A couple weeks ago I made a Plex app for our Samsung TV and called it samsucks. It was a joke about how slow the official Plex app is on Samsung TVs. It takes a minute just to open. Last week I learned slow isn’t the worst thing about these Samsung TVs….
Your TV is listening
Last week a reverse engineer who goes by log4j (same name as the Java library behind the Log4Shell vulnerability – I was responsible for patching Tumblr.com from this one at the time, fun!) got a root shell on his 2025 Samsung TV and started posting what he found:
He says if your TV doesn’t have a microphone, it uses one on something connected to it, like your soundbar or a Bluetooth device. I couldn’t find anything from Samsung that backs that part up, so I’d wait for his write up on that one.
Then he kept digging:
Samsung advertises this part. Its 2025 TVs have features called Pet Care and Family Care that “use on-device AI to detect a dog barking or a baby crying” The fine print says it “only works when the TV is turned off.” So the TV listens to your house when you think it’s off.
What log4j found is the other half. The code keeps counts of those dog barking and baby crying events, along with which sensors you have turned on and how long a camera streamed, and packages them up as telemetry for a Samsung logging server. On Friday his notes said he hadn’t confirmed it was actually being sent. Sunday night he posted that he’s now capturing the telemetry the TV sends Samsung in plaintext, using what he says is a packet logger Samsung built into the TV.
A company knows when your baby cries
A TV company built a counter for how often a baby cries in your house. That tells them you have a baby, roughly how old it is, when it’s awake and when you’re home. None of that has anything to do with watching TV.
To be fair, his full write up still isn’t out (on Friday he said it was a few days away), it hasn’t been independently confirmed, and Samsung hasn’t commented, even though TechRadar and Decrypt both asked. TechRadar thinks it’s overblown, since Samsung advertised these features. It also reports that Samsung is dropping baby cry detection because not enough people used it and it kept going off when babies cried on TV. I couldn’t find Samsung’s own announcement of that. But Samsung is the one telling you the TV listens for your kid, and that alone is crazy IMO.
It’s watching, too
The other Samsung post that blew up last week came from Jake Stevens, who used Codex to root his TV and turn the tracking off:
The screenshot part is true, and Samsung says so itself. It’s called automatic content recognition (ACR). A Samsung Ads guide for advertisers says it “takes glass-level screenshots every 500 milliseconds” on TVs that opted in, turns them into fingerprints and matches them against a library of shows and ads. That’s twice a second. A 2024 study found it working over HDMI too, so it sees whatever you plug in.
In the TV’s settings this is called “Viewing Information Services,” and turning it off is supposed to stop it. Researchers at Northeastern published a study last week that says it doesn’t, at least not completely. After they opted out on a Samsung TV, traffic consistent with ACR kept going in 41 of 60 antenna tests and 18 of 30 HDMI tests. It’s encrypted, so they couldn’t see what was in it, and Samsung hasn’t told Ars Technica why it’s still happening.
The rest of his list is shakier, and his own repo says so. Its privacy notes say a Bixby wake word detector isn’t evidence that the TV is recording your house, and that nothing he found showed it was.
Everybody’s worried about Flock
Everybody’s worried about Flock cameras right now, and they should be. They’re license plate readers that police departments, neighborhood associations and property owners put up all over the place, and they log every car that drives past. At DEF CON this year I sat in on a talk from EFF and Colonel Panic about cheap ESP32 boards built to fight back against this stuff, including mapping where the Flock cameras are. In another talk, a researcher who bought Flock hardware on eBay found 51+ vulnerabilities and 63 live camera feeds sitting on the internet with no password…
Those cameras are on poles outside. This is in your living room, where your kids play.
People have spent years arguing about whether our phones are secretly listening to us “I talked about mattresses now I get mattress ads!” Turns out your TV was listening to you the whole time.
What you can do
The TV I built the Samsung app for is a 2022 model. Samsung only lists a microphone in its remote, I don’t use Samsung’s remote, and Pet Care and Family Care are only on newer, more expensive models anyway. As far as I can tell it has nothing to hear us with. It can still watch, though, and I’m not giving it the benefit of the doubt:
- Turn off “Viewing Information Services” in the TV’s settings. Northeastern’s results say it doesn’t fully stop the tracking, but it’s the setting Samsung gives you.
- Turn off voice features you don’t use, and the sound sensor in the SmartThings app if your TV has one.
- Don’t sign the TV into a Samsung account or SmartThings if you don’t need to. The baby and dog features need both.
- Block Samsung’s tracking servers on your router or Pi-hole. The Northeastern researchers published a blocklist that covers Samsung’s ACR servers, and blocking them didn’t break anything in their tests. The logging server in log4j’s screenshot,
lcprd1.samsungcloudsolution.net, is already on public smart TV blocklists. - If you want to be really sure, take the TV off the internet and use a streaming box instead. That’s what the Northeastern researchers recommend too.
- If you want to really do the best thing, don’t use a Samsung TV.
(samsucks only talks to Plex, so it keeps working with Samsung’s servers blocked 👍)
Leave a Reply