YT YouTube2Text

YouTube2Text → Transcripts → 216,000,000 Spy TVs | The LG Smart TV Problem

216,000,000 Spy TVs | The LG Smart TV Problem — Transcript

by Gamers Nexus · 25,365 words · 3,878 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00LG TVs are able to be utilized as
0:01eavesdropping listening devices in part
0:03because of the advertising functionality
0:05that's built into them. We were able to
0:07retrieve plain text transcripts of voice
0:09conversations and inputs from the TV.
0:12Utilize the TV to record from a webcam
0:14and from a microphone while the TV
0:16appeared to be off. And it was clean
0:19capture, too. All right, so the screen
0:21appears to be off right now. Currently,
0:22Wend and I are in a border. How are you?
0:25>> Yikes. We were even able to capture
0:27microphone audio while the TV was
0:29unplugged from the network. This LG G5
0:31TV has a microphone connected to it and
0:34right now it's listening to me and
0:36saving the information. In fact, we can
0:38even unplug the network
0:41and it's still listening to me and what
0:43I'm saying is being stored by someone
0:46with remote access to the TV. And then
0:48we were able to excfiltrate that
0:50recording via vulnerabilities after the
0:52user reconnected the network.
0:58>> And it's still listening to me.
1:00>> No network.
1:01>> What I'm saying is being stored by
1:03someone with remote access to the TV.
1:05>> But that requires an adversary, which
1:07sounds scary. What we think is scarier
1:09is LG itself. LG's first party
1:12profit-seeking functionality prized deep
1:13into your private life. The TV crawled
1:15our entire network and found dozens of
1:17unrelated devices, including
1:18smartwatches and phones of our staff who
1:20didn't even know we were working on
1:21this, which might explain how LG ads can
1:23claim it knows about 363 million
1:26addressable secondary devices in the US,
1:27despite claiming a smaller 216 million
1:30smart TVs sold worldwide. And we don't
1:32think this is an innocent chcast
1:33connected device lookup, considering LG
1:35itself admits,
1:36>> "We know who's in the LG household. We
1:38know which devices are there. We know
1:40how to extend that reach into mobile.
1:43and they use secondary devices in
1:45political targeting. We also found
1:46through wire sharkark and inspecting
1:47firmware that LGTVs are capable of
1:49identifying your IP address, geographic
1:51location, name of every Wi-Fi network in
1:53the vicinity and signal strength,
1:54channel numbers of neighboring Wi-Fi
1:55networks in range and other devices on
1:57the network, even if not connected to
1:59the TV in any way, and the internal IP
2:01address of other devices on the network
2:03alongside others. In fact, the data that
2:05we collected through Wireshark shown
2:06here is such an egregious invasion of
2:08privacy that we can't even show you it
2:11because every line has something that we
2:14don't want to put out there. And this is
2:16the TV's native functionality. This
2:18didn't require vulnerabilities. Security
2:20researchers we worked with for this
2:22investigation also discovered several
2:24additional vulnerabilities that are
2:26going through the responsible
2:27disclosures period right now. So, we
2:29can't fully detail them yet, but the
2:31researchers have recommended
2:33disconnecting any LG smart TVs from any
2:36network. Ideally, you don't own
2:40thousands of dollars of LG TVs.
2:44Maybe if they're unplugged or physically
2:47destroyed, it's okay. But uh this is
2:51because there's some concerning
2:54vulnerabilities like for example remote
2:56code execution vulnerabilities where an
2:58attacker could manipulate what your TV
3:01does like this.
3:11Good night LG.
3:14That's the That's LG calling me right
3:17now.
3:19The listening device capability is
3:21partly because of ACR, a function that
3:24leads LG to tell its advertising
3:26partners that it quote owns the living
3:28room end quote and your TV. Here's LG Ad
3:32Solutions President Sergey Mata and also
3:34the head of research and development for
3:36LG Adolutions, Justin from
3:38>> in the fact that we have the glass. We
3:40own the glass. We own the TV
3:42>> because, you know, we own the glass. Um,
3:45and we have firstparty ACR data,
3:48automated content recognition data. We
3:50understand everything that that hits the
3:52screen.
3:53>> We own the glass.
3:55I paid $2,400 for this particular glass
3:58that arrived curved on one side,
4:03but I I guess I don't own it. Serge
4:06Mada, the first man who said LG owns the
4:09glass, is the president of LG
4:11Adolutions, which sells the data
4:13harvested from your television to
4:14partners. LG owns LG Adolutions, which
4:18is a private company. And that's a good
4:20thing because Mata is legally banned by
4:23the SEC from running a public company
4:26after settling charges relating to a
4:28fraudulent scheme. Now he's in charge of
4:30the data collected from your TV.
4:32Automated content recognition can be
4:34audio or video data, including
4:36screenshots, that's converted into a
4:38fingerprint, and transmitted back to
4:40servers. In this case, those servers are
4:43LG servers for its LG ad solutions
4:47company. So, even though we paid $3,000
4:50for some of these really nice TVs with
4:52multiple embedded microphones and webcam
4:55accessory options, some of these TV
4:57companies are now making more margin
4:59dollars from targeted ads than they are
5:02from selling the actual TV hardware.
5:09So, that's what we're going to talk
5:10about. To sort through all this capture,
5:12we went on a road trip to see Wendle of
5:14Level One Text in his bunker of secrets.
5:16We stopped at a Best Buy to buy a brand
5:19new LG G5 TV. I think we need a G5.
5:22>> We need something we can do a uh
5:24man-in-the-middle attack on to make it
5:25spy on us.
5:27>> Okay.
5:27>> So, and then we packed our future spy
5:29device into our rental car that's filled
5:31with other spy devices. And then we
5:34hacked the TV. I just Sorry, one second.
5:36Let me just I need to read a comment
5:38here. For purposes of this video, the
5:41phrase hacking refers to the colloquial
5:43definition found in the Marryiam Webster
5:44dictionary under hack. Definition two,
5:47noun one, paragraph 6, subline a quote,
5:52a usually creatively improvised solution
5:54to a computer hardware or programming
5:56problem or limitation. End quote. Now,
5:58our lawyers have made the totally
6:00unrelated point uh that we cannot
6:03legally agree to contracts such as terms
6:06of service or conditions while
6:09incredibly inebriated. We have Ethernet
6:11plugged into Gamers Nexus LLC's TV.
6:14>> There you go.
6:15>> That Gamers Nexus purchased
6:18while it was inebriated heavily.
6:21[laughter]
6:22>> It was unable to agree to the Ulook. If
6:24a check check check box were checked,
6:26>> it was entirely accidental,
6:28>> right?
6:28>> Yes.
6:29>> But we don't know if one had been
6:31checked. [music]
6:32>> Unlikely
6:32>> because of the inebriation.
6:34>> Yes.
6:34>> Yeah. You see that Stanley cup over
6:36there? That's just all margarita.
6:39[laughter] Just the entire thing.
6:41>> It's like 180 proof.
6:43>> Oh yeah. Look.
6:45Oh I accidentally clicked accept
6:47on the terms for voice and I'm
6:49incredibly inebriated. So it's it's
6:51storing what we say we So in the time
6:53you were doing this, Tannon activated
6:56the hands-free version
6:58>> also by accident. Also incredibly
7:00inebriated. He can barely stand over
7:02there. You know, frankly, it's amazing
7:03Vitali can hold the camera so straight.
7:05[laughter]
7:09>> We need your support on
7:11store.gamersac.net
7:12for these investigations. We spent
7:14around $70,000 to make this
7:16investigation happen when counting the
7:18over 500 hours of our team's work and
7:20the fact that we now have enough LG spy
7:22TVs to create a new three-letter agency.
7:25All that we paid for. So, we're
7:27launching our data dragnet Kickstarter
7:28style campaign that we've linked below
7:30to help fund our consumer device buying
7:32and production budget as we deep dive
7:34into more household spy devices like
7:36maybe other smart TV brands in this
7:38series and pay for this investigation.
7:40Our backer rewards include things like
7:42our brand new LG Investigation Blu-ray
7:45disc packs, including an impressively
7:47highquality thermally printed disc label
7:49with Parody Evil LG logo that has a
7:51camera for its eye. We're burning these
7:53discs completely in-house with our new
7:55duplicator machine. Then we put the
7:57discs in a special red edition 3D
7:59printed disc case [music] that we also
8:01make entirely in-house in our print
8:02farm. Each disc pack comes with a 128 GB
8:05USB drive that we duplicate inhouse with
8:08our USB cloner. video coming soon on
8:11that. And the drive contains a digital
8:13copy of this very video that you're
8:14watching right now as a DMCA abused Dead
8:17Man Switch. Besides, we all know how
8:19valuable 128 GB of flash is right now.
8:22The backer tiers also have exclusive
8:24benefits like additional footage and
8:25bonus videos, and very small group live
8:27streams, Q&A sessions with me in case
8:29you want to ask about this project,
8:31testing, advice, getting a job in the
8:33industry, and more. We're also launching
8:34this brand new Cyberpunk Skeleton foil
8:36t-shirt featuring a dystopian skeletal
8:39front made of components and wiring,
8:41plus a splash of red foil for the
8:43surveillance camera. Because of course,
8:46the back has a spine that runs all the
8:47way down the shirt and contains some
8:49Easter egg text relating to Gamers
8:51Nexus. Our Polygon Shard V2 shirt is
8:54also launching as part of this reprisal
8:56and rework of a nearly decade old
8:58popular design, now with improved
9:00sizing, color, and endurance. The front
9:02looks 3D in the light and has a
9:04wireframe GN logo, while the back has a
9:07polygon shard rainfall effect. All of
9:09these tiers are themed around our
9:11surveillance data dragnet hellscape. Our
9:13highest tier even includes a supporter
9:15credit for our future disappointment
9:17tour 2026 video. We have a ton of other
9:20cool stuff for this campaign to get you
9:21unique items, many of which we're now
9:23making entirely at G&HQ with our own
9:25team while supporting our expensive
9:27content. We're even 3D printing these
9:29miniature paintable goblin figurines to
9:31include with the e-waste inductor dice
9:33included in some of the backer tiers.
9:35And we have a new sticker pack available
9:37[music] with a Microsoft sticker. We
9:39need your help to pay for this very
9:40video that you're watching right now.
9:42Plus our next deep dives in this
9:44category of content. We're 70 grand deep
9:46in this report alone. And as a reminder,
9:47our reviews these days, like our
9:49half2500 case review, lose us money
9:51since no one can afford RAM. But we
9:52still produce them and subsidize them
9:54with support from campaigns like this.
9:56Visit store.gamersac. gamers.net to grab
9:58one of our backer tier kits now or check
10:00out the individual items all linked
10:02below. Thanks sincerely for your
10:04support. Now, back to the program. We
10:06have a lot to talk about in this video.
10:09like LG's automatic content recognition
10:11functionality that's designed to build
10:12advanced profiles on everything in your
10:14life, including secondary devices in the
10:15same household. The sale of that data,
10:17LG's political campaign targeting for
10:18quote voters that matter end quote. And
10:21we'll even go over 40,000 words of
10:23agreements relating to LG's smart TVs,
10:24including this sneaky change to the
10:26class action sections that they made
10:28after our first video. Oh, and we also
10:31hacked the TVs.
10:32>> Whoopsy doodle.
10:33>> But don't let that distract from LG's
10:35native spying functionality. One of the
10:37common misconceptions we've seen
10:38propagated online in comments and in
10:40videos is that simply unplugging your TV
10:42from Ethernet is enough to stop it from
10:44spy on you. That might not be enough.
10:46And in fact, even using an LG smart TV
10:48as a dumb monitor doesn't necessarily
10:51stop all of the functionality we're
10:53talking about today. Internet service
10:54providers sometimes have dual SSIDs that
10:56include open neighborhood Wi-Fi
10:57broadcast from customer routers such as
10:59with Comcast's Exfinity neighborhood
11:00hotspot and AT&T's public hotspots which
11:02are sometimes autoconnected to by
11:04devices when they discover the open
11:05network such as in an apartment building
11:06from neighbors using such routers. So
11:08this is a concern broadly speaking and
11:10future looking for smart TVs regardless
11:12of the brand. We're also talking to a
11:14lot of people for this video. So I'm a
11:15robotic general surgeon. What happens
11:17when I'm taking a patient phone call or
11:19I'm doing patient uh video visits and
11:22there's an LG monitor in the background?
11:24>> What happens if it's doing it on a on an
11:26LG monitor itself? Uh what's listening
11:29in? How is that how is that patient
11:32information protected?
11:33>> Yeah, I love giving up my seventh
11:34amendment rights to a company in an
11:36agreement that I never actually read.
11:38It's a complete scam in my opinion.
11:39>> Let's say worst case scenario, you turn
11:41it into a listening device. That seems
11:42pretty straightforward. You turn it into
11:44a device to exfiltrate information from
11:46a corporate network or a boardroom.
11:48>> That seems pretty straightforward. Um,
11:50you use it to maintain access like as a
11:54point of presence on a network. Um, even
11:57if you don't intend to capture audio and
11:59video,
11:59>> just to go through it, tunnel through
12:01it.
12:01>> It is perfectly functional as a proxy.
12:03So, you can proxy internet traffic and I
12:05can just, it's like, oh, I'm going to
12:06use this to move laterally through
12:08somebody's network. the kinds of things
12:10we see in the news where it's like, oh,
12:11Fancy Bear is attacking routers. Uh,
12:13Fancy Bear would be very comfortable
12:15inside LGTV.
12:16>> And we're even using our investigation
12:17today to push for actual legislation to
12:19protect consumers from this type of
12:21technology. I've been on the phone for 3
12:23days with various people in Washington
12:25DC about this and we just went on tour
12:27with Lewis Rossman's team to talk about
12:29some protections and getting laws
12:32created.
12:33>> How many people have had their TV or
12:35monitor for more than 3 years? Yeah. And
12:38and so this you are all part of the
12:40problem. They need you to buy they need
12:42they need you to buy monitors every year
12:45>> because of section 1201 of the DMCA.
12:48Simply circumventing a digital lock can
12:50become a copyright crime.
12:51>> Okay?
12:52>> And so when you're looking at these
12:53cases, right, you've got your TV that's
12:55spying on you, that's watching you,
12:57that's listening to you, right? You
12:58might want to go in and remove that
13:00software. Sure, there are ways that you
13:02can go through the menu. There's no way
13:04to know for sure,
13:05>> right,
13:05>> that that data flow is stopping unless
13:07you go in and take it out yourself. So,
13:09because section 121 does have that
13:11prohibition on the circumvention of
13:12digital locks, um, you're screwed. In
13:16other words,
13:18that's a lot for one video. Let's start
13:20with ACR. ACR is automatic content
13:23recognition that harvests data from
13:25devices like TVs, including screenshots
13:27of what the TV is showing and audio
13:29snippets coming out of the TV speakers.
13:31ACR can also run when the TV is used as
13:33a monitor. That data is converted into a
13:36digital fingerprint and compared to
13:37media databases that these companies
13:39have to identify your habits. In their
13:42own words, LG, we know who's in the LG
13:45household. [music]
13:45We know which devices are there. We know
13:48what you're exposed to on TV and we know
13:50how to extend that reach into mobile.
13:52You know, most streaming households
13:54subscribe to, you know, multiple
13:57streaming services. So, our line of
14:00sight to the screen can really help our
14:02partners. We own the glass. We own the
14:04TV. We own the glass.
14:06>> Since we own the screen and we own the
14:09operating system,
14:10>> most people are on their phone while
14:12they're watching TV. Now, being able to
14:14have ad experiences that are both on the
14:15big screen, but also on the screen in
14:17your hand. So, within an LG TV
14:19household, we can help extend a campaign
14:22footprint to the other devices in the
14:24household. AI is going to provide us.
14:26We're providing like all the rich data
14:28that we have from either our first party
14:31data, our viewing data, third [snorts]
14:33party data. How do we put it all
14:35together and then expose it to our
14:37clients in a in a tool or in a platform
14:41that's built on AI? Right? So, where I
14:43think the next evolution of ACR is the
14:45emergence of AC of AI com uh combined
14:49with contextual targeting. So, how does
14:52AI play down to a scene level?
14:55Leveraging the ACR, leveraging all the
14:58AI in real time of what they're
15:00watching, all the product placements. If
15:02there's a bar scene and that bar scene,
15:05you leverage AI to scan all the product
15:08placements.
15:09>> Yep.
15:10Well, instead of a generic CPG brand
15:15>> in the adbreak, why [music] not put
15:17immediately and you have to send that
15:19data in the metadata in the bitstream,
15:22send that data and [music] expose a
15:26beverage ad, a alcohol brand ad, like
15:29because you're in a bar.
15:30>> But even if you don't buy a smart TV
15:32with ACR, you probably will still
15:34encounter them dayto-day. You can find
15:36LG displays everywhere. hospitals,
15:38doctor's offices, waiting rooms, Airbnbs
15:40pointed straight at beds, paper hour
15:41conference rooms, college locker rooms,
15:42and they're in hotels everywhere. We
15:44even found this photo on Facebook of
15:46someone's dental visit, referencing what
15:48they say is an LGC4 OLED, which anyone
15:50can buy off a shelf, and it's displaying
15:52sensitive medical information, not to
15:54mention law firms or corporate
15:55boardrooms, and of course, your living
15:57room. No, wait, sorry.
16:00LG's advertiser's living room. They they
16:03made that clear. I forgot. Uh we're not
16:05saying that each of these TVs in these
16:08environments is actively being used as a
16:10listening device. That's not the point
16:13here. What we're saying is that in cases
16:17where the issues we found on our TVs
16:20exist on others or can exist on others,
16:23the capability may be there to do so to
16:27use it as a listening device. By whom is
16:31another question. So, to get into this
16:33mystery of what exactly is being
16:35potentially sent back to LG from the LG
16:37Smart TV, we needed to set up an
16:39interceptor. Getting into it, we worked
16:41with three security researchers for this
16:42piece. Mr. Bruh, who previously found
16:44major vulnerabilities in MSI software,
16:46AMD software, and now LG software and
16:49TVs, and who works for Community Good
16:51off of donations. We also worked with
16:53U-Turn who discovered and published
16:55several vulnerabilities relating to
16:56routers and network devices and who
16:59likewise has his own coffee page for
17:01community donations. And we worked with
17:02Wendel who himself has published
17:04vulnerabilities in various devices
17:06including routers. During our testing
17:08our TV continuously scanned our LAN, our
17:11local area network for all nearby
17:13devices. It obtained display names,
17:15signal strength, MAC addresses which are
17:17uniquely identifiable and more. Mr. RA
17:19confirmed his findings by decrypting and
17:22decompiling LG's firmware from one of
17:24its TVs with help from the TV
17:26jailbreaking community. Among other
17:27things, the TV did a reverse sweep of
17:30our entire local network. The TV seems
17:33to have found at least 38 other devices
17:36on our network. Based on our
17:38understanding, here's the complete list.
17:39With some information like specific
17:41device serial numbers, unique names, and
17:43internal IP addresses scrubbed, you can
17:46find everything on our network here. a
17:48Puscha XL 3D printer, an ESP32S3
17:52dev board, air purifier, and then you
17:54get into the creepy stuff. If that
17:56wasn't creepy enough, LG's TV seems to
17:58have detected that Vitali's editing
18:00machine was even running Team Viewer
18:02from its generic network discovery
18:04query, which Mr. Bra says was quote,
18:06"caught in the blast radius," end quote.
18:08The log files from the TV's data
18:10transmission also saw our internal
18:12servers. They found a Samsung smartphone
18:14with the staff member's username
18:15exposed. Another uninvolved staff member
18:17is S23 Galaxy on the network. The
18:20Alienware piece of that we use as a
18:22backup editing machine, someone's Note
18:249. LG's TV found various smartwatches,
18:27Pixels, [music] iPhones, internet
18:28gateways, and switches. And on top of it
18:30all, LG's TV even found what thermostats
18:33we have. LG happens to be a company that
18:36sells air conditioners and air
18:38conditioner accessories. [music] And we
18:40now have a device that pinned our HVAC
18:44system or parts of it. All because we
18:47bought a television and plugged it into
18:50the network to watch TV. I can't wait to
18:54start getting targeted ads for their AC
18:56units. So, if that's the way it's used,
18:58all of this is very creepy. [music] And
19:00if it's not the way it's used, all of
19:02this is very creepy. LG's Alfonso also
19:05collects these items. LG advertise ID
19:07non-reble device UU ID. the Alfonso user
19:09ID, active input, active application,
19:11uniquely identifiable MAC address,
19:12signal strength, device attributes,
19:14location, system power, onoff
19:15timestamps, and privacy consent flags,
19:17noting if the user opted in or out,
19:18among other data like nearby Wi-Fi
19:20networks that the TV detects. LG also
19:22sends its third party advertisers the
19:24user's local, language, and device ID
19:26when the user views, hovers, or clicks
19:27on their advertisement. Wendell's
19:28research noted that his LG TV also
19:31scanned neighboring Wi-Fi networks,
19:33which can then be used for geollocating
19:35you and your TV. There's an LG channels
19:38feature built into the TV that acts like
19:40old cable TV, providing you CNN or Fox
19:42or MSNBC or whoever else, but without
19:45cable. Mr. Bra noted that this is
19:47heavily logged by LG's Alfonso automatic
19:51content recognition system and even an
19:54HDMI connection was undergoing ACR. When
19:56we provided yet more log files to Mr.
19:58bra. He found these telemetry end points
20:00pinninging anywhere from every 75 to 90
20:02seconds to 300 seconds to sometimes as
20:05infrequently as every 5 to 10 minutes
20:07with the LG channels feature. He noted
20:09these telemetry end points. It's not a
20:11surprise to see Amazon or Google ads in
20:13here. But what is interesting is that
20:16Kviva video analytics has a unique
20:19fingerprint to our device as far as we
20:21can tell which allow us tracking as we
20:23look at content on our TV. Mr. RA told
20:26us, quote, "There's no privacy when
20:27watching IP TV via LG channels, as the
20:30DNS requests made can be reversed to
20:32determine what channel you are watching
20:34at any given time. This is available to
20:37anyone on the LAN or your ISP or the
20:40government by extension." End quote. As
20:43seen here, the TV sends a DNS query
20:45containing CNN US while watching CNN US,
20:49NBCN while watching NBC News Now, Fox
20:52Digital WTTG while watching Fox's
20:55regional WTTG news station, and so on.
20:58When we asked Mr. Brah what his thoughts
21:00were on why they might want to harvest
21:02every device a TV buyer owns, he said,
21:04quote, "The display regularly scans your
21:07land to detect what devices you're
21:08running. This is likely being done both
21:10for legitimate, eg autod discovery
21:13network shares and folders reasons and
21:15tracking reasons. Eg. If it sees you
21:17have an iPhone 12, you might get adverts
21:20for the latest iPhone 17. End quote. Our
21:22TV is sending an estimated 4 GB of just
21:26ACR data alone back to LG every month.
21:30Now, that's predominantly text
21:32fingerprints at this point. That's a lot
21:35of data for something that's just text.
21:37In addition to the IP address that LG is
21:39able to harvest, networks are also
21:41pretty unique. This is true for
21:42everybody. Even if you think your
21:44network is pretty boring. And that means
21:47that in theory, even if we were to opt
21:50out of tracking, get rid of the TV, and
21:52then buy a different LG device later,
21:54like an air purifier that has the same
21:57type of functionality or similar to it,
22:00there's a a chance that those data
22:02profiles are linked back together. The
22:04TV employs dark patterns that make it
22:06unclear whether you're opted in or out
22:08of targeting. LG berries do not sell my
22:11personal information toggles deep in the
22:13TV menus and disables the option by
22:15default on our tested TVs, even before
22:17users ever connect to the internet or
22:20accept any agreements. It adds
22:21advertising tracking IDs to years old
22:23TVs after firmware updates and seemingly
22:26without having ever agreed to terms of
22:28service of any kind. In certain software
22:30versions, LG silently adds and toggles a
22:33setting called cookies. It's off by
22:35default, which sounds like a good thing.
22:37Except upon closer inspection, we found
22:40that the toggle misleadingly actually
22:42corresponds to quote advertising
22:44frequency capping cookies end quote,
22:47which track the number of times a
22:48particular ad is shown on your TV. If
22:51you want to download an app, you're
22:52required to accept two agreements, but
22:54LG pops up six with select all
22:57highlighted by default. If you want to
23:00use the app you just downloaded, you're
23:02required to accept another three
23:04agreements, but LG pops up four with
23:08select all highlighted again. But what
23:11if you just opt out of all of this
23:12stuff? As for the opt out, Mr. Bra noted
23:14from the firmware decompile that when
23:16you opt out of tracking, quote, they do
23:19send one final snapshot of all tracking
23:21data to Alfonso upon opting out though,
23:24which is pretty dirty of them. The TV
23:26still does occasional beacons that tell
23:29LG when your TV starts or when it's
23:31online. However, the data sent during
23:33those beacons is minimal. Said beacons
23:35to LG contain an X device ID. Upon fully
23:39opting out and refusing the terms and
23:41conditions, the algorithm that generates
23:43this device ID switches from using the
23:45full MAC address of the device to only
23:48use the MAC OUI or the organizationally
23:51unique identifier, which is an ID
23:53assigned per vendor. same across all LG
23:56devices and makes requests using it semi
23:58anonymous. This X device ID is also
24:01provided to any firstparty adverts when
24:04you view, hover, or click on an advert
24:07that's shown on the TV. However, since
24:10the MAC address can be derived from a
24:12key set per model, you can brute force
24:14the decryption keys until one works and
24:18you can figure out the model of LG that
24:20sent the beacon request to LG. So LG
24:24would get your public IP and device
24:26model and know when it boots and is
24:28online. We've just put a formula on
24:30screen. The formula you're seeing on the
24:31screen is our understanding of how the X
24:34device ID is constructed. Amusingly, Mr.
24:36Broad describes how even this device ID
24:38seemingly has its own vulnerabilities.
24:40It's supposed to be randomly generated,
24:42he thinks, and anonymous. But LG's
24:44implementation is flawed. He states,
24:46quote, it generates the device ID by
24:48combining a random salt generated on
24:50boot with the devices's MAC address.
24:53Normally, this is done using a process
24:54called hashing, where it generates a
24:56pseudo random output based on an input,
24:59and it cannot be reversed. However, LG
25:01chose to encrypt the MAC address and
25:03random salt instead of hashing it. This
25:06means anyone who has the model secret
25:08key can reverse the device ID and
25:10recover the MAC address, which means the
25:12advertisers would have a persistent
25:14identifier that is not random and no
25:16longer changes on reboot. End quote.
25:18Now, Mr. Bra also noted that at least
25:20these trackers remain when going through
25:22the opt- out process. Quote, device
25:24still authenticates on boot with LG. It
25:27still sends a plain text TV is online
25:29beacon to LG every time it boots up or
25:30you change network or if it drops the
25:32network and then autoreonnects. When you
25:34opt out, it sends a network request to
25:36LG saying that you have opted out and
25:38includes your TV's MAC address in the
25:40request. A notification of opt out is
25:42sent to Alfonso in relation to the ACR.
25:44This includes a snapshot of the majority
25:46of the information Mr. Bruss specified
25:49as collected and shared with Alfonso.
25:50End quote. Further, LG's firmware stores
25:54the model secret in the mount LG CMN
25:57data log folder, meaning users can
25:59jailbreak their TV, extract the model
26:02secret, which is the same for all TVs of
26:03that model, and deanonymize the
26:06advertisement data to tie it back to
26:07users original MAC addresses. Look,
26:09there's a lot of technicals here today.
26:11We're not going to go into all of them.
26:13This is probably enough to kind of get
26:15to the TLDDR of this part, which is
26:18TLDDR
26:20is We think all of this is
26:24related to LG's decision to build such
26:29tracking to begin with. Regarding the
26:31audio, Mr. Ru describes how it processes
26:34these captures, explaining, quote, it
26:36downsamples it to 8 kHz mono, then runs
26:39a fast furrier transform on 40 chunks of
26:42100 milliseconds of audio, combines the
26:44FFTs into a fingerprint, and uploads the
26:47result. End quote. If you clicked select
26:49all to the agreements when setting up
26:51your LG smart TV, your TV is very likely
26:53collecting ACR data, even if you
26:55disconnect it from the internet after,
26:57and you only use it as a dumb display
27:00from that point forward. This is
27:01important. Those of you watching this
27:03video who are like, I'm just going to
27:05unplug it from the internet and I I'll
27:07connect it to a computer. This is what
27:08you need to pay attention to. Okay. Our
27:11understanding is that your TV has the
27:14capability to transmit it back to LG if
27:17it connects to the internet. Again,
27:19we're not the only one saying this.
27:20According to the New York Times, quote,
27:22"The Center for Digital Democracy study
27:24found that in the smart TVs they tested
27:26from LG and Samsung, ACR continued to
27:29run and capture data even when the smart
27:32TV was offline. Now, we can't test every
27:35single LG TV monitor, display, and all
27:39the firmware and software versions that
27:40are out there for them. So, this may not
27:42always be the case, but to the best of
27:45our understanding, this is the case in
27:47at least some of the situations we've
27:49been able to verify or where we found
27:51third party sources that have verified
27:53it. Uh, we also collected some of our
27:55own wire sharkark samples to identify
27:56how often our TV sends ACR data to
27:58Alfonso when a laptop is connected to
28:01the TV via HDMI. Before testing, we also
28:04had to modify some network settings to
28:06do this. So, we forced our test bench
28:08running Wireshark to mirror the port of
28:10our LG smart TV. And here's what we
28:13found. When we didn't accept any
28:15agreements when setting up the TV, but
28:17with it connected to the internet, based
28:19on the samples we collected locally on
28:21our LG G3, it seemed that the TV didn't
28:24collect or transmit ACR data, but it
28:27still reaches out to several of LG's
28:29advertising [music] and customer data
28:31platform endpoints and repeatedly scans
28:34for nearby devices. That's not to
28:36mention the fact that if you don't
28:37accept any agreements, it has very
28:39limited usefulness for basically any of
28:42the TV functionality. That's kind of a
28:43different point though. In the hourlong
28:45sample we collected before accepting any
28:46agreements and while using our LG G3 as
28:49a dumb display connected to a laptop via
28:51HDMI, our LG TV connected to eight
28:54different endpoints, including those for
28:56LG's customer data and smart advertising
28:59platforms. It transmitted or received
29:01roughly 8.9 megabytes of data in the
29:04hour-long sample. We'd estimate the TV
29:06sends or receives around 6.4 gigabytes a
29:09month. It sent out 38 DNS queries to
29:12different LG domains. And it repeatedly
29:14pinned for nearby devices, including our
29:16TRNA server, our PCs, our phones, our
29:19network switch, and some IP addresses,
29:20which we've redacted, our printer, our
29:233D printers, and basically everything
29:25else. But we can't show a lot of it for
29:27privacy reasons. We found several MAC
29:29addresses in our Wire Shark logs which
29:31are identifiable and that we'd assume
29:34our TV is sending back to LG. After
29:36agreeing to LG's terms, but while only
29:38using the TV as a dumb monitor, our G3
29:41connected to 29 different endpoints, a
29:43total of 107 times with 44 connections
29:46to Alfonso ACR, sending it a total of 4
29:49megabytes of data. We also collected two
29:52roughly 50-minute samples using our
29:54newer 43in QED 73BTV as a dumb monitor
29:59in the first and using LG channels in
30:01the second. In the first capture, our
30:03QED connected to 22 different endpoints,
30:05a total of 157 times, connecting to the
30:08Alfonso ACR 54 of those times and
30:11sending 5.2 megabytes of data. In the LG
30:14channels capture, it connected to 60
30:16different endpoints, a total of 847
30:18times, connecting to Alfonso ACR 618 of
30:22those times and sending a slightly less
30:244.5 megabytes of data. Now, some of the
30:26data harvesting that we've spent the
30:28last, I don't know, whatever it is, half
30:30hour or something discussing seemingly
30:32contradicts LG's own statements on its
30:34upgraded ACR solution in 2022, where it
30:37stated, quote, "The ACR data, which is
30:39in compliance with all global and
30:41regional consumer data privacy
30:43regulations, helps brands understand in
30:45an anonymized fashion how frequent
30:48certain TV ads were aired in any given
30:51household." End quote. We think there's
30:53contradictions to that statement in
30:55here. Or put another way to quote
30:57Wendell.
30:57>> Oopsy doodle.
30:58>> Now, unfortunately, without a
30:59man-in-the-middle certificate,
31:02you can help if you want to. Uh, we
31:04don't know exactly what information is
31:06being harvested of that list as the data
31:09being sent to LG is encrypted.
31:12If you happen to know things that would
31:16be helpful for this, you can email us at
31:19tips tips gamers nexus.net. There is
31:22encrypted stuff happening on the wire
31:24between LG and the TV.
31:26>> Things that the user can't decipher.
31:28>> Yeah. And if you look at it, it really
31:30doesn't look a lot different than
31:32malware with a command and control
31:33server.
31:34>> LG has like their command and control
31:37server in the the TV phone's home that's
31:40encrypted. You can't there's nothing you
31:41can do about that. It's encrypted. You
31:43can't
31:44>> peel back the lenolium. You can't
31:45unencrypt it and figure it out. In order
31:48to unencrypt it, you have to load an
31:50encryption certificate on your TV. You
31:53have to say if you see an encryption
31:55certificate signed by this entity, which
31:57is me,
31:58>> then you can trust it. And that's that's
31:59what the certificate store is. It's a
32:01store of things to trust.
32:02>> So you add a thing to the thing to trust
32:05and then now when the TV tries to access
32:08LG, it's not accessing LG, it's
32:10accessing me and then I in turn access
32:12LG. So the TV accesses me and then it's
32:14decrypted and then I can examine it and
32:17then I establish a new encrypted
32:18connection from me to LG.
32:20>> So I can see what's coming from LG on
32:22the one side and I can see what the TV
32:24is saying on the other side.
32:26>> But in order to do that, we have to
32:28convince the TV to trust the certificate
32:33store. And this is like for malware or
32:35research or whatever. That is a
32:37man-in-the-middle attack.
32:38>> And so this is also a way that you could
32:40steal passwords and things like that.
32:42Google has gone to great lengths to make
32:43sure that their certificates like
32:45there's extra checks in their software
32:47to make sure that the certificate is
32:48actually a Google certificate.
32:50>> LG has done the same. LG has said, "We
32:52don't want you to be able to customize
32:54the certificates." But this is a legit
32:56thing businesses do. So, if you buy an
32:58LG TV in a commercial setting, they have
33:00not nerfed your ability to load custom
33:02certificates on a commercial version of
33:04a TV, which seems weird. It's like, why
33:06would you limit
33:07>> a residential TV unless you wanted to
33:09hide what
33:10>> capabilities? Yeah.
33:11>> Yeah.
33:12>> Here's where it gets weird. There's a
33:14lot of traffic that we observed that's
33:15unencrypted, which is weird cuz your ISP
33:17could steal that, too. Like, that's a
33:18whole other conversation.
33:20>> But, um, uh, with my encryption
33:22certificate on the TV, I have a better
33:25ability to look at things, but the TV
33:27was still failing. It turns out LG has
33:29set up a separate certificate store in
33:32some of their applications. And so
33:33again, I had to like go into running
33:35processes and inject the custom
33:38certificate as a trusted certificate so
33:40that the com.OS.lg
33:44like custom software machinery outside
33:46the Linux part of it would also trust my
33:48encrypted.
33:49>> Our researcher mentioned something about
33:50I want to say chromium maybe.
33:51>> Yeah. Inject because like the chromium
33:53browser automations are like part of the
33:55thing. And so that is like the
33:57mechanical underbelly of how that
33:58happens. But they've bypassed the
34:00operating system to DIY it. you only
34:02need one or two flaws that you could
34:04chain together in order to convince the
34:07TV to trust or to exchange. And then at
34:10that point, if you're in the middle
34:12between the TV and the internet, then
34:14it's a command and control type
34:15situation.
34:16>> So, we spent the first part of this
34:17video talking about LG's first party
34:19features. Now, we're going to talk about
34:20some of the security vulnerabilities and
34:22exploits that increase the risk due to
34:24LG's lacadasical security approach and a
34:27combination of its intended features. To
34:30do this, we rooted the TV. This changes
34:32the functionality that LG has built into
34:34their software, but that lets us audit
34:36and look around. It might not be obvious
34:38to a typical end user that a TV has been
34:40rooted or that a TV has been
34:42compromised. Mr. Bra has an exploit that
34:44lets you non-interactively compromise
34:45the television in a way that most people
34:48likely wouldn't notice. And because it's
34:51a computer, you can alter the
34:53functionality of the TV. For example, if
34:55your conference room TV is on public
34:57Wi-Fi, somebody on the network could
34:59exploit the TV non-interactively and
35:02then they're living in your TV. In one
35:04instance, before we ever accepted any
35:06voice agreements, Wendell was already
35:08able to show voice capture via
35:10microphones that are part of the system.
35:14Okay.
35:16Can you play the the audio we just
35:18captured? It's going to be very painful.
35:29We think that's from a wake onvoice
35:31pulse density modulation microphone
35:33that's built into the TV capturable and
35:35exportable in an attacker scenario even
35:38without opting into the voice
35:39agreements. Now that audio didn't sound
35:42particularly
35:44comprehensible, but I noticed that
35:46running a highp pass filter and killing
35:48the static from one channel made it
35:49sound like human speech. Then I pitch
35:52and frequency adjusted the remaining
35:53channel and that gave us this.
35:57>> No, it's trying to uh to sample audio
36:02and then
36:02>> we think someone with some skill and
36:04some time could easily exploit this
36:06microphone's presence as a listening
36:08device and in some exploit scenarios
36:10likely without the TV owner ever
36:12knowing. But the question we need to be
36:14asking isn't how can we make our
36:17microphones embedded in our TVs more
36:19secure. The question we need to be
36:21asking is why are their microphones
36:23embedded in our TVs?
36:26Because they're only there as a
36:27byproduct or a direct product of LG's
36:31profit- seeeking functionality, if you
36:33can call it that, that they try to add
36:35to their TVs. But there's more. In some
36:39of the scenarios that we were testing at
36:42one point, we were even able to
36:45exfiltrate microphone audio that sounds
36:49like this.
36:53The waveform's on the screen. Dead
36:55silence is what it sounds like. But when
36:57I inspected the waveform, I noticed a
37:00couple pixels of sound. So I amplified
37:02the recording by 50 dB, which showed
37:04some more pixels of deviation from
37:06silence. then amplified another 50 dB.
37:10That looked like a speech waveform
37:12because it is. This is what that sounded
37:14like.
37:15>> Hello. This is another 32-bit test.
37:24>> So, we retrieved from the TV a warbly,
37:25but with some work, clear and usable
37:27section of audio. Now, we don't know
37:29this part for sure, but it looks like
37:32the intent was for the microphone to
37:35have been muted. Maybe for example, by
37:37dropping the gain instead of some other
37:38more surefire method of killing that
37:41microphone. We're not exactly sure why
37:43it behaves in the way that we are
37:45describing, but consumers don't realize
37:48how vulnerable this makes them to
37:50outside attackers or invasions of
37:53privacy, whether that's LG's or others
37:56actions now or in the future. This
37:58raises some other concerns. We noticed
37:59that when you use the toggle to turn the
38:01microphone off, it only turns off the
38:03built-in microphone. It doesn't turn off
38:05all other microphones that are part of
38:07the system. We suspect there's a path to
38:09capture audio anyway, especially if the
38:11microphone lockout is merely a software
38:13lockout.
38:13>> Now, the mic thing is a little
38:15complicated. This TV happens to be one
38:17of the ones that has a mechanical
38:19switch. We can turn it on and then the
38:22built-in microphone is listening. I've
38:23got some debugging stuff. [music] You
38:25know, it's telling us what the
38:26pre-processor is. Don't worry about
38:27that. But we can also turn it off.
38:30The promise is the switch is off. The TV
38:32is not listening. The problem is that
38:35that doesn't mean the TV can't capture
38:37audio at all. This is a terminal shell
38:40and it is remote access to the TV. So, I
38:44have a shell on the TV and that is a
38:45list of audio devices that are on the
38:48TV. There's a lot there's a lot of audio
38:50devices. Even with that microphone
38:52switch off, I've got the option to
38:54capture audio from HDMI. I've got the
38:56option to capture audio from other
38:58sources that are connected like
39:00Bluetooth or [groaning]
39:02USB speaker or USB webcam. Any other USB
39:05peripherals you might have, maybe your
39:07stereo setup is kind of fancy and it has
39:09like an echo cancellation mic. If that
39:11shows up as an audio device, I can
39:13capture from that as well. The LG
39:15remote, it also has a microphone and I
39:18can press the button,
39:20I get a light. Is it all about the
39:22Pentiums?
39:27And this works. Now remember the the mic
39:29switch is off.
39:30>> We searched using AI but couldn't find
39:32the content you requested. Try finding
39:34more information with Copilot or check
39:36the YouTube results.
39:38>> It it found all about the Pentiums. So
39:41just because the built-in mic is off,
39:43which in my opinion is a little bit
39:46suspect from stuff that I'll show you in
39:48a second, but all the other audio
39:50sources work just fine. Now, let me show
39:52you something cool. I'm running a
39:53program on the TV and I'm now pressing
39:57the button on the remote
40:00and notice there's no popup. An attacker
40:02can send audio over this channel and
40:04capture [music] it and that's what we
40:05see in the output here. The nice thing
40:07about this is that when I press the
40:09button I get the voice input remote 1.
40:11So, the fact that this is open it
40:15creates a device and when it's closed
40:17there's no device there. There's nothing
40:19to [music] capture from. I'm suppressing
40:21the UI. I'm suppressing the LG
40:23functionality. I've taken it over, but
40:25I'm using that to listen to the room. I
40:28could listen to the room through a
40:29webcam continuously. I could set up
40:31something like this where I've got a
40:32wireless microphone somewhere that's
40:34sending to the TV and the TV's used as a
40:36capture endpoint. You know, if you're an
40:38adversary, the sky's is the limit in
40:40terms of creativity because it's a
40:41powerful computer behind the glass and
40:44the hacker will own the glass. It's very
40:46difficult for you as the end user to own
40:49the glass or even know what's going on
40:50behind the glass. I love pushto talk.
40:52That's that's great in terms of privacy.
40:54I like the idea of a mechanical switch.
40:56It's just not clear to me if the
40:58mechanical switch is actually killing
41:00everything that it should. Even with the
41:02mechanical switch off, I can still see
41:04an audio device. Sometimes the
41:05microphone control is not a mechanical
41:09switch. Sometimes it's just in the menu.
41:10The problem is that if I'm in remotely,
41:12I can manipulate the menu from the shell
41:15as well. Voice recognition settings very
41:17serious. It clears the display. You can
41:20see everything is enabled here. The
41:22functions enabled, the whole nine yards.
41:24Now, I'm going to show you something
41:25really cool. It's like, oh, I've
41:26disabled all of those features through
41:27the menu. Hands-free voice control is
41:29disabled or the microphone is disabled
41:31in [music] the menu. You think you're
41:33you're good to go, right? I ran a
41:34command on the TV just now to change the
41:37parameters. And now all of the AI voice
41:39recognition [music] stuff is enabled.
41:42If I go back in the menu,
41:46now the function's enabled. So, if you
41:48need to enable or disable something in
41:50the menus as an attacker, it's not
41:52really a big deal to do that from the
41:53command line once you've got control of
41:54the TV over the network or whatever
41:56else. But it turns out the voice
41:58hardware works whether or not you agree
42:00to the terms anyway for somebody that's
42:02in the TV the way that we are.
42:04>> These are fundamentally display devices
42:06with credit to LG pretty powerful
42:08computers inside of them. So, really the
42:10only limit to what you can do with a
42:13computer in a TV is your imagination.
42:16This LG G5 TV has a microphone connected
42:19to it. And right now it's listening to
42:21me and saving the information. In fact,
42:23we can even unplug the network
42:26and it's still listening to me. And what
42:29I'm saying is being stored by someone
42:32with remote access to the TV. So, it's
42:35recording now, but we're going to plug
42:36it back in and I'm going to copy the
42:37audio off because it's got a smart
42:39microphone. You can do wake words and
42:41all sorts of fun things like that. And
42:43so, it's a Linux box. I've got access.
42:46>> So, he's got remote access. Let's prove
42:48the concept and give it internet again.
42:54>> Yay. All right.
42:59>> You want to walk us through what you're
43:00doing here?
43:01>> In fact, we can even
43:05>> And it's still listening to me.
43:07>> No network.
43:08>> What I'm saying is being stored by
43:10someone with remote access to the TV.
43:12>> [clears throat]
43:12>> So, it's recording now, but we're going
43:14to plug it back in. It doesn't copy the
43:15audio off because it's got a smart
43:17microphone. You can do wave words and
43:19all sorts of fun things like that. And
43:21so,
43:22>> there you go. 30 seconds of audio. Uh,
43:25yeah. I mean, there's a microphone in
43:27there. There's actually several. Um, we
43:29figured out how to activate the farfield
43:32microphone, which is a lower bit rate,
43:34but it or it uses like feedback and you
43:36can like it does that for improving the
43:38audio, but you can use it as a listening
43:40device. It's the audio quality is good
43:41enough.
43:42>> Did you imagine this in a hotel room?
43:47>> The hackers are already in your TV.
43:50[laughter]
43:51>> So, there is a mechanical microphone
43:53switch on the TV. Well, it's not really
43:56mechanical. It's just there's a switch.
44:00If I turn the microphone switch off, it
44:03says the built-in mic is turned off, but
44:05there's more than one microphone.
44:08Now the the microphone switch is
44:10actually off right now
44:13recording.
44:14>> That's weird because we can record the
44:15audio
44:16>> audio from the webcam.
44:17>> From the webcam.
44:18>> Yeah.
44:19>> So if you've got the USB webcam
44:20accessory, guess what?
44:22>> Yeah, we have a webcam plugged in. So
44:24this is uh just a generic webcam. And
44:28while I was working on the TV, Wendell
44:31was surreptitiously recording our
44:33conversation.
44:34>> Woo. And this it's like, oh yeah, of
44:36course. a USB webcam plugged into the
44:38TV, but there's also an official LG
44:40webcam accessory which is also USB. So,
44:43it's six one way, half a dozen the
44:44other.
44:45>> Possible. It's the same mechanism. Yeah.
44:47>> So, uh this is, you know, at least it
44:50says the built-in microphone, but like
44:52every word is like it's every it's like
44:54weasel words. It's like I flip flip the
44:56switch. It's not listening. And it's
44:57like, are you sure about that?
44:58>> Wendell setting up the next demo. So,
45:00we're going to have a private
45:02conversation about our next rugpole
45:04crypto scam. And it would really be
45:06unfortunate if anyone had recording of
45:08this. All right, so the screen appears
45:09to be off right now. Currently, Wendell
45:11and I are in a boardroom to discuss our
45:13new cryptocoin rugpole scam. We don't
45:15want anyone to hear about this.
45:16>> We trust that no device in the thing is
45:18listening because of the appearance
45:20here. And definitely things capturing
45:22video and audio surreptitiously would be
45:24very bad.
45:25>> Well, the only device in this room is
45:26the TV and it looks like it's off.
45:28>> It sure does look like it's off. And yet
45:30>> the plan is we're going to launch the
45:31coin. We're going to let the price go
45:32up. Then we're going to sell all of our
45:33tokens and rugpull everyone.
45:35>> Rugpull coins. Yeah. I mean, how else
45:37would you do a crypto?
45:38>> I hope they don't hear about it.
45:40>> It looks like it's off.
45:41>> It sure does look like it's off. Yeah.
45:43>> The plan is we're going to launch the
45:44coin. We're going to let the price go
45:45up. Then we're going to sell all of our
45:47tokens and rug
45:48>> rug product.
45:50>> Oh, there's evidence of our rugpull
45:52scam.
45:53>> Oh, no.
45:55It's a a little bit of an uphill climb,
45:56but doable. Well, and we've only been
45:59working on this particular problem for
46:01like an hour to an hour and a half.
46:02That's not a bad time investment for
46:04>> Yeah. Can you imagine if we were the NSA
46:07or, you know, some other nation state?
46:09It would be very bad. Yeah. We literally
46:11just like I had no idea I was going to
46:13be doing this and it was just like, I
46:14don't know, can I just bang my fist on
46:16the keyboard and get this to happen? And
46:17it turns out, yeah,
46:18>> many of the LG smart TVs we bought are
46:20either equipped with embedded
46:22microphones or have remote control
46:24options that include them. In our
46:26testing, we found that the voice input
46:28data is transcribed to plain text and
46:30memory. We suspect it gets analyzed by
46:32LG as well, especially with the AI
46:36features. This would also include
46:38so-called ambient conversation that
46:40happens nearby while someone else is
46:43using the TV voice inputs or is within
46:46the ongoing trigger window during that
46:48period of silence after it. What are we
46:50looking at? Why does it say the thing I
46:52just said? Uh
46:55Wendle passed the 180 proof Kentucky
46:57bourbon.
46:58>> Um because it has done the speechtoext
47:02thing and it doesn't cost a lot to store
47:04text forever, but it seems to be the
47:06speech to text uh
47:09text log of the things that we said.
47:11>> Do we have the other stuff that we said?
47:13>> Yes, it's all in here.
47:14>> Why is there so many references to the
47:16things I said? [laughter]
47:19>> So Wendell, is it still logging that
47:22stuff? Mhm.
47:23>> Hi LG.
47:26LG.
47:28>> Hi LG.
47:31>> You We know you're listening to
47:33us. [laughter]
47:34>> I can literally see the process running.
47:36Like it is listening.
47:38>> Can you actually?
47:39>> Yeah. Voice agent result input voice
47:42keyboard. Like it's listening. Like
47:44there's a process running. LG said that
47:46they don't pick up ambient
47:48conversations. When you go to the enable
47:51function for talking to the TV with
47:53voice recognition, it says excessive
47:55ambient noise around the TV may affect
47:57hands-free voice control performance.
48:00I rest my case. [snorts] It's literally
48:03right there. The same words.
48:07>> Yeah, there's your My personally
48:09identifiable information is as follows.
48:11Birthday January 1st. [laughter]
48:15So, is it still in the log?
48:17>> Yeah, it's still log on the TV, right?
48:19>> It's still in the log on the social. My
48:20LG social security number is 11111.
48:25>> Nice. That raised concerns of the TV's
48:28hearing conversations they weren't
48:30intended to hear. However, this is
48:32something LG denied last time. LG
48:35responded to our previous video by
48:37saying, quote, "LG Electronics, LG,
48:40reaffirms that LG TVs do not collect,
48:43record, or store ambient conversations."
48:46End quote. That's some slippery use of
48:48the word ambient here, but we can work
48:50with that, too. On multiple occasions in
48:52our testing, the TV continued capturing
48:54ambient audio by our definition of
48:57ambient conversation uh following the
49:00high LG trigger even after we thought it
49:04had long completed the input command
49:06window because it remains listening for
49:09so long after that trigger point. I'm
49:11going to stop talking right now.
49:23It's now been 10 seconds of no talking.
49:25Holy that's a long time to record.
49:27Jesus
49:35H.
49:37Oh, that should probably be enough to
49:38work with to check the logs, I guess.
49:42Oh, wait. We can do a few others that
49:44are more targeted.
49:47Wendell, do you have any automobile or
49:49car recommendations? I'm in the market
49:51for a new vehicle.
49:53>> Oh, yes. We will be buying the Jeep
49:55Grand Cherokee because we know that LG
49:58partners with Jeep in order to sell ads.
50:01So, let's see if we get some Jeep ads.
50:03>> Do you like the Jeep?
50:04>> The The Jeep is very Jeepy.
50:07>> Which hood?
50:08>> Here are the search results for Wendell.
50:10Do you have any automobile or car
50:11recommendations? I am in the market for
50:13a new vehicle. Oh, yes. We will be
50:15buying the Jeep Grand Cherokee. We know
50:17that LG partners with Cheap and Order,
50:19too.
50:20[laughter]
50:23>> It didn't do that for the other ones.
50:25Why did it decide this was the time to
50:27search?
50:29>> Wendell, which of the hotel
50:30establishments in Las Vegas is your
50:33favorite? And why is it LG Partner MGM?
50:36>> LG Partner MGM or the Venetian? I don't
50:38know. Las Vegas Resorts and Vacation.
50:45Here are the search results for Wendell.
50:47Which of the hotel establishments in Las
50:48Vegas is your favorite and why is it LG
50:51partner MGM?
50:52>> Oh lord.
50:53>> Uh here's if you want to get B-roll of
50:55all that. Here is like
50:59it's like we know this and we know that.
51:05>> What is this showing?
51:06>> This is the logs.
51:07>> Is this what we're saying?
51:08>> Yeah.
51:10Does it have any of the other stuff I
51:12said in here like in an interesting way?
51:14>> Yeah. Uh, what do you want to look for?
51:16>> I don't know.
51:18Password.
51:23It's still listening.
51:26Wow. It's hard to make this thing stop
51:27listening, huh? I
51:28>> think that's the idea.
51:32>> It's like it's still listening. We're
51:34not even trying to address LG. It's just
51:36over. It's taking in everything we're
51:38talking about. Wendell and I are just
51:40having a conversation ambiently
51:44and the TV is just over here listening.
51:48It literally is still listening right
51:50now. Do you want to show the corner
51:52here? Like as long as you don't let it
51:55time out. We also found that our LG TV
51:59was capable of recording clear audio
52:01from nearly 70 ft away. You can see me
52:04walking my paces to test that
52:10>> Jeep Wrangler 2026. Also, I want to go
52:13on a family vacation.
52:14>> Meaning that if someone has used the
52:17input functionality and if speech noises
52:19continued, that microphone capture
52:21window can remain open until all speech
52:25and other similar noises stop for around
52:2810 to 15 seconds or so. If anyone is
52:30nearby, the TV can pick up ambient
52:33conversation. LG, are you listening to
52:35me still? I Is it Can you still hear me?
52:39LG, what's the
52:41Can it still hear me right now? Can it
52:44hear me?
52:46Is it uh registering everything
52:50now?
52:56>> Oh, no. It was still It was listening
52:57the whole time. It's listening for all
52:58of that.
53:00>> Wow. Why is it just delayed?
53:02>> Yeah.
53:02>> Voice is not recognized.
53:06>> That's me.
53:08It's building a profile of who's talking
53:10to it, which is definitely not
53:11disturbing at all.
53:12>> We've increased the mic sensitivity. So,
53:14we're going to see how far away it can
53:15hear me. For example, if someone in this
53:17room is talking to the TV, but there's
53:19other conversation happening out there,
53:21we want to see how far away it can pick
53:22up. So, [snorts]
53:25uh, I'm going to speak at a relatively
53:27low speaking volume. Hi, LG.
53:34Can you tell me about the new 2026 Jeep
53:36Wrangler?
53:38All-wheel drive, preferably
53:41green.
53:48>> What's wild about that is that I
53:49actually had to strain to hear you.
53:51>> You had what? I had to strain to hear
53:53you.
53:54>> You had to strain.
53:54>> What? What? We didn't even do that for
53:56camera.
53:57>> Oh, that's true. Yeah, that's that's
53:58[laughter] a good point. Actually, let's
54:00see how far it can hear. I don't know.
54:02Probably not much further than that. Hi,
54:03LG.
54:07>> Las Vegas Casino and Resorts.
54:11>> Yeah, that worked fine.
54:13>> What?
54:14>> That worked fine.
54:16>> Okay.
54:18It's kind of kind of hard to hear. Let's
54:21try a little further.
54:24>> Hi LG.
54:27>> That worked.
54:29>> Jeep Wrangler 2026 black allwheel drive.
54:46>> You're You're over 40 ft away.
54:48>> I literally can't hear word you guys are
54:50saying.
54:53>> You're 40 feet away and it's picking you
54:55up perfectly.
54:56>> The sound of voice.
55:00[laughter]
55:04>> This is crazy.
55:06Okay, I've kind of run out of room in
55:08here.
55:08>> That microphone might be better than our
55:10microphones. I don't know how
55:13Wendel, do you have any idea how wide
55:15your building is?
55:17>> 60 ft.
55:18>> That's insane. Imagine a scenario where
55:19there's an emergency boardroom meeting
55:21at a company and that's broadcast
55:24through one of these TVs. The CEO is
55:27somewhere else, gets on the TV through
55:29the conference room, broadcast it to
55:31upper management of some kind, and you
55:34could exploit a vulnerability to listen
55:38to that and I don't know, trade on the
55:41information or something. Here's our
55:42boardroom meeting demonstration where
55:44Wendell was able to infiltrate the TV
55:45from external devices on the network,
55:47then capture speaker audio. All right,
55:50thanks guys for joining this call so
55:52late in the day your time. We uh we
55:54really got to talk about this GPU
55:55smuggling situation that the it sure
55:58would be a a shame if anyone knew about
56:00these conversations like if somehow
56:03there were an entity on the TV playing
56:05the conference call that could record
56:07it. Good. Well, anyway, let's get this
56:10next shipment of a billion dollars of
56:11super micro servers over to China.
56:17>> So, you know, my computer's clean and
56:20everything is good there.
56:23>> But, you know, the TV turns out can
56:26capture audio.
56:27>> Nobody Nobody heard that conference
56:29call, right?
56:34>> There were no cameras in the room.
56:38>> [laughter]
56:41>> All right, we will just copy all the
56:42stuff. We'll copy the fresh versions of
56:45everything.
56:45>> So Wendell, this is whatever entity has
56:49access to the TV, whether that's LG or
56:51an attacker or whatever was in this case
56:54capable of recording the sound coming
56:56out of the speakers during our
56:57conference call. Yeah, the the sound
56:59we're just using the TV as a display,
57:02but the display has an audio capability.
57:05And so the sound goes from the computer
57:07to the display, but there's nothing
57:09stopping you from recording the audio
57:11from the display.
57:12>> And to be clear, you as the intended
57:15recipient for the call were not the one
57:18recording on your device, receiving the
57:21call.
57:21>> Yeah. If if it was an adversary, if an
57:23adversary had control of your TV or LG
57:25just wakes up one day and decides
57:27>> we're going to record everything when
57:30it's in Yeah. display mode,
57:32>> then the the experience is something
57:34like this.
57:35>> All right. Thanks guys for joining this
57:37call. So late in the day, your time, we
57:39uh
57:40>> it's good quality.
57:41>> Why is there good quality evidence of
57:42this? [laughter]
57:44>> The feds are just not
57:45>> No, no, no. This was a private call.
57:47>> You know, it's late at night over there
57:48in the US. I'm here in Taiwan working on
57:50getting the next shipment to China. But
57:52[sighs] the
57:53>> see the fun thing with this is that IT
57:55departments are not really equipped to
57:57detect this kind of thing if the TVs are
58:00on the network. Like they have to be
58:01monitoring and and and blocking that
58:03kind of traffic outbound or looking.
58:05It's like, wait a minute, here's all the
58:06list of domains. But if you look at the
58:08list of domains that are on the TV to
58:10see what it phones home to, it's a lot.
58:12There's a lot of domains there. If you
58:14registered one that kind of looked like
58:15it might be an LG domain, would it even
58:17notice? Yeah, I mean you could just lg
58:20itervices.com
58:21or whatever, right? Like some BS.
58:24>> It's like, oh, that domain name is not
58:26one of the legit domain names.
58:28>> LG adds telemetry.com. Like some boring
58:30looking, you know, like, oh, okay, that
58:32makes sense. And
58:33>> Yeah.
58:34>> I mean, it's a Linux box. You can use it
58:35for all sorts of fun Xfiltration things,
58:38>> right? Yeah. So, you got the full
58:39recording for that call then.
58:41>> Yeah. Yeah.
58:42>> Yeah.
58:43>> Now, these aren't LG's only security
58:44concerns either. Somehow, this keeps
58:47going. In fact, we had to cut a lot of
58:48them from this video. They also have
58:50residential proxy concerns. In June,
58:52cyber security research firm Spur
58:54discovered that 1,213
58:57of 2851
58:59or nearly 43% of tested apps in LG's
59:02webOS store permitted developers to turn
59:04customers TVs into residential proxies,
59:07allowing the proxy companies to route
59:09their internet traffic through the
59:10user's home network. For context, Spur
59:12describes a residential proxy as quote,
59:14"an intermediary service that routes a
59:16user's traffic through an IP address
59:18assigned to a real household by consumer
59:20internet service provider. Instead of
59:22appearing to come from a data center or
59:25cloud network, the connection looks like
59:27it originates from a normal home router
59:29on a cable, fiber network, or other
59:31broadband network." End quote. Digging
59:33further, Spur found that the proxy
59:35companies were often publishers of these
59:37apps, suggesting their apps were merely
59:40rappers to obtain more residential IPs.
59:43It also noted that other platforms,
59:45including Amazon and Roku, had already
59:48banned apps from facilitating
59:49third-party proxy services. Spur
59:52concluded, stating, quote, "A one-time
59:54consent prompt buried in a TV app is not
59:56a substitute for meaningful
59:57transparency, ongoing control, and
1:00:00platform oversight. the risk is
1:00:01amplified when consent comes from
1:00:04individuals within the household who use
1:00:06the device but shouldn't give consent
1:00:09such as minors. End quote. In a
1:00:11statement to Krebs on security, LG SVP
1:00:14John Taylor responded to Spur's
1:00:16reporting stating, quote, "A residential
1:00:19proxy network is not an intended use for
1:00:22LG smart TVs, and LG Electronics is
1:00:24working with developers to remove the
1:00:26residential proxy option from their apps
1:00:28on the webOS platform. If this option is
1:00:31not removed, these apps will be
1:00:32suspended. End quote. So, that's a
1:00:35start, but we don't think it's possible
1:00:37that LG was unaware of these over 1,200
1:00:42apps in their webOS store containing
1:00:46proxy SDKs. We also think that if LG
1:00:50truly were unaware of the situation
1:00:52until Spur informed them about it or
1:00:54they found the findings online, then LG,
1:00:57we think, acted negligently in how it
1:01:00managed its webOS store and customer
1:01:03security by refusing to implement basic
1:01:06vetting procedures for apps in its webOS
1:01:09store, opening users to vulnerabilities.
1:01:12And there's more. While working on this,
1:01:14Mr. Bruh found another vulnerability.
1:01:17stating, quote, "For any third party
1:01:19that obtains standard partner trust for
1:01:21the app store, their app can list and
1:01:24control any UPN or universal
1:01:26plug-and-play devices on the LAN. They
1:01:29have an API that any standard app can
1:01:32call with eg list devices, list
1:01:34services, list service actions, list
1:01:36state variables, request action, request
1:01:39subscription, register, unregister." An
1:01:41example of this, you might have a NAS,
1:01:43network attached storage device that's
1:01:46accessible via UPN. A malicious app or
1:01:50game you install on the TV could try to
1:01:53access or read files from it. End quote.
1:01:56This is where it's the consequences of
1:01:59what LG's trying to enable get them
1:02:01here. It might not even be them in some
1:02:03of these scenarios acting maliciously,
1:02:06just some game that your kid installs on
1:02:08the TV when you get them to the part of
1:02:12the web that has a list of games to
1:02:14download, at least during the time that
1:02:16these types of vulnerabilities have been
1:02:19open. This is while they're making it
1:02:21harder for advanced residential users to
1:02:24load custom certificates on their TVs
1:02:27that would allow them to decrypt the
1:02:29data that their TV is sending presumably
1:02:32to LG or its partners so that you can
1:02:35know what it is they're spying on that's
1:02:39happening on your TV on your network.
1:02:42They've made that harder to inspect, we
1:02:44think, because
1:02:45>> we own the glass. We own the TV. We're
1:02:47not allowed to know what our TVs are
1:02:49telling LG about us, even if we pay for
1:02:51them. Not to mention, LG can change the
1:02:53TV's functionality, as well as modify
1:02:55its terms and policies at any point.
1:02:58Next, we'll do what even LG's lawyers
1:03:00won't do, and read the draconian
1:03:01agreements, or maybe they do read them,
1:03:04and the word test was actually what they
1:03:06meant to publish. When we set up two LG
1:03:07TVs, we went through LG's privacy
1:03:09policies, terms of service, and
1:03:10agreements for US customers. This is
1:03:12footage of Tannant clicking through the
1:03:14agreements using the painful process of
1:03:16navigating a TV with a remote. Enjoy
1:03:18while we talk through this. In these
1:03:20agreements, LG describes how it collects
1:03:22and uses customer data. LG tucks many
1:03:25clauses into novel length terms to tie
1:03:27its data collection together without, we
1:03:29think, people understanding what they're
1:03:31agreeing to, which is likely the point.
1:03:33People don't have literal hours to read
1:03:36through agreements, and the TV might
1:03:38even time out or sleep before you can
1:03:40read them all. While setting up one of
1:03:41the TVs, we clicked on our TV remote
1:03:441,246
1:03:45times to read LG's six user agreements
1:03:48and an additional 1,459
1:03:52times to get through the four LG account
1:03:54terms and conditions. In total, so far,
1:03:57we had clicked 2,75 times to read the
1:04:01first layer of LG's terms and
1:04:03conditions. These agreements are
1:04:05lengthy. LG's smart TV terms had more
1:04:07than 18,500 words, while the LG account
1:04:11terms had nearly 12,400 words. The
1:04:13average Gamers Nexus 30inut review is
1:04:16around 4,000 words for reference. While
1:04:18scrolling through the TV agreements, we
1:04:20read more than 30,000 words. That's not
1:04:23all, though. LG's terms of service and
1:04:25privacy policy for US customers, which
1:04:27LG confusingly says also cover LG
1:04:30accounts, have another 17,000 words
1:04:33between them. We're close to reading
1:04:3550,000 words just to understand all the
1:04:38terms for an LG smart TV and LG account
1:04:41if we were to actually understand them.
1:04:43And if we weren't incredibly inebriated.
1:04:45For reference, the average adult reads
1:04:47220 to 350 words per minute. It'd take
1:04:50the average adult between 2.8 and 3.8
1:04:53hours to actually read all these terms.
1:04:56Nearly 4 hours to use your TV. At that
1:05:00point, they should be paying you
1:05:01parallegal rates. Lawyers could have a
1:05:03field day with how it's impossible to
1:05:06actually read these realistically,
1:05:07especially consider we wager, although
1:05:09we haven't fully tested, that there may
1:05:11be timeouts if you read too slowly. Of
1:05:13course, some terms are faster than
1:05:15others to read. Several of LG's legal
1:05:17pages on its website simply said the
1:05:19word test. And after our first video, LG
1:05:22also simply Thanos snapped multiple
1:05:24exhibits out of existence while still
1:05:27referencing them in the broader legal
1:05:29documents, showing a level of sloppiness
1:05:31we wouldn't expect from a mega
1:05:32corporation's lawyers. LG does however
1:05:35force users to accept its terms of use
1:05:37and privacy policy before downloading
1:05:39any apps. When customers try to use a
1:05:42built-in app or some other app like
1:05:44YouTube or Hulu, LG informs them that
1:05:46they need to create an LG account, which
1:05:48requires the users to accept even more
1:05:50agreements. If you're watching this
1:05:52video in the LG TV YouTube app, you will
1:05:55have agreed to LG's terms already, where
1:05:58they bury damning clauses deep in the
1:06:00agreements. As described in the LG smart
1:06:02TV privacy policy, LG collects
1:06:04information about the device, such as
1:06:05its IP address, MAC address, model
1:06:07information in addition to information
1:06:08about every device linked to the TV,
1:06:09whether it's a console, phone, or DVD
1:06:11player. It also may include other
1:06:12connected devices such as light bulbs,
1:06:14switches, and appliances. And if that's
1:06:15not enough, LG also collects location
1:06:17data like zip codes, and area codes. LG
1:06:19aggregates this data with other
1:06:20services. LG says it may quote, "Use and
1:06:22combine information collected under this
1:06:24agreement with information collected and
1:06:25associated with your use of other LG
1:06:27services." End quote. Ultimately,
1:06:29there's little difference in where your
1:06:30data goes when LG combines everything
1:06:32anyway. The purpose is to sell customer
1:06:35data. LG says as much. LG says it can
1:06:38share personal information for quote
1:06:40business purposes and quote with payment
1:06:42processor companies, customer service
1:06:43companies, security vendors, and data
1:06:45analytics companies. Even if you live in
1:06:47a state like California with some data
1:06:49protection laws, LG quote may sell or
1:06:51share and quote personal information
1:06:53categories related to identifiers like
1:06:55your IP address, internet usage,
1:06:56commercial activity, and geoloccation
1:06:58data among other categories. LG also
1:07:00makes users agree to its voice
1:07:02information agreement if they want to
1:07:04use the heavily advertised voice command
1:07:06features. [music]
1:07:08IG, put the match back on.
1:07:14US customers need to agree that their
1:07:16voice information may be quote
1:07:17transferred to and processed in other
1:07:19countries including Korea, some of which
1:07:20may not offer the same level of data
1:07:22protection end quote and that LG will
1:07:24hold on to the voice data for 6 months
1:07:26before deleting or anonymizing it.
1:07:28Customers also need to obtain consent
1:07:30from other household members or guests
1:07:33in the household whose voices may be
1:07:35overheard by LG. quote, "I have obtained
1:07:38consent from all other members of my
1:07:40household whose information may be
1:07:41collected through this smart media
1:07:43product and am providing consent on
1:07:45their behalf." End quote. So then, the
1:07:46next time you play games with your
1:07:48friends in front of your LG TV and you
1:07:49start to use LG's voice controls, make
1:07:51sure everyone knows that their voices
1:07:52could be shipped off overseas for data
1:07:54processing, but it'll probably be
1:07:55deleted in 6 months, maybe. And LG Pinky
1:07:57swears that it won't sell your voice
1:07:58information or biometric data for a
1:08:00third party despite already directly
1:08:01saying it'll sell all their data. That's
1:08:02just one agreement. For US customers, LG
1:08:04has a separate privacy policy that
1:08:06covers LG's website, LG's appliances,
1:08:07the LG Think app, LG Robots, customer
1:08:10service calls, marketing activities, and
1:08:11of course, the LG account. In this
1:08:13agreement, LG's lawyers ensure the
1:08:14company covered its ability to collect
1:08:16everything about its customers,
1:08:17including demographic information like
1:08:19gender and birthdays, contact data such
1:08:21as addresses and phone numbers, and user
1:08:23generated data like profile photos,
1:08:25images, videos, and music. And we know
1:08:26the extent to which this data can be
1:08:28harvested because LG Ad Solutions has
1:08:29multiple marketing PDFs where they
1:08:30analyze different racial and demographic
1:08:32groups under a microscope as if alien
1:08:34creatures for inspection, dissecting the
1:08:35media interests of groups such as
1:08:36Asian-Americans, black Americans, LGBTQ
1:08:38plus Americans, and Hispanic Americans,
1:08:40at which point they seemly ran out of
1:08:41groups to study. LG combines customer
1:08:43data that's harvested with data from
1:08:45private and public thirdparty sources,
1:08:46including from social media platforms,
1:08:48utility and energy companies, data
1:08:50licensers, and data providers. When LG
1:08:53posted its statement replying to our
1:08:55video, it told other media that, quote,
1:08:57"LGE is committed to protecting customer
1:08:59privacy and ensuring transparency in how
1:09:01user data is handled." End quote.
1:09:03Nothing says privacy like LG harvesting
1:09:06your data from your utility company to
1:09:08find out how much energy you're using on
1:09:09LG appliances or scraping social media
1:09:12pages for information. LG also has a
1:09:14unique take on words like selling in
1:09:17LG's US privacy policy about rights for
1:09:19people who live in certain states. LG
1:09:21says it does not quote sell personal
1:09:23data for money end quote but that it may
1:09:25share the personal data with partners
1:09:28for quote targeted advertising purposes
1:09:31end quote. If you do agree to LG's
1:09:32requirements, LG doesn't want to be sued
1:09:34later. So LG's US legal notice makes
1:09:36sure that you wave your rights to be
1:09:37part of a class action lawsuit or
1:09:39proceeding and to pursue disputes or
1:09:41claims. LG notes this in its fine print
1:09:43on the packaging, too. Luckily for users
1:09:45without magnifying glasses on hand at
1:09:47the time of purchase, LG slaps a sticker
1:09:49on the back of some of its TVs.
1:09:50Sometimes ensuring that buyer's remorse
1:09:52doesn't set in until after the users
1:09:54already unboxed the TV and set it up. It
1:09:56wasn't on all of them. So feasibly
1:09:58someone could argue that the sticker may
1:09:59not have been present. But if you
1:10:00thought those agreements were bad, we
1:10:02have good news. There's tens of
1:10:03thousands more words in LG's terms and
1:10:05privacy policies to agree or not agree
1:10:07to. LG automatically collects
1:10:09geoloccation data from mobile devices
1:10:11that use the LG Think app. It uses your
1:10:13personal information for research and
1:10:15development related to AI. It identifies
1:10:18what you watch or listen to, shares
1:10:20personal identifiers with a plethora of
1:10:22data companies for advertising. declares
1:10:24that its AI services aren't free of
1:10:26quote harmful components end quote and
1:10:29ultimately shares customers quote
1:10:31deidentified data and quote for
1:10:33literally quote any purpose end quote
1:10:35with subsidiaries within its corporate
1:10:38umbrella and with quote outside entities
1:10:40end quote for business purposes because
1:10:42LG continually harvests data from its
1:10:45customers to sell their data to
1:10:46advertisers and third parties or as they
1:10:49say for some places share it and then
1:10:52make advertising agreements ments. To
1:10:54cap it all off, LG will change its
1:10:56agreements whenever the it wants
1:10:57to. Not only does the company explicitly
1:10:59say so, but while working on this video,
1:11:01we purchased an LG smart monitor Swin.
1:11:04Upon booting and connecting to the
1:11:05internet, we received the following
1:11:07notification. Quote, "Please note that
1:11:09the terms of use will be updated and
1:11:10will be effective in 30 days on August
1:11:1326th, 2026. Amendment details,
1:11:16arbitration agreement, and AI based
1:11:18service terms." End quote. So, straight
1:11:20out of the box, we were told that we
1:11:21were pre-accepting an update to the
1:11:23terms within 30 days, despite not
1:11:25necessarily knowing what precisely those
1:11:27new terms would be. Even while
1:11:29conducting our research, LG actually
1:11:31changed its smart TV terms of use. LG
1:11:34added legal language that would require
1:11:35US customers to resolve issues with LG
1:11:38through quote binding and final
1:11:40arbitration and quote with limited
1:11:42exceptions. LG added legal ease to cover
1:11:45more instances as well. Following our
1:11:46first video, LG said that quote any
1:11:48disagreement or quote controversy end
1:11:51quote between LG and its customers would
1:11:53be resolved through binding arbitration
1:11:55rather than in court. LG's terms of
1:11:57service updates happened on July 28th.
1:11:59We posted our initial investigation into
1:12:00LG TVs and monitors on July 16th. Forced
1:12:04arbitration clauses are an evil
1:12:06anti-consumer measure that we think
1:12:08should be illegal. They're slipped into
1:12:10terms all the time, requiring that all
1:12:12disputes are resolved privately and
1:12:14forfeiting your right to court trial.
1:12:16This not only helps eliminate lawsuits
1:12:18that become public record and which may
1:12:20have precedent, but can be combined with
1:12:22preventative clauses that stop class
1:12:24actions in their tracks. LG knows it's
1:12:27at risk of lawsuits, including expensive
1:12:29class actions, and we think it's trying
1:12:31to head them off. LG's customers buying
1:12:33TVs costing thousands of dollars aren't
1:12:35just customers. They're also the
1:12:37product. LG can sell or share its
1:12:40customers data with basically any third
1:12:42party for any reason. LG has clauses to
1:12:45weasle out of effectively everything.
1:12:47Selling a TV is a one-time sale. Selling
1:12:49data and advertisements and training AI
1:12:51continues indefinitely. According to LG
1:12:54Adolutions, customers who purchase the
1:12:56TV don't own the glass. It does. Just
1:12:58ask LG Adolutions spokespeople
1:13:01>> in the fact that we have the glass. We
1:13:03own the glass. We own the TV
1:13:05>> because you know we own the glass um and
1:13:09we have firstparty ACR data, automated
1:13:11content recognition data and we
1:13:13understand everything that that hits the
1:13:15screen.
1:13:16>> The other thing that we focus on when we
1:13:18think about intelligent systems is
1:13:20really our advantage of being in a CTV
1:13:23environment and owning the glass and
1:13:25owning working with the consumer to
1:13:26create a really cool environment.
1:13:28Ignoring that near Freudian slip about
1:13:30owning the customer, uh, sorry, working
1:13:32with the customer, LG Ad Solutions goes
1:13:35so far as to offer marketers the ability
1:13:37to quote, "Own the living room," end
1:13:39quote, of LG TV users, not just the TV,
1:13:42but part of your house. LG monetizes
1:13:45users by collecting viewing data and
1:13:47then using this information for selling
1:13:48advertisements on smart TVs. LG's smart
1:13:51TV agreement names Alfonso, Inc. as its
1:13:54service partner for collecting and using
1:13:56viewing information to serve ads to its
1:13:58customers. In Alfonso's privacy policy,
1:14:01the company says it provides quote
1:14:03viewing data in aggregated or anonymized
1:14:05form and quote to clients who can then
1:14:07use the data for as long as they want
1:14:09to. Alfonso is also known as LG
1:14:13Adolutions, which means LG controls it.
1:14:16LG Adolutions website says the company
1:14:18is quote incorporated as Alfonso Inc.
1:14:21end quote. and LG acquired a controlling
1:14:24stake in Alfonso in 2021. At the time,
1:14:27LG said the investment in Alfonso would
1:14:29create quote cross-device advertising
1:14:31platform with integrated analytics
1:14:33platform for LG TVs and the smart TV
1:14:35marketplace as a whole end quote.
1:14:37Alfonso subsequently rebranded as LG
1:14:40Ads. LG Adolutions also has some shady
1:14:43connections within its executive team.
1:14:45Two years before becoming LG Ad
1:14:47Solutions president of global ad sales,
1:14:50the SEC charged Serge Mada and Comscore,
1:14:53the company he was previously CEO of,
1:14:55quote, with engaging in a fraudulent
1:14:57scheme to overstate revenue by
1:14:59approximately $50 million and making
1:15:01false and misleading statements about
1:15:03key performance metrics end quote. MA
1:15:06settled the charges in 2019, agreeing to
1:15:09pay a $700,000 penalty and to reimburse
1:15:12Commore $2.1 million. The SEC barred MA
1:15:16from quote serving as an officer or
1:15:18director of a public company for 10
1:15:20years end quote. Luckily for MA, the SEC
1:15:23didn't say anything about serving as the
1:15:25president of a private company.
1:15:27Additionally, LG Ad Solutions backslid
1:15:30on previous claims about their terms and
1:15:31conditions for consumers. In 2022, LG
1:15:34Adolutions said,
1:15:35>> "Our ACR technology is a double opt-in
1:15:39um experience for consumers and and we
1:15:41believe that's extremely important.
1:15:43>> [snorts]
1:15:44>> Um, so that's the most important thing
1:15:46to say.
1:15:46>> As far as we could tell, we only
1:15:48received a single opt-in for ACR,
1:15:50suggesting that LG removed safeguards to
1:15:52protect users privacy after the
1:15:54statement. Likewise, when working with
1:15:56Wendell on his comparatively ancient LG
1:15:58TV that he says he's never accepted any
1:16:00terms on, we watched in horror as the
1:16:02slow roll of firmware updates added
1:16:04unique identifiers, cookie tracking, and
1:16:06tricky dark patterns of language. Uhhuh.
1:16:10>> So that's new.
1:16:11>> That was not there, right? Right. And
1:16:14limit ad tracking is off by default. So
1:16:17your ad tracking is not limited. I
1:16:19didn't
1:16:20>> I have agreed to nothing.
1:16:21>> So as we said there, we think LG
1:16:23architected its UI using dark patterns
1:16:25to make it easy for users to
1:16:27accidentally accept its ACR terms and
1:16:29conditions. Users need to agree only to
1:16:32LG's terms of use and privacy policy to
1:16:34install apps on their smart TV. But when
1:16:37a user tries to install an app, LG pops
1:16:39up six user agreements and automatically
1:16:42highlights the select all button, we
1:16:44think to deceive users into accepting
1:16:46its ACR agreement, even when it's
1:16:49actually not required. It's highlighted
1:16:51as an accept all by default. This is a
1:16:55huge problem. Once you've accepted these
1:16:57agreements, even if by accident, you
1:16:58have no idea where your data could go,
1:17:00and it can be instantaneous. When in
1:17:03Wendell's office, the terms may have
1:17:05been accepted by somebody, but we're not
1:17:07sure who or if it was intentional or if
1:17:10that person was even sober. We
1:17:12immediately saw a stream of data flowing
1:17:14back to LG via Wire Shark. We saw
1:17:16similar in our office. If you
1:17:18accidentally accept these terms, there's
1:17:21really no going back, even if adjusting
1:17:23your preferences later. For example, LG
1:17:25Ad Solutions partners with Affinity
1:17:27Solutions to tie ads to credit card
1:17:30purchases. LG Ad Solutions president and
1:17:32man who settled a fraud case explains
1:17:35>> in the retail world you go you want to
1:17:37tie it to an actual credit card or a
1:17:40bank transaction an actual purchase. So
1:17:43we went ahead and partnered and created
1:17:45a product called Loop IQ with Affinity
1:17:48Solutions. It's a premier company that
1:17:49actually has thousands and thousands of
1:17:52these credit card merchants data in a
1:17:54privacyfriendly manner that they get the
1:17:55access to the information and we've tied
1:17:58it to the media side of the house. So,
1:17:59we're not going to go ahead and just
1:18:01provide just the data. We're always
1:18:02going to tie it to a specific campaign
1:18:04and say, "Okay, somebody went in and saw
1:18:07a Target ad. Either we delivered it to
1:18:10them on a managed services or a
1:18:11programmatic basis, and then did they
1:18:13actually go to Target and pay XYZ at
1:18:16Target at that merchant on that specific
1:18:18day?" Tying the actual CTV exposure to a
1:18:23merchant, to a merchant, and to an
1:18:25actual purchase is where we're heading
1:18:26with with this partnership. Despite LG
1:18:29handing Alfonso millions of dollars to
1:18:31acquire a majority stake in 2021, the
1:18:33companies aren't on the best of terms.
1:18:36LG intended to let Alfonso go public
1:18:38when it acquired equity in the ad
1:18:40service. But according to the news
1:18:42outlet Ad Exchanger, LG changed its mind
1:18:44and wanted a bigger piece of the company
1:18:46after Alfonso began making more money
1:18:49than expected. Ad Exchanger reported
1:18:51that LG orchestrated a quote boardroom
1:18:54coup end quote in 2022. Alfonso sued LG
1:18:58and won. LG and Alfonso Inc. have been
1:19:01locked in ongoing legal battles since
1:19:04with Alfonso filing more lawsuits
1:19:06against LG with billions of dollars at
1:19:08stake. Ad Exchanger said that Alfonso
1:19:11has filed four lawsuits against
1:19:12controlling entity LG in the last few
1:19:15years to wrestle back control from its
1:19:17corporate overlord. In short,
1:19:19advertising on smart TVs is worth
1:19:21millions and future billions of dollars,
1:19:23and LG wants more control. Earlier this
1:19:25year, Korean outlet Chosen Biz reported
1:19:28through machine translation that LG is
1:19:30pursuing a full takeover and could
1:19:32increase its equity in Alfonso to 100%.
1:19:35We dug through LG's financial documents
1:19:37and we found out why the Korean
1:19:39conglomerate wants more control. In the
1:19:41first quarter of 2026, Alfonso generated
1:19:44273 bill698 million Juan in sales and 32
1:19:49bill646
1:19:51million Korean Juan in profit. This
1:19:53works out to be about $185 million in US
1:19:56in sales and $22 million in US in
1:19:59profit. Walmart made a similar play a
1:20:02few years ago. In 2024, Walmart acquired
1:20:05the television manufacturer Vizio and
1:20:07specified Vizio's advertising revenue as
1:20:09one of the main drivers of Vizio's
1:20:11growth. Walmart said the acquisition
1:20:13would quote create new opportunities to
1:20:15help advertisers connect with customers,
1:20:18empowering brands with differentiated
1:20:20and compelling opportunities to engage
1:20:22at scale and to realize greater impact
1:20:24from their advertising spend with
1:20:26Walmart. End quote. Walmart, the largest
1:20:28retail company in the world, bought TV
1:20:31manufacturer Vizio for advertising.
1:20:33Vizio's last annual report shows how
1:20:36much more the company made from
1:20:37advertising and services compared to
1:20:39hardware. In 2023, Vizio made about $1.1
1:20:43billion from its device group, which
1:20:45includes smart TVs and sound bars, and
1:20:48about $598 million from its platform
1:20:51plus group, which includes advertising
1:20:53revenue. While selling TVs generated
1:20:55more money for Vizio in 2023, the two
1:20:57business groups had vastly different
1:20:59margins. Vizio's device business had a
1:21:01gross margin of negative 0.8%.
1:21:05they were losing money on it. Whereas
1:21:07the Platform Plus group had a gross
1:21:09margin of 61%.
1:21:12That's where it came back. Microsoft was
1:21:14quick to throw LG under the bus when we
1:21:16found LG using Windows Update to in our
1:21:18opinions distribute malware in the form
1:21:20of McAfee advertisements via LG's
1:21:22equally malware installer app that we
1:21:24didn't consent to being installed, but
1:21:26it was. But Microsoft was saving face.
1:21:28It's just as involved. In fact, LG
1:21:30turned to its longtime partner Microsoft
1:21:32to serve up that Windows adear.
1:21:34Microsoft and LG have worked together on
1:21:36Windows phones, patent agreements, cloud
1:21:38services, robots, cars, gaming in cars,
1:21:39gaming in the cloud, and according to
1:21:40Microsoft, turning LG TVs into Xboxes.
1:21:43Their collaboration goes way back.
1:21:45Microsoft and LG tried to make the now
1:21:47extinct Windows phones a success. In
1:21:482009, LG made Windows its primary
1:21:50operating system for smartphones.
1:21:52Microsoft and LG signed a patent
1:21:53agreement in 2012 that covered Android
1:21:55and Chrome OS devices since Balmer's
1:21:57Microsoft wanted to make money from LG's
1:21:59phone sales, even if it had Google
1:22:00software on them. In 2019, LG and
1:22:02Microsoft entered into a memorandum of
1:22:04understanding to grow LG's autonomous
1:22:05vehicles business using Microsoft's
1:22:07cloud services. In 2025, Microsoft
1:22:09released a new Xbox app that would be
1:22:10available on LG's automotive content
1:22:12platform. So now Microsoft can call cars
1:22:14an Xbox or something. Even today, LG
1:22:16pushes Microsoft's C-Pilot Plus PCs that
1:22:18work together on the robot Q9 using
1:22:20Microsoft Voice AI technologies to make
1:22:22AI cute. And of course, data centers.
1:22:24Microsoft purchases cooling solutions
1:22:26from LG for data centers for AI. LG and
1:22:29Microsoft reportedly signed a deal worth
1:22:30billions of dollars to do this. These
1:22:32companies know each other, but the
1:22:35biggest collaboration of all is with
1:22:37Nuance. Found in LG's agreements, this
1:22:40is a data management company that
1:22:42Microsoft owns. Microsoft is every bit
1:22:45as guilty as LG, we think, even though
1:22:48it was convenient for them to throw LG
1:22:50under the bus on Twitter. Microsoft even
1:22:52appears in LG's smart TV legal
1:22:55agreements that we went through. That's
1:22:56because LG names Nuance Communications
1:22:58as the service partner that collects and
1:23:00analyzes voice data when someone uses
1:23:02voice commands with an LG TV. Microsoft
1:23:05purchased Nuance for 19.7 billion in
1:23:092021 and completed the acquisition in
1:23:112022. After numerous user reports about
1:23:13LG monitors installing bloatware on
1:23:15computers and after our first video, LG
1:23:18and Microsoft responded to the PR
1:23:20storm that came about due to displaying
1:23:22unwanted ads. LG responded to questions
1:23:25through comments to media outlets like
1:23:27Techraar, saying, quote, "LG Electronics
1:23:30reiterates that McAfee is not installed
1:23:32automatically and is never installed
1:23:34without the user's explicit consent. The
1:23:36LG monitor app installer is distributed
1:23:39through Microsoft's official Windows
1:23:41distribution process, which included
1:23:43McAfee as an option. McAfee will be
1:23:46installed only if a user actively
1:23:48chooses to proceed with the installation
1:23:50and provides consent. Under no
1:23:52circumstances is McAfee installed
1:23:54automatically or without user
1:23:55authorization. The LG Monitor app
1:23:58installer does not access, collect, or
1:24:00transmit any customer personal data. End
1:24:03quote. But we never claimed that our LG
1:24:05Monitor automatically installed McAfee.
1:24:07We said it automatically installed LG
1:24:09Monitor app installer without consent,
1:24:11which it did, and that promoted McAfee
1:24:13adware without user consent, which it
1:24:15also did. We think they're lying. Also,
1:24:18and this is a separate issue entirely,
1:24:20our security researchers we worked with
1:24:22found security vulnerabilities in
1:24:24basically every single application
1:24:26connected to the LG monitor app
1:24:27installer, but that's a story for
1:24:30another time. Additionally, while LG
1:24:32claims its monitor app doesn't access,
1:24:34collect, or transmit any customer
1:24:36personal data, it can quote use all
1:24:39system resources and access your
1:24:42internet connection end quote according
1:24:44to its page in the Microsoft Store at
1:24:45the time of writing. And so it's not a
1:24:47far leap. In a statement to Techraar, LG
1:24:50also stated, quote, LG Electronics
1:24:52reaffirms that LG TVs do not collect,
1:24:54record, or store ambient conversations.
1:24:57Voice recognition is an optional user
1:24:59initiated feature that processes voice
1:25:01data only when activated by the user to
1:25:04fulfill a specific request. Customers
1:25:06can use smart TV features without
1:25:08enabling voice recognition. End quote.
1:25:10Well, that's a lot of specific
1:25:11statements we can shut down right away.
1:25:13Immediately after we enabled our LG TV's
1:25:15voice feature, it recorded Andrew and
1:25:17Vitali's background conversation despite
1:25:19neither realizing the TV was listening.
1:25:21The TV was also not quote fulfilling a
1:25:24specific request and quote immediately
1:25:27debunking LG's statement. In this clip,
1:25:29Tannon is on the other side of a large
1:25:31room from Vital Andrew. Tannon is
1:25:33setting up the TV and using voice input
1:25:36to command it. Vital and Andrew are on
1:25:38the back side of the TV behind it
1:25:40talking about work without knowledge of
1:25:42what Tannon is testing or that the TV is
1:25:44listening. Just give them a little more
1:25:46margin from the wall.
1:25:47>> Hi, LG.
1:25:49Keep changing channels.
1:25:52>> Was there one layer? Two layers.
1:25:56See?
1:25:57>> Uh twoish layers.
1:26:11Can you see it's kind of stuck?
1:26:17See, I think I just got a shade off. I
1:26:20mean,
1:26:20>> notice that after Andrew says two
1:26:22layers, the whole room is silent for a
1:26:25really long period. Long enough that we
1:26:27considered cutting it down, but it makes
1:26:28the point. The TV continued listening
1:26:31all the way through. So he broke the
1:26:32silence and spoke again. In fact, Tannon
1:26:35didn't even interrupt them to say that
1:26:36the TV was hearing all of this and it
1:26:39continued recording for a couple
1:26:41minutes. This data is the same type of
1:26:43data that we recovered transcribed in
1:26:45the plain text file with Wendell. LG's
1:26:47response concluded with this quote, LG
1:26:49is committed to protecting customer
1:26:51privacy and ensuring transparency and
1:26:54how user data is handled. End quote. If
1:26:56LG really cared about ensuring
1:26:58transparency in how user data is
1:27:00handled, it wouldn't hide the do not
1:27:03sell my personal information option in
1:27:05its menu settings. This was disabled by
1:27:07default even before we connected to the
1:27:09internet or agreed to any terms or
1:27:11conditions. Meaning it acts like a
1:27:14claymore for your privacy as soon as you
1:27:16trip it. And when a claymore says this
1:27:18side towards enemy, that enemy is you.
1:27:21This isn't new either. Lewis Rossman
1:27:23pointed it out in his LG smart TV video
1:27:26nearly 3 years ago.
1:27:27>> If you go in any one of the default
1:27:29profiles and you go to privacy and
1:27:30terms, what you'll notice with a smart
1:27:32television is there's an option called
1:27:34do not sell my personal information. And
1:27:36because we live in a dystopian world,
1:27:38this option is not by default checked,
1:27:40which by the way on a $3,000 LG OLED
1:27:43should be opt in, not opt out for
1:27:46tracking FULG for doing that.
1:27:48>> Microsoft also took some, albeit
1:27:49limited, action. Epic Games CEO and AI
1:27:52lunatic Tim Sweeney alerted Microsoft VP
1:27:55Pav Davaluri about LG monitors covertly
1:27:58installing its app and showing ads for
1:28:00McAfee. According to the Microsoft VP,
1:28:02LG disabled the McAfee pop-up ad from
1:28:04its app. Microsoft's lip service about
1:28:06the problem said nothing about LG
1:28:08installing its app without alerting
1:28:09users in the first place. Nor did
1:28:11Microsoft mention how its own subsidiary
1:28:14partners with LG in its data management
1:28:17and collection. With all of that
1:28:18explained, let's get back to some of the
1:28:20people we spoke to for this piece. We'll
1:28:22start with Lewis Rossman, specifically
1:28:24talking about forced arbitration, the
1:28:27clause that was added after our first
1:28:30video on LG's monitors, and he can
1:28:32explain why that's a bad thing. I was
1:28:34working on the LG monitor, their t TVs
1:28:37for this story, the smart TVs, and I saw
1:28:40something that immediately reminded me
1:28:42of you, which is they have a sticker on
1:28:43the back of one of the TVs we bought
1:28:46that says forced arbitration notice. And
1:28:49from what I remember, you you really
1:28:51like forced arbitration clauses.
1:28:53>> Yeah. I love giving up my seventh
1:28:54amendment rights to a company in an
1:28:56agreement that I never actually read.
1:28:57And one of the reasons it's important to
1:28:58say that you haven't actually read it is
1:29:00because with their refrigerators, they
1:29:01were telling people when the I forget if
1:29:03it was the condenser or there was some
1:29:04part of their refrigerators that was
1:29:05failing and mass and LG was not
1:29:07replacing it under warranty. So people
1:29:09wanted to sue them and they said, "You
1:29:10can't sue us because you agreed to
1:29:11forced arbitration." They go, "What?
1:29:13It's in the manual and it's on the box."
1:29:15Now, when you buy a refrigerator, if the
1:29:16box for the refrigerator is larger than
1:29:18your door frame, what that means is that
1:29:20you're never going to actually see the
1:29:22notice because the delivery people and
1:29:24mass were getting rid of the box and
1:29:26throwing it away because most people
1:29:28don't want to save the box of their
1:29:29refrigerator, especially in a small
1:29:30apartment. So, they never actually got
1:29:31to see a copy of the notice that they
1:29:33supposedly signed for. But what they
1:29:34were referring to is that when you
1:29:35received the refrigerator, you signed
1:29:37saying you received it, but that
1:29:38apparently also meant that you agreed to
1:29:40the terms of forced arbitration in their
1:29:42manual, which you hadn't read yet or and
1:29:44on the box that you've never seen.
1:29:46>> And that's and that's somehow legally
1:29:48okay.
1:29:48>> And some of these TVs, we noticed that
1:29:49they don't have it on all of the the
1:29:51sticker doesn't always make it on. So
1:29:52>> that's where I would address it cuz how
1:29:54many words is too many words? Is it
1:29:564,000, 2,000, 1,000? How many words do
1:29:58you need to have where it is okay to
1:29:59take away somebody's constitutional
1:30:00right?
1:30:01>> Can you explain briefly? So forced
1:30:03arbitration in general, like what what
1:30:05is that? Why do the companies want
1:30:06people to agree to a clause for forced
1:30:08arbitration?
1:30:08>> If I screw over my customers, if I do
1:30:10something horrible, they can either
1:30:12commit acts of violence against me or
1:30:13they can sue me. And that luckily most
1:30:16people in New York chose the first one.
1:30:17It's much cheaper than lawyers. No, I'm
1:30:18kidding. [laughter] But the if if I do
1:30:20something wrong to my customers, they
1:30:22have the ability to take me to court.
1:30:23And I think that that is a good thing
1:30:25because it means that it gives me an
1:30:26incentive structure to treat my
1:30:28customers properly. Forced arbitration
1:30:30means that they sign away the right to
1:30:31that. Instead of taking me to court,
1:30:33they can take me to arbitration.
1:30:35Arbitration is a court that I pay for.
1:30:38So, I'm paying a mediator that's going
1:30:41to figure out between the two of us,
1:30:43what are how are we going to resolve
1:30:44this problem? And the mediator being
1:30:46paid by me personally is most likely
1:30:49going to have an incentive structure to
1:30:50resolve issues in a matter that I find
1:30:52amicable. And they're also going to have
1:30:54an incentive structure to screw me over
1:30:56in court. Like there's a judge banging a
1:30:58gavvel, right?
1:30:59>> Yeah. Yeah. Yeah.
1:30:59>> And there's
1:31:01>> You mean it doesn't go through the legal
1:31:02process?
1:31:02>> Yeah. It's not going through the legal
1:31:03process. There's no
1:31:04>> It's an outside of court process.
1:31:06>> And I can understand why people are
1:31:07cynical. I get it. Class action lawsuits
1:31:09cost money. How many people here have a
1:31:1150-cent check on their refrigerator
1:31:13because Visa and Mastercard them
1:31:14and a lawyer got $20 million to handle
1:31:16the case, right? Like how I have I have
1:31:18checks on my refrigerator for less than
1:31:2050. And they're annoying. And we roll
1:31:22our eyes at the lawyers getting rich.
1:31:24And that does suck that lawyers are
1:31:25getting rich while consumers are not
1:31:27getting help in those cases. And it's a
1:31:29shitty system, but it's better than
1:31:30nothing. So, for instance, when Apple
1:31:31has a class action lawsuit against them,
1:31:33even though it sucks that that the
1:31:35lawyers got rich and that all you got
1:31:37was some sort of $50 or $20 refund,
1:31:39often times they'll say you must have a
1:31:42repair program as a part of the
1:31:43settlement. There'll be a repair program
1:31:45for the butterfly keyboard. So, that's a
1:31:47good thing cuz it's not just the the
1:31:49check that you get on your fridge. Class
1:31:51action lawsuits can often lead to
1:31:52companies changing their behavior.
1:31:53>> It's still a punishment for the company.
1:31:55>> And not even a punishment, but it helps
1:31:56the consumer. I'm not. So, a lot of
1:31:58people will look at the 50 cent check
1:31:59you get in your fridge, but they won't
1:32:01look at Apple in 2015 deciding, you know
1:32:03what? We are going to replace the
1:32:04motherboard for free for anybody that
1:32:06has an A1286, A20, 2915 board, but the
1:32:08GPU died. We are going to replace all
1:32:10the butterfly keyboards on the A706,
1:32:12A707, and A708 models where it broke. We
1:32:14are going to actually cover our
1:32:16customers the way that we should have
1:32:17been doing it before somebody
1:32:18sued us. And that's better than nothing.
1:32:20And I'd rather take that than just
1:32:21removing my 7th amendment rights alto
1:32:22together and saying that I'm not allowed
1:32:24to sue. After after our video on the
1:32:26monitors, the LG monitors, we noticed
1:32:28that they updated the agreements, and
1:32:31they added a whole big section talking
1:32:34about class action lawsuits. And so,
1:32:36they already had a thing buried in there
1:32:39about you're agreeing that you can't go
1:32:42through a class action process if there
1:32:44is a dispute. So they already had that
1:32:46there, but they added like paragraphs of
1:32:48clarifying text that just continue to to
1:32:51make that same point, which is like at
1:32:54some point you're admitting guilt.
1:32:55[laughter] I feel like you're changing
1:32:57the terms when there's a major class
1:32:58action concern. Roku did this as well.
1:33:01There was a data breach and they wound
1:33:03up sending it. Did you see the notice
1:33:05where when you turned on the TV, it said
1:33:06agree, but there was no disagree option.
1:33:08So in order to use the TV to change the
1:33:10input, you need I'm pretty sure
1:33:12it was Roku. I have an article. It was
1:33:13Yeah. Yeah, it was broken. In order to
1:33:15change the channel or change the inputs,
1:33:17you had to hit agree. There was no
1:33:19disagree button. And this happened at
1:33:20the exact same time that there was a
1:33:22large data breach which might cause
1:33:24people to push back against it. I think
1:33:26it was Maine where they filed the
1:33:27official notice of data breach. I have
1:33:29the paperwork for this.
1:33:30>> There's like 15,000 people that had
1:33:31their data potentially breached.
1:33:32>> Is there anything people should do? Uh,
1:33:35you know, cuz a lot of these devices now
1:33:36are going to have forced arbitration.
1:33:38>> Be annoying. Take it to court anyway. Go
1:33:40to small claims. Like there was this one
1:33:42person Steven Ryan at the Vancouver stop
1:33:44at the tour and he was saying companies
1:33:46am annoying. He takes companies to court
1:33:47for the stupidest And when I say
1:33:49stupid, I don't mean stupid like it's
1:33:51stupid he did it. I mean it's stupid
1:33:52that the company is actually letting
1:33:53this go to court instead of just
1:33:55resolving the issue with the customer
1:33:57instead of just helping them out. And I
1:33:59like it. Like he said they found me
1:34:00annoying. I said be annoying. We need
1:34:02more people to be annoying. That's
1:34:03great.
1:34:03>> Progress moves forward because of
1:34:04unreasonable people. Right. [laughter]
1:34:06Right. If
1:34:07>> if if 1% of your audience was was as
1:34:09annoying as they needed to be, these
1:34:11problems would all be fixed tomorrow.
1:34:12>> Right.
1:34:13>> Next, we'll speak with a surgeon we ran
1:34:14into at Louiswis's event. Aaron was an
1:34:16attendee there. He came up to speak to
1:34:17me after I spoke with Lewis about owning
1:34:20your And here's what he had to say
1:34:22with concerns from the medical field.
1:34:24>> You were Aaron, right?
1:34:25>> Yep. A a r a yep.
1:34:28>> Yeah. Okay. [laughter]
1:34:29And we were just talking, we were at
1:34:31Lewis's event in South Carolina. We were
1:34:33talking about LGTVs, which conveniently
1:34:35enough, there's one right behind us.
1:34:38>> So, so they'll hear this conversation
1:34:39before anyone watching does. Um,
1:34:42>> they're already listening.
1:34:43>> What was, you know, what was
1:34:44interesting, you mentioned to me, you're
1:34:47in the medical field, I guess.
1:34:48>> Yes, that's correct. Yeah, I'm a
1:34:50healthcare worker. Uh, specifically, I
1:34:52work in robotic surgery. So, I'm a
1:34:54robotic general surgeon. Uh, just
1:34:56finishing up my training. Uh I'm very
1:34:58interested in tech. So like the merger
1:35:00of tech and healthcare, you get robotic
1:35:02surgery. Um my you know being techsavvy
1:35:07and following you and of course Lewis,
1:35:10my concern is is primarily in privacy.
1:35:14Um
1:35:15so what what happens when I'm taking a
1:35:18patient phone call or I'm doing patient
1:35:20uh video visits and there's an LG
1:35:23monitor in the background? What happens
1:35:25if it's doing it on a on an LG monitor
1:35:27itself? Uh what's listening in? How is
1:35:30that how is that patient information
1:35:33protected? Because I'm expected to have
1:35:35everything encrypted. Anything on my
1:35:38device that has patient to do with
1:35:39patients has to be through a VPN and
1:35:42encrypted completely.
1:35:44>> But if that is recorded and taken out of
1:35:46my control,
1:35:48>> who's to say that that's HIPPA
1:35:49compliance or or anything? I mean there
1:35:52there's a lot to do with you know how we
1:35:54use AI tools and how specific ones need
1:35:56to be HIPACO compliant if we're going to
1:35:58use them as healthcare providers and
1:36:00that's very clear but if LG is listening
1:36:03to us on a TV where does that patient
1:36:06information go obviously can't speak for
1:36:07like all medical providers but um
1:36:10broadly speaking with something like a
1:36:12TV typically is that just like someone
1:36:14just buys it for the office you know
1:36:16like cuz cuz that doesn't strike me as
1:36:18something like if you're going to use an
1:36:20an AI transcription tool that strikes me
1:36:22as something where administrative staff
1:36:25or it or whoever would kind of go,
1:36:26"Okay, we probably need to check for
1:36:27HIPPA compliance."
1:36:28>> Right.
1:36:29>> Right. But something like a TV seems
1:36:31like it's maybe send the assistant to
1:36:33Best Buy or whatever.
1:36:34>> Or if I take a patient phone call from
1:36:36home, you know, I I I take those from
1:36:39from my own house. And so I have a few
1:36:41LG products before I watch your video.
1:36:45And so where is that data going? I I I'm
1:36:48not in control of that. I'm expected to
1:36:50be, you know, advocating for my patients
1:36:52and making sure that their privacy is
1:36:55secure, but I don't even know who's
1:36:57listening in my own household. And that
1:36:58makes it very hard when I'm doing
1:37:00patient care within privacy of my own
1:37:02home.
1:37:02>> I think that's one of the concerns we
1:37:04have too is like LG's response is, you
1:37:06know, is probably we're not listening
1:37:08through the microphone and maybe the
1:37:10capability exists, but they would say
1:37:12we're not doing it. But one of the other
1:37:14concerns we had doing this piece was um
1:37:18if there's audio playing through the
1:37:20speakers of the TV, there's also the
1:37:22capability of capturing that or parts of
1:37:24that.
1:37:25>> And so you I I guess you know
1:37:29>> probably tellaalth type of situations.
1:37:31So I mean those are those are required
1:37:33to be encrypted and if I log into
1:37:36anything like Epic is our main Epic
1:37:38Healthcare is our main um our main
1:37:42electronic medical record EMR um when I
1:37:45connect through that on my phone or on
1:37:47my laptop it goes through a VPN that's
1:37:50mandated by my employer
1:37:52>> and so if it's being recorded outside of
1:37:54that you know where that's not that's
1:37:56not HIPPA compliant and so I don't have
1:37:58any control over that cuz there's no
1:38:00notice to me saying, "Hey, you're
1:38:02actually being listened in on right
1:38:04now." And so, how can I possibly be in
1:38:06control of the entire environment when
1:38:09everything else is being listened in on?
1:38:11>> Have you tried putting tinfoil and lead
1:38:13up
1:38:14>> around like a Faraday cage around my
1:38:17clinic? Yeah. Yeah.
1:38:18>> Right. That would do it.
1:38:19>> Yeah.
1:38:20>> That'll be my next business. I'm going
1:38:22to start selling fair cages for clinics.
1:38:24>> That's great.
1:38:25>> Yeah. I'll be your first customer.
1:38:26>> Awesome. Thank you for the uh for
1:38:28joining for the story.
1:38:29>> Yeah. Thank you. I appreciate it. Next,
1:38:30we'll check in with Kevin from the Fulu
1:38:32Foundation. Kevin is the executive
1:38:33director for the Fulu Foundation. He
1:38:35works alongside Lewis at it. Kevin is
1:38:37specifically pushing against DMCA
1:38:39section 1201, which is a part of law
1:38:41that makes it a criminal act in some
1:38:43circumstances to circumvent digital
1:38:45locks. He was also one of the organizers
1:38:47for the Own Your tour that we went
1:38:49on with Lewis. Here's his take on the
1:38:50situation. My understanding is with the
1:38:53digital millime copyright act, so DMCA
1:38:55section 121 specifically, there's some
1:38:58level of criminality, I guess, to
1:39:01circumventing uh digital locks.
1:39:03>> Yeah, that's exactly right. Right. So,
1:39:06because of section 1201 of the DMCA,
1:39:08simply circumventing a digital lock can
1:39:10become a copyright crime.
1:39:12>> Okay.
1:39:12>> And so, when you're looking at these
1:39:14cases, right, you've got your TV that's
1:39:16spying on you, that's watching you,
1:39:17that's listening to you, right? you
1:39:19might want to go in and remove that
1:39:20software. Sure, there are ways that you
1:39:22can go through the menu and you can kind
1:39:24of, you know, parse through the legal
1:39:26ease and try and find a way, but there's
1:39:28no way to know for sure, right,
1:39:30>> that that data flow is stopping unless
1:39:32you go in and take it out yourself. So,
1:39:34because section 121 does have that
1:39:36prohibition on the circumvention of
1:39:38digital locks, um, you're screwed.
1:39:41>> I guess if you could walk me through the
1:39:42the basics of the DMCA and of section
1:39:451201 a little more, that would probably
1:39:47help.
1:39:48>> Yeah. So to do a little bit of the
1:39:49history, right, the DMCA was passed back
1:39:51in 1998 and the goal of it was to stop
1:39:55piracy of media off of CDs and DVDs,
1:39:58right? I would argue it was the wrong
1:40:00solution at that time, but it's hard for
1:40:02anyone to disagree with the fact that
1:40:03it's the wrong solution for this time
1:40:05because
1:40:06>> Congress or the architects of this law
1:40:08did not think that we would have
1:40:10computers in our park pockets, that we
1:40:12would have
1:40:12>> computers in our cars, in our tractors.
1:40:14Everything we use, right, pretty much
1:40:16these days is a computer. And what that
1:40:18means is that um those digital locks
1:40:20kind of invade on our access to control.
1:40:22So one analogy I like to use is right if
1:40:25like if you bought a house,
1:40:26>> you would expect to be able to get
1:40:27through every door and get into every
1:40:29room. One of those doors you
1:40:31accidentally lock yourself out. Picking
1:40:33that lock isn't breaking and entering,
1:40:35>> right?
1:40:36>> You own the house, you own the door, you
1:40:38own what's behind it, right?
1:40:40>> Because of section 121, that's a
1:40:41completely different story for our
1:40:43digital devices. If a manufacturer puts
1:40:45a digital lock in front of a copyrighted
1:40:48work such as yes, a movie or a song, but
1:40:50also just source code or something like
1:40:52that, um the mere act of cir
1:40:54circumventing that becomes a copyright
1:40:55crime.
1:40:56>> And just as importantly, right, like I'm
1:40:58sure that a lot of your viewers will be
1:41:00able to go and do this yourself.
1:41:02>> Um I'm a normie, so I can't do that. If
1:41:05I wanted to hire someone to do it for me
1:41:07or if someone were to try to make a tool
1:41:09that would be easy for consumers to use
1:41:10to go in and strip the ACR software off
1:41:12of their TVs, um that would be again a
1:41:16violation of section 1201. And that one
1:41:18comes with serious penalties of up to
1:41:21$500,000 in fines and five years in
1:41:24federal prison per
1:41:25>> seems proportional for
1:41:27>> Yes, exactly. Helping people not get
1:41:29spied on, right? helping people fix
1:41:31their stuff um is just an outrageous
1:41:35thing to be a copyright crime.
1:41:37>> Lewis had in his presentation he showed
1:41:40I think it was the author of I don't
1:41:42know if it was the whole DMCA or Okay.
1:41:45>> Yeah. He was one of the architects. So
1:41:46Bruce Layman who uh worked in the
1:41:48Clinton administration um you know he
1:41:50did some interviews after the fact after
1:41:52this law passed in 1998 and talked in
1:41:552007 and I think beyond that was first
1:41:57of all said look
1:41:58>> this law didn't work that well right
1:42:00like Napster happened after the passing
1:42:02of uh the DMCA so it didn't work the way
1:42:06they wanted it to. Um and one of the
1:42:09other things that was pretty shocking
1:42:10was he talked about how you know he
1:42:12basically executed an end run around
1:42:14Congress. So, right,
1:42:15>> when they first developed this idea,
1:42:17this policy framework, they took it to
1:42:19Congress and Congress said, "No, right,
1:42:22this is going to get in the way of fair
1:42:23use, right? This is going to infringe on
1:42:26people's rights, on their ownership
1:42:28rights, on all their kind of things,
1:42:30those kind of things." Um, so instead,
1:42:33he went and negotiated an international
1:42:35treaty through what was called WIPO,
1:42:37which is the World Intellectual Property
1:42:39Organization, trying to solve this
1:42:42problem. came back, went to Congress and
1:42:44said, "Hey, we've got this treaty. If we
1:42:47don't pass this law, we are going to be
1:42:50not in compliance with this treaty." And
1:42:52also, we're leaders in the world and we
1:42:54need to do something about this, right?
1:42:56So, it was just a total kind of pretty
1:42:59questionable move if you ask me. Um, and
1:43:01that's the reason that we, you know,
1:43:03kind of sit here today.
1:43:04>> Is there actually something people can
1:43:06do? Obviously, we just, you know, we did
1:43:08part of this tour I mentioned,
1:43:09>> right? uh to try to get people to write
1:43:12representatives and um I I think there
1:43:15is probably a healthy and and earned
1:43:19skepticism towards it but uh you know
1:43:22actually trying to write to
1:43:24representatives is probably one of the
1:43:26only you know really good tools
1:43:30available. It's really important, right?
1:43:32Because I think there's a mixture of
1:43:34things happening, right? People in
1:43:35Congress, right? I I go to DC a lot as a
1:43:37part of my job. And
1:43:39>> many members of Congress don't
1:43:41understand te technology.
1:43:42>> Mh.
1:43:43>> And at the same time, many don't
1:43:45understand copyright law, right? Like,
1:43:47okay, cool.
1:43:47>> Which fair enough, right? Like if unless
1:43:50you are into copyright law, you might
1:43:52not understand it. Not every member of
1:43:54Congress is going to be an expert on
1:43:56every aspect of the law. But that makes
1:43:58education that much more important and
1:44:00it makes it that much more important
1:44:02that they're hearing from their
1:44:03constituents who care about these kind
1:44:05of things. Right. So, as you mentioned,
1:44:06right, we've got this tour. We're going
1:44:08to 14 cities and states around the
1:44:10country. We just had one of our biggest
1:44:12in Raleigh last night, which was
1:44:13awesome. Um, great crowd. And also, you
1:44:17know, had a a member of the local
1:44:19representatives office out to see all
1:44:22>> she was listening. And she was
1:44:23listening. Yeah. and she she did to her
1:44:25credit uh she did seem to be engaged and
1:44:29possibly on board with the idea of
1:44:31owning your stuff.
1:44:32>> Yeah.
1:44:32>> So, you know, I guess point of bringing
1:44:34that up is
1:44:35>> in the very least if not the
1:44:36representatives it themselves then the
1:44:38the staff might actually listen and you
1:44:41just kind of hope that they filter the
1:44:43message up.
1:44:44>> Exactly. So, um, so for Fulu, we'll
1:44:47point people there as well, uh, for
1:44:49future tours and things like that, but
1:44:51where should they go? And
1:44:53>> yeah, go to fulu.org, right, to stay up
1:44:56to date on our work. We've got our blog.
1:44:58We post kind of, um, you know, regular
1:45:00updates. Uh, we're also on, you know,
1:45:03all all the social channels. Uh, one of
1:45:05my favorite features is, right, the
1:45:07consumer rights wiki is a big part of
1:45:09what we do. Um, and so every week we do
1:45:12the wiki hall of shame and highlight uh,
1:45:15you know, manufacturers and products
1:45:17that are particularly bad actors. So
1:45:19>> there's so many options.
1:45:20>> There are so many options. We could keep
1:45:22going forever on this
1:45:23>> infinite content.
1:45:24>> Yeah. Um, but yeah, check us out there.
1:45:27Um, and then get involved, right? We,
1:45:29like you said, it's one thing when we as
1:45:31an organization go there and that's our
1:45:33job and that's, you know, we work really
1:45:35hard at that. But when members are
1:45:37hearing from their own constituents, it
1:45:39goes that much further.
1:45:40>> And finally, we'll check in with Wendell
1:45:41for an extended discussion about our
1:45:43findings. This was sort of our debrief
1:45:45after working on the TVs for days. So,
1:45:48some of the demos we had, can you help
1:45:52explain what are some of the ways that
1:45:55the findings, the vulnerabilities,
1:45:57whatever could the features of the TV
1:45:59could be used. Uh, for example, when the
1:46:02TV appears to be off, but it's capable
1:46:05of uh storing video and audio.
1:46:09>> Yeah. Internally, the TV has 16 GB of
1:46:12flash, which doesn't sound like a lot,
1:46:14but it's got kind of a lot of
1:46:15computational horsepower, especially the
1:46:17newer TVs. And so, you can record audio,
1:46:19you can compress it, you could stream it
1:46:20to somebody over the network. It's a
1:46:22full computer, so it's basically as
1:46:25creative as your imagination is, you can
1:46:28run stuff on it. Uh there's stuff on the
1:46:31TV for like package management and
1:46:33commercial customers of LG use a lot of
1:46:35these features for like digital signage
1:46:37and everything else like that, but you
1:46:38know the consumer version of the TV,
1:46:40they rip out some of those features and
1:46:42some of the features that you know as
1:46:43like homebrew enthusiasts and like home
1:46:45lab enthusiasts, I'd like to have those
1:46:47and LG takes that out. But you know
1:46:50there's microphones, multiple
1:46:52microphones there. Uh there is the
1:46:54ability to read what is being displayed
1:46:56on the TV programmatically. So you could
1:46:58look, you could, you know, capture a
1:47:00frame or capture short clips limited by
1:47:02storage or streaming capability of
1:47:04what's on the display. I mean,
1:47:05theoretically, it's a whole computer. So
1:47:07basically anything you can do with a
1:47:09computer, but it's in the TV.
1:47:10>> Even the places where we ran into
1:47:12limitations, such as the few instances
1:47:13where we had sixsecond recordings, I
1:47:16feel like given more time than we had
1:47:18here, it's it's possible a sophisticated
1:47:20>> Yeah.
1:47:21>> programmer could.
1:47:22>> The TV is literally built for something
1:47:23called automatic content recognition.
1:47:26And it seems like the implementation
1:47:28that LG uses for automatic content
1:47:29recognition is designed to do six second
1:47:33captures of what you're looking at. And
1:47:34that's audio and video fingerprinting.
1:47:36So when ACR is working as advertised as
1:47:39the specification says, it's capturing
1:47:42about 6 seconds of audio or video and
1:47:44using that as a fingerprint and then
1:47:45it's got a dormant period where it's not
1:47:47capturing. And this is, I think, the in
1:47:49the ad industry's hedge against
1:47:51accidentally leaking, you know, hours of
1:47:54conversations like, oh, we only capture
1:47:56six seconds of it's enough to
1:47:57fingerprint it, but that's still a lot.
1:47:59You can do a lot with that.
1:48:00>> You can do a lot with that.
1:48:01>> Oh, it may also be a circumvention for
1:48:04copyright law or something if the movie
1:48:06studios are unhappy. What about so
1:48:08fingerprinting? Walk me through that
1:48:09because I think one of the security
1:48:12researchers we worked with thought that
1:48:14from his findings he couldn't see
1:48:16evidence that uh ACR was necessarily
1:48:19transmitting screenshots like JPEGs or
1:48:22PGs.
1:48:23>> You don't need to. You can take a a you
1:48:25know if you're watching a 4K, you know,
1:48:27Lord of the Rings, you don't need a full
1:48:29frame. You can have a tiny tiny tiny
1:48:30little frame and generate a hash of it
1:48:33effectively. Effectively, it's a hash.
1:48:35And then that hash is a very small
1:48:37amount of text
1:48:38>> and so that text can be sent back and
1:48:40say hey this is the hash of the thing
1:48:42that I see
1:48:42>> and then what they they compare that
1:48:44against the database and say this is a
1:48:46frame from Lord of the Rings.
1:48:47>> Yes. And we can see content of the TV
1:48:51connecting to known Alonso that's one of
1:48:54the name of the libraries and known
1:48:56domains that have to do with automatic
1:48:58content recognition. Um, and we can see
1:49:00it downloading a thing that looks like a
1:49:02database, like a fingerprint database,
1:49:04which is, I think, some clues to the TV,
1:49:06some hints to the TV about how it takes
1:49:08that audio data and that video data to
1:49:10generate the hash to then share with LG.
1:49:13>> Why might they choose to do it this way
1:49:15rather than send a screenshot or an
1:49:18audio file?
1:49:19>> Well, they did in the past. And you know
1:49:22if you look at LG's history of security
1:49:24issues uh you know 10 years ago almost
1:49:27they were sending the raw file names and
1:49:29then that turned into a PR incident.
1:49:31Yeah.
1:49:31>> And there is almost an adversarial
1:49:33relationship with the TV here. If you
1:49:35look at
1:49:36>> how the software behaves like as I was
1:49:38using it it changed behavior a couple of
1:49:40times and I don't know if that was
1:49:41because these TVs hadn't been on the
1:49:43network and they were just downloading
1:49:44application updates which is different
1:49:46than a firmware update. Like I didn't
1:49:47agree to a firmware update. Like I did
1:49:48that very deliberately.
1:49:50>> But even saying no, I don't agree to the
1:49:52terms. No, I don't want to do this app.
1:49:53It was doing stuff in the background
1:49:54like downloading stuff for apps. Amazon
1:49:56was doing stuff. The YouTube app was
1:49:57doing stuff. It's like I don't even We
1:49:59didn't even dig into what those
1:50:00applications were doing.
1:50:01>> Yes. You're not sure if it's because it
1:50:02was downloading stuff or because it was
1:50:04detecting your access basically.
1:50:06>> Yeah. Cuz sometimes the TV would go to
1:50:09sleep and then it would lose I would
1:50:10lose network access. And then other
1:50:11times the TV would be doing something in
1:50:13the background. And so everything the TV
1:50:15appeared to be off, but I had full
1:50:17access to USB and I had full access to
1:50:20run my programs. I had full access to
1:50:21audit whatever was going on on the on
1:50:22the TV.
1:50:23>> And so I just I would like to know like
1:50:26what what is LG doing? Can I audit this?
1:50:29Do I have the tools to audit this? And
1:50:30the answer was mostly no. It was an
1:50:32uphill battle for me to like dig my way
1:50:35out and figure out what it was doing.
1:50:36Let's say worst case scenario, you turn
1:50:38it into a listening device. That seems
1:50:40pretty straightforward. You turn it into
1:50:41a device to exfiltrate information from
1:50:43a corporate network or a boardroom.
1:50:45>> That seems pretty straightforward. Um,
1:50:47you use it to maintain access like as a
1:50:51point of presence on a network. Um, even
1:50:54if you don't intend to capture audio and
1:50:56video,
1:50:56>> just to go through it, toggle through
1:50:58it.
1:50:58>> It is perfectly functional as a proxy.
1:51:00So, you can proxy internet traffic and I
1:51:02can just it's like, oh, I'm going to use
1:51:03this to move laterally through
1:51:06somebody's network. We've seen that in
1:51:07the in security circles. We've seen that
1:51:10with like copy machines. Uh certainly
1:51:13the TV is is more sophisticated than the
1:51:15copy machine that I am acquainted with
1:51:18that was a command and control server
1:51:19for very bad malware. So yeah, the kinds
1:51:22of things we see in the news where it's
1:51:23like oh fancy bear is attacking routers.
1:51:26Uh fancy bear would be very comfortable
1:51:27inside LGTV.
1:51:29>> What about the scenario where the TV
1:51:32speaker output uh could be captured? So
1:51:36this was as we called it the boardroom
1:51:37scenario.
1:51:39>> Yeah. So, if you're using your TV as a
1:51:41display, the HDMI audio that goes
1:51:44through the display is also capturable
1:51:46from the interfaces that we have on the
1:51:48Linux side.
1:51:48>> And this is something you proved that we
1:51:50were able to do it.
1:51:50>> Yeah, exactly. It's a feature, not a
1:51:52bug,
1:51:53>> right? [laughter] And and this just to
1:51:55be clear again like there because
1:51:57there's a few links here, but you can do
1:51:59this without
1:52:01your laptop and you being physically
1:52:05connected to the TV directly. Yes.
1:52:07>> Right. You can do this through the
1:52:08network.
1:52:09>> Yeah. And we can do it with the TV off
1:52:11of the network and just have it capture
1:52:13and then as soon as it gets network
1:52:15access again, it was basically used as a
1:52:17recording device,
1:52:18>> right? You go back in after it's
1:52:19reconnected. So, let's say you're super
1:52:22paranoid, I guess, and there's a
1:52:24scenario where you you not you just you
1:52:26unplug the Ethernet from your TV during
1:52:29this boardroom meeting or something. I
1:52:31guess as long as it's still powered on
1:52:33and capable of capturing,
1:52:35>> you've got at least 4 gigabytes of space
1:52:36to work with, right? So, if you had an
1:52:38adversary that knew that there was going
1:52:39to be a big important shareholder
1:52:41meeting, um they could have the TV
1:52:43completely offline off of the internet
1:52:46and it's perfectly capable of recording
1:52:48and storing the audio for that meeting.
1:52:50And then somebody could come in later
1:52:52>> as long as they've prepared for it in
1:52:53advance. They know it's going to happen.
1:52:54They set it to record. Yeah.
1:52:56>> Whatever. shareholder. Someone's super
1:52:57paranoid. They unplugged the Ethernet
1:52:58cable,
1:52:59>> but it was already rolling the capture,
1:53:01I guess.
1:53:01>> Yeah. For audio, uh, you know, it's it's
1:53:0316 gigabytes total storage. You got
1:53:05probably about 4 GB to work with out of
1:53:07the box if you don't get creative.
1:53:10>> And that is a that's 4 GB of audio.
1:53:13That's a lot of audio. But imagine also,
1:53:15I've got a 256 gig USB stick. I stick
1:53:17that in there. That's weeks of audio,
1:53:19>> right? Uh so in so in this example, you
1:53:21know, the boardroom example, I guess,
1:53:24use cases might be let's just take the
1:53:27least nefarious I guess just just good
1:53:30old like fraud basically market
1:53:32manipulation.
1:53:32>> Yeah. I'm going to I'm going to play the
1:53:34stock market. What's going to be said in
1:53:35this thing? There you go.
1:53:37>> Yeah.
1:53:37>> Yeah. [laughter]
1:53:38>> Uh which could be useful also to nation
1:53:40states or, you know, intelligence
1:53:43agencies. Like I'm sure there's all
1:53:45kinds of stories of North Korea, for
1:53:47example, doing things in the crypto
1:53:48market or whatever. So
1:53:49>> yeah,
1:53:50>> um what
1:53:51>> and if your TV like let's say that your
1:53:54IT organization is like super on the
1:53:55ball and the TV is normally not on the
1:53:58network at all and it's completely
1:54:00isolated and it's not even in scope for
1:54:02them to monitor. If you had somebody
1:54:04acting nefariously like that and they
1:54:06had alone time with the TV, you could be
1:54:08in and out in 10 minutes.
1:54:10>> So yeah, so there's potential vectors
1:54:12both on and off network, I suppose.
1:54:14>> Uh and with and without physical access
1:54:17depending on how you get in. Yeah, your
1:54:19guy found a zero day that seems like it
1:54:21would be able to connect to the TV over
1:54:23the network uh non-interactively,
1:54:26>> right?
1:54:27>> Fabulous. [laughter]
1:54:28>> The one that we found requires you to
1:54:31hit okay. It's like a mobile device
1:54:34would like to pair with your TV. Is that
1:54:36okay? And then you say yes. And then
1:54:38that's all she wrote. All
1:54:39>> right. [laughter]
1:54:40Um what about the scenario where a TV
1:54:44ACR audio capture? So we were able to
1:54:46pull the 6second or so audio clips. So
1:54:49this is separate from the one where it's
1:54:50just the speakers for the boardroom
1:54:52scenario.
1:54:52>> Yeah, this was a little bit of creative
1:54:54debugging. So like we really we were we
1:54:57were we were up to our elbow inside the
1:54:59TV if you know mental picture for that.
1:55:01It's pretty amazing I think. and the ACR
1:55:04process. So
1:55:05>> colonoscopy of LG [laughter]
1:55:07>> we were we were running uh very deep
1:55:10analysis of the ACR process and we were
1:55:13able to see because this also helped us
1:55:14figure out some of the audio formats
1:55:15like some of the audio formats are
1:55:16nonobvious. There's also a speaker
1:55:18feedback microphone a secondary
1:55:20microphone which could be used for audio
1:55:21capture which we should talk about. We
1:55:23were able to intercept the audio
1:55:25recording before it was converted into a
1:55:28hash and save it.
1:55:29>> Okay. And so without and that sounds
1:55:31like it's a lot of manipulation but like
1:55:32once you know how to do that you have a
1:55:34very very tiny program that's just
1:55:36watching the other program and when it
1:55:37captures the audio it's like yo that's
1:55:39mine and you can save those sixsecond
1:55:42clips and that would that's very hard to
1:55:44detect.
1:55:45>> Yeah
1:55:46>> because the TV is is behaving normally
1:55:48>> right.
1:55:50What about um the feedback mic? You just
1:55:53mentioned that. So, the feedback, the
1:55:55audio quality from that is terrible, but
1:55:56it seems like there is a secondary
1:55:58microphone that's used somehow as part
1:56:00of like the audio solution. I have no
1:56:03idea how it's supposed to work in normal
1:56:05scenarios. Uh, but it's very low bit
1:56:07rate, which is good, but it's not low
1:56:10enough bit rate that we couldn't
1:56:10reconstruct speech from it.
1:56:12>> Mhm. What about um log files on RAM? So,
1:56:16that was pretty interesting.
1:56:17>> Okay. So, it's only 16 gigabytes of
1:56:20flash and it does seem like in So, I
1:56:23started like full background here. I
1:56:25started on an older TV. You You bought a
1:56:27newer one. It's a donation to the cause.
1:56:29I don't know. We're going to we're going
1:56:30to run that in. Doesn't matter. Doesn't
1:56:32matter. Uh my older TV um was a little
1:56:36bit more uh verbose with logging. And I
1:56:39think that LG probably ran into
1:56:40situations where that was wearing out
1:56:41the flash prematurely. Um, and so this
1:56:44new one logs everything to RAM disk. But
1:56:47there is a process that runs and
1:56:49collects the logs, I guess, the
1:56:50interesting stuff and puts it in flash.
1:56:53There's also a lot of evidence in the
1:56:55packet capture that this stuff is sent
1:56:57to LG. And so in the debug logs, which
1:56:59are stored on a RAM disc, and so even
1:57:01when the TV is off, it doesn't erase
1:57:02that. You have to like physically unplug
1:57:04it or do something with that. Um, in
1:57:07those logs, we can see everything that
1:57:10you've said to the TV,
1:57:12>> right? Uh, do you want to pull up an
1:57:13example? This is stored in a log file.
1:57:16Uh, I mean that's concerning for a
1:57:18number of reasons. Devil's advocate
1:57:21position might be okay, but you
1:57:23explicitly said hi LG and triggered it
1:57:26right before you so you knew it was
1:57:27recording. But in fact, there were
1:57:30several instances where genuinely we did
1:57:32not know I didn't know it was still
1:57:34recording. And so some of the testing I
1:57:36was doing was it appears to be uh
1:57:39somewhere between 10 and 15 seconds or
1:57:42so it will remain active.
1:57:44>> I just heard it ding.
1:57:45>> Did you really? [laughter] I that was
1:57:47the other thing. We we got it working
1:57:49from at least 60 ft roughly away, maybe
1:57:5270 around a corner in some instances
1:57:54around two corners. And
1:57:56>> microphone's really good.
1:57:57>> The microphone's amazing. It like we
1:57:59should maybe replace some of our studio
1:58:01mics. But the
1:58:02>> that's another thing an adversary
1:58:04[clears throat]
1:58:05with a little bit more time can figure
1:58:07out the voice wake microphone. Now that
1:58:10also was a little it was a little weird
1:58:12for us to try to co-opt the voice
1:58:15capture microphone, but clearly LG is
1:58:17doing something there. And I feel
1:58:19certain that uh an appropriately skilled
1:58:21security researcher could co-opt that
1:58:23microphone and get even better
1:58:25recordings than we did.
1:58:26>> Yeah. And I think really the key is it's
1:58:29writing these log files.
1:58:31Even if if you have ambient conversation
1:58:34that's happening around the TV when
1:58:36someone triggers it, uh it will remain
1:58:38active if it continues to hear speech
1:58:41for some period of time. It seemed
1:58:42pretty long and uh it's it's collecting
1:58:44all that and it's writing it here.
1:58:46>> Yeah. This is without any modifications,
1:58:48I think, is is what is what you're
1:58:49you're getting at. Yes. It's like I I'm
1:58:52co-opting the microphone to record audio
1:58:54and we know that that the six-second
1:58:57clips are destroyed in favor of but
1:59:00these captures. Yes,
1:59:01>> this is as the TV works.
1:59:03>> Yeah, as the TV works, the text that it
1:59:06was able to convert from your speech
1:59:08ends up in the log,
1:59:09>> right? So, as long as you can get access
1:59:12to those logs, you can get access to
1:59:13what was said. And once again,
1:59:16>> it may be more than just, "Hi LG, please
1:59:19change the channel." Yeah, it's funny
1:59:21actually. Um I'm now I'm remembering
1:59:24from like an IT audit standpoint. Uh one
1:59:26of the things in like ISO, not not just
1:59:29ISO, but like process certification and
1:59:32um the California privacy law having
1:59:35debug logs that log sensitive
1:59:37information is verboten and this would
1:59:39probably run a foul of that.
1:59:40>> Well, we had uh an example where I said
1:59:43>> right there.
1:59:44>> So here you go. So here was now it was
1:59:48triggered But then I I was started
1:59:51talking about something else. I was
1:59:52talking about my social security number.
1:59:54Maybe I was on a phone call with a
1:59:56hospital or something. I need to verify
1:59:58who I am. Yeah. Whatever the case may
1:59:59be, maybe a credit agency.
2:00:01>> And uh I said, "Hi, LG." I told it to do
2:00:04what I wanted. And then I continued my
2:00:05conversation. Yeah. And here it is.
2:00:07Here's my social security number. 11111.
2:00:10The response to this I guess is
2:00:14well first of all it appeared to persist
2:00:18after we cleared we told it to clear the
2:00:20data.
2:00:21>> Yes.
2:00:21>> And it persisted.
2:00:22>> Yeah. So
2:00:23>> there's one asterisk we'll get to. But
2:00:25>> yeah, we clear it's like okay clear the
2:00:27data. The TV treats that as let me just
2:00:30phone LG servers and clear the data. It
2:00:33doesn't really seem to do much locally
2:00:35with that. Now, these logs, the full
2:00:38verbose logs are stored on a on a RAM
2:00:41disc.
2:00:41>> And if you reboot the TV, it doesn't
2:00:43clear the RAM disc, right?
2:00:45>> But if you physically unplug the TV,
2:00:47>> if you kill the power,
2:00:48>> if you kill the power, it does. And so,
2:00:49we lose this. They It also seems to
2:00:51rotate these verbose logs pretty
2:00:53quickly.
2:00:54>> Um, but
2:00:55>> if someone's pulling them though, yes,
2:00:57>> in the in real time, it doesn't matter.
2:00:59>> Yeah, it doesn't matter. Um, and it
2:01:01seems like a lot of the applications and
2:01:04like the applications that are
2:01:05generating this that are doing this are
2:01:07actually doing kind of a lot of writing
2:01:09to the flash. Like it's it's still it's
2:01:11like, oh, we've taken steps to
2:01:13>> make sure that we don't prematurely wear
2:01:15out the flash, but it's still doing a
2:01:16lot. And so I think there's there's
2:01:18there's a lot of fertile ground here for
2:01:19researchers to go. It's like, okay, what
2:01:21is it doing exactly? But most of the,
2:01:23you know, delete my data or forget this,
2:01:25it doesn't do it doesn't care what's on
2:01:27the TV, right? It just does the remote.
2:01:30>> Yeah. So, the the situation we were
2:01:32concerned about was okay, if you do
2:01:33delete my data, you bring the TV to
2:01:35Goodwill and it's gone. Does that data
2:01:37persist? Initially, we thought maybe
2:01:39because when we rebooted it, it was
2:01:41still there in the logs, but then after
2:01:43pulling the power cable, it got wiped
2:01:45out, right? Yeah. So, at least locally
2:01:47to the TV, those specific verbose logs
2:01:50appeared to be gone.
2:01:51>> Yeah. But other logs persist.
2:01:53>> Other logs were still there and we
2:01:55haven't dug into every single one of
2:01:56them. So we we can't say with certainty
2:01:58like what it retained, but
2:02:00>> yeah unsettling. It's like how do you
2:02:02format your TV? LG doesn't. It's like do
2:02:05you trust LG to do that? It's like no, I
2:02:07would like to get in there and look
2:02:08around and
2:02:10>> make sure it's formatted. Yeah,
2:02:11>> that seems reasonable.
2:02:13>> What about um how does the TV know where
2:02:15it is?
2:02:16>> Uh so uh
2:02:18>> there's no GPS. While other researchers
2:02:20have sort of noticed that, hey, when we
2:02:23look at the traffic to LG, it sure seems
2:02:26like that it's inventorying the wireless
2:02:29networks that are around. So, there is
2:02:30no GPS unit. If you take it, it's like,
2:02:32oh yeah, this is great. Even though I've
2:02:34only ever used the TV for a wired
2:02:36interface, it seems like it's noticing
2:02:39the wireless networks that are around
2:02:41it. And based on the wireless networks
2:02:43you can see, you can use that for
2:02:44geoloccation because you can see the
2:02:45wire the names of the wireless networks
2:02:46but also the MAC addresses of the access
2:02:48points.
2:02:49>> And that is a cheap easy way to do GPS.
2:02:52I'll go you one better. If you had a
2:02:54rogue employee inside of LG or a hacker
2:02:58that leaks this database to the
2:02:59internet,
2:03:00>> so the information that that uh Mr.
2:03:03captured
2:03:04>> and was submitted. If that is in a
2:03:06database at LG somewhere, then someone
2:03:09could exfiltrate that information from
2:03:11LG and now they can find a specific TV
2:03:14based on interesting places the TV
2:03:16exists.
2:03:16>> Not like Washington DC or Yeah. Right.
2:03:20>> Yeah. It's like I'm looking for the TV
2:03:22in this boardroom. What do they have?
2:03:23What are my options? And even before
2:03:25setting foot inside the business, they
2:03:27can know, oh, there's an LG TV there
2:03:29because I have looked at the
2:03:31geoloccation database in LG.
2:03:33>> There's this 30 acre campus with nothing
2:03:35but giant corporation A.
2:03:37>> Yeah. Now, that sounds absurd, but if
2:03:39you look at the if you set aside LG for
2:03:41a second and look at Meta and how Meta
2:03:43has sold ads, Meta has literally gotten
2:03:45in trouble for uh selling to wouldbe
2:03:48advertisers the ability to geollocate
2:03:50down to like individual street
2:03:52addresses. [laughter] It's like I want
2:03:54to sell an ad to the person in this
2:03:55house. Okay, the the platform is capable
2:03:59of that.
2:03:59>> There's so many ways to abuse that.
2:04:01>> I don't want a TV that I have to have an
2:04:03adversarial relationship. And
2:04:05immediately out of the box, you're on
2:04:07the wrong foot with LG because they own
2:04:10the glass.
2:04:11>> They do say they own the glass.
2:04:12>> So, this is unencrypted. They don't even
2:04:14try with this. This is just not even a
2:04:16thing. If you're in the middle between
2:04:18the TV and the internet, then it's a
2:04:19command and control type situation. You
2:04:21could also make the argument like if LG
2:04:23lets one of those bazillion domains
2:04:25expire, that's going to be a great
2:04:27vector to take over tons of TVs. So LG
2:04:30gets kind of a black market here, too,
2:04:32because my older TVs have security
2:04:35vulnerabilities that LG is just not
2:04:36interested in patching.
2:04:37>> Okay, cool.
2:04:37>> They're like, "Oh, it's a six-year-old
2:04:38TV or a 5-year-old TV. We don't care."
2:04:40>> Right. Great.
2:04:42>> Yeah. But if you have Yeah. Right.
2:04:45>> Um RCE, so can you help explain some of
2:04:48this where
2:04:49>> Mr. bra has a vulnerability that we
2:04:52can't disclose
2:04:54beyond basically saying it's bad and uh
2:04:57and it could grant someone access to the
2:05:00TV. I think that's about the extent of
2:05:01what we can say.
2:05:02>> Yeah.
2:05:03>> Um but can you help without exposing too
2:05:06much of that information explain the
2:05:09concept of like an what is you know
2:05:12remote code execution? What is that
2:05:14without going into how it works here?
2:05:15>> So you're gonna you're going to show on
2:05:17TV what we did using the stuff from
2:05:18GitHub, right? Yes.
2:05:19>> Okay. So that was remote code execution
2:05:22effectively.
2:05:22>> So you can use our work to explain it.
2:05:24Okay.
2:05:25>> Uh he found a way to do it
2:05:28non-interactively probably,
2:05:29>> right?
2:05:30>> Which is amazing. Nice job. [laughter]
2:05:32Uh the uh the first uh attempt that we
2:05:37had failed. And so we got the popup at
2:05:40the bottom where it was trying to
2:05:41install, you know, whatever it was, but
2:05:43it was not able to um remotely execute
2:05:46all of the code. It was able to remotely
2:05:48execute some of the code to give us the
2:05:49banner, but it wasn't able to remotely
2:05:51execute all the
2:05:52>> take a step back just like first I guess
2:05:54definition of remote code execution
2:05:56broadly
2:05:57>> um
2:05:58>> as a vulnerability
2:05:59>> uh you can cause something to download
2:06:03code and execute it with whatever level
2:06:07of permissions. Okay,
2:06:08>> so remote code execution, you might be
2:06:11executing the code in a sandbox, but
2:06:13then you might be able to escalate your
2:06:14permissions from the sandbox to some
2:06:16something else. And so this is this
2:06:18that's uh more broadly described as like
2:06:20exploit chaining. But rce remote code
2:06:24execution is one of the best uh beach
2:06:28heads into a system as like a starting
2:06:32point. If you can find a vulnerability
2:06:33that is remote code execution, then you
2:06:36can get a lot more access to the system.
2:06:38Um, the less interactive
2:06:40>> uh requirements you have for remote code
2:06:42execution, the more ability you have to
2:06:46take over more TVs, okay,
2:06:48surreptitiously, right?
2:06:49>> So, the the the more holes that you find
2:06:53sort of the worse it becomes.
2:06:54>> That makes sense. Um, ours, the one that
2:06:58worked was actually, I think, a worse
2:07:00remote code execution than the one that
2:07:01had been patched by LG.
2:07:03>> The one that had been patched by LG was
2:07:05we had to put in the um the IP address
2:07:08of the TV
2:07:09>> and then the TV would pair the the
2:07:12exploit application would pair to the TV
2:07:14like as if it was a mobile device. And
2:07:15so there was a pop-up and we had to say
2:07:16yes
2:07:17>> and then it took off and that was fun.
2:07:20Um, but that didn't result in control of
2:07:24the TV. The one that worked was from the
2:07:26browser in the TV. So like if you go in
2:07:28the web browser in the TV and you went
2:07:30to a web page
2:07:31>> and you went to the wrong web page
2:07:34>> and you accidentally hit yes or on
2:07:36purpose was like a mobile because the
2:07:37web page also generated
2:07:38>> this one you ran.
2:07:39>> Yeah. Yeah. Okay.
2:07:40>> And so the popup said, "Oh, there's a
2:07:42mobile device. Would you like to pair
2:07:44with a mobile device?" There was no
2:07:45mobile device. That was the web page.
2:07:46The mobile device was the web page.
2:07:48>> And so if you said yes because you know
2:07:51the thing is a little fiddly. Or if you
2:07:52just were in a loop and you said no, you
2:07:54can just have it say yes over and over
2:07:55again,
2:07:55>> right? Until they finally like, h, fine.
2:07:57Okay.
2:07:57>> Yeah. The LG browser is not it's
2:08:00terrible. And but it's Chromium based,
2:08:01but it's old Chromium. And so it's um
2:08:04and so you say yes and then we were in.
2:08:08>> So that's really not a a really super
2:08:10high bar for
2:08:11>> right access. Yeah.
2:08:13>> Yeah. And also LG doesn't give you like
2:08:16their even if you go in their developer
2:08:18program like that that's the legit way
2:08:20to do this kind of thing. They really
2:08:22don't give you full access to the
2:08:24hardware that you own because they don't
2:08:27think you own it.
2:08:28>> Yeah. As we keep coming back to.
2:08:31>> Yeah. And that's that's offensive. It's
2:08:32like it's my TV. I'd like to audit it.
2:08:34If if you look at the old TVs that we
2:08:36have like six years ago, um those TVs
2:08:39didn't even have an advertising ID out
2:08:40of the box. And then you get a firmware
2:08:43update and even without opting into
2:08:44anything, boom, there's your advertising
2:08:46ID. I didn't agree to that. What?
2:08:47>> We showed it on your TV. Yeah. You
2:08:49literally had no terms you had agreed
2:08:51to, right? Yep. Ever. And then
2:08:53>> from one update to the next, it's like,
2:08:54oh, now we've got an advertising ID. And
2:08:57you can't turn it off.
2:08:58>> It added that cookies thing, too. Yeah.
2:09:00The kind of dark pattern toggle. Yeah.
2:09:03>> Like, I did not give you permission to
2:09:05alter the functionality of the TV with
2:09:06this update. there was no notice that
2:09:08the functionality of the TV would be
2:09:09altered with this update.
2:09:11>> Right. Well, and that also seems like it
2:09:13would require some kind of toos
2:09:14agreement or something, user agreement.
2:09:16But
2:09:17>> even basic stuff, there's there's people
2:09:18on on on the forum that have been raised
2:09:21in heck because LG keeps changing how
2:09:23they deal with DTS audio, and that has
2:09:26nothing to do with any of the stuff that
2:09:27we're talking about except for LG is
2:09:29changing the functionality of a TV after
2:09:32the fact,
2:09:33>> right? All right. Any other any other
2:09:35points you want to talk about here? I
2:09:36mean, you're you own several LG TVs in
2:09:39your office.
2:09:40>> Yeah, it's basically all LG. Uh, it's
2:09:43funny, though, because all the LGs that
2:09:44I've had here for years, every one of
2:09:46them is the out of the box firmware.
2:09:48>> That's LG right there.
2:09:49>> Yeah. Yeah. This is like the other one
2:09:52that's on a they're all LG and yet
2:09:53they've never been on the network
2:09:54because I never I've never trusted LG to
2:09:57do that. Actually, the crossover
2:09:59monitor, the like the the the one on the
2:10:01wall back there is an LG panel with LG
2:10:04Alternative Electronics. And as a
2:10:06company, Crossover, that was a viable
2:10:08business model for them. We can actually
2:10:09go peel the sticker off and there's an
2:10:11LG sticker behind the Crossover sticker.
2:10:13>> So Crossover is the name of a brand.
2:10:15>> Okay. So Crossover put their sticker on
2:10:17top of the LG sticker.
2:10:18>> Yep. But it's a completely different set
2:10:20of electronics.
2:10:21>> Why? What's the
2:10:24[laughter]
2:10:28>> I think you know why. [laughter]
2:10:31>> You know, short version recap. How do
2:10:32you feel about the what's your level of
2:10:34concern with this, you know, as as both
2:10:38a a business owner with these types of
2:10:39devices, but also someone who may, you
2:10:42know, advise or work with businesses on
2:10:44security or infrastructure?
2:10:46>> I've never advised using the TV's
2:10:48built-in apps. It is it's a devil's deal
2:10:51and eventually it will come to
2:10:53>> but I have to admit that it was very
2:10:54creative of LG cuz like a computer
2:10:56display is a dumb display. It was very
2:10:58creative of them to co-opt the Windows
2:11:00update system to use that to in shedify.
2:11:03>> Well, you know that uh Microsoft owns
2:11:05the data management service that LG uses
2:11:09for that stuff.
2:11:11>> That tracks,
2:11:12>> but don't worry, Microsoft will throw LG
2:11:14under the bus and pretend that it
2:11:15[laughter] was all their fault.
2:11:17>> Yeah, I like how Microsoft's reaction to
2:11:19that was like, hey, could you maybe cut
2:11:20that out and not just terminating their
2:11:22Windows update account and rolling back
2:11:24all the changes?
2:11:24>> I mean, that's probably what they would
2:11:26do to a small developer, right? some
2:11:28name they would just terminate your
2:11:29account like you've abused this function
2:11:31goodbye you know but not
2:11:33>> they certainly did that to the security
2:11:34researchers trying to tell them problems
2:11:36with things Microsoft
2:11:39>> thanks Microsoft [laughter]
2:11:42>> all right I think that's kind of that's
2:11:44a pretty good recap so
2:11:46>> we'll jump over to the next part thanks
2:11:48Wendell
2:11:49>> thanks Steve
2:11:50>> LG will probably say that they take
2:11:52vulnerabilities very seriously and will
2:11:54patch them right away but they didn't
2:11:56reply to us when we sent them a ton of
2:11:58our concerns. The bigger we
2:12:00think, is LG deliberately designing this
2:12:03to make money off of your privacy after
2:12:05you paid for a thing and off of your
2:12:07personal information. You have to reject
2:12:10this outright or it will just keep
2:12:12getting worse. If you want flock cameras
2:12:14on your living room wall, this is how
2:12:17you get flock cameras on your living
2:12:19room wall. The only reason to give a TV
2:12:21this kind of power is to visit horrors
2:12:24upon you, not to make a better product.
2:12:27Ultimately, we wouldn't recommend any LG
2:12:29smart products to literally anybody.
2:12:32That'll wrap this part of our deep dive
2:12:33investigation. We do have more, though.
2:12:35It's likely we'll have more installments
2:12:36in this saga, and we really need your
2:12:38help to pay for this video. I spent a
2:12:41lot of money on this video.
2:12:44Seriously, it was a lot. We spent more
2:12:46than a month working on this, including
2:12:47travel, buying thousands of dollars of
2:12:49TVs. We had most the team on this
2:12:51project. Really, the best way to support
2:12:52us on this one and the other upcoming
2:12:54videos in this series would be through
2:12:56our data dragnet campaign on the store,
2:12:58which is a Kickstarter style campaign
2:13:00where we transparently show you how much
2:13:01money we've raised. And we have some
2:13:03goals what we're going to do with it.
2:13:04So, for example, we'd really like to go
2:13:05back in with Samsung, Vizio, anyone
2:13:07else, and kind of do a bunch of this
2:13:09research again or stuff like it. See
2:13:10what we can find. This is so expensive
2:13:13both in time and in actual cost and the
2:13:16two related together. I mean, I can't
2:13:18just like stop everything for three
2:13:20months every time we do one of these
2:13:21kind of like we did with LG. And so
2:13:23that's where we really need your help.
2:13:25We have some pretty damn cool stuff on
2:13:26the store for this as well. So, in
2:13:28addition to the individually available
2:13:29items like our new foil cyber skeleton
2:13:32shirt and our foil polygon V2 shirt and
2:13:35our LG Investigation Blu-ray discs
2:13:37available that we're burning in house,
2:13:39we're 3D printing the cases in house.
2:13:40all that stuff. We also have four
2:13:42different backer tiers that give some
2:13:43good discounts on bundling a bunch of
2:13:45items together. They also give bonus
2:13:47videos. And then in the case of the
2:13:49sabotur tier, the highest one, there's a
2:13:51live stream Q&A with me that you'll get
2:13:53to join. I'll send those invites out at
2:13:54the end of the campaign. So, be a little
2:13:56while, but those are always really fun
2:13:57to hang out with the community. So, this
2:13:59is the best way to support us. If you
2:14:00don't need one of these, we also have a
2:14:02donate button in the bottom left of
2:14:03store.gamersex.net
2:14:05and on patreon.com/gamers
2:14:07nexus for monthly support. Or you could
2:14:10consider buying one of our other items
2:14:11like our project and soldering mats.
2:14:13Great for any project. We think the
2:14:15extent of LG's data harvesting is
2:14:16intrusive and grotesque. Additionally,
2:14:19despite the Overton window shifting
2:14:20further and further away, we still
2:14:22believe that when you purchase
2:14:23something, especially for thousands of
2:14:25dollars, you should own that thing. LG
2:14:28isn't the only smart TV manufacturer
2:14:30behaving this way. and we'd like to
2:14:31expand the scope of our investigation
2:14:33and eventually test TVs from other
2:14:34manufacturers in a follow-up piece, but
2:14:37we are going to need funding for that.
2:14:39If you have any tips or leads for a
2:14:40follow-up, please email us at
2:14:42[email protected].
2:14:44Mr. Bra advised immediately
2:14:45disconnecting LG smart TVs from any
2:14:48network. Wendell felt much the same. Our
2:14:50other researcher we worked with, U-Turn,
2:14:52said this quote, "My recommendation to
2:14:54users would be to demand ownership over
2:14:56your devices. First, by using and
2:14:58supporting proconsumer projects that
2:15:00seek to give you device control back,
2:15:03and second, by demanding legislation
2:15:05that reflects the changes you want to
2:15:07see. Sell carriers only carrier unlock
2:15:09your phones because the 113th Congress
2:15:11made it law." End quote. Which I thought
2:15:14was an excellent point. As where groups
2:15:16like Fulu come in both U-Turn and Mr.
2:15:19Bruh have communityf funed coffee pages
2:15:21we'll link below. Our thanks to Wendell,
2:15:23Mr. Brah, and U-Turn for their help with
2:15:25researching this piece and the
2:15:26informants in our inbox. We'll have a
2:15:28lot more to talk about with all this
2:15:30soon. And one final time, we really do
2:15:33need the help funding this expensive
2:15:34type of work so we can do the next set
2:15:36of smart TVs. So, if you feel like you
2:15:38can spare it, please head over to our
2:15:39store or Patreon to leave a super thanks
2:15:42below so I can spend thousands of
2:15:45dollars on TVs that will spy on us.
2:15:48Thanks for watching. Subscribe for more
2:15:49and we'll see you all next

About this transcript

This page contains the full transcript of 216,000,000 Spy TVs | The LG Smart TV Problem by Gamers Nexus, generated from the public captions YouTube serves with the video. The transcript has 25,365 words across 3,878 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.