top | item 6759426

LG Smart TVs log USB filenames and viewing info to LG servers

297 points| Amadou | 12 years ago |doctorbeet.blogspot.com | reply

178 comments

order
[+] jamesrom|12 years ago|reply
Dear TV manufacturers,

No one want's your shitty software, it's not a competitive edge. No one has ever been impressed by the software their TV comes with, and for every person that found your software easy to use, there is a thousand who are still trying to figure out what that one button does on their remote. You wanna know what people are care about? Picture quality. That's it. That's always been the key. I don't know why you constantly fail to understand that.

Why can't you just make a dumb screen? You know desktop monitors? Like that. No sound, minimal software, but if you really want to get fancy, maybe a nice small remote to turn it on and off. Everything else, from sound to color profiles can, and have already for years now, be handled by external devices smarter than you.

If you make this, and you focus on picture quality instead of figuring out ways to confuse and exploit the customer, I promise you, I absolutely promise you, every AV nerd I know will buy one. And they will love it. And they will recommend it, and share it, and buy them for their loved ones. And blog about it. Tweet about it. Podcast, vlog and sing about it.

And you'll disrupt the old model. You will be the company that brings about the next revolution in television. You've been looking to do that for so long haven't you? And while you always secretly knew it wasn't IPTV or 3D that was going to start the next revolution, what you didn't know is how easy it would be to disrupt the current incumbents.

The customer is waiting, cash in hand.

[+] untog|12 years ago|reply
Disagree. I agree that many current 'Smart TV' efforts are awful, but the concept is very, very sound. There are TVs with Hulu and Netflix just a few remote presses away - people want that. AV nerds are a small market by comparison.

This seems like more of an extension of hardware manufacturers still not being good at software. I'd say Samsung's version of Android proves that they still aren't great at it (but are getting better).

[+] acheron|12 years ago|reply
Seriously.

I plan to keep using my TV for at least 10 years and probably rather longer. There is no chance any of the "smart" BS will still be useful then. (Imagine you had a "smart" TV in 2004 that, say, updated your Myspace page.)

Obviously as far as the manufacturer is concerned, they'd rather I buy a new TV after 4 years so I can get new "smart apps" and yada yada yada, but anyone who does research isn't going to fall for that.

[+] CWuestefeld|12 years ago|reply
Agreed.

The rate of change of the "smart" technology is far greater than that of the actual video display. That is, I expect that the TV will continue to work for displaying video for many years, but the cycle time for "smart" services is currently months or very few years.

Thus, to keep current with the ability to display content, I'd need to dump a display system that's perfectly good.

Better to separate the modules. Have a really good display system, and separate, a smart device that handles content. That smart device can be dead-simple to install and to operate, and still do a great job (like Roku).

[+] netcan|12 years ago|reply
Tangent: I think there's room for an 'Android of TVs.'

This may or may not be Android, which is kind of the problem. The most likely contenders here (Apple, Google, MS, Sony) have a dog in the race & incumbent problems. They committed to an approach or a technology too early. They have a market (eg itunes), complementary products or ecosystems to protect.

What does TV software really need in order to be significantly better than the average smart TV? A handful of core apps (Youtube, Netflix), some local ???Players (these could be introduced market by market) and some experimental/novelty apps (eg Skype, spotify). That's it. That's a good start. Crappy games and access to 99 upstart content marketplaces is not necessary. An app marketplace could come second.

*Vanilla android is not the answer. If it's going to be android it needs to be android for TV.

[+] w1ntermute|12 years ago|reply
The problem is that what you're suggesting is a race to the bottom in terms of price. The TV industry is hurting from that approach, which is why they're now trying to become more than just dumb panels.
[+] Someone|12 years ago|reply
"No one want's your shitty software, it's not a competitive edge [...] You wanna know what people are care about? Picture quality."

To be fair, a lot of that is software, too, nowadays. Upscaling without visible artifacts? Figuring out what the optimal backlighting should be? Adaptive blurring? Motion blur compensation? All done in software.

A large part of the problem, I think, is that tv companies, traditionally, let the hardware engineers who write that software add a menu structure, because they are programmers, and all programming is programming, isn't it? I do think things are a lot better than they were 5 years ago, but could be a lot better still.

[+] mavhc|12 years ago|reply
I doubt people care about picture quality as they watch SD channels when the HD version is available. Norms care about having 1 box that they plug in with the fewest number of cables and works well enough they don't need to buy something else. Geeks want a display, norms want a TV.

Of course I want a new firmware board for my 5 year old HD TV which sends the wrong resolution data to my pc, has a terrible SD UI, and doesn't decode HD OTA signals, but it's not going to be cheaper than buying a new TV

[+] r0h1n|12 years ago|reply
If the data sending wasn't creepy enough, LG's response to the author's letter takes the cake - they tell him to contact the retailer!

"The advice we have been given is that unfortunately as you accepted the Terms and Conditions on your TV, your concerns would be best directed to the retailer. We understand you feel you should have been made aware of these T's and C's at the point of sale, and for obvious reasons LG are unable to pass comment on their actions."

[+] pfortuny|12 years ago|reply
Next time I buy a loaf of bread I shall ask for the terms and conditions, just to be sure...
[+] jrockway|12 years ago|reply
I read this as: "Please organize a class action lawsuit if you have any further concerns."

The problem for LG is: more than 0 people do do that.

[+] DanBC|12 years ago|reply
That's the UK law if you have a faulty product.
[+] eonil|12 years ago|reply
Actually, there's real good and simple method to determine which one is a shit or not. If it has a word SMART on its name, that's a shit. SMART - it's a magic word to identify shits. Because I never saw stupid companies can make great stuff with more computing power and accessibility. When they have more freedom, they always make a bigger shit. And sometimes it becomes deadly huge.

Real nice product doesn't advertise such smart shit stuff, and only focus on the feature what you actually need and use. Even such computing features made you happy, they know that's not a feature to be advertised.

Just don't buy any SMART stuff. Whatever they ADVERTISE, they're saying on advertisement are all bullshit.

[+] aunty_helen|12 years ago|reply
Just started looking at what my Samsung is dialing up. http://54.241.140.58/api/tvp/1.0 + huge url param string is one thing that jumps out. Resolves to 'Samsung AdHub Portal'

Only seems to be transmitting back when using the smart tv stuff though. The request params and some of the stuff I can decipher. request? id=<some id> s=220x124 dt=03 did=<device id> pt=04 pv=T-INFOLINK2012-1003 nt=10 coc=<country> lnc=<language> ts=1384856584858 <timestamp> tz=<time zone> scr=1280x720 <screen size> dy=2012 md=12_X10PLUS mf=Samsung HTTP/1.1\\r\\n

[+] pestaa|12 years ago|reply
Have you tried blocking the IP and see what that might break?
[+] DanBC|12 years ago|reply
A nice write up for the Information Commissioner would probably be a good idea.

I'd suggest doing a short cover letter, a simple-English write-up, with a detailed technical appendix.

I'd ask if LG are registered to collect data, and if their registration covers this data. And if any of this information leave the EU etc.

Thanks for the write up! It's interesting. I wonder if rooting the telly to replace this functionality is legal? I never know what the laws are about reverse engineering stuff now.

[+] justincormack|12 years ago|reply
I can't even find LG Electronics UK Ltd on the data protection register...
[+] csmuk|12 years ago|reply
Actually perhaps the most annoying thing I can see is that after paying a fuck-load for the television, they dare to show me adverts on the guide!

LG is instantly on my shitlist for this and the channel and media data leaks.

[+] ccozan|12 years ago|reply
I worked for a system like this, but for Philips. Could be that the company ( cannot tell the name!) sold the solution to LG. Actually this was meant to display channel suggestions, not ads. Seems like since last time they twisted it. Quite a shame.

It was an opt out system, every TV got a unique ID, but it was anonymous - Philips didn't knew who you were. If someone watched something more than 15 mins, it was send to the DB and was profiled. After a while, the system learned your preferences - also depending on the watching hour - and started to show, per request, recommandations what to watch - which channel was the most close to your preferences. It worked like a charm.

But indeed, no personal data was collected so I don't really understand the fuss. Same for this case, LG sens anonymous data, and returns best ads for you. A little better than Google, i might say.

[+] incongruity|12 years ago|reply
I'm sorry, but every detail of what I do or my family does within the privacy of our own home is personal. I do not expect my TV to be spying on me in any form.
[+] cjrp|12 years ago|reply
>But indeed, no personal data was collected so I don't really understand the fuss.

Filenames on USB sticks attached to the TV could quite easily include personal data. That and the lack of (working) option to disable the feature entirely.

[+] lucian1900|12 years ago|reply
Such a service (even the one you describe, not the ads) would be a breach of privacy if merely opt-out. Anything like this must be opt-in.
[+] kaoD|12 years ago|reply
> LG sens anonymous data, and returns best ads for you

Thanks! I always love it when I get the best ads!

[+] DanBC|12 years ago|reply
Make it opt in, present it as an option when user sets up TV, and avoid all the negative publicity.
[+] nnnnni|12 years ago|reply
You had us until "but indeed".
[+] ronaldx|12 years ago|reply
My television preferences and the times that I am normally watching TV are personal data - and potentially sensitive.

There is some disconnection within two sentences: If it's not personal to me, how can they return the best ads for me?

[+] enesex|12 years ago|reply
priz3 found this info on the company
[+] nodata|12 years ago|reply
The first comment on that page is important: contact the ICO.

But it's interesting and worrying that this problem would not have been found if LG was using SSL.

[+] nnnnni|12 years ago|reply
So when this sniffs the viewing habits of someone who is under 13, does it run afoul of CIPA or COPA or whatever it's called?
[+] icebraining|12 years ago|reply
I don't think so, because COPPA only applies if the service is directed at children and/or asks (directly or indirectly) the user's age.
[+] grecy|12 years ago|reply
I wonder what would happen if I had a movie on my USB stick I wanted to watch, and it happened to be in the same folder as a few documents that happened to be named with my personal identifying data.

My name, address, tax number, drivers license number, passport number, etc, etc.

Now they've slurped that off my drive without my permission, and transmitted it in the clear. Can I sue them for "unauthorized access" or identity theft?

What if the file name was some industry secret under NDA or other protection?

(For example Apple_iPhone_7_2015_design_spec.pdf or NSA_POTUS_PHONE_LOGS_2013_TOP_SECRET.csv )

[+] russellsprouts|12 years ago|reply
Trade secret information is not blanket protected. For example, the recipe for Coke is a trade secret, but you can still try to reverse engineer it. You cannot try to steal it, or pay someone to give it to you. It seems that the user agreed that the TV would give that information, in some sort of license agreement, and plugged that data into the TV also. I don't think it would count as a fraudulent way of getting the data.

With regard to TOP SECRET info, I think that the person plugging the data in is at fault, if they were under an obligation to keep it protected, and they failed by letting it go to a private server.

Identity information could be a liability for them, I think. By instituting this feature, they open a possibility of collecting private information, which they should have a duty to protect.

[+] orbitingpluto|12 years ago|reply
Anyone have a link to LG's Terms and Conditions that reveal they will be collecting data?

Furthermore, there's an issue of going further down the rabbit hole with smart TVs. What about the terms and conditions of use of software that you may never even use that is still collecting data?

I have a LG dumb TV with DLNA and wired connectivity only. LAN only setup does not work. It has to have a full Internet connection.

[+] rem1313|12 years ago|reply
I'm currently in the market for a new TV 50-55", preferably the least smart, the better.

Any suggestions? I can't seem to find any non-smart TVs that are reasonably current with at least 3 HDMI ports.

[+] nicolsc|12 years ago|reply
Why non-smart especially ? You're free not to connect it to the internet. That's exactly what most customers do with their 'smart' tvs : not plugging them or getting their hands dirty with the wifi settings.
[+] stedaniels|12 years ago|reply
I've got one of these TV's and annoyingly I think it's great. I'm likely going to have to set up some routing/dns/proxy rules to defeat this.

Might even have some fun with it by sending it lots of channel changes, pen drive details and the rest.

[+] hellweaver666|12 years ago|reply
could you get a small USB device (Rasberry Pi?) and set it up to show as a USB storage device and randomly generate file names while it's plugged in? That would flood their servers with dummy data :)
[+] csmuk|12 years ago|reply
That scares me. I'm going to fire up wireshark on my Sony Bravia tonight and see what that sends off as well.
[+] acqq|12 years ago|reply
Now who can suggest the best software to install on the home router to block the connections based on the URLs? Ideally it would be a transparent solution -- the client computers shouldn't need any additional configuration. I have an OpenWrt based router.

Another question is how to handle https requests?

[+] icebraining|12 years ago|reply
URLs or domains? If the latter is enough, you could just install a DNS resolver like dnsmasq and configure those domain to redirect to 0.0.0.0 or so. Example config:

  address=/[banned domain]/0.0.0.0
Then either configure your dhcp server or clients to use the router as the DNS resolver.
[+] hiby007|12 years ago|reply
someone should DDOS these servers. Or may be pass wrong info. JK.

These is very bad For LG, And Samsung. These wrongful data collection should stop.

[+] ChikkaChiChi|12 years ago|reply
Auto manufacturers do the same thing. Stop giving me a button to talk to your shitty computer and have it be a bluetooth command action for Siri or Google Now.

My phone is smarter than you.

[+] Spearchucker|12 years ago|reply
How can't it be disabled? It needs a network connection to do that. I imagine there is a use case compelling enough to encourage the user to hook it up (YouTube?) but I doubt it has satcoms. Sooo... just don't configure the network.

That notwithstanding, I see boxes like Apple TV and Xbox One becoming the way that people interact with their TVs, making the whole problem somewhat moot anyway.

[+] joering2|12 years ago|reply
> I think it's important to point out that the URL that the data is being POSTed to doesn't in fact exist, you can see this from the HTTP 404 response

Is it possible that they do indeed collect it, but are faking 404?

Step now would be implement technology into the TVs. check

Step two would be to accept payload, however perhaps they are in waiting period to see if news like this one will come up, and then how much damage, if any, it will create. If none, then Step two: check.

What's step 3? Agreement with RIAA or Holywood to sell this data? It could help in litigation by giving more ammunition to plantiff. What is LG TOS of the TV says? Mentions anything about it?

Thank you for the post BTW. While they are tens of TV brands, its good to know which one to stay away from.

[+] bobdvb|12 years ago|reply
I've worked in the consumer electronics business for quite some time so let me present some information for your consideration, I don't expect you to like it but it will explain context: 1) Adverts: These are often used to subsidise features and capabilities. Sometimes good EPG data needs to be paid for, sometimes you need to justify the running of applications stores. This is a business choice that the manufacturer has to make, be off-putting or lose money. Targeted advertising does increase acceptance of advertising over non-targeted advertising, however if you hate advertising your just not going to get a subsidised product (if it is economically feasible to make one). 2) Viewer tracking: This has many uses a) product improvement: by knowing how users use products you can improve your designs. However this isn't usually done in such a scatter gun approach. b) You can sell anonymous information to agencies who use it to understand viewing habits and increase the value of traditional TV advertising. 3) Third party content tracking - This could be used a) to identify working and non-working content formats, not all encoders are the same and it is a nightmare debugging all the strange formats the people of the internet generate. b) to deliver improved titling, indexing and other metadata.

Above all remember Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity.": 1) LG's response from their CS department was composed by a minimum wage agent who got a response from their mid-level supervisor who enquired with someone in product management who badly translated that from some Korean discussions. 2) Most Koreans don't care about content piracy, it is rife in Korea, especially with their excellent bandwidth. 3) Most of these policies were probably written by someone more interested in making the best product for the least money and probably not someone from the west.

I would hope that LG might pick up on this and make a better statement, but it won't change their attitude.

Finally, personally as someone who makes a lot of set-top boxes I would happily see more dumb TVs, but the business of TVs is loss making. None of the big brands has made money in the TV business in ages, most people do it either for turn-over or brand recognition. Making basic large "monitors" is a difficult business to make a profit in because you are selling something very basic in a mature market.

[+] kevinpet|12 years ago|reply
"just not going to get a subsidised product"

What subsidized product? I just paid hundreds to thousands for something you advertise as a smart tv.