LG product features that suck!

[DeskJockey]

So, on top of the recent debacle about LG monitors triggering an automatic, unapproved download of some McAfee "helpware" when connected to Windows (they've since rowed back on that, but still), and the latest WebOS firmware defaulting to using the microphones and cameras to "maybe" (definitely) record in the space it is placed in (and making it the issue of the owner of the device to inform and consent anyone there that it may (will) happen), I have another one.

For a while my dad has been complaining about an unknown WiFi network in the house that devices sometimes connect to, including his LG TV, and then nothing works. So, as I am here I decided to do some investimification and lo and behold... it is a "feature" of the soundbar, ostensibly to aid people in playing high quality audio. LG in their infinite wisdom, decided to set up and broadcast an open SSID on the device. It cannot connect to the internet, but anyone can connect to it and play whatever they like. And... there is no way to turn it off, hide it, or secure it. Doing a factory reset changes the SSID name, but nothing else.

Brilliant design.

[Barry]

Ironic that my LG TV WiFi board failed right after the warranty, then the Cat5 LAN port got real fussy about cables, so it's been offline ever since. The TV wand is rubbish now but it's staying that way.

[dinny_g]

I know this has been debunked by ‘experts’ on here but I really think the LG TV speakers should run alongside the LG soundbar to fill out or enhance the sound but its TV or Soundbar but not both

[Beany]

Hey kids, there's more bad features. Namely, they're listening to everything, and sending data back to home, and the software doing that is insecure.

https://www.theregister.com/security/20 ... on/5294956



It's over two hours, but there's a lot to go over. Including that the telly can pick up speech from 60ft away and listens long after you put in a voice command. It scans your entire network. It takes screenshots of what you're watching. And it sends all that data back to LG for processing and selling to the highest bidder. Oh, and that there's a remote code execution flaw that allows access to all this by nefarious people.And there's no practical way to stop it, because it stores that data locally and sends it out the moment it gets a sniff of a WAN connection.

Got a Nest thermostat? Might get ads for Honeywell. The mic records when the TV is in standby mode, so having a private conversation with a mate in the man cave about that tart you think you knocked up, because the wife won't touch you (presumably because of your obsession with LG TVs - she's a Samsung woman* )? Then when that's done, you remember to reconnect the telly to wifi to check for a firmware update? Boom, data goes, and you might be having fun explaining pregnancy test ads at best. Given that the software is full of holes, could be reporting the wifi is off but actually connected, and it could be blackmail (or in their example, corporate espionage - got an LG telly in a boardroom?) - at worst.

A brief summary:

Data collection

• Local Network Sweeping: webOS sweeps the local subnet to map and inventory non-TV hardware (phones, PCs, 3D printers, smartwatches, IoT devices), logging internal IP addresses, hostnames, and MAC addresses.
• Nearby Wi-Fi Mapping: Collects neighboring SSIDs, BSSIDs, and signal strengths to pinpoint the physical geolocation of the household.
• Standby Audio Logging: Built-in microphones continue recording and logging ambient speech to internal storage while the screen is off or in standby.
• Massive ACR Exfiltration: Automatic Content Recognition continuously samples screen frames and audio across all inputs, generating ~4 GB of tracking telemetry per month.
• Cross-Device Ad Pipeline: Transmits network maps directly to LG Ad Solutions to link viewing habits across 360+ million secondary household devices for targeted advertising.

Exfil Routes

• Offline Caching: Telemetry and audio logs hoard on internal storage when disconnected from the internet and upload in bulk as soon as WAN connectivity resumes.
• Root & RCE Vulnerabilities: Discovered zero-day Remote Code Execution flaws that allow full root shell access via network triggers or simple pairing prompts.

* yes, Samsung and the others do similar, but GN have a been in their bonnet about LG, so they get the ire



It used to be an urban myth that your phone was listening to you for ad targetting. This is now evidenced and out in the open that TV makers are doing exactly that and far, far more - LG make huge amounts of money from ad, comparable to what they do from TVs. And they aren't doing that with low value ads. It's through extremely targetted, surreptitiously generated data on you including where you live, what's in your home, and what you talk about.

So yeah, living in a cyberpunk dystopia without the flying cars fucking sucks.

[DeskJockey]

Where's the big tech off switch? It is appalling behaviour, and should by rights be illegal.

[Beany]

There's a solid chance that some of this isn't happening in UK/EU because it is illegal, but you know they'll be pushing to get away with it, with as much legal chicanery as they can, including political lobbying, because fuck you that's why.

[DeskJockey]

A brief search shows there are multiple Pi-Hole blocklists targeting LG and other smart TV manufacturers. Whether it'll block the spying as well I don't know, and it shouldn't have to come to that.

The tech community is great.

[Matty]

"They" reckon it's part of the reason TV's are quite cheap, relative to other tech, because there's also the data element they can glean from it. Again, could be tinfoil, but I've seen the T&C's I had to accept when I had my Samsung TV! Probably sold my soul and first born.

[DeskJockey]

I think that's very likely true. I hope my 2007 Samsung lasts a good while longer. I had thought about replacing it with a Sony Bravia3 as they supposedly have a dumb mode, but whether that stops the spying, I don't know.

[Beany]

I'm pretty sure that if they use DNS over HTTPS ( https://en.wikipedia.org/wiki/DNS_over_HTTPS ) then PiHole can't do much unless it has the relevant certificate to intercept etc, but I'll hold my hands up and say that's off my head and I haven't checked - the point of DoH is so that your DNS queries are secure.

But long story short, it's just another example of rampant late stage capitalism making the world a significantly worse place so that shareholders can make an extra penny on the pound at the end of the year.

[DeskJockey]

It would make sense that they protect the DNS queries precisely for that reason. Unlikely to cost them anything extra in the development/deployment, but frustrates attempts at stopping their racket. See also TVs that don't work at all without an internet connection.

[Mito Man]

I bought one of those Sky TV’s a while ago. I imagine it’s doing a lot of spying. I know it’s always listening because it has voice commands and sometimes mistakenly turns on when I’m talking. Then again so does the Homepod.

[DeskJockey]

And we're normalising that as just okay, and nothing to worry about.

[Mito Man]

Yep but it’s either this or living in the Stone Age!

[DeskJockey]

It really isn't.

[Beany]

I don't see why I have to live in Literally 1984 (you think they're not selling this data to governments? ) to have a fucking display in my house.