We all know the old “it’s not a bug; it’s a feature” joke, but the observation sometimes extends to security issues.
Security researchers have discovered an admittedly mild vulnerability on a Samsung Smart TV that could let an intruder access the TV set over Wi-Fi. But according to the researchers, rather than issue a software fix or suggest a workaround, the South Korean electronics giant instead shrugged its metaphorical shoulders and explained that everything is working as intended.
Your Samsung Smart TV probably isn’t at a huge risk, but the flaw is something you should at least be aware of. Fortunately, the workaround to avoid attacks stemming from this vulnerability is pretty simple.
MORE: Best TVs - Top-Rated Smart and 4K Televisions for Every Budget
Neseso, an online security consulting firm, last week released an advisory discussing a newfound flaw in the Samsung UN32J5500, a 32-inch Tizen-based smart TV first released as part of the 2015 model year and still being sold in North America.
The TV can use Wi-Fi Direct, a convenient protocol that allows two or more devices to connect directly to each other wirelessly without going through a router. (Think about a TV that wirelessly connects to your smartphone so that you can use the phone as a remote, for example.)
Most Wi-Fi Direct devices ask users to provide a password or PIN when connecting, in order to prevent unwanted intrusions. The UN32J5500, on the other hand, simply cross-references a device attempting to connect against a whitelist of devices that the user has already pre-authorized. Devices are identified according to their MAC addresses, which are unique IDs assigned to every network port on every networked device.
In theory, this means that only devices that the user has personally authorized can connect to the TV. In practice, it’s not that hard to spoof a MAC address. If an attacker happened to know the MAC address of your smartphone's Wi-Fi chip, for example, he or she could stand outside your house with his or her own laptop or smartphone, replicate your smartphone's MAC address and get control of your smart TV.
After Neseso reported its findings to the manufacturer last month, Samsung investigated the issue and apparently told the researchers that it was “not a security threat.”
On the other hand, while this exploit seems very easy to pull off, it might be of limited benefit to a potential cybercriminal. While a Wi-Fi Direct connection could let an attacker take over your TV, they couldn’t do much with it other than change the channel or enable screen mirroring. Furthermore, Wi-Fi Direct doesn’t work across long distances, so this attacker would have to be willing to be in close proximity to your TV.
In theory, a very savvy hacker could use other vulnerabilities in the Samsung Smart TV platform — and, according to a different researcher, there are indeed a whole bunch of Samsung Smart TV security flaws — to rig up some way to extract your home Wi-Fi network’s name and access password, but the Wi-Fi Direct flaw itself provides no simple way to do so.
How to protect your Samsung Smart TV
Neseso recommended that users "remove all whitelisted devices" from the TV's settings, but did not discuss exactly how this is done, suggesting only that users contact Samsung for an exact method. (It will probably be somewhere in the Network menu under Settings. If you've whitelisted any devices, you should be able to go back in and delete devices.) Without any whitelisted MAC address, an attacker will have no MAC addresses to spoof, and hence no avenue of attack.
If you want to play it extremely safe, you could disable the Wi-Fi on your TV, which appears to be the only way to disable Wi-Fi Direct. However, doing so will also prevent you from using all the other smart-TV features for which you paid good money.
While Samsung’s shoulder-shrugging at the issue is disappointing for owners of UN32J5500 models (as well as those of other Samsung Smart TVs that run similar firmware; Neseso hypothesized that other models could share this vulnerability, but didn't test any), it’s understandable that the company might not want to divert resources to patching a mild issue for a two-year-old TV.
Our best advice would be to not sweat it, but if someone starts messing with your channels, call the police, disable the Wi-Fi, and buy a cheap streaming media player instead.
Tom's Guide has reached out to Samsung for comment, and we will update this story when the company replies.
