An investigation into LG Smart TVs has raised a disturbing scenario: certain televisions from the South Korean brand may continue to capture audio even when the screen is off, while at the same time identifying mobile phones, Wi-Fi networks and other devices nearby.
The findings were published by the Gamers Nexus channel on YouTube, following an analysis of LG OLED Smart TVs carried out in collaboration with Level1Techs and independent analysts, as reported on Tuesday, 7 September, by the Europa Press agency.
To understand what was happening inside the devices, the researchers used different methods of interception and network analysis. The tools used included Wireshark, a well-known network protocol analyser, as well as disassembly and code analysis.
It was then that the televisions' network traffic revealed more extensive activity than would be immediately apparent to the user. According to the investigation, the devices analysed scanned the local network looking for unrelated devices, including smartphones, and collected data such as IP addresses, SSIDs, the signal strength of neighbouring Wi-Fi networks and geographic location information.
The most sensitive discovery came when the researchers switched off the screen and disconnected the television from the home network. According to the analysis, the device continued to record the audio of voices in the environment, storing the files in its internal flash memory.
When the network connection was subsequently restored, these files were sent to the company's servers, according to the researchers.
The analysis also identified what it describes as critical security flaws in webOS, the operating system used in LG televisions. The vulnerabilities would allow administrator privileges, or root, to be obtained, enabling remote access to the system. In these circumstances, the researchers maintain, the television could be turned into a covert listening device, capable of streaming live the audio of the space where it is located.
The capture capability would not be limited to the microphones built into the television or the remote control. The investigation concluded that it would also be possible to extract audio from external peripherals connected to the device, including webcams connected via USB.
Collection extends to advertising
The investigation warns that these capabilities pose a particularly relevant risk for professional and business environments, where large televisions are often installed in meeting rooms, offices and other workspaces.
There is, however, another dimension to the collection of information.
The Smart TVs analysed use Automatic Content Recognition technology, known by the acronym ACR. Although this technology is not new, the system captures six-second segments of the content users are watching on the screen, both video and audio, creating a sort of digital fingerprint of the content played.
This data is then transmitted to LG and goes directly to LG Ad Solutions, the company's advertising platform, according to the investigation.
The potential scale of this collection becomes particularly striking when set against the brand's global presence. According to the researchers, although LG has sold approximately 216 million Smart TVs worldwide, the data collection associated with its systems would cover around 363 million devices in the United States alone.
