2

This webpage will exploit your LG webOS smart TV, gain local root privileges, and install the webOS Homebrew Channel.

rootmy.tv

I really hate the constant ad breaks on YouTube and have rooted my LG TV to install an alternative YouTube client (with adblocker).

However, this RootMyTV blocks updates from the manufacturer. What security risks do I run?

In this forum you can find a lot about security and rooting Android mobile, but a TV has a limited functionality. How are the security risks of rooting TV different from Android mobile?

1
  • 1
    Rooting any device adds security risk: anyone who exploits the device and gets unprivileged access will have a much easier time getting root than they otherwise would (privilege escalation). My advice for any "Smart" (aka Spy) device: Just assume its backdoored and monitored as you get it from the factory, then nobody can ever get anything of real value if they compromise it. Feb 11, 2022 at 16:22

1 Answer 1

4

but a TV has a limited functionality.

A SmartTV is not so much different from a normal computer or smartphone. The limits of the TV are mostly based on the software and on the hardware. Especially it can behave much differently with a modified software.

A rooted TV might have different functionality than intended by the vendor. And a compromised TV usually has different functionality than intended by the owner of the device. In both cases it is still the same device, only with different software and no longer limited by what the vendor intended.

I recommend that you view a SmartTV as a potentially vulnerable device, which is both connected to the internet and your local network. Internet access might lead to internet triggered exploits, which then can lead to a system compromise. Then you have a compromised system in your own network which might help the attacker to propagate to other systems in your own network.

Even if you strictly separate the SmartTV from your local network it will still have access to the internet and might be used as part of botnets to attack other systems - see for example New Mirai Botnet Variant Targets IoT TV, Presentation Systems. And if the TV has microphone and/or camera inside it might be used to spy on you.

So the only safe way to operate such a system would be to disconnect it from both the local network and the internet. Unfortunately this would make it kind of useless for typical use cases. Less harsh would be limited connectivity, i.e. restricted to only the necessary sites. This will decrease the attack surface and also the misuse which can be done if the device gets compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .