Roku Says, Samsung Smart TVs Have Security Vulnerabilities,Smart TV tracking features , II millions of smart TV's can be hacked

SAN FRANCISCO (KGO) --

Roku Says, Samsung Smart TVs Have Security Vulnerabilities,millions of smart TV's can be hacked
Could your TV be controlled by hackers? 7 On Your Side's Michael Finney has details about a new investigation by Consumer Reports. It found millions of smart TV's don't do enough to protect your security.

Who's controlling your TV?

Consumer Reports has found millions of smart TV's from major manufacturers can be controlled by hackers exploiting easy to-find security vulnerabilities.

The problems affect Samsung televisions along with TV models made by TCL and other brands that use the Roku TV platform.

"While evaluating smart TV's for data privacy and security, we came across a vulnerability in some smart TV's that can be exploited by a hacker, who could write code to control the TV without the user's permission," revealed Maria Rerecich, Consumer Reports Electronics Testing.

Consumer Reports was able to demonstrate how a hacker could potentially take over your TV. They can change channels, play offensive content, or turn the volume-up to full blast. All without your control.

"This happens because many smart TV's have a programming interface, called an API, that lets you use for smartphone or tablet as a remote control over WiFi," said Rerecich. "In some cases, we found that this API was not properly secured and that could let a hacker control your TV."

This investigation marks Consumer Reports' first tests using the Digital Standard, which was developed to evaluate the privacy and security of products and services.

When Consumer Reports reached out to Samsung and Roku, both companies said, they "take privacy and security seriously." TCL referred to Roku's response.

To find out more about what you can do to protect your personal privacy, and limit the amount of data your smart TV is collecting about you, here is a link to Consumer Reports' website. You will find instructions specific to your TV.

Now a representative from Roku reached out to 7 On Your Side, on Wednesday morning, and released this statement:

"Roku takes security very seriously. There is no security risk to our customers' accounts or to the Roku platform as stated by Consumer Reports. Roku enables third party developers to create remote control applications that consumers can use to control their Roku devices. These applications are only accessible to those on a customer's Wi-Fi which we recommend consumers lock. If customers prefer, they can, turn off this feature by going to Settings>System>Advanced System Settings>External Control>Disabled. Any characterization of this feature as a vulnerability is inaccurate."

And we reached out to Samsung, and they provided us their statement:

"Protecting consumer data is one of our top priorities. Samsung's privacy practices are specifically designed to keep the personal information of consumers secure. Our Smart TVs include a number of features that combine data security with the best possible user experience. Before collecting any information from consumers, we always ask for their consent, and we make every effort to ensure that data is handled with the utmost care. We have been in contact with Consumer Reports regarding the evaluation of our Smart TV and are looking into the specific points made. To ensure the security of any device, we continue to evaluate the feedback we receive on all of our connected products."

If you want to keep your  binge-watching and late-night surfing private, you can turn off the monitoring — but you'll have to go back into the original setup menus, the one you likely flipped right through in your eagerness to start watching. 

TVs from Sony, Samsung, LG, Vizio and TCL, which makes sets branded as "Roku" models featuring a built-in Roku streaming player, were tested by Consumer Reports and most had a feature called Automatic Content Recognition that tracks what shows you're watching. 

The consumer benefit in tracking is that ads will be more finely structured to you, similar to online ads. Software companies that are integrated into these smart TVs take the information to suggest other TV shows and movies to viewers, much like Netflix and Amazon Prime Video do, and allow advertisers to make targeted advertisements, similar to what happens when users surf the Web on a computer.

But not everyone will be happy about this tracking. Here's how to turn it off, if you have a smart TV:

LG

In the menu, click to Settings, which brings you to All Settings, and find your way to General. The feature to look for here is LivePlus, which is what LG calls the ACR technology. This is the one you want to turn off. 

Samsung

On newer sets, go for Settings in the menu, then Support, then Terms & Policies. From there, Consumer Reports suggests pulling Viewing Information Services to opt out of. On older models, Consumer Reports says to click on Support and then select Terms & Policy and then SyncPlus and Marketing to turn off ACR. 

 

Sony

Consumer Reports notes that ACR is turned on during setup of the TV, via agreements with Sony, which makes the TV; Google, which provides the AndroidTV operating system; and Samba TV, a company that gathers analytics on viewers' habits that advertisers can use for targeted ad campaigns. .

On Sony TVs, you'll have to get go back to the setup, available within Settings, to turn off ACR.

If you want some of the Web connectivity, but not everything, you can agree to Sony and Google policies, and then when you come to Samba TV, opt out of ACR by clicking “disable.”

TCL/Roku

TCL makes branded Roku TVs with software also used in sets by Hisense, Hitachi, Insignia, Philips, RCA and Sharp.

Turn off ACR by going to Settings, then Privacy, and "Smart TV Experience." Consumer Reports says you can uncheck "Use Information for TV Inputs" to disable ACR. 

Vizio

For Vizio sets, select System, click on Reset & Admin and opt for Viewing Data to opt out of ACR. 

Lee Neikirk, who reviews TVs for Reviewed.com, a sister unit of USA TODAY, says manufacturers have to do a better job informing the public about the data being collected from them on smart TVs. 

"The integrity move would be a blatant statement right up front when you're setting up the TV, 'this is what we are doing, and this is how to turn it off.' "

The actual act of changing the settings is easy, he adds, but most consumers never bother with fiddling with menu changes.