Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung Q990D unresponsive after 1020 firmware update

us.community.samsung.com

Post reply on HN
Print view View original

41–50 of 580 posts

Re: Samsung Q990D unresponsive after 1020 firmware update

#41

Post by grishka »

thimabi wrote: post #12

It bothers me that many devices are so easily remotely bricked and that keeping them offline is the only way to avoid such issues. Automated updates were supposed to give us peace of mind instead of having us worried about what bug or enshittification will follow. I’d wager that, for most Internet-connected appliances, keeping them offline or disabling autoupdates have way more pros than cons.

If it allows anyone to remotely execute arbitrary code on a device without the user's consent, it's called an RCE vulnerability. About as serous as software vulnerabilities go, needs to be patched yesterday.

But if it only allows the manufacturer to remotely execute arbitrary code on a device without the user's consent, it's called an automatic software update mechanism and most people somehow consider that it's totally fine.

Re: Samsung Q990D unresponsive after 1020 firmware update

#42

Post by whatwhaaaaat »

jakeydus wrote: post #25
mcs5280 wrote: post #16

Earlier quoted context omitted.

Probably some new AI/tracking/ad delivery features

Few things over the past few years have infuriated me as much as tracking and advertising being introduced at the OS level, especially on TVs. I'm looking at you, LG! I will gladly pay more for a TV that doesn't try to advertise Roku's streaming service to me or track my kids' watch history. Seems like they are few and far between, though. The best thing we have been able to come up with is leaving the TV itself disc…

This is sound advice for keeping yourself free from malware as well. Many of these TVs end up running super vulnerable junk that doesn’t get updated and has known exploits.

I’ve had two devices end up with malware like this. A Sony blue ray player that was uploading 2gig a month before I caught it and a Samsung tv.

It’s worth mentioning you have to block or change WiFi credentials. The device with malware may attempt to connect to any known wifi even if you disable it on the device. I get 45000 auth attempts a day from my tv.

Re: Samsung Q990D unresponsive after 1020 firmware update

#43

Post by OtherShrezzing »

mytailorisrich wrote: post #27
tomstokes wrote: post #18

Two important features I insist on for products I develop: 1. Staged rollout of firmware updates. It’s common practice for apps and software but for some reason it’s less common with firmware. Rolling out to 1% (or less, depending on scale) of devices and waiting a day is cheap insurance. Side note: Build a good relationship with customer service people so you hear about these things immediately. 2. A failsafe firmwa…

Indeed a golden factory firmware version that will be booted automatically if all else fails and that provides minimum connectivity is crucial.

I wonder if that opens a threat vector from a security point of view? If an attacker knows that the golden firmware has some critical vulnerability which they can exploit easily, they can activate it at will by bricking the device and waiting for it to restart.

Re: Samsung Q990D unresponsive after 1020 firmware update

#44

Post by grishka »

nemomarx wrote: post #37
grishka wrote: post #34

Earlier quoted context omitted.

It's a speaker system. It plays sound. Why could it possibly have AI, tracking, or ad delivery?

Insert ads into the music the customer is playing, using AI to find pauses, and track what songs they're playing for data gathering?

Yeah but why would anyone actually buy that then?

Re: Samsung Q990D unresponsive after 1020 firmware update

#47

Post by RUnconcerned »

vosper wrote: post #33
jakeydus wrote: post #25

Earlier quoted context omitted.

Few things over the past few years have infuriated me as much as tracking and advertising being introduced at the OS level, especially on TVs. I'm looking at you, LG! I will gladly pay more for a TV that doesn't try to advertise Roku's streaming service to me or track my kids' watch history. Seems like they are few and far between, though. The best thing we have been able to come up with is leaving the TV itself disc…

> I will gladly pay more for a TV that doesn't try to advertise Roku's streaming service to me or track my kids' watch history. Seems like they are few and far between, though. Plug in an Apple TV?

That's... not a TV, it just has TV in its name.

Re: Samsung Q990D unresponsive after 1020 firmware update

#48

Post by stego-tech »

OtherShrezzing wrote: post #43
mytailorisrich wrote: post #27

Earlier quoted context omitted.

Indeed a golden factory firmware version that will be booted automatically if all else fails and that provides minimum connectivity is crucial.

I wonder if that opens a threat vector from a security point of view? If an attacker knows that the golden firmware has some critical vulnerability which they can exploit easily, they can activate it at will by bricking the device and waiting for it to restart.

They could, and that's been a way for attackers to "jailbreak" devices and load custom firmware in the past. Though for the sake of reducing eWaste and enabling device repurposing and reuse, I do think this is the best path for firmware-updatable devices.

Re: Samsung Q990D unresponsive after 1020 firmware update

#49

Post by MiddleEndian »

ethbr1 wrote: post #38
marcodiego wrote: post #22

Should be codified by law: - If a firmware can be updated, it must keep a minimum ROM feature so it can be recovered. - No device should be updated without the *owner* explicit intention to do so. - Full docs must be released if the vendor stops supporting it.

> No device should be updated without the *owner* explicit intention to do so. That point has practical issues, because most consumer electronic customers are technically dumb. Consequently, you end up with a long-tail of deployed device firmware versions, which makes support a nightmare (fix this external integration that broke... across 20 different versions). I'd phrase it more in terms of: - Every device must inc…

>That point has practical issues, because most consumer electronic customers are technically dumb.

It's a speaker that worked fine until Samsung unilaterally broke it. I don't think the customers are the dumb ones here.

Post reply on HN