Samsung TVs look for microphones in your house via Bluetooth and then spy events

Your Samsung TV can now listen to other Bluetooth devices in your home without your explicit consent.

Samsung TVs can reportedly access microphone data from other devices in a user's home through Bluetooth connections. Researchers at security firm Penetrum demonstrated how the company's SmartThings app, when installed on a Samsung TV, can discover and connect to nearby Bluetooth devices, including smart speakers and other IoT gadgets. Once connected, the TV app can then potentially capture audio data from these devices, even if they are not directly paired with the TV. This functionality, while not explicitly designed for eavesdropping, raises significant privacy concerns as it bypasses typical security protocols for audio access. The researchers found that the TV app would continuously scan for and connect to any discoverable Bluetooth devices, making sensitive audio data vulnerable.

This vulnerability highlights a new vector for potential data exfiltration, where a seemingly innocuous smart TV becomes a hub for intercepting audio from a variety of connected devices. The ability for the TV to autonomously connect and record from other Bluetooth devices suggests a broader trend of smart home ecosystems inadvertently creating surveillance opportunities. It raises questions about the security architecture of interconnected devices and the extent to which manufacturers are prioritizing user privacy over convenience and feature expansion.

The implications extend to manufacturers of other smart home devices and app developers, who must now consider how their products interact with Smart TVs and similar platforms. Consumers may need to become more vigilant about the permissions granted to their smart TV applications and the Bluetooth discoverability settings on all their connected devices. Future device development will likely need to incorporate more robust authentication and explicit user consent mechanisms for cross-device audio access to prevent such privacy breaches.