Security Holes Opened Back Door To TCL Android Smart TVs

guest · Nov 12, 2020

Security Holes Opened Back Door To TCL Android Smart TVs
TCL is the world’s 3rd largest TV manufacturer
November 12, 2020
https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/

Millions of Android smart television sets from the Chinese vendor TCL Technology Group Corporation contained gaping software security holes that researchers say could have allowed remote attackers to take control of the devices, steal data or even control cameras and microphones to surveil the set’s owners.

The security holes appear to have been patched by the manufacturer in early November. However the manner in which the holes were closed is raising further alarm among the researchers about whether the China-based firm is able to access and control deployed television sets without the owner’s knowledge or permission.
Click to expand...

Two Flaws, Lots of Red Flags
In a report published on Monday, two security researchers described two serious software security holes affecting TCL brand television sets. First, a vulnerability in the software that runs TCL Android Smart TVs allowed an attacker on the adjacent network to browse and download sensitive files over an insecure web server running on port 7989.

That flaw, CVE-2020-27403, would allow an unprivileged remote attacker on the adjacent network to download most system files from the TV set up to and including images, personal data and security tokens for connected applications. The flaw could lead to serious critical information disclosure, the researchers warned.
Click to expand...

Second, the researchers found a vulnerability in the TCL software that allowed a local unprivileged attacker to read from- and write to critical vendor resource directories within the TV’s Android file system, including the vendor upgrades folder. That flaw was assigned the identifier CVE-2020-28055.

Both flaws affect TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below, according to the official CVE reports.
Click to expand...

guest · Nov 21, 2020

TV Maker TCL Denies Back Door, Promises Better Process
November 20, 2020
https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/

Chinese electronics giant TCL has acknowledged security holes in some models of its smart television sets, but denies that it maintains a secret “back door” that gives it control over deployed TVs.

In an email statement to The Security Ledger dated November 16, Senior Vice President for TCL North America Chris Larson acknowledged that the company issued a security patch on October 30 for one of two serious security holes reported by independent researchers on October 27.
A patch for a second flaw, CVE-2020-28055, will be released in the coming days, TCL said.
A Learning Process for TCL
In an email statement to Security Ledger, Larson acknowledged that TCL, a global electronics giant with a market capitalization of $98 billion, “did not have a thorough and well-developed plan or strategy for reacting to issues” like those raised by the two researchers. “This was certainly a learning process for us,” he wrote.
At issue was both the security holes and the manner in which the company addressed them.
Click to expand...

No Back Doors, Just “Remote Maintenance”
While TCL denied having a back door into its smart TVs, the company did acknowledge the existence of remote “maintenance” features that could give its employees or others control over deployed television sets, including onboard cameras and microphones.

In particular, TCL acknowledges that an Android APK known as “Terminal Manager…supports remote diagnostics in select regions, [...] However, TCL said that Terminal Manager can only be used if the user “requests such action during the diagnostic session.”
Click to expand...

Other clarifications from the vendor suggest that, while reports of secret back doors in smart TVs may be overwrought, there is plenty of reason to worry about the security of TCL smart TVs.
The TCL statement acknowledged, for example, that two publicly browsable directories on the TCL Android TVs identified by the researchers could have potentially opened the door for malicious actors.
Click to expand...

guest · Dec 22, 2020

DHS Looking Into Cyber Risk from TCL Smart TVs
December 22, 2020
https://securityledger.com/2020/12/dhs-looking-into-cyber-risk-from-tcl-smart-tvs/

The acting head of the U.S. Department of Homeland Security said the agency was assessing the cyber risk of smart TVs sold by the Chinese electronics giant TCL, following reports last month in The Security Ledger and elsewhere that the devices may give the company “back door” access to deployed sets.
Speaking at The Heritage Foundation, a conservative think tank, Acting DHS Secretary Chad Wolf said that DHS is “reviewing entities such as the Chinese manufacturer TCL.”

As reported by The Security Ledger last month, independent researchers John Jackson, (@johnjhacking) - [...]
The first, CVE-2020-27403, would allow an unprivileged remote attacker on the adjacent network to download most system files from the TV set up to and including images, personal data and security tokens for connected applications
The second vulnerability, CVE-2020-28055, would have allowed a local unprivileged attacker to read from- and write to critical vendor resource directories within the TV’s Android file system, including the vendor upgrades folder.
Click to expand...

Sick Codes, in a phone interview with The Security Ledger, said the company’s ability to push and update code to its deployed sets without owner approval amounted to a back door that could give TCL access to audio and video streams from deployed sets, regardless of the wishes of owners.

“They can update the application and make authorization happen through that. They have full control,” he said.
Such concerns obviously raised alarms within the Department of Homeland Security as well, which has taken steps to ban technology from other Chinese firms from use on federal networks.
Click to expand...

guest · Dec 28, 2020

TCL Says Its TVs Have no Backdoors Despite Allegations
TCL finds backdoor allegations entirely unsubstantiated and investigation claims highly dubious
December 28, 2020
https://www.technadu.com/tcl-says-tvs-have-no-backdoors-despite-allegations/235804/

Back in November, security researchers found a way to access TCL smart TVs remotely and without authentication, which essentially opened the way for planting malware, modifying existing files, or exfiltrating sensitive user data.

Last week, the head of the Department of Homeland Security, Chad Wolf, stated that the federal agency was looking into TCL products, and TVs more specifically, to fully appreciate the backdoor risk.
As the official stated, this year, they discovered that TCL incorporates backdoors into all of its TV sets. He further added that there’s evidence the firm is state-supported, which complicates the situation for the brand’s presence in the United States.
Click to expand...

TCL has felt the need to refute these claims now, saying that they are very concerned about the inaccuracies that hit the media these days, underlining that they have been conducting business in the United States for over 15 years without any security risk ever having been proven.
Click to expand...

Log in or Sign up

Security Holes Opened Back Door To TCL Android Smart TVs

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Security Holes Opened Back Door To TCL Android Smart TVs

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches