Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack

from the dumb-is-the-new-smart dept

We’ve noted repeatedly how “smart” television sets have the same security issues plaguing the rest of the internet of broken things: namely there often isn’t any security to speak of. The net result has been TVs that spy on you by recording in-home audio, and in some cases transmitting that data unencrypted around the internet. But we’ve also noted how these TVs — like the rest of the Internet of Things — can be compromised in a matter of moments by some rather rudimentary hacking, then incorporated into the historically unprecedented DDoS attacks we’re now seeing around the world.

As an added bonus, your smart TV can now be infected by ransomware, too. Software engineer Darren Cauthon found this out the hard way when he awoke on Christmas Day to find that his family’s LG 50GA6400 had been infected with a version of the Cyber.Police ransomware — aka FLocker, Dogspectus, or Frantic Locker. That particular ransomware posts an image to the screen of the television pretending to originate with the FBI, and claiming that users must pay a $500 penalty to return full functionality to the television.

Cauthon quickly headed to Twitter to not only complain that his television was now demanding a payment just to function — but that LG’s online factory reset instructions for the TV in question didn’t work:

Worse, perhaps, Cauthon stated that when he contacted LG, he was shuffled around several support departments before being told that he might have to bring the TV in to be serviced by a technician (for a $340 surcharge):

“Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn’t work. When the software engineer contacted LG, the company told him to visit one of their service centers, where one of its employees could reset his TV.

This angered Cauthon because factory reset procedures shouldn’t be secret, but also because the service center visit implied a $340 bill. The ransomware asked Cauthon to pay $500 to unlock his TV.

As one commenter on Twitter pointed out, it would be cheaper to buy a new TV. “Avoid these ‘smart tvs’ like the plague,” Cauthon added following his discussion with LG.”

Ultimately LG reached out to Cauthon to help by providing the correct factory reset sequence, though the infection should have never been possible to begin with. While it’s possible that the infection could have come via a dubious download from the Google app store, the design of the television should never allow an application to take complete control of the device in the first place. While these infections are rare, other LG users have complained about similar attacks, and found removal of the offending malware to be difficult — especially given the lack of control users often have over devices they purportedly “own.”

Of course, security firms like Symantec have been warning about the rise of TV infections since 2015, noting that while in some instances a factory reset will solve the issue, in many instances removing the malware can be borderline impossible for a less technical user. And like so many internet of broken things devices, these TVs often fail to include basic functionality allowing users to determine what traffic the television is sending over the network, or settings allowing users to protect their security. It’s just one more example of how “smart” devices are frequently dumber than the technology they’re replacing.

Filed Under: , ,
Companies: lg

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack”

Subscribe: RSS Leave a comment
Michael (profile) says:

Re: Re:

I, for one, am pretty happy with my smart tv’s.

I get all of my programming from the web and OTA (no cable).
I have a single remote control that actually controls everything rather than a table covered in them and a 4 step procedure to turn on the TV, select a channel, and hear sound.
My TV is updated and working every day (it updates automatically in the early hours of the day).
News is available any time (including Facebook and Twitter).
Internet Radio is available when I want music.

I am not a huge fan of everything being connected to the internet, but a smart TV is actually one of the things that really has made things more convenient and better for me.

David says:

Re: Re: Re:

Depends on how long they support the platform. I have a “Smart” TV and can’t use the Amazon Prime app to view movies since it’s no longer supported. So I have to buy a box for that. Which also does all the other streaming platforms, so the “smart” functions are no longer used.

Give me a “dumb” TV and an HDMI port to plug in my smart app box of choice.

Teamchaos (profile) says:

Re: Re: Re: Re:

The Smart features on my Sony (with Android TV) are pretty worthless. The ARC will not pass Dolby Digital+ (only Dolby Digital) so I bought a Roku. They could also do away with the worthless TV speakers as far as I’m concerned.

Anyone know how this guy got infected? What features did he use? Email? Browser? Google store?

Teamchaos (profile) says:

Re: Re: Re:2 Re:

Found the answer to my question on kim komando’s site:

Frantic Locker was first reported to spread via spam text messages and malicious web links. To avoid getting your Google TV infected, be careful when visiting websites using the built-in TV web browser. Additionally, checking email and clicking unknown links through your TV can also put it at risk. However, in Cauthon’s case, it appears that his TV was infected by a rogue app. It goes without saying, please refrain from downloading and installing apps from unofficial and unknown app sources.

Don’t install 3rd party apps, don’t browse the web, don’t check your email on your ‘smart’ TV. In short – don’t do stupid stuff.

Eldakka (profile) says:

Re: Re: Re:

I also have one remote control to control everything, and while I do have a smart TV, it has no data connectivity outside HDMI cables.

My one remote control controls a HTPC that does everything except displaying the actual image. It plays movies on the HTPC out to the TV, music, free-to-air TV, it records that TV if I want to time-shift it. If I want to surf the net using my TV as my display, I do, but the surfing occurs on the HTPC using a wireless (or wired if i feel like it) keyboard, mouse, or the remote control which is a wireless pointer as well. I can play games without switching devices (Civ, Battlefield and whatnot). I can update video and audio codecs on the HTPC whenever I need to to play the latest and greatest format, without having to worry about the TV vendor refusing to update its codec set in the hopes I’ll buy a complete new TV just to get the latest codecs. I can use the latest software, browsers, and whatever else I want.

The only time I need to replace the TV is when either the screen breaks, or there have been significant changes in dislay hardware technology. E.g. CRT -> 720p/1080p Plasma -> 1080p LED backlit LCD -> 4k OLED HDR. Not every time there is a minor software technology or hardware change like xVid -> x264 -> x265. USB 2 -> 3 -> 3.1 (Type A or C) gen2, or 100Mb -> 1Gb (hopefully soon! -> 2.5Gb -> 5Gb), or wireless A/G -> N -> AC , and so on.

Not an Electronic Rodent (profile) says:

Re: Re:

Silly question maybe but why we need TVs smarter than "display good quality image and that’s it" when there are much better devices that can do everything the smartness can do with added security, comfort and reliability?

I’d gladly skip $100 or more to get a stripped down TV…

Yeah, not a silly question all att, but unfortunately if you want a large screen, an equivalent "dumb" TV is not +$100, it’s more likely twice-or-more the price.

This, though, is exactly my "smart" TV has been dumbed-down since purchase to being just a screen for rather smarter devices.

Eldakka (profile) says:

Re: Re:

So that there is more reason to force upgrades on consumers.

When I was a kid, a TV was like a fridge or washing machine – you’d buy a new one every decade or so. Maybe have a 2nd smaller one for the kids, which is most likely a hand-me-down from when the main TV was upgraded to an OMG 68cm so the 48cm it was replacing was moved off to the kids room.

But by incorporating many unnecessary technologies in the TV – media players, web browsers, players for specific eco-systems (netflix, amazon etc) that aren’t upgradeable, or that they only support for a year or 2 with upgrades (like a mobile phone), there are more opportunities to foist upgrades on users.

That Anonymous Coward (profile) says:

$340 for them to press & hold a series of keys, then type in a code.
Gee you’d think that the data they suck out of the smart tv’s that gets them paid would offset the cost of just keeping a plain web page up with the instructions.

Of course this was one of the older abandoned Google Smart TV’s where the ‘don’t be evil’ corporation could have forced this magical sequence be available to consumers, but that would have made LG sad.

There seems to be little actual benefit for having a smart tv – you pay a premium price, you get spied on, you get special advertising, you get zero support unless you pay a huge fee….

Just because you can, doesn’t mean you should. It really is high time people start voting with their wallets & avoiding corps that insist they have to spy so they can make more off of you.

Anonymous Coward says:

and yet

some still want self driving cars…idiotic

Unfortunately these “smart” tv’s REQUIRE network access in order to enable/configure their highest picture quality settings (i.e. download the latest HDR patch which fixes some HDR video gameplay or 4K BluRay video flaw).

Look! Someone wrote the word “Gullible” on the ceiling!

Anonymous Coward says:

Re: and yet

Necessity is the mother of all invention.

Look on the bright side, after enough people die, real security will become a reality.

I hate to be there bearer of bad news, but humanity kinda requires massive death and destruction to get motivated to do the right things. Or have you not looked at history and its many wars?

Anonymous Coward says:

This angered Cauthon because factory reset procedures shouldn’t be secret, but also because the service center visit implied a $340 bill.

What if he decided to sell it and wanted to make sure his personal information was off the set? Would LG expect this guy to take it to a service center, pay $340 for them to reset it, only to sell it for say, $250?

Fuck you LG.

Fuck you very much.

Anonymous Coward says:

Worth noting - media attention was required

Anyone want to bet how much time and/or money it would have cost him if he had not made a public stink about how poorly LG was treating him? Once again, the only thing that got LG to address the problem was negative publicity sufficient to convince an LG manager that the publicity was hurting the company’s future profits.

Anonymous Coward says:

It’s almost impossible these days to buy a TV without the so called smart crap in it. I big problem is, they add this crap with no real intention in supporting it in the future. TV’s have such a slim profit margin, it’s not in their interest to do anything with it after the sale.

The problem is, when it comes to TV’s you tend to hold onto them for many years. Hell I have a couple 50″ Panasonic Plasma’s that I love and have no plans to replace anytime soon and I’ve already owned them quite a few years already. They’re dumb TV’s. Just how I like them. I think it’s much better to just buy a nice AppleTV, or a ROKU box or something like that to get the so called SMART stuff. It’ll be faster, far better supported, and if you want to upgrade, it’s simple to swap out a box to something else. Maybe put the old box to some other older TV you may happen to have.

This crap built into your TV doesn’t get supported and so it gets laggy, and app’s slowly stop working because they don’t get updated. Security is a joke. It really doesn’t make much sense and if I had a choice, I would get a DUMB TV. Just give me something with a nice picture and I’ll hook up what I need to it to display what I want. The TV should just work!!!

Anonymous Coward says:

Re: Re:

It’s almost impossible these days to buy a TV without the so called smart crap in it.

That’s because the TV manufacturers get paid by the streaming services to include their crappy apps on the the TV. Like the ways PC manufacturers get paid to pre-load crapware on new PC’s. So the price of the TV is subsidized by the crapware and that’s why it can cost more to get a TV without it.

David (profile) says:

This is just the Internet of Shit

Any device manufacturer that sees a competitor try something these days immediately tries to improve/copy/hit the checkbox to they have the same or better feature.

Few companies have the expertise to do this. In particular when it comes to security and, as mentioned above, have no incentive at all to provide support for a product where there is no ongoing profit. With their well known razor thin profits these devices can add the feature(sic) with an out of date SoC which might well be lacking the necessary hardware to provide modern protection.

There is no possibility of solving this. The smart TV is now the default for many. The OS of choice is Android, which supports their store. That is where the mighty malware lives.

Don’t buy smart TVs.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...