Encryption in RF TV remotes - Page 1
Forum section: electronics / general

author: ivan747
author_rank: Super Contributor
timestamp: July 31, 2016, 10:26:14 pm
content: I recently used a smart TV remote for a Samsung TV and I wondered, being RF, how strong is the encryption? We have seen Bluetooth keyloggers before, how can we trust smart TV manufacturers to get their security right when they have failed in the past? These remotes are occasionally used to enter passwords and other sensitive data, just like a keyboard.

author: ataradov
author_rank: Super Contributor
timestamp: July 31, 2016, 10:51:01 pm
content: It would be nice to know what ICs are used in the remote.One of the protocols for remote controls is ZigBee RF4CE, and it is secure.If they went with some proprietary stuff, then who knows.

author: Halcyon
author_rank: Unknown
timestamp: August 01, 2016, 01:53:53 am
content: Quote from: ivan747 on July 31, 2016, 10:26:14 pmI have a Philips TV with a combination IR and RF remote. Personally, I wouldn't trust it at all, then again, I wouldn't connect my television or any other appliance to my network without locking down what it can and can't access. In my case, I've allowed my TV to access only HTTP/HTTPS out to the internet (for software updates) and NTP. It doesn't need access to anything else (including all the other machines on my network).I know this is probably beyond the average user but even 'average' users can take steps to ensure they are secure, such as using different passwords for different services and setting up a guest wireless network for "untrusted" devices such as televisions, fridges and all the other crap that gets connected to the internet these days.

author: ataradov
author_rank: Super Contributor
timestamp: August 01, 2016, 03:31:32 am
content: Quote from: Halcyon on August 01, 2016, 01:53:53 amBut that's all malware needs to send your passwords out.

author: ivan747
author_rank: Super Contributor
timestamp: August 01, 2016, 04:03:35 am
content: Yeh, it seems like consumer products full of back doors and security holes are becoming the norm.On that note, I wonder how secure are consumer / small business grade Network Attached Storage... Specially since they have sort of a Dropbox or Google Drive functionality.They connect to the manufacturers server and the manufacturer provides you with an app that works like your personal Dropbox.Having that port redirection enabled on my router gives me a bad feeling, so I turned it off after a day or two. Then I firewalled the thing into the local network.Not all TVs come with Android though. I wonder how vulnerable those custom OSes are.Sent from my iPhone using Tapatalk

author: Jeroen3
author_rank: Super Contributor
timestamp: August 01, 2016, 05:45:26 am
content: Quote from: ivan747 on August 01, 2016, 04:03:35 amVery. They inherit all cve's from various open source packages and theynever get security updates.

author: Halcyon
author_rank: Unknown
timestamp: August 01, 2016, 08:04:09 am
content: Quote from: ataradov on August 01, 2016, 03:31:32 amWhat password? My TV isn't storing any, nor does it have access to any part of the network where they are stored. I've also further restricted HTTP access only to the Philips domain where the updates come from.

author: System Error Message
author_rank: Frequent Contributor
timestamp: August 01, 2016, 03:18:18 pm
content: In the past TVs use frequency based so if you had a really strong transmitter you could spook people.Not all products today encrypt their short range communication. keyboards, mouse, bluetooth, infrared, it really depends on implementation and features that are built into it. Ive seen videos on people using a bluetooth hidden in a usb plug as a keylogger for wireless keyboards. Despite the chip support encryption the encryption was not used or left to be the same for every chip.

author: ataradov
author_rank: Super Contributor
timestamp: August 01, 2016, 04:05:37 pm
content: Quote from: Halcyon on August 01, 2016, 08:04:09 amNetflix, Hulu, Amazon and other stuff like that.

author: Halcyon
author_rank: Unknown
timestamp: August 01, 2016, 09:50:49 pm
content: Quote from: ataradov on August 01, 2016, 04:05:37 pmI personally don't use any of those services, but for those that do, their passwords should be different from other accounts (especially e-mail). Even if the password was discovered, it won't compromise other accounts and can be easily changed.

author: silent
author_rank: Contributor
timestamp: August 02, 2016, 04:54:27 pm
content: RF remote can be secure - it depends on technology used and if manufacturer is actually using the security features.For example, there are some devices using Bluetooth Low Energy (BLE) which supports encryption and key exchange (even Out-of-Band, over second medium, like NFC). I don't know if this particular device and other similar remotes are actually using it, but if they do, then it's relatively safe. "Safe-enough" for home use.