Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

blog.includesecurity.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#31

Post by graypegg »

cobbzilla wrote: post #3

I never connect any “smart” device to wifi. If it doesn’t work without connectivity, I don’t want it. I use my TVs as display devices. They have HDMI-in and that’s it.

I have a smart TV that's never spoken to the internet after exiting the factory, but it's a pretty tenuous state of affairs. I have this fear that someone staying over is going to see the "Services unavailable, press [menu] to troubleshoot" toast that shows up overtop the HDMI feed for a few seconds and think they're helping me by connecting it. 4-5 years worth of firmware updates all at once... half a decade of watch data somehow extracated from the HDMI feed and stored for precisely this moment... ads everywhere. Even if it doesn't happen instantly, I can only assume there's some flag deep in the OS called makeEverythingWorse just waiting to be flipped on the femtosecond The Beast catches a whiff of a slightly-higher patch number; now content in it's doomed state after having fufilled it's one true purpose of telling someone at samsung my favourite show is HDMI2.

I have had to back my mother down from that precipice on her own TV so I know it's worth worrying about. The siren call of an entirely empty TV homescreen beckoning us with a struck-out radio tower icon. "We have Disney+ and CraveTV too... press [menu]... pay no attention to the sticky note your son put on the coffee table"

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#33

Post by rootsudo »

cyanydeez wrote: post #19
xg15 wrote: post #5

> After config fetch, the SDK opens a persistent WebSocket to: wss://proxyjs.brdtnet.com:443 This hostname resolves to AWS Global Accelerator IPs There is some irony that both the scrapers and the websites being scraped are probably hosted on AWS, while playing an elaborate cat-and-mouse game pretending that they weren't.

Kind how the American government needs commercial businesses which they poorly regulate so those businesses provide privacy invasions as a legal means to wash their hands.

Same for arms dealing, and every other industry.

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#35

Post by jappgar »

blakesterz wrote: post #24

Are there any defenses I can put in front of my websites that are good for stopping these things? The amount of traffic I see from residential proxies is just killing me. In particular defense against residential proxies.

The bots used by these proxies are detectable in a few ways. Remember the bot itself doesn't run on the proxy...

There is discernible lag from proxy to c&c node. The individual bots don't have access to a lot of compute, and are sometimes restricted wrt feature set (e.g. proprietary video codecs).

There are a few other techniques. It's a cat and mouse game though. And the bot owners are usually more motivated than you are.

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#36

Post by tamimio »

Years ago I had smart TV, and while I never used anything “smart”, one day I connected it to the network to update it and forgot it, two days later I was checking my dns and 80% of the traffic and blocked queries in the past two days were from one device, after tracking it, it was the TV!

So what I have now is a pre-smart TV I found at the thrift, still very good picture that’s more than enough for the few times I use it.

There should be a way to disable the “smart” garbage in new TVs, or an option to buy normal ones at least.

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#37

Post by kotaKat »

picofarad wrote: post #15
calcifer wrote: post #11

> The SDK’s config ships a flag “use_netifs”: true. That flag triggers code in the SDK binary that constructs its NWConnection with a specific required interface: en0 (WiFi) or pdp_ip0 (cellular), rather than using the system default route. > On iOS, this bypasses any configured VPN’s tun0 interface entirely. The peer tunnel does not cross a user-configured VPN, even when the rest of the app’s HTTPS traffic does. Wha…

> When/why should an app be allowed to bypass a user-configured VPN? temporarily if full tunnelling isn't working, one can split tunnel to route around issues due to VPN But imo an app should never bypass something like a network boundary.

Look at how far TikTok can go if you try blocking DNS. The hardcoded IPs, self-DNS-resolution and cat-and-mouse game of blocking is quite... interesting.

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#38

Post by tamimio »

drhike wrote: post #21
lelandfe wrote: post #7

Earlier quoted context omitted.

On my TCL TV, you have to connect it to read the Google policies you are agreeing to. If you don't, you agree to policies unread. Thankfully, the blast radius of this is nothing without connectivity.

If it has an Ethernet port I would use that then unplug it. It still gets to phone home once but you don't have to worry about it maliciously saving your Wi-Fi password for later

You can create a guest wifi with temporary password, I do that when I need to connect devices that might store the password like kindle or such.

Re: The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

#39

Post by vsgherzi »

kotaKat wrote: post #37
picofarad wrote: post #15

Earlier quoted context omitted.

> When/why should an app be allowed to bypass a user-configured VPN? temporarily if full tunnelling isn't working, one can split tunnel to route around issues due to VPN But imo an app should never bypass something like a network boundary.

Look at how far TikTok can go if you try blocking DNS. The hardcoded IPs, self-DNS-resolution and cat-and-mouse game of blocking is quite... interesting.

Is there anywhere I could read more about this ?
Post reply on HN