Smart TVs May Be Watching And Listening In Your Home, FBI Warns

Don’t sneer at those who warn that, somewhere behind the smart TV you bought on Black Friday or Cyber Monday, someone is watching and listening to what’s going on in your house. The FBI says the idea isn’t that far-fetched.

That’s right. While you’re watching your smart TV — which connects through the internet to give access to streaming services such as Netflix and Hulu — the TV may be watching back as it collects data to help advertisers better target their ads and make programming suggestions based on what you've already watched.

The FBI warns that many smart TV owners don’t take the same protective steps they do to secure and defend their computers. But they should, the agency says.

"Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home,” the FBI says in a press release. “A bad cyber actor may not be able to access your locked-down computer directly, but it is possible that your unsecured TV can give him or her an easy way in the backdoor through your router.”

Many smart TVs have built-in cameras that use facial recognition to make programming suggestions based on who’s watching or for live, two-way conversations on a large screen. These intuitive TVs also respond to voice commands “for those of us who are too lazy to actually pick up the remote,” the FBI says.

The capabilities of smart TVs can go beyond data collection, though.

In the worst-case scenario, the FBI says, hackers “can turn on your bedroom TV's camera and microphone and silently cyberstalk you.”

“At the low end of the risk spectrum, [hackers] can change channels, play with the volume and show your kids inappropriate details,” the agency continues.

Concerns that the government could use smart TVs to spy on Americans were raised in 2017, when WikiLeaks published information about a tool developed by the Central Intelligence Agency called “Weeping Angel” that attempted to turn some Samsung smart TVs into remote listening and monitoring devices.

The capabilities of Weeping Angel were chilling.

Had it been implemented, Weeping Angel could have extracted browser search history and Wi-Fi credentials and history, even those with WPA (Wi-Fi Protected Access). Even if a TV was turned off, Weeping Angel “kept it in a deep standby mode, listening and waiting,” Tech Crunch reported.

Earlier this year, hackers hijacked thousands of Chromecast streaming devices and tricked them into playing YouTube videos that customers neither requested nor wanted. The hackers warned that the bug, known as CastHack, could be used for more nefarious and disruptive purposes.

Another smart TV manufacturer, Vizio, reached a $2.2 million settlement with the Federal Trade Commission, which accused it of unauthorized tracking via its automated content recognition software in 11 million of its internet-connected televisions. Vizio not only learned what people were watching down to the second but also collected the household’s IP addresses, the vicinity of the house in relation to local landmarks, and ZIP code and other information, then shared it with other companies.

The FTC said the settlement “makes clear” that smart TV makers need to get their customers’ consent before they collect and share information about viewing habits.

Internet security isn’t the top concern of the makers of internet-connected televisions, and the smartest smart TV protection may be not connecting to the web at all. But with the ever-growing popularity of internet-enabled streaming alternatives to cable television and satellite dish services, consumers need to make security a top concern, the FBI says.

For starters, make sure you know everything about what features are available on smart TVs and how to control them. For an extra layer of protection, do an internet search of your TV model number using the keywords “microphone,” “camera” and “privacy.”

So, what else should you do to secure your smart TV? The FBI offers these tips:

• Don’t just depend on the default security settings. If you can, change passwords. Know how to turn off microphones, cameras and the collection of personal data. If you can’t turn off those features, consider the risks of buying that model or using a particular streaming service.
• If you can’t turn off the camera, put a piece of black tape over the camera lens.
• Check on the ability of the manufacturer to update your smart TV with security patches. How often does the manufacturer issue patches?
• Check the privacy policy of the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store it and what they do with it.

Cyberfraud can be reported to the FBI’s Internet Crime Complaint Center or by calling your local FBI office.