Consumer Reports: Samsung, Roku Smart TVs may be vulnerable to hackers
Description: Consumer Reports studied the top 5 brands. All are tracking what we watch, unless we opt out, and two of the brands failed a basic security test.

Get the news

12

###### Share This Story!

Let friends in your social network know what you are reading about

#### Your smart TV may be prey for hackers and collecting more info than you realize, Consumer Reports warns

Consumer Reports studied the top 5 brands. All are tracking what we watch, unless we opt out, and two of the brands failed a basic security test.

Post to Facebook

#### Posted!

A link has been posted to your Facebook feed.

1

###### Join the Nation's Conversation

To find out more about Facebook commenting please read the Conversation Guidelines and FAQs

# Your smart TV may be prey for hackers and collecting more info than you realize, Consumer Reports warns

Jefferson Graham, USA TODAY Published 6:00 a.m. ET Feb. 7, 2018 | Updated 11:37 a.m. ET Feb. 7, 2018
750 Shares
CLOSE

Consumer Reports shows how easy it was to hack into TVs from Samsung and TCL. Jefferson Graham reports. USA TODAY

Element Roku TV 4K/HDR smart TV (Photo: Reviewed.com / Lee Neikirk)

LOS ANGELES —Buyer beware. If you’ve snapped up a smart TV, with built-in Netflix, YouTube, Hulu and other Web connections, heads up on this warning—your smart TV could make you vulnerable to hackers and is probably monitoring more of your viewing than you realize.

Consumer Reports just analyzed smart TVs from the five biggest US TV brands — Samsung, LG, Sony, TCL and Vizio — and found several problems. All can track what consumers watch and two of the brands failed a basic security test.

How bad is the security? So poor, according to its report, that it was able to take over complete remote control of the TVs from Samsung and TCL's branded Roku TV, which included changing channels, upping the volume, installing new apps and playing objectionable content from YouTube.

"What we found most disturbing about this, was the relative simplicity of," how easy it was to hack in, says Glenn Derene, Consumer Report's senior director of content.

He called it "frightening," that someone remotely could type something into the search bar, launch and install apps, knock the TV off the Wi-Fi network and use the hack to "harass and frighten someone."

It was easy to break in, said Derene, because "basic security practices were not being followed." Both Roku and Samsung told Consumer Reports the companies would take a closer look at the issues and address them, it said.

However, Roku pushed back Wednesday morning in a blog post, saying Consumer Reports "got it wrong," and insisted that there is "no security risk," with its products.

"We take the security of our platform and the privacy of our users very seriously," said Gary Ellison, a Roku vice president.

Consumer Reports hacked into the TCL/Roku TV by using a feature Roku created that allows for remote use of a remote control via other platforms, like on a smartphone. That feature can be disabled, says Roku. Additionally, to use the feature, you have to be on the same Wi-Fi system, and Roku suggests users have password-protected Wi-Fi to prevent security breaches.

Smart TVs represented over half of all TV sales in the first half of 2017, according to market researcher GFK, and at this point, most sets being marketed are "smart." Consumers opt for them because they save people the hassle of changing their settings when they want to stream media from the Internet.

These new TVs have a technology add-on called Automatic Content Recognition, which monitors what you watch, in an attempt to do a better job than Nielsen at measuring viewership.

So hypothetically you could watch the show “This is Us,” and the next thing you know, your computer and phone will start showing you ads for the NBC show, similar to how we’re tracked online.

Consumer Reports says there’s an easy fix. Turn it off.

That’s one choice. Your other two are to turn off Wi-Fi while you’re watching, which doesn’t make sense if you like to stream, or buy a dumb TV and stream the old-fashioned way, via a set-up box.

But that still may leave you open to hackers. Consumer Reports found that the Roku streaming box, which used the same operating system it tested on Roku-branded TV's sold by TCL, was also vulnerable. It didn’t mention testing the Amazon Fire TV or Apple TV boxes, because those operating systems aren't widely available, if at all, within other TVs.

Hacking risk aside, the report found that the smart TVs it evaluated asked for permission to collect viewing data and other information, but it wasn't necessarily easy for users to understand what information they were agreeing to share, and there was a tendency to request oversharing — such as monitoring everything a TV watcher did, whether it was streaming, playing a DVD or watching paid TV.

Consumers are used to letting Internet-streaming services Netflix, YouTube and Hulu track everything they watch on their services, in order to recommend other shows. So is it so bad if NBC and CBS, via the set manufacturer, get the same information?

Derene's view: It's just not the expectation of consumers that their TV will be tracking everything they watch, particularly if they're not streaming.

Regulators have also started to look more closely on the information gathered by Web-connected TVs. A year ago, Vizio agreed to pay $2.2 million to settle claims from the Federal Trade Commission and the Office of the New Jersey Attorney General over collecting viewing data without consumers' consent. That information, along with demographics data including sex, age, income, marital status and home ownership, was sold to third parties who used it for targeting advertising and other purposes, the agencies charged.

Consumers have voiced concerns about smart speakers from Amazon and Google in the home that are "always on," and listening, but the companies have insisted that the speakers only come to life when they are awoken by saying the words "Alexa," or "Hey Google."

Follow USA TODAY's Jefferson Graham on Twitter, @jeffersongraham

Read or Share this story: https://usat.ly/2nJXu3A

###### Most Popular

- ###### Facebook limiting status updates in news feed to 25 friends? That's a hoax, pass it on

- ###### SpaceX: Elon Musk plans to drive a Tesla to Mars (with some Falcon Heavy rocket help)

- ###### Your smart TV may be prey for hackers and collecting more info than you realize, Consumer Reports warns

- ###### Amazon second headquarters: Some see a clue in Amazon's Alexa Super Bowl ad

- ###### Did Keanu Reeves really create that website?

- ###### YouTube to label state-funded news videos in effort to provide transparency