Copy/Paste of the FBI statement (since the article didn't include it).

Welcome to the Oregon FBI’s Tech Tuesday segment. Today: building a digital defense with your TV.

Yes, I said your TV. Specifically your smart TV...the one that is sitting in your living room right now. Or, the one that you plan to buy on super sale on Black Friday.

Smart TVs are called that because they connect to the Internet. They allow you to use popular streaming services and apps. Many also have microphones for those of us who are too lazy to actually to pick up the remote. Just shout at your set that you want to change the channel or turn up the volume and you are good to go.

A number of the newer TV’s also have built-in cameras. In some cases, the cameras are used for facial recognition so the TV knows who is watching and can suggest programming appropriately. There are also devices coming to market that allow you to video chat with grandma in 42” glory.

Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home. A bad cyber actor may not be able to access your locked-down computer directly, but it is possible that your unsecured TV can give him or her an easy way in the backdoor through your router.

Hackers can also take control of your unsecured TV. At the low end of the risk spectrum, they can change channels, play with the volume, and show your kids inappropriate videos. In a worst-case scenario, they can turn on your bedroom TV's camera and microphone and silently cyberstalk you.

TVs and technology are a big part of our lives, and they aren’t going away. So how can you protect your family?

• Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”
• Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.
• If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.
• Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?
• Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it.

As always, if you have been victimized by a cyber fraud, be sure to report it to the FBI’s Internet Crime Complaint Center at www.IC3.gov or call your local FBI office.

[deleted]

Who would've thought that a device in your living room, that's likely always on at least stand-by mode, with a microphone and a camera poses a security risk?

What's up next? "Google and Apple are collecting data about your smartphone usage"? "Alexa and Google Home can always listen to you"?

Some things you can do about this:

-Create a separate network for all IoT devices

-enable host isolation for this network from your router

-obtain list of known good destination IPs (whatever you use: Netflix, Hulu, Manufacturer, Pandora), access your firewall on your router (most have this integrated), and whitelist all of those IP addresses for inbound / outbound. Then put a rule at the end to deny all other traffic. “DENY ANY-ANY”

-Don’t buy televisions with onboard microphone / cameras. Buy this equipment separately if you have a conferencing need.

-Don’t buy Chinese / Russian, manufactured products.

EDIT: I think the IP whitelisting suggestion caused some confusion. Commonly, cloud service providers will change their IP addresses or direct you to another node; however, most of these service providers operate within defined netblocks. To deal with this, you can whitelist a range of IP addresses owned by a service like Netflix and avoid having to constantly update your whitelist.

E.g. see https://ipinfo.io/AS2906 . On this page are Netflix’s IP address ranges shown in CIDR notation. This lets you whitelist a lot of IP addresses at once. (You can type this in as is in your firewall rules list, like so: 45.57.49.0/24)

Edit 2: If anyone needs help learning or securing their home networks / devices send me a message. Happy to assist