Is Your New TCL HDTV (Made In China) A Security Risk?

Is Your New TCL HDTV (Made In China) A Security Risk? 

BY TYLER DURDEN  FRIDAY, DEC 25, 2020 - 21:20Authored by Stephen Silver via 19fortyfive.com,

There’s been a huge amount of concern this year about the security implications of technology that originates in China or is owned by Chinese companies. That was, after all, at the heart of the fight by the Trump Administration to ban the popular social networking app TikTok, or at least to force a sale of it. The U.S. government has also cracked down on the manufacturers Huawei and ZTE, and the omnibus/coronavirus rescue package recently passed by Congress even included $1.9 billion to help companies remove equipment from those two companies.

Recently, a pair of security researchers raised the alarm about another Chinese tech company, the TV manufacturer TCL, which makes some of the most popular televisions available in the U.S.

The website of the researcher and hacker known as Sick Codes, in a blog post in November, pointed out “extraordinary vulnerabilities” in TCL’s Android TVs.

“Near the end of September, while conducting research into low-end Android boxes, I came across a number of serious flaws in the way in which these devices were being designed,” the post said.

“Without delving into the nuances of each device, all of the Smart TV products are Android-based.”

The researcher discovered that they could easily access the entire file system of the devices.

“Why would an Android device need a web server running on a non-standard port?” he asked.

“What kind of manufacturer publishes the whole file system of a device?”

Sick Codes was later joined in his work by another researcher named John Jackson, and in October the two of them both notified TCL which, after a delay in response, said they would patch the issue.

In an interview with Tom’s Guide, Sick Codes sent a URL that provided “full access to the file system of a TCL smart TV in Zambia,” and the writer was able to browse the directories of that person’s TV.

And in another interview with Security Ledger, Sick Codes said that “anybody on an adjacent network can browse the TV’s file system and download any file they want.”

TCL issued a statement to the media, as reported by Tom’s Guide:

“TCL was recently notified by an independent security researcher of two vulnerabilities in Android TV models,” the statement said.

“Once TCL received notification, the company quickly took steps to investigate, thoroughly test, develop patches, and implement a plan to send updates to resolve the matter. Updating devices and applications to enhance security is a regular occurrence in the technology industry, and these updates should be distributed to all affected Android TV models in the coming days.”

“Going forward, we are putting processes in place to better react to discoveries by 3rd parties [and] performing additional training for our customer service agents on escalation procedures on these issues as well as establishing a direct reporting system online,” TCL said further, in a statement to PC Mag.

It’s worth pointing out, as stated by Sick Codes in the comments to the original post, that the issue they pinpointed only applies to TCL’s Android TVs, and not to its Roku TVs, which are the majority of what TCL sells in North America. In fact, TCL only brought Android TVs to the North American market for the first time in July.

On Tuesday, the Department of Homeland Security released a new report called “Data Security Business Advisory: Risks and Considerations for Businesses Using Data Services and Equipment from Firms Linked to the People’s Republic of China.”

TCL is not mentioned in the report, nor are televisions.

“The PRC’s data collection actions result in numerous risks to U.S. businesses and customers, including: the theft of trade secrets, of intellectual property, and of other confidential business information; violations of U.S. export control laws; violations of U.S. privacy laws; breaches of contractual provisions and terms of service; security and privacy risks to customers and employees; risk of PRC surveillance and tracking of regime critics; and reputational harm to U.S. businesses,” the report said

https://www.zerohedge.com/technology/your-new-tcl-hdtv-made-china-security-risk