back to article Supra smart TVs aren't so super smart: Hole lets hackers go all Max Headroom on e-tellies

Owners of Supra Smart Cloud TVs are in danger of getting some unwanted programming: it's possible for miscreants or malware on your Wi-Fi network to switch whatever you're watching for video of their or its choosing. Bug-hunter Dhiraj Mishra laid claim to CVE-2019-12477, a remote file inclusion zero-day vulnerability that …

  1. Anonymous Coward
    Anonymous Coward

    #fakenews

    This is a feature of all smart TV's that support UPnP/DLNA, any device on the local network can send video streams to the TV and has been able to do so for the last 15 years or so. If you want to see real cool hack's get into the remote and messaging control API's, you can do real spooky things like send a message "have you done your homework?" if answer is no then turn TV off. Kids be loving that one.

    1. JetSetJim Silver badge

      Yup - when I got my Synology box I got a bit frustrated with the DLNA server not authenticating so I could restrict the availablity of different categories of tv/films to my kids. Very annoying.

      Presumably this "hack" also allows for someone to interfere with a wired TV, as long as it's addressable from the wifi network. If it's on a network, it's dlna discoverable, which means this should work.

    2. Overflowing Stack

      I was about to say the same thing. Sony/Samsung/LG all have DLNA, as do most blu-ray players and home cinema receivers.

      If someone has local access to your network, then playing videos on your TV is the last of your worries. This is a silly story.

    3. FrogsAndChips Silver badge

      DLNA at least provides some kind of allow/deny/prompt mechanism to control which devices can stream to the TV. It seems the issue here is that anyone on the network can hijack the stream without any authorization needed.

    4. Michael Wojcik Silver badge

      CVE-2019-12477 has nothing to do with UPnP or DLNA, as two seconds of research would have shown you (and the me-too idiots who replied to your post).

      If you're going to be too lazy to read or think, why not spare us your efforts at commenting as well?

  2. Negative Charlie

    "There is nothing wrong with your television set. Do not attempt to adjust the picture. We are controlling transmission. If we wish to make it louder, we will bring up the volume. If we wish to make it softer, we will tune it to a whisper. We will control the horizontal. We will control the vertical. We can roll the image, make it flutter. We can change the focus to a soft blur or sharpen it to crystal clarity."

    Isn't it lovely when life imitates art?

  3. Andy Non Silver badge

    Not impressed with so called smart TVs full stop.

    Bought a fairly expensive Sony Bravia but the "smart-software" is as intelligent as a sack of rocks. By default it runs an app called YouView which it needs to access TV programs via the internet, ITV hub etc. But with this enabled you are blocked from recording Freeview programs to external media via the USB port. So you need to disable YouView to record terrestrial TV programs (limited to one recording at a time anyway) but now you can't watch programs on the ITV hub etc. There are also numerous other bugs with the Sony Bravia software that have never been fixed in software updates. In the end we've bought a Humax box, now we can record multiple programs at the same time and have easy access to ITV hub etc. So in effect, using the "smart TV" as a dumb screen. Won't be buying another "smart" Sony TV again when this one dies.

    1. JetSetJim Silver badge

      Re: Not impressed with so called smart TVs full stop.

      > But with this enabled you are blocked from recording programs to external media via the USB port.

      This is not a bug, but in all likelihood built in by demand from MPAA/RIAA and the like so that you can't then just get a Netflix/Prime subscription and then stream the lot to a few (for some values of "few") thumb drives for your viewing pleasure later on.

      1. Andy Non Silver badge

        Re: Not impressed with so called smart TVs full stop.

        There are no features to record anything other than the Freeview channels anyway, so it isn't even possible to record any streaming / internet based programs, so blocking the recording feature serves no purpose other than to annoy the TV user. Not that the Sony recording software is very reliable anyway. It occasionally misses a program from the recording schedule and when this happens it never records anything again in the schedule until you delete the missed programs. The logic of the software matching the current time against the recording schedule is flaky.

        Another bug... changing channel gets slower and slower over time. After a few months it can take up to ten seconds to change channel. A full power off reboot is needed to resolve the issue.

        It took the purchase of the Humax box to get the so called smart features, because the Sony TV is definitely not smart. It is positively idiotic and annoyingly stupid.

        1. defiler Silver badge

          Re: Not impressed with so called smart TVs full stop.

          I had a lovely Samsung that developed a fault. Extended warranty job with the shop - no problem. Since it was 1080 they couldn't source a replacement panel and let me go to town in the shop with a budget to blow. I picked a Sony Bravia with Android that was pretty high up the range.

          I can't use half of the catch-up features without plugging in an aerial. I don't even have an aerial point here because I have TVHeadend running in the garage. The menus are slow and clunky. I wouldn't give much of a shit, running everything through Kodi (including broadcast telly), but it doesn't pass half the buttons through on HDMI CEC either. Numbers? Channel up/down? Nah mate.

          A friend of mine has a very similar Sony, and has a whole world of problems with it. He actually uses the TV to do TV stuff rather than just as a display, and he regaled me with his litany of woes which ran for the best part of an hour without repeating. (We were driving somewhere, so we had time to burn on a good moan!)

          When Sony get it right, they can produce something fantastic. I had a beautiful Sony DVP-NS900 DVD player hooked up to an STR-VA555ES amp, and my PS2 plugged in. Each one of these devices was brilliant in its day. And the Trinitron tubes gave great colour (although I had a Panasonic plasma screen to go with that kit). But aside from these examples, Sony have been pretty universally disappointing.

          As for my TV? Two stars out of five. "Fucking mediocre"

          Don't think I'll get a job in What Hifi with that though.

          Also, my old Humax kicked ass :)

          1. Jay 2
            Meh

            Re: Not impressed with so called smart TVs full stop.

            Rarely do I have to use my Sony TV as anything other than something that displays whatever the AV Reciever is thowing out. But when I do... it is an exercise in frustration. Mainly as a combo of input lag on a s-l-o-w front end. It's horrible to use and usually forces me to deploy my non-trivial full range of expletives in doing so.

            Maybe I need to power cycle it every so often just in case. A pox on Sony for this one.

        2. vtcodger Silver badge

          Re: Not impressed with so called smart TVs full stop.

          "A full power off reboot is needed to resolve the issue."

          OMG -- you have to turn the TV OFF?

          In this day and age? Inconceivable !!!

          ... and probably illegal.

          (Not that I've ever found anything very smart about "smart" TVs. Unfortunately "they" seem to have decided that there's no market for dumb TVs that just work. Can't seem to buy those anymore. Probably illustrates that marketing folks are even dumber than the products they peddle.)

          1. Andy Non Silver badge

            Re: Not impressed with so called smart TVs full stop.

            Wouldn't be so bad if it didn't take several minutes to start up again. My parent's 1960s valve based TV started up quicker.

    2. Korev Silver badge

      Re: Not impressed with so called smart TVs full stop.

      My Samsung "Smart TV" is made smart with a Chromecast...

      1. Dan 55 Silver badge

        Re: Not impressed with so called smart TVs full stop.

        Out of the frying pan into the fire.

    3. Baldrickk Silver badge

      Re: Not impressed with so called smart TVs full stop.

      My "WebOS" LG is doing a fine job, for now at least. The only thing I wish I could do was easily stream music from play music (because I like to own my music, and it's convenient to use it to have a copy online) The app will happily stream to a chromecast, but nothing else.

    4. Halfmad Silver badge

      Re: Not impressed with so called smart TVs full stop.

      It's also made TVs incredibly slow to update. EPG etc are no where near as fast as they use to be prior to the "smart" features all being thrown in..

    5. NonSSL-Login

      Re: Not impressed with so called smart TVs full stop.

      MPAA DRM and geo-restrictions screwing people over everywhere. Encrypted recordings, Youview which launches iPlayer and other apps which refuse to work over a VPN, even though the TV can say exactly where it is due to the signal it is getting.

      Don't even get me started on HDMI/HDCP.

      Usability for loads of things are fucked and people should be aware than 9 out of 10 times the tv problems are due to the Hollywood studios and stuff they force tv makers to do and the things they force tv channels to do via licencing agreements.

      They are the reason you cant watch legit content on linux, 4k on some android box's, nothing at all on rooted phones and force shitty DRM on tv' and other equipment through their part of being part of HDMI organisation.

      We would not need smart tv's if Hollywood were not so anal with pushing DRM.

  4. Dan 55 Silver badge

    Bah humbug

    Any TV with Smart Cloud in the name would get immediately crossed off my list.

    1. Charles 9 Silver badge

      Re: Bah humbug

      Given the market today, you'll be crossing EVERYTHING from your list, leaving you with NOTV instead.

      1. Pascal Monett Silver badge

        That will not be a problem

        I have a Philips WatchLine with Pixel Plus. To this day people who see the image on that screen still marvel at how good it looks. Yes, it is a beast that needs two grown men to move it, but I don't care as it doesn't move. It is getting old, though, and I am starting to think about looking around to see what my options are.

        Cloud will not be one of them, and I am dead set on keeping "smart" out of my house as well. A TV is a dumb screen, anything with intelligence should be what is sending it the image to show. The only thing that irks me is the fact that all TVs with the best screens also drag in that effing "smart" stuff.

        I guess I'll just have to make do with a truly dumb terminal screen, and forego all the bells and whistles.

      2. Dan 55 Silver badge

        Re: Bah humbug

        Or a smart TV never connected to the network...

        1. Mike 16 Silver badge

          Re: Smart TV never connected to the Internet

          Sure that would work? Keep in mind the next generation of smart TVs will take a page from Star Trek's M5 if you get between them and their Overlord Override.

          https://www.startrek.com/database_article/m-5

        2. Anonymous Coward
          Anonymous Coward

          Re: Bah humbug

          What makes you think they won't find a way to connect wil ne nil ye, say through powerline networking or whispernets?

      3. Michael Wojcik Silver badge

        Re: Bah humbug

        I was able to buy a non-"smart" TV off the shelf at Target a year or so ago.

        Granted, they only stocked one model. But there was the one.

        I expect the next "TV" replacement will be a dumb monitor, driven by a set-top box. It's not like I have any trust whatsoever in most of those, but I'll take one misbegotten security-hole-ridden spybox over two. And the set-top boxes seem to get more frequent updates, and they're a lot cheaper and easier to replace. They cold-boot faster than the TV, too.

  5. Captain Hogwash Silver badge

    purge message

    I had to "google" this. Scary. I prefer this though https://www.youtube.com/watch?v=lpgyVxP8OG8

  6. steelpillow Silver badge
    Pint

    TL:DR but plus one for Max Headroom reference

    My fave d-d-d-d-d-digital avatar of all time.

    1. Chozo

      Re: TL:DR but plus one for Max Headroom reference

      We'll be right back with more wacky fun at el-reg right after these blipverts from our friends...

      https://youtu.be/PJP-Ilw_xaY

    2. Teiwaz Silver badge
      Windows

      Re: TL:DR but plus one for Max Headroom reference

      It's wonderful, isn't it!'

  7. LDS Silver badge
    Coat

    "Radio killed the video star"

    A missed headline opportunity....

  8. Zarno

    And here I am, trying to find a truly "Dumb" 4K TV for under or at the cost of a smart one.

    My home theater receiver handles audio and video switching, all amplification, and the TV is just "there for the show".

    No cable input, no broadcast tuner needed.

    I do understand that they may need something "smart" in the controls section, possibly an embedded OS of a bit higher function for some stuff like on-screen menu, Dynamic backlight Brightness/HDR and maybe something for HDCP, but the last gen dumb units had it all working fine...

    1. Charles 9 Silver badge

      I'd like to see where you actually FOUND a dumb unit. I haven't seen a truly-no-frills HDTV since the introduction of BluRays. The only way to go dumb it seems is to use monitors, which tend to be too small, have overkill resolutions for TV purposes, or both.

      1. Zarno

        Sanyo 55" set, bought a ways back.

        When smart TV's were more expensive.

        Criteria looked for when buying was it needed to be 1080, in-stock at a big box store that evening, bigger screen than the dying floor model CRT it replaced, and lowest price per diagonal inch.

  9. Tree

    You'd be stupid to go smart

    Over the air I get 156 channels here In greater Los Angeles, but there is still nothing to watch. That's why I read theregister.co.uk !

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019