Is Your New TCL HDTV (Made In China) A Security Risk?
There’s been a huge amount of concern this year about the security implications of technology that originates in China or is owned by Chinese companies. That was, after all, at the heart of the fight by the Trump Administration to ban the popular social networking app TikTok, or at least to force a sale of it. The U.S. government has also cracked down on the manufacturers Huawei and ZTE, and the omnibus/coronavirus rescue package recently passed by Congress even included $1.9 billion to help companies remove equipment from those two companies.
Recently, a pair of security researchers raised the alarm about another Chinese tech company, the TV manufacturer TCL, which makes some of the most popular televisions available in the U.S.
The website of the researcher and hacker known as Sick Codes, in a blog post in November, pointed out “extraordinary vulnerabilities” in TCL’s Android TVs.
“Near the end of September, while conducting research into low-end Android boxes, I came across a number of serious flaws in the way in which these devices were being designed,” the post said.
“Without delving into the nuances of each device, all of the Smart TV products are Android-based.”
The researcher discovered that they could easily access the entire file system of the devices.
“Why would an Android device need a web server running on a non-standard port?” he asked.
“What kind of manufacturer publishes the whole file system of a device?”
Sick Codes was later joined in his work by another researcher named John Jackson, and in October the two of them both notified TCL which, after a delay in response, said they would patch the issue.
In an interview with Tom’s Guide, Sick Codes sent a URL that provided “full access to the file system of a TCL smart TV in Zambia,” and the writer was able to browse the directories of that person’s TV.
And in another interview with Security Ledger, Sick Codes said that “anybody on an adjacent network can browse the TV’s file system and download any file they want.”
https://www.zerohedge.com/technology/your-new-tcl-hdtv-made-china-security-risk
Data Security Business Advisory
https://www.dhs.gov/sites/default/files/publications/20_1222_data-security-business-advisory.pdf