OpenTube

The LG Smart TV Spying Scandal: How Researchers Actually Prove It

Dad, the engineer

72,713 views

‪@GamersNexus‬ and ‪@Level1Techs‬ just showed LG smart TVs logging and uploading user data, scanning the home network, even capturing audio. Great findings. But they went deep on WHAT they found and lighter on HOW they found it. This video is the how.

See GN's video here: 216,000,000 Spy TVs | The LG Smart TV Problem

I walk up the four layers of reverse engineering that security researchers use to find hidden functionality, backdoors, and quiet data collection, starting with a free download and ending at a lab that costs more than a house. It is the answer to the comment I get on every privacy video: how do you actually know what a device is doing?

We start with software disassembly.
Then firmware.
Then hardware debugging.
Finally, the nuclear option, reverse engineering the silicon itself.

For each layer I cover the tools, what they can actually determine, what education it takes, who does the work, and who pays for it, from bug bounties and nonprofits like the Citizen Lab to multi-million dollar commercial teardown labs. The point of the whole thing: with all these people, at all these price points, poking at everything, there is nowhere left for hidden functionality to hide.

CHAPTERS:
0:00 - The LG TV Investigation
0:29 - The Eufy "No Cloud" Camera That Got Caught
1:27 - The Supermicro hoax
3:02 - The Four Layers
3:49 - Layer 1: Disassembling Apps and Phone Operating Systems
8:54 - Layer 2: Firmware, binwalk, and the Unpatchable checkm8
12:06 - Layer 3: JTAG, UART, and Hardware Debugging
18:10 - Layer 4: Reverse Engineering the Silicon Itself
24:12 - Nowhere Left to Hide
27:45 - Wrap-Up

Tools and equipment
Ghidra: https://ghidra-sre.org
IDA Pro (Hex-Rays): https://hex-rays.com/ida-pro
jadx: https://github.com/skylot/jadx
apktool: https://apktool.org
Frida: https://frida.re
Wireshark: https://www.wireshark.org
mitmproxy: https://mitmproxy.org
Burp Suite (PortSwigger): https://portswigger.net/burp
binwalk: https://github.com/ReFirmLabs/binwalk
checkm8 / ipwndfu (axi0mX): https://github.com/axi0mX/ipwndfu
checkra1n (jailbreak built on checkm8): https://checkra.in
OpenOCD (JTAG / SWD): https://openocd.org
flashrom: https://www.flashrom.org
JTAGulator (Grand Idea Studio): https://www.grandideastudio.com/jtagu...
Bus Pirate: https://buspirate.com
ChipWhisperer (NewAE): https://www.newae.com/chipwhisperer
Degate: https://github.com/DegateCommunity/De...

Labs & companies
TechInsights: https://www.techinsights.com
Texplained: https://texplained.com
Midnight Blue (TETRA:BURST research): https://www.midnightblue.nl/research/...
The Citizen Lab: https://citizenlab.ca
Amnesty International Security Lab: https://securitylab.amnesty.org
Google Project Zero: https://googleprojectzero.blogspot.com

#reverseengineering #privacy #smarttv #hardwarehacking #infosec #lgtv

20 Comments

@Dad-The-Engineer Creator 2 weeks ago Pinned

I've argued with too many people that say that phones secretly record us. Instead of teaching them, one at a time, I'm going to try to teach EVERYONE at least one thing they didn't already know about uncovering the operation of any program or device. Let me know what YOU learned!

@martyb3783 2 weeks ago

The devices in my house that I trust the least are the ones that require electricity. Very interesting video. I don't know how you have time to produce these videos. There is obviously allot of work and thought that go into them. Thanks for making them.

@238CardsTest 2 weeks ago

Wow, this has single-handedly answered so many questions I've had regarding not simply security, but the different levels/layers of computers themselves. And it was done deep enough to be thorough, but approachable enough that even I could understand. Well done brother!

@djjipsybean1714 2 weeks ago

We are in a century were all devices became spyware for agencies and shadowy companies, time to act with legislation and accountability for them

@kabubagachugu7729 2 weeks ago

This was great! Ill have to rewatch it to internalize everything but damn this was some great content.

@JaxVideos 2 weeks ago

I worked on a widely-used 'silicon compiler.' We took in thousands of hardware device designs as a customer-oriented test suite for our compiler. Around 2007, device complexity skyrocketted and I noticed chip area devoted to TCP/IP, encryption, silicon radio, A/D converters and other sensor technology showed up in otherwise simple single-purpose devices. Granted that no one designs custom ASIC for truly trivial uses, but not every chip needed full RISC CPU capability (or so I thought).

@effigy80 2 weeks ago

When I saw this topic rise again, I immediately thought of you videos on this. Thanks for the good work you do

@superduperguru 2 weeks ago

Dude, didn't think i'd be able to sit through 30 minutes on this, but you got me. Continuing to enjoy the content. Cheers.

@uno-tu9xx 2 weeks ago

Great info as always - thanks.

@lowiq888 2 weeks ago

Good video. As you say, this could be a good reference to enlighten the faithful and the suckers. Thanks Dadiyo. I learned a lot, and you confirmed some things I formerly assumed. Like looking at the power consumption to find clues as to what is going on in a gadget or a system. The first time I ever heard of a "smart" TV I assumed it would be spying on the user. Another way to determine whether a gadget is spying on you is to start a rumor and expect the feedback. Careful with that method because it can cause mental illness, irrational paranoia, and legal trouble. Widespread mental illness is a problem in this modern world and gadgets may play a role in that.

@ergonomiczero2228 2 weeks ago

Wow! Thanks for the in-depth explanations and research

@tehNashty 13 days ago

I knew about de-compilers, defcon and the like. I had never thought about the higher layers.
Thank you for this, I am certain it will be handy!
Oh, and thank you for all you do!

@dreaoca 2 weeks ago

Great video, new subscriber. Thanks for the explanation.

@cef-ym3gb 2 weeks ago

Awesome explanation.. Thank you.. 👍

@20chocsaday 2 weeks ago

I used to work in a company and one of their aims was to find out what it was about a competitor's product that made it better.
It wasn't a substance you could take apart. What they did was try to infer from all the measurements they were making the reason it was better.

@DaveNelson22 2 weeks ago

Hey, super fascinating. Thanks as always. But - what do I do now with my LG tv on my network? Think I've turned off all the ad settings, which it apparently ignores! You've mentioned network containers - is my Pi dns server good enough to do that? Or is it time to get a cheap home server like you've made vids on recently? Also wonder about feasibility of flashing new open source or other firmware on the tv, tho perhaps that's outside your wheelhouse. At any rate, appreciate all you do and would love some kind of video guide on "What's next to contain my rogue LG tv?" 🤘😁