Post

Getting tired of people doing a bunch of llm assisted reverse engineering and making big claims about devices (cough LG and other TVs) and not providing evidence to support these claims. It goes without saying that pretty much all are spying on you, but how it does that matters..

One key example is the claim from GamersNexus video about how LG TVs attempt to connect to open WiFi networks to exfil voice transcriptions. If true, this would be super evil. After reviewing dozens of firmware variants for LG, I have found no evidence of this.

I analyzed the network stack across several firmware types. It's pretty standard embedded Linux stuff for the most part. wpa_supplicant, connman, and some wrappers. I grepped for common open wifi like xfinity-wifi and attwifi, with no results. I also RE'd the wrapper binaries.

I even spun up fake APs and tested this as well, on multiple LG TVs, including the exact one featured in the video, the LG G5. None connected to me! While I don't put it past any company to be this scummy, there was no proof in the pudding.

Additionally, the claim that the LG TVs do nmap style scans of the network were also unsubstantiated. The TV does mdns and service discovery scans, but it doesn't aggressively scan individual devices based on what I've seen.

All told, you definitely SHOULD NOT connect your TV to the internet. It IS spying on you and pumping out tons of telemetry. But in a disconnected state, there is no evidence that it does aggressive exfil. And on the network, it doesnt appear to port scan, just service discovery.

Additionally, the plaintext voice transcription bit is real, but the claim that it survives power off is unfounded. Tested this on several TVs and each time, the /tmp dir it lives in is cleared. It makes sense since it doesn't have _that_ much flash storage, but seemed plausible.

My vision for a smash and grab attack against these LG TVs would be to pair to the tv, get it to connect to my AP, then deliver an exploit to exfil the voice logs. I imagined the TVs as like a piñata with transcribed treats for whoever hits it right. But it's not that simple.