Is my Samsung Smart TV vulnerable to the "weeping angel" attack?

Question

On CNet, there's a report about Samsung UNF 8000 smart TVs being vulnerable to a hack developed by the CIA:

In June 2014, the CIA and UK's MI5 held a joint workshop to improve the "Weeping Angel" hack, which appears to have specifically targeted Samsung's F8000 series TVs released in 2013.

A "Fake-Off" mode was developed to trick users into thinking their TV was off (by turning off the screen and front LEDs), while still recording voice conversations. Based on what we know about the TV, the hack would have tapped into the microphone located in a TV's accompanying remote.

I've read 'Can I monitor my network for rogue IoT device activity?' which gives some general ideas about how a network could be monitored, but I'm interested in specific ways that I could detect if my TV was infected and transmitting data to the cloud.

Is there any way that I could detect if my TV was recording and transmitting audio to a malicious party?

I'm thinking about anyone who may have developed a similar attack, too, not just the CIA's specific exploit. A problem I can foresee with the general methods in the linked question is that it might be hard to differentiate between general network traffic and malicious traffic from my TV—is there any way I could tell between them easily?

The TV is connected to a Netgear N600 router and I have no special monitoring equipment, but I'm happy to use Wireshark if necessary.

Answer 1

Weeping Angel

No, you were with a probability bordering on certainty not spied on by the Weeping Angel at least as described in the leaked documents. Why? The attack involved a physical component—"physically plugging a USB cable"—which makes it very unlikely that you were targeted. After all, they would have to deploy an actual physical spy to deploy that hack. Every such operation has costs and has a (however slim) likelihood of the operative being caught. Thus, you'd have to be a high value target to be targeted. Furthermore, the attack window of the leaked hack is pretty short and ended with version 1118 which was released barely a year after market launch of the product.

However, and being abundantly clear, there is no way to know right now if they improved on the hack. If a Weeping Angel v2 got rid of the physical component the big data approach would get more likely. "Just hack everything and see what turns up."

Similar Attacks

There is no simple solution to detect such attacks. It's hard for the manufacturers of the devices to detect them and for the customer it's virtually impossible to do it for a device of a certain smartness.

Why? Simply put: The more functionalities a device has, the more endpoints it communicates with. That makes traffic analysis pretty hard. A few years ago, a TV of a certain manufacturer would only communicate with that manufacturer—and that already makes a few services, for example a streaming service, an update service, a shop service and whatnot. Nowadays more and more device in the processing power class of TVs get apps. Each app connects to its own cloud service. Monitoring of these channels costs a lot of effort. And if they are using some basic security you can't differentiate a bit because you can't look into the traffic, you can only see the endpoints by addressed IP.

Basically network analysis gets really nasty. Unfortunately, it's pattern analysis again. The same as in the linked question. You expect a TV to download a lot more stuff than it uploads. If your TV has gigabytes of upload something is up. Speech is a lot less data than video but normally the control stuff your TV uploads should be less than what speech data amounts to.

Clean Firmware & Updates

The only thing you can do is flashing the device with a trusted firmware from a trusted source. Maybe you can check if the device loads the firmware from a server that is associated with the manufacturer.

As Weeping Angel shows those updates may invalidate hacks on their own. It was done with version 1118—at least from what we know of the leak.

Answer 2

I'm drawing primarily from this article on ibtimes.com. There are several things you should realise:

• Weeping Angel can only infect Samsung TV's from 2012 and 2013. From the article referenced:

  The Weeping Angel hack only works on Samsung TVs released in 2012 or 2013. From Samsung’s 2012 lineup, the UNES8000F, E8000GF plasma and UNES7550F models are at risk. From 2013, the UNF8000 series, F8500 plasma, UNF7500 series and UNF7000 series are vulnerable.

• Weeping Angel only infects devices with certain firmware versions. Wired.com reports:

  It must be noted that the hack, codenamed Weeping Angel (a Doctor Who reference, by the way) applies only to Samsung televisions from 2012 and 2013 that feature outdated firmware versions 1111, 1112, and 1116.

---

That foundation laid, if you are suspecting that you have been infected, there is a tell-tale sign that you should be on the lookout for. While the red light on the front of the TV will be off when the TV is off, a blue light on the back of the TV will remain on. According to Ibtimes,

If that light is still illuminated, the Fake Off mode has been activated and is keeping the TV on despite it appearing off.

To keep your TV safe, make sure your firmware is up to date. So long as your firmware is not on versions 1111, 1112, or 1116, your TV should be safe... from that hack.

Answer 3

To answer your second question, yes, this attack was publicized in 2013 at Black Hat. Two Korean researchers demonstrated an attack that was developed against Android. Attacking TVs was easier than phones, because they didn't have to worry about excessive battery draining giving away the existence of the bug.

The link above is to the slide presentation. It has a lot of technical information about how to infect a target remotely, just like any other attack. Some of it might be useful in examining your TV.

Answer 4

There are multiple aspects. Let's try on the 'means, motive. and opportunity' filter:

• Means: Weeping Angel is (one) technical possibility, provided you have a particular make, model and year of TV. BTW If someone wanted to bug you, how likely is is that they would use this particular option, instead of some other kind (perhaps more mass-produced) of bug?
• Motive: suppose you could put a listening device in every room and hallway in every house, office building and warehouse. Now you have to make arrangements to collect, store, and filter through all of that, including filtering out TV programs, background noise, vacuum-cleaner sounds, dogs barking, etc. etc. Is there some reason that someone would want to spend all that effort, in your case?
• Opportunity: for Weeping Angel, someone would (per 'anonymous 2' post) have to have installed this on your TV, either at the factory or by visiting in person. Let's assume that you don't have a special alarm, so this is possible.

I kind of settle on "yes they could, but why?"