Samsung and Vizio smart TVs keep sending ACR-like traffic after opt-out; VIDAA exposed 57M recognition results
A study titled "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition" found that Samsung (Tizen) and Vizio (SmartCast) televisions kept sending traffic consistent with automatic content recognition (ACR) after researchers disabled the feature. The researchers ran 5,943 automated experiments on 12 TVs from 10 manufacturers across eight operating systems. Because the connections were encrypted, they could not confirm whether the traffic carried viewing data or whether the manufacturers retained it. Separately, VIDAA transmitted audio fingerprints and persistent device identifiers over unencrypted MQTT, and an unauthenticated server exposed more than 57 million recognition results linked to over one million TVs. The findings apply only to the tested devices and firmware.
Detalhes técnicos
- Method: Network traffic was captured while controlled content was supplied via antenna, HDMI and screen mirroring. Each scenario was repeated 30 times per privacy setting. Residual volumes below 5% of opted-in traffic were excluded when judging whether opt-out worked.
- Samsung Tizen: ACR-like traffic persisted in all 30 opted-out tests with its built-in streaming service, in 41 of 60 antenna runs, 18 of 30 HDMI runs and 6 of 30 Tubi tests.
- Vizio SmartCast: There was no observable reduction in traffic to its identified Amazon Kinesis ACR endpoint after opt-out. The endpoint received traffic in every opted-out run.
- Effective opt-outs: LG webOS, Sony Google TV, VIDAA and Fire TV. Roku's controls did not cover its own streaming service.
- VIDAA: Audio fingerprints and persistent device identifiers were sent over unencrypted MQTT. An unauthenticated server exposed more than 57 million recognition results tied to over one million TVs in a three-hour sampling window. VIDAA later added server authentication, but the transmissions remained unencrypted.
- Vizio WatchFree+: Show or channel information leaked through readable DNS queries and TLS SNI fields tied to Amagi delivery infrastructure, regardless of ACR settings.
Remediação
The article gives no remediation guidance.
Linha do tempo
-
Samsung and Vizio smart TVs keep sending ACR-like traffic after opt-out; VIDAA exposed 57M recognition results
ler a análise desta fonte ocultar
A study titled "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition" found that Samsung (Tizen) and Vizio (SmartCast) televisions kept sending traffic consistent with automatic content recognition (ACR) after researchers disabled the feature. The researchers ran 5,943 automated experiments on 12 TVs from 10 manufacturers across eight operating systems. Because the connections were encrypted, they could not confirm whether the traffic carried viewing data or whether the manufacturers retained it. Separately, VIDAA transmitted audio fingerprints and persistent device identifiers over unencrypted MQTT, and an unauthenticated server exposed more than 57 million recognition results linked to over one million TVs. The findings apply only to the tested devices and firmware.
Technical Details
- Method: Network traffic was captured while controlled content was supplied via antenna, HDMI and screen mirroring. Each scenario was repeated 30 times per privacy setting. Residual volumes below 5% of opted-in traffic were excluded when judging whether opt-out worked.
- Samsung Tizen: ACR-like traffic persisted in all 30 opted-out tests with its built-in streaming service, in 41 of 60 antenna runs, 18 of 30 HDMI runs and 6 of 30 Tubi tests.
- Vizio SmartCast: There was no observable reduction in traffic to its identified Amazon Kinesis ACR endpoint after opt-out. The endpoint received traffic in every opted-out run.
- Effective opt-outs: LG webOS, Sony Google TV, VIDAA and Fire TV. Roku's controls did not cover its own streaming service.
- VIDAA: Audio fingerprints and persistent device identifiers were sent over unencrypted MQTT. An unauthenticated server exposed more than 57 million recognition results tied to over one million TVs in a three-hour sampling window. VIDAA later added server authentication, but the transmissions remained unencrypted.
- Vizio WatchFree+: Show or channel information leaked through readable DNS queries and TLS SNI fields tied to Amagi delivery infrastructure, regardless of ACR settings.
Remediation
The article gives no remediation guidance.