TCL's Android TVs Are Reported to Contain a Flaw That Allows Rewriting Files
The security researcher that goes by the handle Sick Codes conducted an investigation together with two of his colleagues working in info-security and came up with some unpleasant findings. The trio of security analysis discovered that TCL Android televisions had a significant security flaw in them.
The investigation took place over the course of three months and resulted in finding major security issues with the manufacturer's smart TV sets. The loophole allowed bad actors to access the television set's file system over Wi-Fi, abusing an undocumented TCP/IP port.
The extent of access this allowed included scraping any information from the device's file system, deleting files from the device and overwriting existing files without any sort of credentials needed.
Further investigation into the issue conducted by the three researchers showed that an app called "Terminal Manager Remote" provided by the manufacturer was actually acting as a backdoor. This led the researchers to the conclusion that the issue was not an oversight but was a deliberate choice, allowing the manufacturer to access any unit and make changes to its software and files.
To prove their point, Sick Codes and his colleagues provided evidence that they were able to access an arbitrary TV set located in Africa. Once they got in, they were able to do anything they wanted with the TV set's file system, as long as the user kept the TV turned on. Additionally, research showed that Roku-based units of the same TCL product line were not affected by this security flaw.
Failing to get a meaningful response from TCL, Sick Codes took the issue to the United States CERT. CERT gave them the green light to publicly disclose the issue if no adequate response comes through from TCL.
A short while later, TCL issued an official statement that it was made aware of the issue and was "working on a fix".
Similar incidents only work to underline how easy it is to allow unwanted guests in your house by purchasing internet-enabled technology. Convenience is always a big factor when people consider buying a fancy new gadget for their home but how secure those new gadgets are is often impossible to gauge, especially for the regular user. That is why doing sufficient research on any fancy new technology you decide to buy is always a good idea.
