Some smart TVs could be even more vulnerable to ransomware, research shows.

You just want to watch your show. 

But you’re fumbling with the remote and spilling your popcorn as your screen shows only one frozen image—a ransom note.

You’ve got smart TV ransomware.

New research shows some TVs may be even more vulnerable to the hostage-holding malware.

Security researcher Amihai Neiderman said his work shows that some Samsung TVs—and other Samsung devices—using the Tizen operating system have dozens of vulnerabilities that could let the bad guys in.

“This would allow all types of malware to be loaded onto the Samsung TV and ransomware would be one of them,” said Michael Patterson of cybersecurity company Plixer International. “Hackers could literally hold your smart TV for ransom.”

Ransomware has already popped up on smart TVs of various brands in Japan and the U.S.

Now some security experts—and a smart TV ransomware victim—are recommending people buy TVs that are not so smart after all.

Samsung SUHD smart TV. Photo credit: Andri Koolme via Foter.com / CC BY

Samsung

The researcher said he started looking at the Tizen operating system after he bought a Samsung TV last year and found the code to be poor, according to Motherboard.

Samsung sent Archer News a response about Neiderman’s research.

“We are fully committed to cooperating with Mr. Neiderman to mitigate any potential vulnerabilities,” Samsung’s statement said.

“Samsung Electronics takes security and privacy very seriously,” the company said. “We regularly check our systems and if at any time there is a credible potential vulnerability, we act promptly to investigate and resolve the issue. We continually provide software updates to consumers to safeguard their products.”

Samsung’s Gear 2 smartwatch uses the Tizen operating system. Photo credit: pestoverde via Foter.com / CC BY

Big in Japan

Ransomware hit smart TVs in Japan last year, racking up 300 reported cases through July 2016, according to cybersecurity company Trend Micro.

The source? Possibly some bad apps. 

Some people in Japan may skip the big-name app stores like Google and Apple and use third-party stores with shady apps that can freeze your devices, according to Jon Clay, director of global threat communication for Trend Micro.

“They are big users of mobile apps and smart TVs and may utilize third-party stores more than U.S. users,” Clay told Archer News.

“While this is an isolated incident, we do predict that 2017 will bring ransomware attacks to new devices and platforms,” he added.

“FBI” warning

A bad app was also behind a smart TV ransomware case in the U.S. over Christmas.

Darren Cauthon of Olathe, Kansas, said his ex-wife downloaded a legitimate-looking app that claimed it would let her watch movies for free with a free trial.

“It even played a movie for about 45 minutes before the television froze,” the software developer explained to Archer News. “After turning it off and on, the FBI warning appeared.”

The “FBI” notice said the agency found evidence they had been visiting porn sites and had suspicious files, and would have to pay a $500 penalty.

“I knew instantly it was malware,” Cauthon said.

What to do?

“My [ex-]wife thought the TV was a goner, and she’d have to buy a new one,” Cauthon said. “I didn’t like the idea of throwing it away because of hackers.”

He decided re-setting the device would fix the problem, since his LG TV had no crucial data like a laptop would.

But he found no information on how to do it online. 

“I called LG’s tech support, and they said that the TV needed a $340 service call to ‘possibly’ fix the TV,” Cauthon said. “I asked them specifically for the ‘factory reset code.’ I was put on hold for 15 minutes, and they came back to say such a code didn’t exist.”

Not true, he said. After he tweeted about the issue—and the tweet went viral—LG contacted him to say they had found the factory reset code. Problem solved.

“I’m not mad at LG, but I hope they learned their lesson and document this simple procedure,” Cauthon said. “It will fix most TV software problems, and it could keep a customer from potentially trashing a fully-functional television.”

LG

LG did not respond to Archer News’ request for comment about Cauthon’s experience.

In fact, only one smart TV company sent information about what customers can do to avoid ransomware on their TV’s.

Samsung, Sony, TCL, Vizio and LG did not answer the question we put to them.

Panasonic gave these three pieces of advice:

—Correctly set the encryption of your home wireless LAN.

—Please be careful not to browse suspicious sites.

—When the “software update” message comes out on the screen of Panasonic TVs, please apply the updates.

Samsung advertises its Tizen operating system. Photo credit: vernieman via Foter.com / CC BY

You may want to check with your TV maker about a factory reset code so you can be ready if ransomware hits.

If you have a Samsung smart TV or other device, like a watch or refrigerator, you can look to see if it has a Tizen operating system. 

If so, try contacting Samsung for information on what to do next.

What should you do now?

For some, the answer is a TV that is less fancy, less connected, less smart.

“To avoid infecting your television, invest in TVs that don’t have web browser capabilities,” Patterson said.

You may not get a lot of security updates from your smart TV maker, according to Patterson.

“It should be noted that TV manufacturers rarely release software updates unless they want to collect additional information about the end user or possibly to remove functionality from the TV, such as when Samsung removed YouTube,” he said to Archer News.

Short life span

Your smart TV may not last as long as you think, according to Cauthon.

“I think they’re nice and fine, but the life cycle of a television usually goes far beyond the attention span of the software developers,” he said.

That means you may not get technical support like security updates after a while, and some software features may disappear.

An LG smart TV. Photo credit: Sinchen.Lin via Foter.com / CC BY

Cauthon decided to buy “dumb.”

“No Netflix, no internet browsers, no Wi-Fi, etc. It’s just a TV, a big Ultra HD 55-inch TV,” he said. “A great TV that I plug other devices into, and I’m not worried my TV is going to get infected.”

“If those other devices get infected somehow, I can just replace them,” he added. “They’re much cheaper than the television!”

Featured image: Samsung smart TV. Photo credit: Andri Koolme via Foter.com / CC BY