Samsung and Vizio smart televisions have been discovered to persist in transmitting traffic consistent with automatic content recognition (ACR) technology, even after users have disabled this feature within privacy settings.
This revelation calls into question the efficacy of smart TV privacy controls in halting the flow of viewing-related data.
Additionally, the research underscores a significant limitation: due to encryption, the precise nature of the data these devices send remains unverified.
The Watching the Watchers study scrutinized 12 commercial televisions from ten distinct manufacturers, encompassing eight operating systems that collectively represent approximately 95% of the U.S. smart TV market.
In this exhaustive investigation, researchers conducted 5,943 automated experiments to juxtapose network activity with ACR both enabled and disabled.
Samsung TV Tracking Continues Post Opt-Out
Automatic content recognition identifies screen content by utilizing brief audio or video clips, or digital fingerprints derived from such samples.
Providers juxtapose these indicators against a database of known content to ascertain programs aired. The resultant viewing records bolster audience measurement, facilitate targeted advertising, and enable data sharing.
Persistence of Tracking on Samsung and Vizio TVs After Opt-Out
This feature is capable of tracking content beyond streaming applications, encompassing antenna broadcasts and HDMI-connected devices.
Previous reports in Cyber Security News have delineated instances where ACR continues to function, even when the television primarily acts as an external display.
For this recent analysis, researchers captured network packets while televisions played controlled content through various methods, including antenna inputs, HDMI connections, streaming services, and screen mirroring.
Each viewing scenario was meticulously replicated with ACR in operation and then again after users opted out.
Results revealed that Samsung’s Tizen televisions exhibited ACR-consistent traffic in all 30 opted-out tests involving its integrated streaming service.
Similar activity was observed in 41 out of 60 antenna assessments, 18 out of 30 HDMI examinations, and 6 out of 30 tests using Tubi.
Conversely, Vizio’s SmartCast televisions continued to connect to their designated Amazon Kinesis ACR endpoint during every opted-out trial for the relevant scenarios, with no reduction in traffic when the feature was disabled.
Although these findings do not irrefutably establish that Samsung or Vizio maintained records of viewing histories, the preponderance of ACR traffic was encrypted.
Thus, researchers depended on metrics such as destination, timing, volume, and other notable network patterns.
As a result, they remained unable to ascertain the specific information relayed to company servers or whether such data was archived.
Notably, opt-out functions proved effective for LG webOS, Sony Google TV, Amazon Fire TV, and VIDAA platforms tested.
However, Roku’s opt-out settings did not fully encompass its own streaming service, an oversight that was revealed on the tested TCL television but not on the Roku-branded model.
The research paper elaborated on additional risks beyond the murky nature of encrypted traffic. VIDAA transmitted ACR messages via MQTT without encryption, thereby jeopardizing device identifiers, application names, input sources, and audio fingerprints.
An unsecured server inadequately protected over 57 million detection outcomes associated with more than one million televisions.
Although VIDAA has since instituted login requirements, researchers noted that data transmissions remained unencrypted.
Furthermore, Vizio’s WatchFree+ service embedded discernible program or channel information within visible network names, transmitted through DNS requests and TLS server-name information. This visibility could potentially unveil viewing habits to network observers, even with ACR disabled.
Researchers advocate for either disconnecting televisions from the internet or obstructing identified ACR endpoints.
Their published blocklist demonstrated no adverse impact on viewing in the tested scenarios, although it did not alleviate the WatchFree+ title leak.
The vulnerabilities associated with smart TVs extend beyond ACR functionality. Additional studies into proxy-enabled television applications elucidate why scrutiny of app permissions and bundled services is warranted.
It is vital to note that these findings pertain specifically to the tested devices and firmware, rather than encompassing all televisions produced by these brands.
Source link: Cybersecuritynews.com.
