Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack
from the dumb-is-the-new-smart dept
We’ve noted repeatedly how “smart” television sets have the same security issues plaguing the rest of the internet of broken things: namely there often isn’t any security to speak of. The net result has been TVs that spy on you by recording in-home audio, and in some cases transmitting that data unencrypted around the internet. But we’ve also noted how these TVs — like the rest of the Internet of Things — can be compromised in a matter of moments by some rather rudimentary hacking, then incorporated into the historically unprecedented DDoS attacks we’re now seeing around the world.
As an added bonus, your smart TV can now be infected by ransomware, too. Software engineer Darren Cauthon found this out the hard way when he awoke on Christmas Day to find that his family’s LG 50GA6400 had been infected with a version of the Cyber.Police ransomware — aka FLocker, Dogspectus, or Frantic Locker. That particular ransomware posts an image to the screen of the television pretending to originate with the FBI, and claiming that users must pay a $500 penalty to return full functionality to the television.
Cauthon quickly headed to Twitter to not only complain that his television was now demanding a payment just to function — but that LG’s online factory reset instructions for the TV in question didn’t work:
Family member's tv is bricked by Android malware. #lg wont disclose factory reset. Avoid these "smart tvs" like the plague. pic.twitter.com/kNz9T1kA0p
— Darren Cauthon (@darrencauthon) December 25, 2016
Worse, perhaps, Cauthon stated that when he contacted LG, he was shuffled around several support departments before being told that he might have to bring the TV in to be serviced by a technician (for a $340 surcharge):
“Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn’t work. When the software engineer contacted LG, the company told him to visit one of their service centers, where one of its employees could reset his TV.
This angered Cauthon because factory reset procedures shouldn’t be secret, but also because the service center visit implied a $340 bill. The ransomware asked Cauthon to pay $500 to unlock his TV.
As one commenter on Twitter pointed out, it would be cheaper to buy a new TV. “Avoid these ‘smart tvs’ like the plague,” Cauthon added following his discussion with LG.”
Ultimately LG reached out to Cauthon to help by providing the correct factory reset sequence, though the infection should have never been possible to begin with. While it’s possible that the infection could have come via a dubious download from the Google app store, the design of the television should never allow an application to take complete control of the device in the first place. While these infections are rare, other LG users have complained about similar attacks, and found removal of the offending malware to be difficult — especially given the lack of control users often have over devices they purportedly “own.”
Of course, security firms like Symantec have been warning about the rise of TV infections since 2015, noting that while in some instances a factory reset will solve the issue, in many instances removing the malware can be borderline impossible for a less technical user. And like so many internet of broken things devices, these TVs often fail to include basic functionality allowing users to determine what traffic the television is sending over the network, or settings allowing users to protect their security. It’s just one more example of how “smart” devices are frequently dumber than the technology they’re replacing.
Filed Under: factory reset, ransomware, smart tv
Comments on “Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack”
Not sure what they mean by “Smart” when describing their product. If said product were smart, it would not allow drive by downloads, worms, viruses, malware.
Does anyone sell an “Ethical” tv?
Maybe it decided it was so smart that it didn’t have to listen to security briefings.
Re: Re: Re:
Maybe the security briefings were a worthless as the factory reset code that didn’t work.
Maybe the security briefings were politically biased so as to delegitimize the rightful owner who won the TV fair and square.
Their called dumb TVs. Or a DIY Linux media box if you want smart and ethical.
“Smart” is the new stupid
Silly question maybe but why we need TVs smarter than “display good quality image and that’s it” when there are much better devices that can do everything the smartness can do with added security, comfort and reliability?
I’d gladly skip $100 or more to get a stripped down TV…
I, for one, am pretty happy with my smart tv’s.
I get all of my programming from the web and OTA (no cable).
I have a single remote control that actually controls everything rather than a table covered in them and a 4 step procedure to turn on the TV, select a channel, and hear sound.
My TV is updated and working every day (it updates automatically in the early hours of the day).
News is available any time (including Facebook and Twitter).
Internet Radio is available when I want music.
I am not a huge fan of everything being connected to the internet, but a smart TV is actually one of the things that really has made things more convenient and better for me.
Re: Re: Re:
Depends on how long they support the platform. I have a “Smart” TV and can’t use the Amazon Prime app to view movies since it’s no longer supported. So I have to buy a box for that. Which also does all the other streaming platforms, so the “smart” functions are no longer used.
Give me a “dumb” TV and an HDMI port to plug in my smart app box of choice.
Re: Re: Re: Re:
The Smart features on my Sony (with Android TV) are pretty worthless. The ARC will not pass Dolby Digital+ (only Dolby Digital) so I bought a Roku. They could also do away with the worthless TV speakers as far as I’m concerned.
Anyone know how this guy got infected? What features did he use? Email? Browser? Google store?
Re: Re: Re:2 Re:
Found the answer to my question on kim komando’s site:
Frantic Locker was first reported to spread via spam text messages and malicious web links. To avoid getting your Google TV infected, be careful when visiting websites using the built-in TV web browser. Additionally, checking email and clicking unknown links through your TV can also put it at risk. However, in Cauthon’s case, it appears that his TV was infected by a rogue app. It goes without saying, please refrain from downloading and installing apps from unofficial and unknown app sources.
Don’t install 3rd party apps, don’t browse the web, don’t check your email on your ‘smart’ TV. In short – don’t do stupid stuff.
Re: Re: Re:
I also have one remote control to control everything, and while I do have a smart TV, it has no data connectivity outside HDMI cables.
My one remote control controls a HTPC that does everything except displaying the actual image. It plays movies on the HTPC out to the TV, music, free-to-air TV, it records that TV if I want to time-shift it. If I want to surf the net using my TV as my display, I do, but the surfing occurs on the HTPC using a wireless (or wired if i feel like it) keyboard, mouse, or the remote control which is a wireless pointer as well. I can play games without switching devices (Civ, Battlefield and whatnot). I can update video and audio codecs on the HTPC whenever I need to to play the latest and greatest format, without having to worry about the TV vendor refusing to update its codec set in the hopes I’ll buy a complete new TV just to get the latest codecs. I can use the latest software, browsers, and whatever else I want.
The only time I need to replace the TV is when either the screen breaks, or there have been significant changes in dislay hardware technology. E.g. CRT -> 720p/1080p Plasma -> 1080p LED backlit LCD -> 4k OLED HDR. Not every time there is a minor software technology or hardware change like xVid -> x264 -> x265. USB 2 -> 3 -> 3.1 (Type A or C) gen2, or 100Mb -> 1Gb (hopefully soon! -> 2.5Gb -> 5Gb), or wireless A/G -> N -> AC , and so on.
Yeah, not a silly question all att, but unfortunately if you want a large screen, an equivalent "dumb" TV is not +$100, it’s more likely twice-or-more the price.
This, though, is exactly my "smart" TV has been dumbed-down since purchase to being just a screen for rather smarter devices.
Re: Re: Re:
There are 55″ “dumb” tv’s out there for cheap if you look.
So that there is more reason to force upgrades on consumers.
When I was a kid, a TV was like a fridge or washing machine – you’d buy a new one every decade or so. Maybe have a 2nd smaller one for the kids, which is most likely a hand-me-down from when the main TV was upgraded to an OMG 68cm so the 48cm it was replacing was moved off to the kids room.
But by incorporating many unnecessary technologies in the TV – media players, web browsers, players for specific eco-systems (netflix, amazon etc) that aren’t upgradeable, or that they only support for a year or 2 with upgrades (like a mobile phone), there are more opportunities to foist upgrades on users.
$340 for them to press & hold a series of keys, then type in a code.
Gee you’d think that the data they suck out of the smart tv’s that gets them paid would offset the cost of just keeping a plain web page up with the instructions.
Of course this was one of the older abandoned Google Smart TV’s where the ‘don’t be evil’ corporation could have forced this magical sequence be available to consumers, but that would have made LG sad.
There seems to be little actual benefit for having a smart tv – you pay a premium price, you get spied on, you get special advertising, you get zero support unless you pay a huge fee….
Just because you can, doesn’t mean you should. It really is high time people start voting with their wallets & avoiding corps that insist they have to spy so they can make more off of you.
In my recent TV shopping there a lot of non-smart TVs were more than their equivalent “smart” versions (and this wasn’t during black friday sales)
Re: Re: Re:
I have a 40 inch smart tv that I got for $250 on Black Friday. I dont really use the “smart” features though, its just attached to my laptop via hdmi. This reminds me, I should turn off the internet connectivity.
Re: Extra $$$ for Samsung
An extra $340? Samsung is partnering with the Ransomware folks after the fact. Isn’t profiting from criminals after the crime also a crime?
Re: Re: Extra $$$ for Samsung
Um… Unless you’re implying that Samsung owns LG, how would they get $340 for a repair on an LG TV?
A cynical person might think they actually unleashed the malware themselves.
Nice to see an accurate headline. Most places I’ve read this either implied or outright stated that the programmer had developed his own fix, rather than simply having to beg LG to waive their massive charge they’d want to enter the reset code themselves.
class action suit - negligence and fraud
they are defrauding him and /or negligent in providing a proper product
reason they dont want that reset out there
….oh its also hackable as in , if you alter that onboard it will be brickable forever….
haha smart indeed making it flashable
In an upcoming ‘leak from the Russians’, LG is shown to be infecting its own TVs with Ransomware.
"Either we get the $500 from the ransom or we get just over $300 at one of our service departments to fix the problem. Either way it is win-win and our stock is at an all time high." -leaked internal LG memo
More consumer education is necessary. Those informed would not connect their smart TV’s to the net. Smart features should be handled by an external computer that gets prompt security updates.
not connect to the net
can you truly not connect to the ‘net? is there wireless capability that can bypass your efforts?
you say your home router is password-protected and so are your neighbors’? hah.
Re: Re: Re:
Yes you can truly not connect to the net.
You simply just do not plug up the patch cable or configure WIFI. TV stays dumb that way.
Re: Re: Re: Re:
That works until the TV or other smart device has to phone home before doing anything, and then the corp[orations own you.
Re: Re: Re:2 Re:
I would not be surprised to find out there are hidden undisclosed wifi transmitters in many everyday devices which are used to spy on you.
Re: Re: Re:3 Re:
tin foil hat
Please, go on…
Re: Re: Re:4 Re:
You’re saying it can not happen?
Re: Re: Re:5 Re:
well umm… they ARE disclosed.
got a smart phone?
some still want self driving cars…idiotic
Unfortunately these “smart” tv’s REQUIRE network access in order to enable/configure their highest picture quality settings (i.e. download the latest HDR patch which fixes some HDR video gameplay or 4K BluRay video flaw).
Look! Someone wrote the word “Gullible” on the ceiling!
Re: and yet
Necessity is the mother of all invention.
Look on the bright side, after enough people die, real security will become a reality.
I hate to be there bearer of bad news, but humanity kinda requires massive death and destruction to get motivated to do the right things. Or have you not looked at history and its many wars?
Re: and yet
I may be coming too late to this discussion, but how is a self-driving car worse than the current hackable cars?
This angered Cauthon because factory reset procedures shouldn’t be secret, but also because the service center visit implied a $340 bill.
What if he decided to sell it and wanted to make sure his personal information was off the set? Would LG expect this guy to take it to a service center, pay $340 for them to reset it, only to sell it for say, $250?
Fuck you LG.
Fuck you very much.
You cannot resell this TV because you only licensed the software that is included. If you would like to sell it, you will need to pay an additional license fee.
All “smart” devices should come with a recessed button that you press with the tip of a pen for 10 seconds to reset it to the factory defaults.
10 seconds to reset to factory defaults, and then 10 hours to reinstall all the patches and updates released since it left the factory.
Re: Re: Re:
Re: Re: Re: Re:
Just a crazy thought, but maybe they could spend a little more time testing the firmware and release something that isn’t broken from the start?
Since he eventually got the correct reset procedure, I hope it gets published on the Internet.
Re: I hope...
“With the TV powered off, place one finger on the settings symbol then another finger on the channel down symbol. Remove finger from settings, then from channel down, and navigate using volume keys to the wipe data/ factory reset option.”
The idea that LG thought he should go to a service center and pay $340 is so ridiculous. I wonder if that fixed the vulnerability too. Otherwise he could just get hit again and need to pay another $340.
Worth noting - media attention was required
Anyone want to bet how much time and/or money it would have cost him if he had not made a public stink about how poorly LG was treating him? Once again, the only thing that got LG to address the problem was negative publicity sufficient to convince an LG manager that the publicity was hurting the company’s future profits.
Where can we buy those dumb displays they use above the counter in fast food restaurants?
It’s almost impossible these days to buy a TV without the so called smart crap in it. I big problem is, they add this crap with no real intention in supporting it in the future. TV’s have such a slim profit margin, it’s not in their interest to do anything with it after the sale.
The problem is, when it comes to TV’s you tend to hold onto them for many years. Hell I have a couple 50″ Panasonic Plasma’s that I love and have no plans to replace anytime soon and I’ve already owned them quite a few years already. They’re dumb TV’s. Just how I like them. I think it’s much better to just buy a nice AppleTV, or a ROKU box or something like that to get the so called SMART stuff. It’ll be faster, far better supported, and if you want to upgrade, it’s simple to swap out a box to something else. Maybe put the old box to some other older TV you may happen to have.
This crap built into your TV doesn’t get supported and so it gets laggy, and app’s slowly stop working because they don’t get updated. Security is a joke. It really doesn’t make much sense and if I had a choice, I would get a DUMB TV. Just give me something with a nice picture and I’ll hook up what I need to it to display what I want. The TV should just work!!!
I wouldn’t know since I haven’t owned one, but I always assumed you can choose not to use the smart functionality.
This is just the Internet of Shit
Any device manufacturer that sees a competitor try something these days immediately tries to improve/copy/hit the checkbox to they have the same or better feature.
Few companies have the expertise to do this. In particular when it comes to security and, as mentioned above, have no incentive at all to provide support for a product where there is no ongoing profit. With their well known razor thin profits these devices can add the feature(sic) with an out of date SoC which might well be lacking the necessary hardware to provide modern protection.
There is no possibility of solving this. The smart TV is now the default for many. The OS of choice is Android, which supports their store. That is where the mighty malware lives.
Don’t buy smart TVs.
Smart tv? Lipstick on a pig.
More reason to call them idiot boxes.
As an added bonus, your smart TV can now be infected by ransomware, too.