GamersNexus and LG: Or why rooting your TV is a bad idea

badsectoracula

> If he can demonstrate someone remotely jailbreaking your TV, or flipping on those settings without you knowing or doing anything to your TV, that would be a far more damning issue, in my view. Do you actually want a channel with 2.66 million subscribers to show how to get remote access to TVs used by millions of people? :-P

bob1029

> What am I meant to take away from this? If you look at other IoT devices, they’re going to show the same thing. But here it’s presented as bad. Why? The influencer economy is a bit soaked these days. You need to crank up the stakes to keep the viewer's attention.

Retr0id

> If you root or jailbreak your devices, you've, by their very nature, broken their security. > If he can demonstrate someone remotely jailbreaking your TV, or flipping on those settings without you knowing or doing anything to your TV, that would be a far more damning issue, in my view. There are ways to remotely jailbreak LG webOS TVs without user interaction, using the same (or similar) vulnerabilities you use to root your own TV voluntarily. The main reason tools like https://rootmy.tv are prefixed with disclaimers and require user interaction is because we're being courteous, not because they're technically necessary. (source: I own the rootmy.tv domain)

rickdeckard

Thanks for the write-up, it reflects my own impression of the video. The video is quite a mixed set of topics mangled together, which is a pity because IMO a cleaner separation would be more beneficial to get the point across. They should have decided to set the focus on a specific area and then present every finding around that, i.e.: 1. The Ad data-collecting platform TV-manufacturers are operating, what data they collect and how they use it. 2. The vulnerabilities of the OS in a SmartTV, and the potential issues to exploit them for malicious purposes. 3. The general behavior of the device when connected to your network, with features like voice control, App control, Smart Home etc. enabled, and how it may expose information about yourself. All the points and scenarios in the video might be valid, but they jump between those scopes and imply that its all the same, weakening the whole investigation. If I'm LG and forced to respond to this, I can easily focus on dissecting the voice-input topic as a mere demonstration of the feature and how rooting the TV beforehand just showed the local process of handling it, steering the narrative away from the (IMO) much more important topics...

LoganDark

They rooted the TV to study it. They're not saying you're in sudden danger of attackers rooting your TV and running commands over SSH. They're saying there's evidence that certain data is collected when you wouldn't want it to be, and there are any number of potential vulnerabilities that could provide hackers access, on top of LG potentially having access as well which you also probably wouldn't want.

fulafel

Seems incoherent. What exactly is the bad idea and why? Are they rediscovering "don't run stuff needlessly as root"?