Root shell on Samsung TV

833 points592 comments2 days ago
luma

Some version of this has been posted a dozen times now. The dog barking and baby crying detection are advertised features of this product range which is used for SmartThings integration.

Swarms of RE-hopefuls are now using tools they don't understand to work on projects they don't understand. Anyone doing RE knows step 1 is read public documentation, FCC filing, patent applications, etc. That step would tell you what the device does out of the box, no RE required to find everything the OP has actually uncovered.

Instead they busted out Claude and have been gaslit by their own AI into thinking they've discovered something. They just discovered features that Samsung has been pitching for years.

show comments
janalsncm

There is a Rick and Morty episode where Rick opens up a store that removes the curses from free items the Devil is handing out.

(Surprisingly, the Devil does not consider lawyering up, which is odd because I would expect the Devil to be pretty familiar with lots of lawyers. It’s fiction of course.)

It would be great to use AI to do something analogous with these spy TVs. I would be very interested in stripping the “smart” crap out of my TV to turn it into a kiosk.

show comments
strenholme

I’m surprised this level of surveillance from a smart TV (if this is real; right now the only sources are social media) doesn’t open up Samsung to a lawsuit.

To wit: There was a lawsuit where Susan Clements-Jeffrey sued Absolute Software (Lojack) for a stolen laptop she acquired; Lojack used surveillance to track down the stolen laptop and Susan successfully sued for invasion of privacy (Lojack settled instead of trying to fight it).

show comments
ada-h00k

If OpenAI really banned him for that reason, that would be pretty stupid. If you can no longer use an LLM for reverse engineering without worrying about your account, that drastically reduces its value.

show comments
Surac

Posting a link to twitter should be illegal grr

antirez

"Why you bother about local AI? LOL with the $ you spend for <insert hardware here> you can buy 5 years of 20x account". Yeah. 5 years where you are told what you can do.

show comments
allthetime

an aside. I'm visiting my wife's parents and they have a new samsung TV. the remote doesn't even have an input selection button on it anymore. the default state of the tv pushes you to a big complicated home screen covered in ads and always pushing you towards their streaming live TV.

they like most poeople have a cable box plugged in, but every time the tv is switched off, the default behaviour of the tv is to forget what input it was on and goes back to the home screen where you have to use a convoluted set of button presses to get back to a non-samsung, non-app device.

You can switch this off somewhere in the settings, something they would never figure out on their own, so that it re-opens on the last selected input. I did this in the past, but then it seems an OS update wiped out all the settings, including the one that makes their cable remote work with the TV.

there is now no doubt that the TV is made to function primarily as an ad-delivery machine with explicit dark patterns built in for the task. I did them one more favour and reset their ad id and unchecked all the consent boxes on the privacy terms pages

going forward anyone who cares about their choice and privacy should not allow their TV to connect to a network at all and simply use it as a dumb link to their devices of choice, or ideally, find a better company to buy from, if that exists.

show comments
breakingcups

Who needs DRM like HDCP if you can just use the capabilities baked into the TV to your advantage?

tkel

from his twitter account:

> if your samsung TV model doesnt have a microphone, it will look for connected devices with one, such as a soundbar or a connected bluetooth device. this gets shipped off to bixby.

show comments
Terr_

Y'all remember the Energy Star logo on computers?

Maybe it's time for something like that, a shared baseline standard of "this thing won't spy on you", with massive financial penalties for companies caught lying about it. Prime adoption by making it a requirement for anything bought by the government.

Then consumers can reliably comparison-shop for a "TV" that doesn't turn into a traitorous 1984 telescreen the moment it breaks out of the LAN or you fail to click "maybe later" on its incessant dark pattern pop-ups.

show comments
agilob

Is there a non-Twitter source to read the whole thing? Were all of them banned?

show comments
MarkWayneNewton

How else will they subsidize the cost of the jumbotron in your living room?

show comments
Hugsun

I'm curious if someone has started cataloging these cases. These spying TVs seem like a common industry practice.

show comments
realo

Cool... Would it be possible to poison all that nice telemetry with perfectly good information, live from Hogwarts or from some other interesting place? The Village from the series "The Prisoner" might also be a good place to send telemetry from.

egamirorrim

This stuffs mad, should I be doing something to my Samsung TV to neuter it? Has anyone rolled all this up somewhere?

show comments
dtgriscom

A perhaps relevant "Clean Your TV" project (although it doesn't work for Samsung): https://github.com/Gathin23/cleanyourtv

jareklupinski

i wonder if the Samsung / LG stuff is how the stock market seemed so "predictable" to some people in early morning trading for a while... imagine having the keys to buckets containing all the plaintext gathered from all the tvs listening in conference rooms on earnings days...

show comments
nickdothutton

This is why you buy a display panel and not a smart TV.

show comments
nekusar

So... Wiretapping is pretty clear violation. And it's punished severely in most jurisdictions (eg: OpenAI engineer installing wiretaps).

So, this is wiretapping at a mass scale. Just how many crimes do the executive class occur before they get turned into the past-tense... The executed class?

I am for a corporate death penalty. Companies that engage in such mass criminal activities do not deserve to exist.

show comments
rightisleft

We’ve opted into surveillance as a feature. It’s sad.

Now if someone can root tizen so we can actually bypass their insane restrictions on booting to an HDMI input by default it would be appreciated.

Smalltalker-80

It's beyond me why people are still buying smart TVs. I've juist looked on a large EU webshop (bol.com). You can buy a non-smart, full-HD, 40 inch TV for less than $200.

show comments
MegaDeKay

People were up in arms (and rightly so) when the LG TVs were found out for their spying thanks to the Gamers Nexus investigation. At least LG TVs can be rooted and you can install apps like Glasshouse [0] to disable all the telemetry and add substantial new features that you can't do via the officially sanctioned Dev Mode. The vulnerability that enabled rooting was recently patched so hopefully another can be found.

Hopefully similar apps will come along for Samsung now that root on it can be achieved [1].

[0] https://github.com/rorygallagher2024/glasshouse

[1] https://news.ycombinator.com/item?id=50218633

show comments
jck86

To what extend do these "smart" products state how, when and what data they are collecting and selling?

Isn't it high time for legislation that at least makes it clear on the box what kind of sensors and integrations it has and how bad the product is privacy wise?

Also, shouldn't corporate spying disguised as automated content recognition and classification be limited or outright be banned?

And all this connected garbage should by law be able to function with the cord cut and without registration, and if an update negatively changes the advertised product characteristics the customer must be allowed to return it for full paid price even if it is 10 years old. Force the manufactures to make statements on the "box" about the features, the support duration and level, and the privacy characteristics.

Why don't politicians care about this?

show comments
Geof25

Claude Code for coding and DeepSeek + opencode for reverse engineering at this point.

DeepSeek will break the binary into code and Claude will search for problems. Now you have most of exploitation chain.

show comments
iugtmkbdfil834

You know what bothers me? So much of human ingenuity wasted on rather worthless tasks.

show comments
prymitive

It’s mind boggling that in the UK there’s a law that says:

> “A plank of wood must not be carried along a pavement. It can only be moved if it is being unloaded from a vehicle or taken into a building.”

But big tech cannot be regulated at all. We used to regulate any minor thing that was annoying enough, but a whole industry spying and prying on the whole population is fine.

show comments
luma

Dog bark and baby crying detection are advertised features for SmartThings integrations. Door bell and door knocking are also included, this is surfaced directly if you hook the TV or sound bar into SmartThings.

show comments
MisterMunchkin

Remember guys, if they are reading it for wrongthink, they are reading it for industrial espionage.

Anthropic and openAI just announced they’re spinning out competitors to their biggest customers… right after ingesting all of their IP and contracts. Do the math.

(Or don’t, because they’ve been caught stealing math research)

show comments
3abiton

This is again will be very funny race to watch. Right now you can fairly do lots of reverse enginnering or "hacking" with off the shelf Chinese models, and they are very capable (GLM3 for example) which can be run locally if you stomach the hardware. Tools like rea are also becoming more popular. If openai continues to be pedantic, they will lose the technical base given how close is the gap getting.

show comments
tintor

This looks very bad on OpenAI.

What is next? Power and water company suspending your account if your home and car are not streaming enough telemetry.

I am glad that open models are closing on frontier.

show comments
killingtime74

It's as if an intern added it and then they just forgot about it.

show comments
gentlerain

Samsung is starting to be a little too much creepy.

I don't know if it's just greed or.

I refused to create an account on their galaxy phone because of the mandatory phone number needed. Yes, I know they can harvest it in other ways, it's just a stand.

show comments
stavros

They're running it and then throwing away the result if you don't consent? Way to waste electricity...

show comments
terhechte

I just double-checked my Samsung TV. I only bought it so it could connect to my Apple TV or Switch, so I don't need their software. Thankfully I was already cautious when I bought it and apparently never connected it to any of our networks.

someonehere

Just a reminder. You can buy a kiosk TV from major TV manufacturers. You just have to look a little. Kiosk TVs are intended for lobby signage or conference rooms. You pay a little more but the garbage UI and always on piece is gone. You get 4 HDMI with them too (from what I've used).

semiquaver

An interesting question is whether LLMs are going to make HDTVs more or less expensive.

acd

Please use full open source Linux distros instead. Then you could update with apt, dnf, pacman etc.

cisc

> ..its literally running.. ..It's literally called.. ..its literally AlexNet.. ..literally doesn't work..

I'm not sure it's literal enough.

show comments
amelius

Folks, we need to move on from "this is outrageous!" to "what can we do to stop it?"

show comments
SimianSci

The idea was always that Facebook or Google were listening to us and whenever we would talk about something we would shortly thereafter see an ad related to it.

Now we can basically say that its not Facebook and Google doing this directly, its our televisions and appliances that are listening and just selling that data back to the ad-networks.

show comments
jacquesm

If they're doing this to TVs, what are they doing with phones?

show comments
hobo123

What is this referring to, Android phones? Are they really eating battery life by constantly running AI on your phone?

show comments
fein

Maybe I'm just old fashioned or out of touch, but why is it such a barrier for people to treat their smart TV as a dumb display? Hook up a computer via HDMI and never connect the TV to wifi.

I understand that the tech in these things is a horrorshow, But so is the tech in every other smart device that normal ("I don't care how it works, just that it works" types) people allow into their homes every day - and these are the people who tech is built for, not "us". Of all the tech to raise red flags about, this seems the easiest to mitigate.

And to be completely fair, I haven't purchased a new TV (Projector yes, TV no) since I bought my plasma in 2014. That 2014 TV has smart features as well but has just never been hooked up to the internet. Maybe the new rigs can't be used until connected to a network but I wouldn't know. Enlighten me if this is the case.

show comments
amelius

Police and FBI need a warrant to bug your home.

Samsung just needs you to buy a TV.

show comments
brookst

I’ve got a Samsung frame used for two things: 1) showing hdmi 1, and 2) showing art when idle.

I guess I’m going to have to just write replacement firmware, aren’t I?

show comments
zkmon

Just don't buy any tech home appliance that was made after 2022.

show comments
kjsingh

so is the hardware mic-off button on Samsung TV any good?

show comments
HackerThemAll

Samsung what? Fridge? Air conditioning? Dishwasher? Excavator? A single more word of explanation would make it crystal clear, whereas now I need to wonder whether it is about TV, computer monitor, smartphone or who knows what.

Den_VR

The tile references on-board ai. “On-board ai” here is automatic content recognition. Imagine my disappointment

show comments
hypfer

Wasn't that used to squeeze better power efficiency etc out of the device by optimizing the parameters based on the content?

I mean it is probably also used to collect data, but this sounds like it might be more than just that. Maybe?

show comments
lousken

now is the best time in history to buy a tv

just hack it right after purchase and own the glass

show comments
zug_zug

There's another analysis there showing that they still send this even if you don't agree to it. I feel like this needs to go to court.

unstatusthequo

I sure wish Tizen was rooted. I’d love to custom flash over the slow ass Samsung UI.

show comments
ComputerGuru

Pretty sure my Samsung plasma TV from 2011 is safe. It was all downhill from there, just competing over which display looks better with its saturation and brightness boosted all the way up with the floor models all next to each other.

sunjester

This is the same company that makes "knox"... yes this will be funny.

aussieguy1234

The AI in the TV was listening for dogs barking and babys crying, a gross invasion of privacy. Possibly this could have been for ad targeting purposes.

With projects like REA, it's going to get harder and harder for companies to get away with things like this.

I'd love to see the major social media apps reverse engineered and analyzed in this way. I can only imagine the dodgy practices that'll be found if this happens.

show comments
anthk

No libre agents and LLM's?

znpy

That would explain why Samsung phones always run like shit.

miki123211

What I wish people understood about privacy is that the less tech adjacent a company is, the worse their privacy record.

Meta and Google will never sell your data. They will collect it and use it for targeted advertising for sure, but they consider it far too valuable and useful to sell. This is because they have the tech and expertise to use their data well.

A grocery store or a gas station chain, though? They're clueless about tech, don't know what to do with the data, and have to aggressively compete on prices. If some savvy data broker comes to them, offering them a way to essentially gain market share by pushing prices lower than the competition and selling your data to make up the loss? That's an offer they can't refuse.

Hardware manufacturers are largely on the grocery store side; they're not data-savvy and they want to make things cheaper than the competition, so they're almost forced to do these shenanigans to win the competitive rat race.

If you want to meaningfully increase privacy, don't quit Meta, quit Target, Visa and LG.

show comments
znpy

so glad i bought a dumb tv.

i remember going store to store in search of one.

gg me, that was a smart move.

show comments
kmeisthax

Gotta love how the phone runs the expensive spying model regardless of consent, purely so that people who withhold consent aren't rewarded with better battery life. As if some % of the battery was still Samsung's property for their own marketing purposes. Stay classy!

fn-mote

As far as I can tell, there is no write up. This is a reddit post with screenshots of a Twitter/X post by @log4j. Even the Twitter post doesn’t seem informative, but Reddit isn’t a source for the information by any means.

The original link was on HN two days ago with no traction.

https://twitter.com/log4j/status/2113014142600953868

show comments
midtake

What a load of shit. Samsung TV always listening if you enable listening, why would they do this? /s

How dare they run a classifier locally on the TV, they should upload it uncut to Czechia like Amazon did with their ring cameras!

show comments
baal80spam

Is it still news that Samsung does this? Feels like I'm reading a similar story every few months.

Kuyawa

They hear us all the time, here is an anecdote...

I was at the butcher one day and asked for "ossobuco" because I wanted some bones for my dog, then all of a sudden I got reels with ossobuco in it, recipes, sellers, nearby shops, etc and I said WTF? Who the fuck makes posts about ossobuco? Why all of a sudden after using social apps just for football and porn all I start getting is ossobuco ads everywhere? A word you will never see anywhere now popping up in all my social feeds.

Possibility of that being random? Zero, not in this probabilistic universe we live in

show comments
megous

Well, dog and baby owners are great targets for advertising, so this makes sense.

show comments
chelmzy

When I was in college this sharp phd student told me that your phone, tv, and other devices talk to each other via radio frequency to build a profile on you. I've seen zero proof of this anywhere and I still think about why he told me that.