Release date 02/07/2018
WASHINGTON, D.C -- Consumer Reports has found that millions of smart TVs can be controlled by hackers exploiting easy to-find security flaws. The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra.
Consumer Reports found that a relatively unsophisticated hacker could change TV channels, turn up the volume, kick the TV off the WiFi connection, and play YouTube videos. This could be done over the web from thousands of miles away. These vulnerabilities would not allow a hacker to spy on the user or steal information.
The findings come from the first-ever product tests by Consumer Reports using its new Digital Standard, which was developed by CR and partner cybersecurity and privacy organizations to help set expectations for how manufacturers should handle privacy, security, and other digital rights. The goal is to educate consumers on their privacy and security options and to influence manufacturers to take these concerns into consideration in developing their products.
This broad privacy and security evaluation focused on smart TVs from five top brands: Samsung, TCL, LG, Sony, and Vizio. In addition to the security flaws found in Samsung and TCL sets, the testing found all of these TVs raised privacy concerns by collecting very detailed information about their users. Consumers can limit the data collection, but they have to give up a lot of the TVs’ functionality, and know the right buttons to click and settings to look for.
Smart TVs can transmit a significant amount of information on their users back to the TV manufacturers and their business partners. These TVs can identify every show you watch, using a technology called automatic content recognition, or ACR. That viewing information can be used for targeted advertising on your TV, as well as mobile phones and computers.
In a recent Consumer Reports subscriber survey of 38,000 smart TV owners, 51 percent were at least somewhat worried about the privacy implications of smart TVs, and 62 percent were at least somewhat worried about the sets’ security practices.
Justin Brookman, director of consumer privacy and technology policy at Consumers Union, the advocacy division of Consumer Reports, said the findings underscore the need for the federal government to set tougher standards to address the security and privacy vulnerabilities found in connected products.
“Congress needs to pass data security standards for connected products, and federal regulators need to step up and hold companies accountable for the privacy, security and safety of these products,” Brookman said. “For years, consumers have had their behavior tracked when they’re online or using their smartphones. But I don't think a lot of people expect their television to be watching what they do."
The full report on smart TVs is available online at ConsumerReports.org.
CR will host a live conversation on digital privacy with CR journalists and experts at the CR labs via Facebook Live tonight at 8-9 pm ET/5-6 pm PT. The CR Privacy Hour will cover concerns about smart TV and toys, digital privacy best practices, and ways to protect your privacy. People are invited to share questions and comments with CR in real time via Consumer Reports Facebook, YouTube and Twitter, and to follow the hashtag #CRPrivacyHour