With the recent news that LG tvs are exfiltrating data to any available wifi network it can find (regardless of whether or not you own it, and regardless of if you’ve told the TV to stay offline), I want to use wireshark to see if I can see what data my TV is collecting from me.
Doing this requires a wifi card being able to go in to “monitor mode”, which (today), i’ve learned not all wifi cards can do (I’m using my desktop PC for this testing today tho).
So my question to the community,
is anyone using their wifi card in monitor mode with their frameworks? if so, which wifi card did you get?
The problem with trying to monitor closed-source firmware is that there’s only a limited amount of data you can collect. You can probably fish out what DNS requests it makes (unless it uses DNS over HTTPS). You can definitely obtain what IP addresses it makes contact with. However it is probably going to be using encryption for the exfiltration, so you’re unlikely to be able to slurp the content.
You might be able to block the TLS port to see if it falls back to unencrypted fetches, but I doubt they’d make such a basic error in their implementation.
I’d probably start with researching prior art on this - e.g. Reddit and YouTube. Someone will already have done some legwork on the topic.
I work in cybersecurity. I saw few words that you used which tells me that you just don’t want to do this and you’ll get in way over your head. Just assume the TV spies on you. Straight from the book 1984.
For testing these sorts of things. I use a different network layout.
Normal internet use:
Internet → ISP Router/AP → local network → TV.
To set this sort of thing:
Internet → ISP Router (with WIFI switched off) → local DMZ → local AP that has Wifi and tcpdump/wireshark capabilities. → local network → TV
So, all the traffic sniffing is done on the local AP and not the ISP router.
But that being said, the best approach to find out if the TV is exfiltrating, is to reverse engineering the TV firmware.
I’m a professional programmer, and have worked in and adjacent to cybersecurity for many years, so nothing really scares me / makes me feel like I’m in way over my head.
The only thing I ever feel like is “eh, not worth the effort, need to find a different way to solve my problem”
Aight. So I’ll just tell you this: just by trying to do the steps (or whatever, didn’t watch the video), you would’ve figured it out already and learned new things instead of waiting for the response here. Generally learn-by-doing has worked better for me in my career than have-everything-on-the-plate.
If you want to run kali, I will assume that you will need to boot from USB instead of VM, as VM will probably have no privileges to modify the state of wifi card.
In any case, everything’s going to be encrypted, wireshark will just see gibberish. It will also probably have SSL pinning, which is not easy to bypass.
You could also just use your PC as a bridge by connecting TV to your PC over ethernet and you would probably see the same stuff.
