Hot on the heels of LG confirming that it’s investigating an allegation that its Smart TVs share sensitive user information unencrypted, a second blogger has emerged with even more seemingly damning evidence: that these Smart TVs also report files that are shared on the local network, files that are not physically accessed by the HDTV via USB.
“I was seeing the same requests DoctorBeet was seeing when it was logging his media from a USB mounted drive, except I had no USB mounted drive plugged in. It turns out it was pulling filenames from my shared folders over the network and broadcasting those instead,” the blogger writes.
Whoa.
As previously reported, Jason “DoctorBeet” Huntley, a 45-year-old IT consultant in the UK and LG Smart TV owner, came across a corporate video that detailed LG’s data collection practices, and decided to switch off a specific data collection feature on his Smart TV. But he then realized, by monitoring internet traffic to and from the device, that information was still being sent unencrypted to LG servers. He even discovered that LG keeps track of video and audio files stored on a connected external drive.
This second blogger, listed as "Mark", assumes that his own LG Smart TV -- model number 42ls570 and purchased in April – uses a different firmware than DoctorBeet’s, as there is no option to disable logging of TV watching. Regardless, he set up a laptop to serve as a “middlebox” to see what kind of traffic transpired between LG and his TV set. First thing he noticed was authentication to the LG server, and a request to deauthorize the session when the TV is turned off or goes into standby mode.
Once he saw that the TV was logging media not shared on a USB drive, he verified the logging by pulling all files out of the shared folder, and throwing in a few "duds" with porn-related names. He then turned the TV off and then back on. "It was still broadcasting the old filenames. The TV couldn’t see those files whilst browsing manually so I’d hazard a guess it’s caching some of these locally. It didn’t take long though to pick up the new ones," he writes.
"Now the clear problem I see with this is even if I did agree to this in any T&Cs presented to me, I doubt guests I have round using my WIFI connection would be too happy with filenames from their shared media being dispatched to LG," the blogger adds. "Personally I’m not too happy that files you assume aren’t leaving the network are having their names broadcasted to LG, even worse so that it’s unencrypted."
Should LG be allowed to see files stored in a shared folder on the network? Should the company be able to see the media you watch even when they’re merely located on a connected USB drive? No. The Smart TV you purchase is your property, and your personal files should not be covered under whatever Terms and Conditions the company cooks up.
