메뉴
HN
Hacker News • 28일 전

스마트 TV가 당신을 감시하는 것을 막는 법

IMP
6/10
핵심 요약

AI 붐 속에서도 스마트 TV 제조사들은 수익을 위해 고객 신뢰를 침해하고 있습니다. LG TV를 노트북에 HDMI로 연결하면 EDID 프로토콜을 통해 Windows가 LG '드라이버'를 자동 설치하고, 이를 통해 동의 없이 McAfee 같은 블로트웨어가 추가로 설치됩니다. 이는 사실상 악성코드에 가까운 행위로, 인터넷 접속을 차단해도 HDMI 연결만으로 발생한다는 점이 충격적입니다.

번역된 본문

스마트 TV는 어디에나 있습니다! 하지만 진짜 주인은 누구일까요? AI 덕분에 전체 전자제품 시장이 호황을 누리는 가운데, 한 분야만 재정적으로 거의 변화가 없습니다. 바로 디지털 디스플레이, 즉 평판 모니터입니다. 그럴만한 이유가 있죠! 엔터테인먼트와 스트리밍 업계 전체가 당신의 거실에 이 기기를 하나씩 놓고 싶어 합니다. 단지 당신의 지갑에 접근하고 싶을 뿐만 아니라, 이 기업들은 판매한 기기에서 몇 푼 더 짜내기 위해 고객의 신뢰를 침해할 준비가 되어 있습니다. 이들 기업에게 당신은 기술적으로 그 기기를 결코 소유한 적이 없으며, 단지 그 기기가 당신의 집에 존재할 '허가'를 구매한 것일 뿐입니다. 진정한 실리콘밸리식 침입자처럼, 이들은 당신의 집에 침입하여 마이크로폰으로 당신이 하는 모든 것을 듣고, 백도어가 심어진 OS 덕분에 당신의 모든 움직임을 추적하며, 가장 중요하게는 자신들이 소유하지도 않은 기기에 악성코드를 퍼뜨립니다.

"와, 잠깐! 악성코드라니, 너무 심한 표현 아닌가요?" - 익명

악성코드란 정의상 당신이 요청한 적 없고 허가 없이 설치된 소프트웨어입니다. 적어도 LG의 경우에는요. '법적 닌자술'을 이용해 모니터 '드라이버' 설치에 동의하는 것이, 함께 제공하기로 선택한 다른 모든 블로트웨어 애플리케이션 설치에도 동의하는 것이라고 주장합니다. 광고처럼, LG의 수익을 창출하기 위해 당신의 데스크톱을 어지럽히는 것이죠. 이 광기의 나락으로의 하강을 계속 읽어보세요.

모든 것은 저렴한 제품을 사는 것에서 시작됐습니다. 아마존에서 75인치 TV의 좋은 거래를 찾는 데 오래 걸리지 않았습니다. 모든 미국 가정처럼, 욕실용 TV는 크게 사는 게 좋으니까 75인치로 가기로 했습니다. 아, 벽 한쪽면을 거의 덮는 TV에서 눈의 피로를 느끼며 변기에 앉아 있는 것만큼 좋은 일이 없죠. 당연히 LG가 (헛소리 같은) AI 업스케일링과 "Wow Orchestra"(그게 뭔지는 몰라도)로 최고의 자리에 올랐습니다. 도시바보다 10달러 더 비싸지만... 어차피 상관없겠죠?!?

그래서 이 녀석을 집에 가져와 Windows 11 노트북에 연결해 넷플릭스를 틀려는데... 아, LG TV용 드라이버 업데이트가 있네요. 말이 되죠? 꽤 최신 TV이고, 드라이버가 TV의 모든 기능을 활용하는 데 도움이 될 테니까요. 물론 마이크로소프트가 다운로드해 주길 바랍니다.

LG 악성코드: 그리고 얼마 후, 데스크톱에 점점 더 많은 애플리케이션이 나타나는 것을 알게 됩니다. 요청한 적 없는 McAfee 백신 복사본처럼 말이죠. 만약 이것이 노부부나 컴퓨터를 전혀 모르는 사람이었다면, 자신의 시스템이 LG에 의해 역으로 이용당하고 있다는 사실조차 모를 것입니다. 누군가 해킹당했다고 생각할 수도 있지만, 실제로는 아닙니다. 마이크로소프트가 LG의 이른바 '드라이버'가 스스로 설치되고, LG를 대리해서 더 많은 애플리케이션까지 설치하는 것을 방관하고 있기 때문입니다.

이 공격은 어떻게 작동할까요? 특히 LG가 인터넷에 접근할 수 없다고 확신했는데 말이죠! 이 모든 일은 HDMI(LG 컴퓨터 모니터를 구매한 사람들은 DisplayPort) 케이블을 인터넷이 연결된 노트북에 꽂는 순간, EDID(Extended Display Identification Data, 확장 디스플레이 식별 데이터)라는 프로토콜을 통해 일어납니다. EDID 자체는 완전히 무해합니다! 단순히 운영체제에 어떤 모니터가 연결되었는지, 어떤 기능이 있는지, 일련번호가 무엇인지 알려줄 뿐이죠. 그게 전부입니다!

Windows에서 장치 관리자를 열어보면 별것 아닌 것처럼 보입니다. 모니터로 연결된 일반 UPnP 장치 하나일 뿐이죠. 장치 관리자를 좀 더 깊이 파고들면 EDID가 마법을 부리는 곳을 발견할 수 있습니다. 이 특정 마이크로소프트 박스가 어떤 삼성 모니터에 연결되어 있다는 것을 알았습니다. 삼성이라면 모니터 기능을 활용하는 데 도움이 되는 드라이버가 있을 수 있습니다. 하지만 이 삼성 모니터는 너무 오래되어서 아예 신경 쓰지 않는 것이죠.

마이크로소프트 같은 핵심 OS가 LG처럼 막대한 부를 가진 조직에 의해 오염되었을 때, Windows 업데이트가 드라이버 릴리스를 예약하는 것은 최종 사용자에게 도움이 되는 일처럼 보입니다. 그리고 LG가 마이크로소프트에 많은 돈을 던져준다면 더욱 그렇죠.

원문 보기
원문 보기 (영어)
Smart TVs are everywhere! But who is the master? Amid the overall electronics boom thanks to A.I., one piece of electronics is almost unchanged financially. That is the digital display or flat-panel monitor. With good reason! The entire entertainment and streaming industry wants one of these devices in your living room. Not only wanting access to your wallet; companies are willing to violate customer trust to squeeze a few extra pennies out of the devices they sold you. To these companies, you technically never really owned the device, but instead purchased permission from these companies to have it exist in your household. Like a true tech-valley rapist, they will break into your home, listen to everything you do via the microphone, track every movement that you make thanks to their backdoored OS, and most importantly, spread malware onto devices they don't even own. Whoah S! Mal-ware? Isn't that a little harsh? - Anonymous Malware, by definition, is software you never asked for and was installed without your permission. At least in LG's case. Using Legal Ninjitsu to state that by agreeing to install their monitor 'driver,' you also agree to install every other bloatware application that they choose should come with it as well. Like advertising, it takes a shit all over your desktop to churn profits for LG. Read on to continue the descent into madness. It all starts with going cheap. It didn't take a whole lot of searching on Amazon to find what appears to be a good deal on a 75-inch TV. We figured we'd go with 75 inches because, like every American household, it's a good idea to go big when purchasing a TV for your bathroom. Ahh, nothing like being on the shitter while catching eye strain from the TV that practically covers an entire side of the wall. Sure enough, LG comes out on top with their (bullshit) AI upscaling and "Wow Orchestra," whatever that means. But $10 more than the Toshiba... WHY NOT RIGHT?!? So you get this bad-boy home, hook it up to your laptop with Windows 11 so you can get Netflix going on.. Oh, there's a driver update for the LG television. Makes sense, right? It's a fairly recent television, and the drivers will help us take advantage of all of the TV's features. Of course, I'd like Microsoft to download it. LG Malware: Then after a while, you notice more and more applications appear on your desktop. Like a copy of McAfee antivirus that you never asked for. Now, if this were an elderly couple or someone who doesn't know anything about computers. They wouldn't even know their system is being turned against them by LG. Some would think their system was hacked by someone else. But actually, no. Because Microsoft is being ambivalent by letting LG's supposed 'driver' install itself and, via LG's proxy, install even more applications. How does this attack work? Especially when you made SURE LG has no access to the internet! This all happens the moment you plug that HDMI (or DisplayPort for people who purchased an LG computer monitor) right into an internet-enabled laptop through a protocol called EDID, also known as "Extended Display Identification Data," which by itself is totally harmless! It simply tells your operating system what kind of monitor is connected, what its capabilities are, it's serial number. That's it! Inside Windows, when you go to Device Manager, it might not seem like much. Just a generic UPNP device attached as a monitor. Dive a little more into Device Manager, and we see where EDID does its magic; we found that this particular Microsoft Box is hooked up to some kind of Samsung monitor. Now, Samsung might have some kind of driver that would help take advantage of my monitor. But this Samsung is so old they simply do not care. When your core OS, like Microslop has been compromised by an incredibly wealthy organization such as LG. Having your Windows Updater schedule a driver release seems like a helpful thing to do for your end users. And it helps if LG throws a lot of money Microsoft's way as a partner to look the other way, as their supposed driver software has its way with your laptop. Well! What's the matter with that? Don't you want "Value added features?" or you can't be possibly stupid to uninstall a virus checker as "Reputable" as McAfee right? Hah! I don't have to worry about this! I got Linux! For now.. That's true. But EDID transmission still happens. and your can install ddcutil to check it out. crackhead@BLORB.LOCALHOST:~$ ddcutil detect I2C bus: /dev/i2c-2 DRM_connector: card1-HDMI-A-2 EDID synopsis: Mfg id: APX - AP Designs Ltd Model: LE24H87 Product code: 12852 (0x3234) Serial number: Binary serial number: 535 (0x00000217) Manufacture year: 2010, Week: 32 This monitor does not support DDC/CI. (I2C slave address x37 is unresponsive.) For the sake of this blog, we powered up one of our thin clients and connected HDMI to it. It shows a lot of information for my ultra-crap monitor that was made in 2010. But what stops LG from convincing the Ubuntu maintainers to make an LG variant of their supposed driver to magically appear in your snap or apt package repository? You hope to God they don't, but the danger is always there. Fuck, i'll just not get an LG TV Then! If you're going to be home all of the time, that's a perfectly acceptable solution. Keep in mind LG may be the first company that is eager to erode trust to get a few extra dollars or listen in on your conversations. Corporations are cowards; if they see one person exploiting people, you'll bet your ass the rest will follow right in line. Eventually, Smart TVs will be used against you. On top of this, getting a "Non-SMART TV," you'll quickly find out that most of those only exist within commercial environments; often, they want a premium price for not having an Android OS that could get hacked, or plaster movie ads the moment you power it up. For example, if you checked into one of the many newly renovated Hilton hotels throughout the United States while traveling. It's almost guaranteed to have an LG TV not only powered on the moment you enter the room but connected to the hotel internet, ready to spy away on you. Usually, you can just unplug the damn TV and watch movies on your laptop screen. OR! You do something about it. Enter the EDID Blocker We've used each one of these units during one part of our lifetime in the world of computers. The gold one on the left is actually an EDID dummy plug. It allows a computer to be powered on, thinking there is an HDMI monitor attached to its workstation, when in reality there is none. Useful if you like graphical remote desktops and don't want the resolution to get all stupid the moment you unplug. The other is a common HDMI EDID blocker. There's a lot out there with varying quality. Originally, these were used in conjunction with an HDMI splitter so if the monitors change it doesn't black out the display. Another use is if you have a lot of projectors in a particular orientation and don't want windows to completely screw up your tiling without using Nvidia Mosaic, this is more of a hardware-based approach. crackhead@BLORB.LOCALHOST:~$ ddcutil detect I2C bus: /dev/i2c-2 DRM_connector: card1-HDMI-A-2 EDID synopsis: Mfg id: XMD - UNK Model: Mi TV Product code: 154 (0x009a) Serial number: Binary serial number: 0 (0x00000000) Manufacture year: 2017, Week: 39 This monitor does not support DDC/CI. (I2C slave address x37 is unresponsive.) TV changed, and if I unplug just the HDMI cable going to my 2010 television, it'll still read just fine. You're probably wondering about the last EDID blocker, which is DisplayPort to DisplayPort. WELL! It's a scam. Just a bunch of wires, shit-soldered together to make a jumper and charger 15-30-45 to pass it off as an actual blocker. We wanted to get a legit EDID blocker to show you its device. But it's important to document even the bootleg garbage you get when working with grey-market tech. Got my refund right away on this one. This, however, illustrates the importance