Researchers investigating LG smart TVs found that the devices repeatedly scan local networks for nearby hardware, identifying phones, computers, smartwatches, printers, network equipment, thermostats, and other connected devices.
The Gamers Nexus investigation also found extensive advertising and viewing telemetry tied to LG’s automatic content recognition (ACR) systems. Separately, security researchers demonstrated vulnerabilities that could allow compromised TVs to be abused as listening devices.
For the investigation, Gamers Nexus partnered with researchers Mr. Bruh, U-Turn, and Wendell from Level1Techs. They analyzed network traffic with Wireshark, decrypted and decompiled LG firmware, rooted test televisions, and inspected system processes and logs.
LG Electronics is one of the world’s major TV manufacturers, while its advertising business operates through LG Ad Solutions, incorporated as Alphonso Inc. LG acquired a controlling stake in Alphonso in 2021 to expand its connected-TV advertising and analytics business.
During testing, the TVs repeatedly scanned the local area network and detected dozens of unrelated devices. According to the investigation, collected information included device names, MAC addresses, signal strength, internal IP addresses, and other attributes.
The researchers said the tested TVs identified smartphones, PCs, smartwatches, network switches, printers, 3D printers, servers, and HVAC-related devices. Firmware analysis also showed that nearby Wi-Fi networks could be detected, including their names, signal strength, and channel information.
This network discovery appeared alongside LG’s ACR functionality, which fingerprints content shown or played through the television so it can be identified and used for advertising and analytics.
Gamers Nexus said ACR remained active in some configurations even when a TV was being used primarily as an HDMI display. In one test, a TV connected to numerous LG and advertising-related endpoints and repeatedly contacted Alphonso’s ACR infrastructure.
The researchers estimated that one television could exchange roughly 4GB of ACR-related data per month. LG Channels activity also generated network requests that could reveal which channel was being watched.
Beyond the privacy findings, the investigation uncovered separate security issues that increased the potential impact of a compromised TV.
After gaining control of test units, researchers demonstrated recording through built-in microphones, USB webcams, remote-control microphones, and other audio sources. In one demonstration, an LG G5 continued recording locally after its network connection was removed, and the audio was retrieved after connectivity was restored.
The team also showed that audio from a conference call passing through the TV could be captured from the television itself.
These demonstrations do not establish that LG is secretly recording private conversations. Rather, they show that the hardware and software capabilities present in the TVs could be abused by an attacker after compromise.
Researchers involved in the investigation recommended disconnecting LG smart TVs from networks while undisclosed vulnerabilities go through responsible disclosure. Users concerned about privacy should also disable ACR and advertising tracking where possible, review voice-control settings, avoid unnecessary microphones or webcams, and isolate smart TVs from sensitive home or business systems.
Leave a Reply