IT security giant warns of smart TV malware attacks


Details

Editor

| 25 November 2015




The peak smart TV selling season is upon us but research from leading IT security firm Symantec is warning that such sets are increasingly the focus of cyber-criminals.



Symantec believes that the growing popularity and connectivity of smart TVs to other devices in a connected home makes them an attractive target for attackers. It cites ransomware attacks — whereby devices are infected with code that locks out users until they pay up —increasing 113% over the last 12 months. The company regards these as an especially prevalent threat that can infect any connected device—TVs, smartphones, tablets and smart watches.

In his research posting, Symantec threat researcher Candid Wueest said that although he had yet to see any widespread malware attacks targeting smart TVs and most of the attacks to date are proof-of-concepts created by security researchers, it doesn’t mean attackers won’t target these devices in the future.

He pinpointed the most likely source of an infection, the threat vector, as the installation of malware onto the TV, either doing this manually through the TV’s USB port, or accidently downloading an infected app from the official market.

Wueest warned that not all connections made by TVs use SSL encryption, and some that do don’t verify the certificate thoroughly enough, calling out some sets that accept self-signed SSL certificates which he proposes are easy for attackers to create. Another way to avoid unsecure communication from the TV would be to make use of device certificates with solid roots of trust, which are already used by the cable industry to protect their content.

In mitigation, Symantec said that in order to help drive awareness and improve the security of IoT devices, the company was supporting the Online Trust Alliance, an organisation developing security and privacy standards for the smart home and connected devices.