YT YouTube2Text

YouTube2Text → Transcripts → Gamers Nexus Said LG TVs Spy on You. I Tapped One to Find Out.

Gamers Nexus Said LG TVs Spy on You. I Tapped One to Find Out. — Transcript

by The Homeboy Workshop · 2,070 words · 343 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Every one of those purple marks is my LG
0:02TV asking my network which devices are
0:05in my house. This happens every 5
0:08minutes, hour after hour, whether anyone
0:11is watching the TV or not.
0:15And this is network traffic captured
0:17passively off a network tap. And this is
0:20my LG TV reaching out to devices on my
0:23network for their names, copied straight
0:26off the wire without the TV ever
0:27knowing.
0:31Gamer Nexus spent 2 hours on this. In
0:33his video, he showed how the LG TVs were
0:36scanning your home network, identifying
0:38what devices you own and the content you
0:40watch, and feeding this into an
0:42advertising profile.
0:44LG's response to this was that network
0:47scanning is a standard function commonly
0:49provided by smart TVs.
0:52They are technically right, but there is
0:54an ethics problem that still stands
0:56anyway, because almost nobody knows what
0:58they've agreed to.
1:01We'd regularly trade convenience for
1:03control points somewhere else. Handed it
1:05over knowingly or otherwise not. On
1:08this, I agree with Gamer Nexus's
1:09message. People think that they're
1:11buying a TV. They do not think that
1:14they're buying something that watches
1:15what they do and sells it back to them
1:17as advertising.
1:19This matters more every year as
1:21advertising profiles turn from a passive
1:23feed to having real-life active changes,
1:26for example, dynamic pricing.
1:29So, I took their video as a starting
1:30point and put a hardware tap on my own
1:33LG TV to see what was actually going on
1:36from a network point of view.
1:43This video is about the network side of
1:45deep packet inspection. It's not about
1:47addressing the microphone listening to
1:49you. It's not about the spying
1:50headlines. It's literally about looking
1:53at the TV's network traffic,
1:55understanding how to capture it, how to
1:57read it, and when encryption becomes an
2:00issue.
2:02On the last video, we talked about the
2:03hardware side of network taps. Plenty of
2:07you said in the comments that you cannot
2:09do anything because encryption stops
2:10everything. However, this is technically
2:13correct, but there's still a lot of
2:15information that can be contained with
2:17the network traffic that you see on the
2:19wire.
2:20Okay, so just a quick disclaimer. This
2:23is my hardware, my isolated network, and
2:26I own every single device. I'm doing
2:28this for security research to understand
2:31what the alleged behavior that
2:33GamerNexus mentioned, and I paid for the
2:35TV and all the devices on this video.
2:39All right, we're going to talk about the
2:40lab that we have set up so everyone can
2:42understand what we're going to do here.
2:45The TV sits on an isolated segment with
2:47no route to the internet. The network
2:50tap sits in line between the TV and the
2:53router,
2:54copying every packet from both
2:56directions out to monitoring ports.
3:00The packet captures from the two
3:02monitoring ports are then stored by
3:05dumpcap on the Raspberry Pi,
3:08writing to disk every 5 minutes.
3:11I then have another MacBook on the same
3:14network segment that replicates the
3:16internet. It responds to DNS requests,
3:20any HP requests, and has its own CA
3:23setup.
3:25This then tricks the TV to thinking that
3:27it's actually connected to the internet.
3:29However, it's actually talking to my
3:30MacBook instead, where I can log all the
3:33traffic directly.
3:35Inside the MacBook, I also have it
3:37pretending to be a bunch of canary
3:39devices.
3:40For example, a Chromecast, an AirPlay
3:42speaker, or a printer. It is also
3:45replicating what GamerNexus saw is that
3:48I'm also advertising TeamViewer and VNC
3:51and SSH
3:53services.
3:55Okay, so now that how we have all the
3:57packet captures on the pie, we're going
3:58to move them by SSH every couple minutes
4:02to an analysis box.
4:04On side that analysis box, we're going
4:06to have InfluxDB that holds time series
4:08data and displaying that into Grafana to
4:11show some behavior over time.
4:14Then we're going to have Arkime that
4:15ingest the network captures and makes
4:18them searchable through OpenSearch.
4:21Then we're also going to
4:24ingest the PCAPs into Zeek that turns
4:27them into traffic logs and we can easily
4:29search this via Grafana as well.
4:32One quick ask before the tools. I really
4:35love making these videos and there's
4:37plenty more still coming.
4:39Please let me know in the comments
4:40section what you would like me to tap
4:41next. If you want those, please consider
4:44subscribing and hitting the like button
4:46because it really does help support
4:48growing this channel.
4:50To understand deep packet inspection,
4:51you first need to understand OSI model.
4:55A packet is not flat. It is made from a
4:58series of layers wrapped around each
5:00other.
5:01On the way out, every layer adds its own
5:03small header. And on the way in, every
5:05layer reads its own header and ignores
5:08everything inside.
5:10That is why a switch will read one layer
5:13and then stop.
5:14And vice versa for a router. And same
5:17for a firewall. Deep packet inspection
5:19is essentially understanding every
5:21single layer and understanding what
5:23layer is doing and then reporting that
5:25back.
5:27There are seven layers to the OSI model
5:29and the first one starts with a physical
5:30side, which is really basic when you
5:32think about it. All you have to think is
5:35the voltage, the light, and the radio
5:37waves. The question here is essentially
5:40is there a signal at all?
5:42My first video was basically about
5:44understanding how copper taps regenerate
5:47the electrical signal and a fiber tap
5:49essentially splits the light and neither
5:51one actually cares what the signal means
5:53or what it's carrying.
5:57Layer two is the data link layer. We
5:59have a signal and now we start to have
6:01some structure. We're talking about an
6:04ethernet frame. Inside that ethernet
6:06frame we'll have MAC addresses, which is
6:08the hardware identifier attaches to the
6:10NICs. The question now becomes which
6:13device on your local network is this
6:15packet actually for?
6:18Layer three is the network. Now we get
6:21to have an IP address. The question
6:23changes from which device is this on my
6:25network to which device anywhere on the
6:28network am I trying to reach? This is
6:31the layer that gets a packet from the
6:32living room across the internet to any
6:35other data center.
6:37Layer four is the transport layer. This
6:39is where TCP or UDP come in with port
6:43numbers like 403, 53, or 80. Now we're
6:47asking slightly a different question.
6:49Which service or application that
6:52machine actually needs this data for? So
6:55instead of saying a packet arrived at
6:56this computer, layer four is talking
6:59about this packet is for this service
7:01listening on this particular port.
7:05Layer five and six is the session and
7:07presentation layer. It's kind of messy
7:10layers where the layers aren't
7:12essentially distinct from each other.
7:15And a lot of engineers still argue where
7:18encryption sits and belongs on this
7:20layer, but for the purpose of this
7:22series, I'm just going to treat that TLS
7:25occurs on layer six.
7:28Layer seven is the application layer and
7:30this is where we finally get the actual
7:32content. We're talking about the DNS
7:34query or the HTTP request with the JSON
7:37payload.
7:38Now the question is what actually is
7:41being said from the source to
7:43destination.
7:45Part one was about the hardware side of
7:47the two different taps that we had, the
7:49copper and fiber network taps. If you
7:52missed that video, there's just one
7:54important part.
7:56Both taps had two monitoring outputs,
8:00one per direction, A to B and B to A.
8:04I ended that video saying that the paths
8:06need stitching back at the software
8:08layer.
8:10The obvious approach is capturing each
8:12interface separately and merging the
8:14files later with mergecap. This will
8:17work fine, however, nobody does this in
8:20production because most of the times
8:22some of the files will reconcile at
8:24different times and you'll have
8:26different clock rotations.
8:28Instead, we're going to use dumpcap.
8:30Dumpcap allows us to capture pcaps on
8:34multiple NICs at the same time and
8:37change the writing to disk at a specific
8:40interval to a single pcap.
8:44Now, while we're talking about the
8:45specific NICs, there's two settings that
8:47we need to talk about, promiscuous mode
8:50and offload seconds.
8:52For promiscuous mode, a card will throw
8:55away frames that was not destined for
8:57itself. We want to essentially turn that
9:00off and that's what promiscuous mode
9:02allows us to do. Accept every single
9:04packet coming over this specific medium.
9:09For offload seconds, we're essentially
9:10trying to turn off the kernel from
9:12combining multiple different packets
9:14into one huge one.
9:16This causes a problem later on because
9:18we get different merging sizes, etc.
9:21Okay, now that we've talked about the
9:22lab setup and the brief understanding of
9:26the OSI model and the different layers,
9:28we're going to talk about what Gamut
9:29Nexus mentioned on the reverse DNS
9:32lookups.
9:33For me, I saw every 300 seconds reverse
9:37DNS lookups being made.
9:40I counted about 23 different sweeps
9:42before I stopped counting.
9:44Gamer Nexus said that the their TV
9:47identified a PC as running TeamViewer.
9:50Well, the answer is actually kind of
9:51boring here, which makes it kind of
9:53interesting.
9:55Multicast DNS service discovery.
9:58The same protocol that makes AirPlay
10:00work without any setup.
10:03The TV sends a query, meaning everybody
10:06list every kind of service you offer.
10:09For me, I saw the TV
10:12querying my network 57 times in 4 hours,
10:16which is roughly every 90 seconds.
10:19So, I built the fake PC to advertise
10:21TeamViewer, VNC, SSH, and RDP services.
10:26And once the fake PC advertised this,
10:29this TV then started querying for these
10:32services.
10:33So, this is actually correct.
10:36Multicast DNS service discovery is a
10:40standard protocol doing what it's
10:41designed for, and LG leaned into this in
10:45their response.
10:48The mechanism is 100% correct. However,
10:52asking every 90 seconds and attaching
10:54the answers to an advertising identity
10:56is a different use case in general that
10:59people probably don't know that is
11:00occurring.
11:02Overhearing is one thing. However, the
11:04TV went further. In a few hours, it
11:07asked for my fake smart plug for a full
11:11system info 99 times, which included the
11:14model, the name, the MAC address, and
11:16the firmware. It asked for the bulb for
11:19its version 54 times. It sent 18
11:22searches for a Belkin Wemo, a brand that
11:25I haven't even faked.
11:27Now, to go back to the packet captures
11:29and the Archon views.
11:32Since this is working well, why doesn't
11:34everyone just do it?
11:36Well, the answer is simple. It's an
11:37encryption. When traffic is encrypted,
11:39everything from layer four down stays
11:42readable. Addresses, the ports, the
11:44packet sizes, the timing, etc.
11:47However, layer seven turns it to
11:50complete jumble.
11:52With TLS 1.2, it used RSA key exchange,
11:56where the client encrypts the session
11:58secret to the server's public key.
12:01If you held the server's private key,
12:04you could decrypt the network traffic
12:06offline.
12:09TLS 1.3
12:11uses ephemeral Diffie-Hellman, which
12:14basically means both sides generate a
12:17temporary key and use them to agree on a
12:19shared secret, and then throw the keys
12:22away.
12:23The secret itself is then never
12:26transmitted across the wire.
12:28This is essentially called perfect
12:30forward secrecy.
12:33This means for TLS 1.3, we can't use the
12:36server's private key anymore to decrypt
12:39the traffic.
12:41You can still see where the packets are
12:43going to, who and when, but you can't
12:47actually see what's in the application
12:49layer, which is encrypted.
12:52Okay, so the final results were to
12:54confirm Gamers Nexus' claims with what
12:56we saw.
12:57We saw that the continuous scans were
13:00occurring from the local network via
13:01reverse DNS every five minutes
13:04and mDNS every 90 seconds. So, this is
13:07definitely confirmed.
13:08We saw that Gamers Nexus alleged that
13:11software devices were enumerated and uh
13:16SSH or services like TeamViewer were
13:18discovered, and that is also confirmed.
13:21We saw record device names and Mac uh
13:24derived IDs and asking for specific
13:27system information from those IDs. And
13:30that's once again confirmed. What we
13:32couldn't confirm is that
13:34uh it was asking for nearby Wi-Fi
13:36devices just because where we were
13:38capturing, we did not have visibility
13:40into this. And that's about it for this
13:43video. I hope it was informative and if
13:46I missed anything or made a mistake,
13:48feel free to correct me in the comments.
13:50As always, uh keep me honest and I'll
13:53see you in the next one.

About this transcript

This page contains the full transcript of Gamers Nexus Said LG TVs Spy on You. I Tapped One to Find Out. by The Homeboy Workshop, generated from the public captions YouTube serves with the video. The transcript has 2,070 words across 343 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.