Samsung and Roku smart TVs can be hacked, Consumer Reports says

Millions of smart TVs can be controlled by hackers looking for easy to-find security flaws, according to an analysis by Consumer Reports.

The problems affect Samsung televisions, along with models made by TCL and other brands that use the Roku TV smart-TV platform, as well as streaming devices such as the Roku Ultra.

Consumer Reports found that an unsophisticated hacker could change TV channels, turn up the volume, kick the TV off the WiFi connection, and play YouTube videos. This could be done over the web from thousands of miles away. These vulnerabilities wouldn’t allow a hacker to spy on the user or steal information.

The findings come from tests by Consumer Reports using its new Digital Standard, which was developed by Consumer Reports and partner cybersecurity and privacy organizations to help set expectations for how manufacturers should handle privacy, security, and other digital rights.

The goal is to educate consumers on their privacy and security options and to influence manufacturers to take these concerns into consideration in developing their products, said Justin Brookman, director of consumer privacy and technology policy at Consumers Union, the advocacy division of Consumer Reports.

The privacy and security evaluation focused on smart TVs from five top brands: Samsung, TCL, LG, Sony, and Vizio. In addition to the security flaws found in Samsung and TCL sets, the testing found all of these TVs raised privacy concerns by collecting information about their users.

Consumers can limit the data collection, but they have to give up a lot of the TVs’ functionality, and know the right buttons to click and settings to look for, said Brookman.

Smart TVs can transmit information on their users back to the TV manufacturers and their business partners. These TVs can identify every show you watch, using a technology called automatic content recognition, or ACR. That viewing information can be used for targeted advertising on your TV, as well as mobile phones and computers.

In a recent Consumer Reports subscriber survey of 38,000 smart TV owners, 51 percent were at least somewhat worried about the privacy implications of smart TVs, and 62 percent were at least somewhat worried about the sets’ security practices.

Brookman said the findings show the need for the federal government to set standards to address the security and privacy problems found in connected products.

“Congress needs to pass data security standards for connected products, and federal regulators need to step up and hold companies accountable for the privacy, security and safety of these products,” he said. “For years, consumers have had their behavior tracked when they’re online or using their smartphones. But I don't think a lot of people expect their television to be watching what they do."