Popular connected home entertainment devices pose a real cyber security threat due to vulnerabilities in their software, and a lack of elementary security measures such as strong default administrator passwords and encryption of Internet connection.
Kaspersky Lab security analyst David Jacoby conducted a research experiment in his own living room to find out how safe his home is in terms of cyber security. He inspected home entertainment devices such as network-attached storages (NAS), Smart TVs, router, Blu-ray player, etc. to find out if they are vulnerable to cyber-attacks. And it turned out they are.
The Kaspersky Lab expert examined two NAS models from different vendors, one Smart TV, a satellite receiver, and a connected printer. As a result of his research David Jacoby managed to find 14 vulnerabilities in the network attached storages, one vulnerability in the Smart TV and several potentially hidden remote control functions in the router.
Man-in-the-Middle via Smart TV: While investigating the security level of his own Smart TV, the Kaspersky researcher discovered that no encryption is used in communication between the TV and the TV vendor’s servers. That potentially opens the way for Man-in-the-Middle attacks that could result in the user transferring money to fraudsters while trying to buy content via the TV. As a proof of concept, the researcher was able to replace an icon of the Smart TV graphic interface with a picture. Normally the widgets and thumbnails are downloaded from the TV vendor’s servers and due to the lack of encrypted connection the information could be modified by a third party. The researcher also discovered that the Smart TV is able to execute Java code that, in combination with the ability to intercept the exchange of traffic between the TV and Internet, could result in exploit-driven malicious attacks.
Hidden spying functions of a router: The DSL router used to provide wireless Internet access for all other home devices contained several dangerous features hidden from its owner. According to the researcher, some of these hidden functions could potentially provide the ISP (Internet Service Provider) remote access to any device in a private network. What’s more important is that, according to the results of the research, sections of the router web interface called “Web Cameras”, “Telephony Expert Configure”, “Access Control”, “WAN-Sensing” and “Update” are “invisible” and not adjustable for the owner of the device. They could only be accessed via exploitation of a rather generic vulnerability making it possible to travel between sections of the interface (that are basically web pages, each with own alphanumeric address) by brute forcing the numbers at the end of the address.