GamersNexus and LG: Or why rooting your TV is a bad idea

Whenever I get to see companies eat shit over bad security, shady business practices, and both, I’m excited. And GamersNexus is here to deliver the goods about LG and their smart TVs. https://www.youtube.com/watch?v=6IFVTcM28KA

“LG TVs are able to be utilized as eavesdropping listening devices, in part because of the advertising functionality.”

Now that’s a claim! I’m pumped. On screen, we see log information from the TV, highlighted as unformatted JSON, that includes statements such as “My credit card information” and “My Social Security Number is…”. Pausing and looking at the rest of the logs, we can see that they show the response to the search query (“Here are the search results for My credit card information”). 

Looking at it, my assumption about the order of operations here is:

• They initiated the search.

• Said stuff

• The OS posted the search and returned the results.

• Logged the actions into a file.

So it’s not always recording and transcribing, at least; they did a voice search. You can make a valid argument for storing these logs alongside the search history (Transcribed or otherwise; I will assume the same would happen if you literally typed them in). It’s not ideal to have that available on device, but it's not the worst issue I’ve seen. I continue the video.

They then claim that they could also record from the webcam and microphone while the TV appeared to be off, record from the microphone even when the TV had no network access, which someone with remote access to the TV could access, and said the TV “crawled their network” to find “dozens of unrelated devices.”

I’m not sure what they’re getting with that last one yet, but okay, I think I understand the gist. Due to LG's hubris with their ad tech, there are a bunch of potential security vulnerabilities; at this point, I’m interested in the implications they present, although skeptical that what they’re showing is what they claim so far.

It cuts to a discussion of the tech, where they cut between LG talking up their tech and reach. Can’t disagree here; ad tech sucks and should die. They then show a screen where they state that “LG can collect” the following:

Yes, by definition, a networked computer can do those things. It’s a computer. Do they demonstrate that LG is collecting it? Not yet. Are they sending this data up to their servers? Haven’t shown it. They do show a blurred Wireshark screenshot claiming things are happening. So, maybe something is?

The sinking feeling sets in: I’m two minutes in; the video is two hours long.

It starts focusing on network calls from the TV. There are three security experts cited: MrBruh and U-Turn, people who found and published vulnerabilities in other software and who GamersNexus have reported on, and Wendell from Level1Techs. I don’t know much about the former outside of watching GamersNexus, but on the outset they seem fine, and I do watch and subscribe to Level1Techs too, so I’m aware of him.

Showing a message from MrBruh about activity from the logs, it reads:

They explain this as the TV “continuously scanned our LAN, our local area network, for all nearby devices.” What they’re showing is smart-device IoT logs: mDNS and SSDP are how UPnP and Bonjour devices announce themselves and Reverse DNS gets the names for those that don’t. Kasa and LIFX, I believe, are TP-Link smart-device protocols and devices (I think a smart bulb?). The TV is a smart device; it can access those things. What am I meant to take away from this? If you look at other IoT devices, they’re going to show the same thing. But here it’s presented as bad. Why?

It should also be said that the TV is a media device; it can access the network to play videos and music. Accessing a Samba share or DLNA isn’t evil! That’s not to say auto-discovery can’t be used for nefarious purposes, but this doesn't read that way. Right now, I am seeing a computer doing computer things. I’m unsure what the problem is.

Now, if LG took those network hostnames, bundled them with a unique identifier, and sent them to their cloud servers and advertisers, that could be something. But they don’t demonstrate that. Hell, if they sent it up as their own telemetry, that would be something. Maybe we could see that next time.

Throughout the video, they show themselves using Wireshark to monitor the network connections on the TV. That’s fine; nothing wrong with that. But the data is encrypted. LG, thankfully, at least attempts some security by using SSL and HTTPS. But because it’s encrypted, the only logs we see are, at most, DNS requests. We can’t see the payloads (The data itself) being sent and what’s being recieved. Wendell mentions this at one point: that you would need a man-in-the-middle setup to decrypt the certificates. That they didn’t do that here is, to me, a huge hole. Since you can’t see the data going in and out, you have to make assumptions about what’s happening. And they do.

They show the “LG Telemetry” and “LG Channels Telemetry” endpoints, along with how many times each is called. Again, we don’t know the payloads or what’s sent, just the number of times something is called and the size of some requests. MrBruh then tells them:

Now, I’m not going to claim to be a network expert. I may be totally off-base, but what? Reverse DNS? I don't know what this means.

From Wireshark, we can see some of the calls. Again, they don’t explain what we’re seeing.

But it’s enough for us to break down the URLs. LG uses Amagi for their FAST service, splitting the name we get:

amg01918: Amagi's channel ID

cnnus: the channel itself, so CNN US

lg-us: the platform and region the feed is for

playouts.now.amagi.tv: The Amagi URL

So, based on the URL alone, you can know which channel is being tuned in to. And if you change channels, that’s a new request that you can timestamp and, theoretically, know what was on at that time.

To say “Available to anyone on the LAN” is, to my understanding, a bit of a stretch. On a switched network, another device can’t passively see your DNS requests. Someone needs to control your underlying connection (Like your router, or by ARP-spoofing you) to know. That's not impossible, but you need to be really motivated to care.

Moreover, this is not unique to LG; several different services use Amagi. Unless they use different URI structures that I don't know of, they’ll all leak it the same way. If it's an issue, it's generic. And if the government wanted to know what FAST channel you were watching at any given time, they probably have easier ways than pwning your router.

Talking about Automatic Content Recognition (ACR), the awful shit that fingerprints what you’re watching on screen, MrBruh says that “even an HDMI connection was undergoing ACR.” and they show a study they show on screen that also says this.

I read the study. It’s a great read, but they mention that they also couldn’t decrypt the payloads from the TV. It's the same issue that hit GamersNexus; They know endpoints are being called, not what’s in them. Could it be HDMI fingerprints? Maybe; we don’t know. The study calls this out for future research.

MrBruh doesn’t say either. They do give an algorithm LG uses for fingerprinting (I assume by going through WebOS?), but as far as I can tell, they didn’t provide a sample.

It’s cool to know what it is, I guess, but knowing how and when it’s implemented and used would be far more interesting, you know? To be clear, I’m not saying that LG couldn’t be doing it, but I don’t think what’s suggested here necessarily is. At best, it’s inconclusive. It’s something I would love to know more about. 

Oh yeah, eavesdropping listening devices- that’s what this video is about. Anyway.

The TV has a microphone. It can be used in apps (do they exist on WebOS still?), for entering text, or to bring up the “AI Voice Assistant,” because it’s 2026 and, of course, we’re going to have that on our TVs for some reason. It has an always-on mode that can be triggered by a wake word to bring up the assistant, and a kill switch on the front to turn it off altogether (specifically, the built-in mic, not the remote)

Each time you flip the switch, it specifically tells you whether the “built-in” mic is turned on or off. Wendell says the “promise,” to him, is that the TV would be able to record audio or not, so he’s surprised that the remote captures audio with the switch off. I don’t mean to be pithy and semantic, but come on. That’s a real stretch. It plainly tells you “built-in mic.” 

The remote is push-to-talk and only appears as a device when you press the button. He does show this happening live and that it’s good that it’s not always connected, which is cool to see! But to me it doesn’t square with the first criticism. It would probably be better to have a way to completely turn them all off and prevent any audio, but this feels minor to me, all things considered. 

He then shows “running commands on the TV” to play with the microphone settings that don’t appear in the UI, and can hide the WebOS UI that shows the microphone is on for search. That is scary. While he doesn’t explain what he’s doing, fortunately, it’s on screen.

We can see a terminal where he’s SSHed into the TV. WebOS runs on Linux, and we can see “root@webOSTV” and “luna-send”. Luna is a Service hub for sending and requesting data from a WebOS device; it’s documented and available for developers, but the command he’s running is internal. 

Now, what he’s showing can be pretty scary. I wouldn’t want any attacker to be able to record me without knowing. But it’s important to remember the context here: earlier in the video, Wendell rooted the TV. He has full access to everything on it. To run those commands and programs, he had to log into WebOS via SSH and run them on the device. He didn't show remoting calling those commands, nor was this done on an unmodified device.

If you root or jailbreak your devices, you've, by their very nature, broken their security. If he can demonstrate someone remotely jailbreaking your TV, or flipping on those settings without you knowing or doing anything to your TV, that would be a far more damning issue, in my view. 

But they then show that they can record using the TV's microphones, even when “the network is not plugged in.” (I would argue that microphones should work regardless of network conditions, because they also let you do voice input to type in text fields and that can be pretty important for accessibility, but I digress.) Because they have remote access to the TV, they can set it to record and capture audio without the user knowing they’re being recorded.

Again, they’re taking an already pwned device and doing bad stuff on it. Unless something was cut from the video or I missed something along the way, they’re still running the root they performed earlier for everything they're recording, so all of this is happening on a device that has already had its security compromised.

If someone jailbreaks your TV, you have bigger problems! What are we doing here?

From there, the rest of the video is mostly just some weird little guys from FOSS talking about owning hardware and ensuring our legal rights to reverse-engineer it. Then they wrap it up.

I know I’m saying things here that could be taken the wrong way. Again, to be clear, I like GamersNexus. I’m a patron, and I don’t plan on stopping! Considering all the bullshit going on in tech and that most people probably aren't looking for case and cooler reviews, I’m all for them doing investigative journalism. I also don’t want to sound like I’m “debunking” them or, even worse, defending LG. 

I’m not! LG sucks! Companies suck and shouldn’t be trusted by default! And I think Steve and Co. are operating in good faith; they saw a thread and went for it. I can’t be mad at that; I want to hold companies' feet to the fire; ad tech really does suck, and hearing the corporate heads talk about it is mind-numbing. 

But to me, they could have waited a bit longer and run it by more people before posting this. Maybe they did. They could post the CVEs tomorrow, and I’ll look like a jackass. That’s fine! I'd rather be proven wrong and shown that they are doing shady shit.

But right now, based on this, I’m not so sure.

Update:

I noticed this was being passed around: https://weowntheglass.com/

It's a "screensaver" that, in their words:

I'm not sure if it's intended to be a joke. Having to say "We DO NOT support or encourage violence of any kind." is quite funny. The copy is also very odd.

The February rising drove King Louis-Philippe off the throne and out of France. Serge Matta, the President of Global Ad Sales at LG Ad Solutions, was also banished from leadership; in his case from running companies for 10 years by the SEC for 'a fraudulent scheme.'

Based on how the copy reads, and the comments in the source code, I'm about 90% sure it's AI generated. If it's not, then whoever wrote it has been reading way too much Claude. Being LLMed is not itself bad, although I would have rewrote the site text at least, but GamersNexus is very Anti-GenAI. They trash it every chance they get. I assume GamersNexus had nothing to do with it, so whoever made it should really think about what they did here.