] this boardroom meeting or something. I [112:31] guess as long as it's still powered on [112:33] and capable of capturing, [112:35] >> you've got at least 4 gigabytes of space [112:36] to work with, right? So, if you had an [112:38] adversary that knew that there was going [112:39] to be a big important shareholder [112:41] meeting, um they could have the TV [112:43] completely offline off of the internet [112:46] and it's perfectly capable of recording [112:48] and storing the audio for that meeting. [112:50] And then somebody could come in later [112:52] >> as long as they've prepared for it in [112:53] advance. They know it's going to happen. [112:54] They set it to record. Yeah. [112:56] >> Whatever. shareholder. Someone's super [112:57] paranoid. They unplugged the Ethernet [112:58] cable, [112:59] >> but it was already rolling the capture, [113:01] I guess. [113:01] >> Yeah. For audio, uh, you know, it's it's [113:03] 16 gigabytes total storage. You got [113:05] probably about 4 GB to work with out of [113:07] the box if you don't get creative. [113:10] >> And that is a that's 4 GB of audio. [113:13] That's a lot of audio. But imagine also, [113:15] I've got a 256 gig USB stick. I stick [113:17] that in there. That's weeks of audio, [113:19] >> right? Uh so in so in this example, you [113:21] know, the boardroom example, I guess, [113:24] use cases might be let's just take the [113:27] least nefarious I guess just just good [113:30] old like fraud basically market [113:32] manipulation. [113:32] >> Yeah. I'm going to I'm going to play the [113:34] stock market. What's going to be said in [113:35] this thing? There you go. [113:37] >> Yeah. [113:37] >> Yeah. [laughter] [113:38] >> Uh which could be useful also to nation [113:40] states or, you know, intelligence [113:43] agencies. Like I'm sure there's all [113:45] kinds of stories of North Korea, for [113:47] example, doing things in the crypto [113:48] market or whatever. So [113:49] >> yeah, [113:50] >> um what [113:51] >> and if your TV like let's say that your [113:54] IT organization is like super on the [113:55] ball and the TV is normally not on the [113:58] network at all and it's completely [114:00] isolated and it's not even in scope for [114:02] them to monitor. If you had somebody [114:04] acting nefariously like that and they [114:06] had alone time with the TV, you could be [114:08] in and out in 10 minutes. [114:10] >> So yeah, so there's potential vectors [114:12] both on and off network, I suppose. [114:14] >> Uh and with and without physical access [114:17] depending on how you get in. Yeah, your [114:19] guy found a zero day that seems like it [114:21] would be able to connect to the TV over [114:23] the network uh non-interactively, [114:26] >> right? [114:27] >> Fabulous. [laughter] [114:28] >> The one that we found requires you to [114:31] hit okay. It's like a mobile device [114:34] would like to pair with your TV. Is that [114:36] okay? And then you say yes. And then [114:38] that's all she wrote. All [114:39] >> right. [laughter] [114:40] Um what about the scenario where a TV [114:44] ACR audio capture? So we were able to [114:46] pull the 6second or so audio clips. So [114:49] this is separate from the one where it's [114:50] just the speakers for the boardroom [114:52] scenario. [114:52] >> Yeah, this was a little bit of creative [114:54] debugging. So like we really we were we [114:57] were we were up to our elbow inside the [114:59] TV if you know mental picture for that. [115:01] It's pretty amazing I think. and the ACR [115:04] process. So [115:05] >> colonoscopy of LG [laughter] [115:07] >> we were we were running uh very deep [115:10] analysis of the ACR process and we were [115:13] able to see because this also helped us [115:14] figure out some of the audio formats [115:15] like some of the audio formats are [115:16] nonobvious. There's also a speaker [115:18] feedback microphone a secondary [115:20] microphone which could be used for audio [115:21] capture which we should talk about. We [115:23] were able to intercept the audio [115:25] recording before it was converted into a [115:28] hash and save it. [115:29] >> Okay. And so without and that sounds [115:31] like it's a lot of manipulation but like [115:32] once you know how to do that you have a [115:34] very very tiny program that's just [115:36] watching the other program and when it [115:37] captures the audio it's like yo that's [115:39] mine and you can save those sixsecond [115:42] clips and that would that's very hard to [115:44] detect. [115:45] >> Yeah [115:46] >> because the TV is is behaving normally [115:48] >> right. [115:50] What about um the feedback mic? You just [115:53] mentioned that. So, the feedback, the [115:55] audio quality from that is terrible, but [115:56] it seems like there is a secondary [115:58] microphone that's used somehow as part [116:00] of like the audio solution. I have no [116:03] idea how it's supposed to work in normal [116:05] scenarios. Uh, but it's very low bit [116:07] rate, which is good, but it's not low [116:10] enough bit rate that we couldn't [116:10] reconstruct speech from it. [116:12] >> Mhm. What about um log files on RAM? So, [116:16] that was pretty interesting. [116:17] >> Okay. So, it's only 16 gigabytes of [116:20] flash and it does seem like in So, I [116:23] started like full background here. I [116:25] started on an older TV. You You bought a [116:27] newer one. It's a donation to the cause. [116:29] I don't know. We're going to we're going [116:30] to run that in. Doesn't matter. Doesn't [116:32] matter. Uh my older TV um was a little [116:36] bit more uh verbose with logging. And I [116:39] think that LG probably ran into [116:40] situations where that was wearing out [116:41] the flash prematurely. Um, and so this [116:44] new one logs everything to RAM disk. But [116:47] there is a process that runs and [116:49] collects the logs, I guess, the [116:50] interesting stuff and puts it in flash. [116:53] There's also a lot of evidence in the [116:55] packet capture that this stuff is sent [116:57] to LG. And so in the debug logs, which [116:59] are stored on a RAM disc, and so even [117:01] when the TV is off, it doesn't erase [117:02] that. You have to like physically unplug [117:04] it or do something with that. Um, in [117:07] those logs, we can see everything that [117:10] you've said to the TV, [117:12] >> right? Uh, do you want to pull up an [117:13] example? This is stored in a log file. [117:16] Uh, I mean that's concerning for a [117:18] number of reasons. Devil's advocate [117:21] position might be okay, but you [117:23] explicitly said hi LG and triggered it [117:26] right before you so you knew it was [117:27] recording. But in fact, there were [117:30] several instances where genuinely we did [117:32] not know I didn't know it was still [117:34] recording. And so some of the testing I [117:36] was doing was it appears to be uh [117:39] somewhere between 10 and 15 seconds or [117:42] so it will remain active. [117:44] >> I just heard it ding. [117:45] >> Did you really? [laughter] I that was [117:47] the other thing. We we got it working [117:49] from at least 60 ft roughly away, maybe [117:52] 70 around a corner in some instances [117:54] around two corners. And [117:56] >> microphone's really good. [117:57] >> The microphone's amazing. It like we [117:59] should maybe replace some of our studio [118:01] mics. But the [118:02] >> that's another thing an adversary [118:04] [clears throat] [118:05] with a little bit more time can figure [118:07] out the voice wake microphone. Now that [118:10] also was a little it was a little weird [118:12] for us to try to co-opt the voice [118:15] capture microphone, but clearly LG is [118:17] doing something there. And I feel [118:19] certain that uh an appropriately skilled [118:21] security researcher could co-opt that [118:23] microphone and get even better [118:25] recordings than we did. [118:26] >> Yeah. And I think really the key is it's [118:29] writing these log files. [118:31] Even if if you have ambient conversation [118:34] that's happening around the TV when [118:36] someone triggers it, uh it will remain [118:38] active if it continues to hear speech [118:41] for some period of time. It seemed [118:42] pretty long and uh it's it's collecting [118:44] all that and it's writing it here. [118:46] >> Yeah. This is without any modifications, [118:48] I think, is is what is what you're [118:49] you're getting at. Yes. It's like I I'm [118:52] co-opting the microphone to record audio [118:54] and we know that that the six-second [118:57] clips are destroyed in favor of but [119:00] these captures. Yes, [119:01] >> this is as the TV works. [119:03] >> Yeah, as the TV works, the text that it [119:06] was able to convert from your speech [119:08] ends up in the log, [119:09] >> right? So, as long as you can get access [119:12] to those logs, you can get access to [119:13] what was said. And once again, [119:16] >> it may be more than just, "Hi LG, please [119:19] change the channel." Yeah, it's funny [119:21] actually. Um I'm now I'm remembering [119:24] from like an IT audit standpoint. Uh one [119:26] of the things in like ISO, not not just [119:29] ISO, but like process certification and [119:32] um the California privacy law having [119:35] debug logs that log sensitive [119:37] information is verboten and this would [119:39] probably run a foul of that. [119:40] >> Well, we had uh an example where I said [119:43] >> right there. [119:44] >> So here you go. So here was now it was [119:48] triggered But then I I was started [119:51] talking about something else. I was [119:52] talking about my social security number. [119:54] Maybe I was on a phone call with a [119:56] hospital or something. I need to verify [119:58] who I am. Yeah. Whatever the case may [119:59] be, maybe a credit agency. [120:01] >> And uh I said, "Hi, LG." I told it to do [120:04] what I wanted. And then I continued my [120:05] conversation. Yeah. And here it is. [120:07] Here's my social security number. 11111. [120:10] The response to this I guess is [120:14] well first of all it appeared to persist [120:18] after we cleared we told it to clear the [120:20] data. [120:21] >> Yes. [120:21] >> And it persisted. [120:22] >> Yeah. So [120:23] >> there's one asterisk we'll get to. But [120:25] >> yeah, we clear it's like okay clear the [120:27] data. The TV treats that as let me just [120:30] phone LG servers and clear the data. It [120:33] doesn't really seem to do much locally [120:35] with that. Now, these logs, the full [120:38] verbose logs are stored on a on a RAM [120:41] disc. [120:41] >> And if you reboot the TV, it doesn't [120:43] clear the RAM disc, right? [120:45] >> But if you physically unplug the TV, [120:47] >> if you kill the power, [120:48] >> if you kill the power, it does. And so, [120:49] we lose this. They It also seems to [120:51] rotate these verbose logs pretty [120:53] quickly. [120:54] >> Um, but [120:55] >> if someone's pulling them though, yes, [120:57] >> in the in real time, it doesn't matter. [120:59] >> Yeah, it doesn't matter. Um, and it [121:01] seems like a lot of the applications and [121:04] like the applications that are [121:05] generating this that are doing this are [121:07] actually doing kind of a lot of writing [121:09] to the flash. Like it's it's still it's [121:11] like, oh, we've taken steps to [121:13] >> make sure that we don't prematurely wear [121:15] out the flash, but it's still doing a [121:16] lot. And so I think there's there's [121:18] there's a lot of fertile ground here for [121:19] researchers to go. It's like, okay, what [121:21] is it doing exactly? But most of the, [121:23] you know, delete my data or forget this, [121:25] it doesn't do it doesn't care what's on [121:27] the TV, right? It just does the remote. [121:30] >> Yeah. So, the the situation we were [121:32] concerned about was okay, if you do [121:33] delete my data, you bring the TV to [121:35] Goodwill and it's gone. Does that data [121:37] persist? Initially, we thought maybe [121:39] because when we rebooted it, it was [121:41] still there in the logs, but then after [121:43] pulling the power cable, it got wiped [121:45] out, right? Yeah. So, at least locally [121:47] to the TV, those specific verbose logs [121:50] appeared to be gone. [121:51] >> Yeah. But other logs persist. [121:53] >> Other logs were still there and we [121:55] haven't dug into every single one of [121:56] them. So we we can't say with certainty [121:58] like what it retained, but [122:00] >> yeah unsettling. It's like how do you [122:02] format your TV? LG doesn't. It's like do [122:05] you trust LG to do that? It's like no, I [122:07] would like to get in there and look [122:08] around and [122:10] >> make sure it's formatted. Yeah, [122:11] >> that seems reasonable. [122:13] >> What about um how does the TV know where [122:15] it is? [122:16] >> Uh so uh [122:18] >> there's no GPS. While other researchers [122:20] have sort of noticed that, hey, when we [122:23] look at the traffic to LG, it sure seems [122:26] like that it's inventorying the wireless [122:29] networks that are around. So, there is [122:30] no GPS unit. If you take it, it's like, [122:32] oh yeah, this is great. Even though I've [122:34] only ever used the TV for a wired [122:36] interface, it seems like it's noticing [122:39] the wireless networks that are around [122:41] it. And based on the wireless networks [122:43] you can see, you can use that for [122:44] geoloccation because you can see the [122:45] wire the names of the wireless networks [122:46] but also the MAC addresses of the access [122:48] points. [122:49] >> And that is a cheap easy way to do GPS. [122:52] I'll go you one better. If you had a [122:54] rogue employee inside of LG or a hacker [122:58] that leaks this database to the [122:59] internet, [123:00] >> so the information that that uh Mr. [123:03] captured [123:04] >> and was submitted. If that is in a [123:06] database at LG somewhere, then someone [123:09] could exfiltrate that information from [123:11] LG and now they can find a specific TV [123:14] based on interesting places the TV [123:16] exists. [123:16] >> Not like Washington DC or Yeah. Right. [123:20] >> Yeah. It's like I'm looking for the TV [123:22] in this boardroom. What do they have? [123:23] What are my options? And even before [123:25] setting foot inside the business, they [123:27] can know, oh, there's an LG TV there [123:29] because I have looked at the [123:31] geoloccation database in LG. [123:33] >> There's this 30 acre campus with nothing [123:35] but giant corporation A. [123:37] >> Yeah. Now, that sounds absurd, but if [123:39] you look at the if you set aside LG for [123:41] a second and look at Meta and how Meta [123:43] has sold ads, Meta has literally gotten [123:45] in trouble for uh selling to wouldbe [123:48] advertisers the ability to geollocate [123:50] down to like individual street [123:52] addresses. [laughter] It's like I want [123:54] to sell an ad to the person in this [123:55] house. Okay, the the platform is capable [123:59] of that. [123:59] >> There's so many ways to abuse that. [124:01] >> I don't want a TV that I have to have an [124:03] adversarial relationship. And [124:05] immediately out of the box, you're on [124:07] the wrong foot with LG because they own [124:10] the glass. [124:11] >> They do say they own the glass. [124:12] >> So, this is unencrypted. They don't even [124:14] try with this. This is just not even a [124:16] thing. If you're in the middle between [124:18] the TV and the internet, then it's a [124:19] command and control type situation. You [124:21] could also make the argument like if LG [124:23] lets one of those bazillion domains [124:25] expire, that's going to be a great [124:27] vector to take over tons of TVs. So LG [124:30] gets kind of a black market here, too, [124:32] because my older TVs have security [124:35] vulnerabilities that LG is just not [124:36] interested in patching. [124:37] >> Okay, cool. [124:37] >> They're like, "Oh, it's a six-year-old [124:38] TV or a 5-year-old TV. We don't care." [124:40] >> Right. Great. [124:42] >> Yeah. But if you have Yeah. Right. [124:45] >> Um RCE, so can you help explain some of [124:48] this where [124:49] >> Mr. bra has a vulnerability that we [124:52] can't disclose [124:54] beyond basically saying it's bad and uh [124:57] and it could grant someone access to the [125:00] TV. I think that's about the extent of [125:01] what we can say. [125:02] >> Yeah. [125:03] >> Um but can you help without exposing too [125:06] much of that information explain the [125:09] concept of like an what is you know [125:12] remote code execution? What is that [125:14] without going into how it works here? [125:15] >> So you're gonna you're going to show on [125:17] TV what we did using the stuff from [125:18] GitHub, right? Yes. [125:19] >> Okay. So that was remote code execution [125:22] effectively. [125:22] >> So you can use our work to explain it. [125:24] Okay. [125:25] >> Uh he found a way to do it [125:28] non-interactively probably, [125:29] >> right? [125:30] >> Which is amazing. Nice job. [laughter] [125:32] Uh the uh the first uh attempt that we [125:37] had failed. And so we got the popup at [125:40] the bottom where it was trying to [125:41] install, you know, whatever it was, but [125:43] it was not able to um remotely execute [125:46] all of the code. It was able to remotely [125:48] execute some of the code to give us the [125:49] banner, but it wasn't able to remotely [125:51] execute all the [125:52] >> take a step back just like first I guess [125:54] definition of remote code execution [125:56] broadly [125:57] >> um [125:58] >> as a vulnerability [125:59] >> uh you can cause something to download [126:03] code and execute it with whatever level [126:07] of permissions. Okay, [126:08] >> so remote code execution, you might be [126:11] executing the code in a sandbox, but [126:13] then you might be able to escalate your [126:14] permissions from the sandbox to some [126:16] something else. And so this is this [126:18] that's uh more broadly described as like [126:20] exploit chaining. But rce remote code [126:24] execution is one of the best uh beach [126:28] heads into a system as like a starting [126:32] point. If you can find a vulnerability [126:33] that is remote code execution, then you [126:36] can get a lot more access to the system. [126:38] Um, the less interactive [126:40] >> uh requirements you have for remote code [126:42] execution, the more ability you have to [126:46] take over more TVs, okay, [126:48] surreptitiously, right? [126:49] >> So, the the the more holes that you find [126:53] sort of the worse it becomes. [126:54] >> That makes sense. Um, ours, the one that [126:58] worked was actually, I think, a worse [127:00] remote code execution than the one that [127:01] had been patched by LG. [127:03] >> The one that had been patched by LG was [127:05] we had to put in the um the IP address [127:08] of the TV [127:09] >> and then the TV would pair the the [127:12] exploit application would pair to the TV [127:14] like as if it was a mobile device. And [127:15] so there was a pop-up and we had to say [127:16] yes [127:17] >> and then it took off and that was fun. [127:20] Um, but that didn't result in control of [127:24] the TV. The one that worked was from the [127:26] browser in the TV. So like if you go in [127:28] the web browser in the TV and you went [127:30] to a web page [127:31] >> and you went to the wrong web page [127:34] >> and you accidentally hit yes or on [127:36] purpose was like a mobile because the [127:37] web page also generated [127:38] >> this one you ran. [127:39] >> Yeah. Yeah. Okay. [127:40] >> And so the popup said, "Oh, there's a [127:42] mobile device. Would you like to pair [127:44] with a mobile device?" There was no [127:45] mobile device. That was the web page. [127:46] The mobile device was the web page. [127:48] >> And so if you said yes because you know [127:51] the thing is a little fiddly. Or if you [127:52] just were in a loop and you said no, you [127:54] can just have it say yes over and over [127:55] again, [127:55] >> right? Until they finally like, h, fine. [127:57] Okay. [127:57] >> Yeah. The LG browser is not it's [128:00] terrible. And but it's Chromium based, [128:01] but it's old Chromium. And so it's um [128:04] and so you say yes and then we were in. [128:08] >> So that's really not a a really super [128:10] high bar for [128:11] >> right access. Yeah. [128:13] >> Yeah. And also LG doesn't give you like [128:16] their even if you go in their developer [128:18] program like that that's the legit way [128:20] to do this kind of thing. They really [128:22] don't give you full access to the [128:24] hardware that you own because they don't [128:27] think you own it. [128:28] >> Yeah. As we keep coming back to. [128:31] >> Yeah. And that's that's offensive. It's [128:32] like it's my TV. I'd like to audit it. [128:34] If if you look at the old TVs that we [128:36] have like six years ago, um those TVs [128:39] didn't even have an advertising ID out [128:40] of the box. And then you get a firmware [128:43] update and even without opting into [128:44] anything, boom, there's your advertising [128:46] ID. I didn't agree to that. What? [128:47] >> We showed it on your TV. Yeah. You [128:49] literally had no terms you had agreed [128:51] to, right? Yep. Ever. And then [128:53] >> from one update to the next, it's like, [128:54] oh, now we've got an advertising ID. And [128:57] you can't turn it off. [128:58] >> It added that cookies thing, too. Yeah. [129:00] The kind of dark pattern toggle. Yeah. [129:03] >> Like, I did not give you permission to [129:05] alter the functionality of the TV with [129:06] this update. there was no notice that [129:08] the functionality of the TV would be [129:09] altered with this update. [129:11] >> Right. Well, and that also seems like it [129:13] would require some kind of toos [129:14] agreement or something, user agreement. [129:16] But [129:17] >> even basic stuff, there's there's people [129:18] on on on the forum that have been raised [129:21] in heck because LG keeps changing how [129:23] they deal with DTS audio, and that has [129:26] nothing to do with any of the stuff that [129:27] we're talking about except for LG is [129:29] changing the functionality of a TV after [129:32] the fact, [129:33] >> right? All right. Any other any other [129:35] points you want to talk about here? I [129:36] mean, you're you own several LG TVs in [129:39] your office. [129:40] >> Yeah, it's basically all LG. Uh, it's [129:43] funny, though, because all the LGs that [129:44] I've had here for years, every one of [129:46] them is the out of the box firmware. [129:48] >> That's LG right there. [129:49] >> Yeah. Yeah. This is like the other one [129:52] that's on a they're all LG and yet [129:53] they've never been on the network [129:54] because I never I've never trusted LG to [129:57] do that. Actually, the crossover [129:59] monitor, the like the the the one on the [130:01] wall back there is an LG panel with LG [130:04] Alternative Electronics. And as a [130:06] company, Crossover, that was a viable [130:08] business model for them. We can actually [130:09] go peel the sticker off and there's an [130:11] LG sticker behind the Crossover sticker. [130:13] >> So Crossover is the name of a brand. [130:15] >> Okay. So Crossover put their sticker on [130:17] top of the LG sticker. [130:18] >> Yep. But it's a completely different set [130:20] of electronics. [130:21] >> Why? What's the [130:24] [laughter] [130:28] >> I think you know why. [laughter] [130:31] >> You know, short version recap. How do [130:32] you feel about the what's your level of [130:34] concern with this, you know, as as both [130:38] a a business owner with these types of [130:39] devices, but also someone who may, you [130:42] know, advise or work with businesses on [130:44] security or infrastructure? [130:46] >> I've never advised using the TV's [130:48] built-in apps. It is it's a devil's deal [130:51] and eventually it will come to [130:53] >> but I have to admit that it was very [130:54] creative of LG cuz like a computer [130:56] display is a dumb display. It was very [130:58] creative of them to co-opt the Windows [131:00] update system to use that to in shedify. [131:03] >> Well, you know that uh Microsoft owns [131:05] the data management service that LG uses [131:09] for that stuff. [131:11] >> That tracks, [131:12] >> but don't worry, Microsoft will throw LG [131:14] under the bus and pretend that it [131:15] [laughter] was all their fault. [131:17] >> Yeah, I like how Microsoft's reaction to [131:19] that was like, hey, could you maybe cut [131:20] that out and not just terminating their [131:22] Windows update account and rolling back [131:24] all the changes? [131:24] >> I mean, that's probably what they would [131:26] do to a small developer, right? some [131:28] name they would just terminate your [131:29] account like you've abused this function [131:31] goodbye you know but not [131:33] >> they certainly did that to the security [131:34] researchers trying to tell them problems [131:36] with things Microsoft [131:39] >> thanks Microsoft [laughter] [131:42] >> all right I think that's kind of that's [131:44] a pretty good recap so [131:46] >> we'll jump over to the next part thanks [131:48] Wendell [131:49] >> thanks Steve [131:50] >> LG will probably say that they take [131:52] vulnerabilities very seriously and will [131:54] patch them right away but they didn't [131:56] reply to us when we sent them a ton of [131:58] our concerns. The bigger we [132:00] think, is LG deliberately designing this [132:03] to make money off of your privacy after [132:05] you paid for a thing and off of your [132:07] personal information. You have to reject [132:10] this outright or it will just keep [132:12] getting worse. If you want flock cameras [132:14] on your living room wall, this is how [132:17] you get flock cameras on your living [132:19] room wall. The only reason to give a TV [132:21] this kind of power is to visit horrors [132:24] upon you, not to make a better product. [132:27] Ultimately, we wouldn't recommend any LG [132:29] smart products to literally anybody. [132:32] That'll wrap this part of our deep dive [132:33] investigation. We do have more, though. [132:35] It's likely we'll have more installments [132:36] in this saga, and we really need your [132:38] help to pay for this video. I spent a [132:41] lot of money on this video. [132:44] Seriously, it was a lot. We spent more [132:46] than a month working on this, including [132:47] travel, buying thousands of dollars of [132:49] TVs. We had most the team on this [132:51] project. Really, the best way to support [132:52] us on this one and the other upcoming [132:54] videos in this series would be through [132:56] our data dragnet campaign on the store, [132:58] which is a Kickstarter style campaign [133:00] where we transparently show you how much [133:01] money we've raised. And we have some [133:03] goals what we're going to do with it. [133:04] So, for example, we'd really like to go [133:05] back in with Samsung, Vizio, anyone [133:07] else, and kind of do a bunch of this [133:09] research again or stuff like it. See [133:10] what we can find. This is so expensive [133:13] both in time and in actual cost and the [133:16] two related together. I mean, I can't [133:18] just like stop everything for three [133:20] months every time we do one of these [133:21] kind of like we did with LG. And so [133:23] that's where we really need your help. [133:25] We have some pretty damn cool stuff on [133:26] the store for this as well. So, in [133:28] addition to the individually available [133:29] items like our new foil cyber skeleton [133:32] shirt and our foil polygon V2 shirt and [133:35] our LG Investigation Blu-ray discs [133:37] available that we're burning in house, [133:39] we're 3D printing the cases in house. [133:40] all that stuff. We also have four [133:42] different backer tiers that give some [133:43] good discounts on bundling a bunch of [133:45] items together. They also give bonus [133:47] videos. And then in the case of the [133:49] sabotur tier, the highest one, there's a [133:51] live stream Q&A with me that you'll get [133:53] to join. I'll send those invites out at [133:54] the end of the campaign. So, be a little [133:56] while, but those are always really fun [133:57] to hang out with the community. So, this [133:59] is the best way to support us. If you [134:00] don't need one of these, we also have a [134:02] donate button in the bottom left of [134:03] store.gamersex.net [134:05] and on patreon.com/gamers [134:07] nexus for monthly support. Or you could [134:10] consider buying one of our other items [134:11] like our project and soldering mats. [134:13] Great for any project. We think the [134:15] extent of LG's data harvesting is [134:16] intrusive and grotesque. Additionally, [134:19] despite the Overton window shifting [134:20] further and further away, we still [134:22] believe that when you purchase [134:23] something, especially for thousands of [134:25] dollars, you should own that thing. LG [134:28] isn't the only smart TV manufacturer [134:30] behaving this way. and we'd like to [134:31] expand the scope of our investigation [134:33] and eventually test TVs from other [134:34] manufacturers in a follow-up piece, but [134:37] we are going to need funding for that. [134:39] If you have any tips or leads for a [134:40] follow-up, please email us at [134:42] tips@gamersex.net. [134:44] Mr. Bra advised immediately [134:45] disconnecting LG smart TVs from any [134:48] network. Wendell felt much the same. Our [134:50] other researcher we worked with, U-Turn, [134:52] said this quote, "My recommendation to [134:54] users would be to demand ownership over [134:56] your devices. First, by using and [134:58] supporting proconsumer projects that [135:00] seek to give you device control back, [135:03] and second, by demanding legislation [135:05] that reflects the changes you want to [135:07] see. Sell carriers only carrier unlock [135:09] your phones because the 113th Congress [135:11] made it law." End quote. Which I thought [135:14] was an excellent point. As where groups [135:16] like Fulu come in both U-Turn and Mr. [135:19] Bruh have communityf funed coffee pages [135:21] we'll link below. Our thanks to Wendell, [135:23] Mr. Brah, and U-Turn for their help with [135:25] researching this piece and the [135:26] informants in our inbox. We'll have a [135:28] lot more to talk about with all this [135:30] soon. And one final time, we really do [135:33] need the help funding this expensive [135:34] type of work so we can do the next set [135:36] of smart TVs. So, if you feel like you [135:38] can spare it, please head over to our [135:39] store or Patreon to leave a super thanks [135:42] below so I can spend thousands of [135:45] dollars on TVs that will spy on us. [135:48] Thanks for watching. Subscribe for more [135:49] and we'll see you all next