When Gamers Nexus and Level1Techs published 216,000,000 Spy TVs: The LG Smart TV Problem on 6 September 2026, most coverage filed it under privacy: your television listens. That headline is true, and it is also the least interesting part. Read the investigation the way a practitioner reads any write-up, and it stops being a story about one manufacturer. It becomes a clean, end-to-end case study of the modern IoT attack surface, with all three layers on display at once: the sensor, the firmware and the network.

SpySat covered the privacy and consent side of this after the video dropped - Your LG TV Was Listening All Along - but here I want to stay in the practitioner lane. What did the investigation actually demonstrate, technically, and what should a security engineer take from it.

A Television Is Three Systems in One Panel

Every smart TV you will ever test is really three separate systems shipped as one object:

  • A sensor package - microphone, a camera on some models, and the content-recognition pipeline.
  • An embedded Linux firmware stack - webOS on LG, Tizen on Samsung, Android TV elsewhere - with apps, network daemons and an update path.
  • A networked endpoint with a persistent connection, local discovery chatter and cloud telemetry.

Each layer is a different discipline. Each layer failed, in its own way, in the same product. That is what makes this worth studying.

Layer One: The Sensor

The television is not off when it is off. Pressing power puts the set into standby, a state that keeps the network alive, keeps background processes running and, per the researchers, keeps microphone access alive so the set can answer instantly. Audio captured in standby was buffered locally and uploaded once connectivity returned; some of the captured material was stored as plaintext transcripts, unencrypted at rest. LG disputes this: it says standby listening is limited to the wake word, processed locally and discarded unless the wake word is detected.

One honest caveat, and it matters: the strongest on-camera audio demonstrations were performed on a compromised device, using remote code execution flaws in webOS that were reported to LG and are still moving through disclosure. That proves two distinct things. The hardware is capable of covert recording, and the platform shipped with holes wide enough to trigger it. It does not prove that an untouched, stock LG set streams your living room by default. It does not make anyone feel better about the microphone either.

The second sensor needs no caveat, because LG confirmed the behaviour: Automatic Content Recognition (LG brands it Live Plus). ACR fingerprints what is on screen and matches it against a database to identify the show, movie or advert, and it runs across linear TV, native apps and external inputs, so plugging in a console does not opt you out. On-device it works by generating lightweight perceptual hashes of the audio stream rather than capturing screenshots, which keeps the CPU and bandwidth cost low. Those hashes are then uploaded, typically in batched telemetry, over TLS to LG Ad Solutions, where they are matched in real time against reference catalogues of broadcasts and ad campaigns.

A 2024 study published at the ACM Internet Measurement Conference, Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs, measured sampling rates per brand. LG sampled roughly every 10 milliseconds. Samsung sampled every 500. The authors - Gianluca Anselmi and Anna Maria Mandalari (UCL), Yash Vekaria, Alexander D'Souza and Zubair Shafiq (UC Davis), and Patricia Callejo (UC3M) - found ACR tracking running across every major brand. An order-of-magnitude difference in how closely a device watches the room is a design decision, not an accident.

Layer Two: The Firmware

webOS is an embedded Linux stack with a browser engine, app runtime, media pipeline and a set of network services. That is a large attack surface in a device that most people never patch on purpose and never monitor at all.

What the researchers demonstrated, per the disclosure write-up, was a local pre-authentication root chain: abusing the ThinQ pairing service on port 3001 (manifest replay from a built-in app to bypass PIN authorisation), a bridge/SSRF primitive in the webOS cmp-client service, and finally command injection into the root logging daemon pmlogd through its log-collection path. Chained, that is unauthenticated local code execution as root. No public CVE had been assigned to that 2026 chain at the time of writing; it moved through coordinated disclosure. For historical context on webOS root bugs, the 2023 batch ran across CVE-2023-6317 through CVE-2023-6320. The tests were run on retail 2025-2026 OLED sets (notably the G5 series, Alpha-class SoCs) and a couple of budget models on webOS 7.5.x, and LG shipped fixes in subsequent firmware updates.

The interesting part for anyone who works in binary exploitation and firmware analysis is not that the RCEs exist. It is the shape of the surface: an internet-connected appliance with privileged local services, a signed-update model that has to be trusted by design, and an incentives problem where security updates are a cost centre on a product sold at thin margin. The exploitation is the headline; the analysis pipeline behind it is the reproducible part:

binwalk -e firmware.img      # extract the root filesystem
nmap -sV -p- <tv-ip>         # map what is actually exposed
grep -R "pmlogd\|ThinQ" ./squashfs-root/usr  # find the interesting services

Pull the image apart, map the running services, check how the update path is signed and what trusts what, then diff firmware versions before and after a patch to see what really changed. That is the part a practitioner can reuse this week on any device in their own rack.

Layer Three: The Network

This is the finding that needs no exploitation at all, and the one most security teams underrate. The TVs scan the local network. They enumerate the devices around them - phones, smartwatches, printers, routers, thermostats, computers - including devices that were never paired to the television and whose owners had no idea a TV was even being tested in the building. Alongside the inventory they collected IP addresses, geographic location hints, and the names, signal strength and channel numbers of nearby Wi-Fi networks.

Under the hood this is ordinary discovery: SSDP (UPnP over UDP 1900), mDNS (UDP 5353), ARP sweeps, DHCP/UPnP discovery and DIAL. Nothing exotic. The collected fields are the mundane ones, which is exactly the point: local IPv4/IPv6 addresses, MAC addresses and vendor OUIs, advertised hostnames and friendly names, UPnP/mDNS device UUIDs, manufacturer and model strings, and the SSIDs, BSSIDs and RSSI signal strengths of nearby Wi-Fi networks. What makes it notable is the aggregation. A device that inventories your phones, guesses your location from nearby SSIDs and correlates all of it with viewing data is not a television that happens to be online. It is a sensor with a screen attached.

There is a neat way to think about this. Browser fingerprinting asks what a web page can learn about your browser. This is the same idea, moved one layer down: what a device on your LAN can learn about your network. I built a small tool to make browser fingerprinting tangible - the Digital Footprint Scanner shows everything a website can legitimately collect from your browser. The network enumeration in this investigation is its LAN-level cousin, and it collects more, because a device inside your perimeter does not need permission from a consent banner.

The supply chain makes it worse. A June 2026 analysis by Spur unpacked 6,038 apps across the LG webOS and Samsung Tizen stores and found 2,058 of them, roughly a third, shipping residential-proxy SDKs that quietly route strangers' traffic through your home connection. Installing a weather app should not turn your television into an exit node for someone else's botnet traffic, and Krebs covered the fallout after LG moved to ban residential proxies from its app store.

Recon From the Other Side

If you want to understand this class of device, test one. The methodology is the same one you would use for any wireless or IoT target, and it is worth building as a lab:

# what it advertises
sudo nmap -sU -p 1900 --script upnp-info <tv-ip>
avahi-browse -a -t -r                                   # mDNS services

# what it probes and where it phones home
sudo tcpdump -i eth0 -n 'udp port 1900 or udp port 5353 or arp'
tcpdump -i eth0 -n host <tv-ip> -w standby.pcap         # capture standby traffic
  • Put the TV on an isolated VLAN with no route to anything you care about.
  • Capture standby traffic and watch where it actually goes: DNS, SNI, and the endpoints it beacons to when nobody is watching.
  • Watch what it probes on the LAN: multicast discovery, ARP sweeps, what it advertises about itself.
  • Firmware-diff across an update and verify that the toggles in settings actually control what they claim to.
  • Treat the whole exercise like an Evil Twin lab: own the hardware, own the network, document everything, and never point it at infrastructure you do not control.

You learn more from one weekend of packet capture than from a dozen privacy policy changes.

It Was Never Only LG

File this under a pattern, not a manufacturer.

In December 2022, MIT Technology Review reported that development iRobot Roomba units had sent camera footage to a data-labelling firm, where contract workers reviewed images including one of a woman on a toilet. The vacuum did not leak because it was hacked; it worked as built. At DEF CON 32 in 2024, researchers Dennis Giese and Braelynn Luedtke demonstrated weak Bluetooth authentication and a four-digit PIN in Ecovacs robots, and real attackers used those holes to seize vacuums in multiple cities, driving them, watching through their cameras and speaking through their speakers. In February 2017 the FTC fined Vizio 2.2 million dollars for pushing content-recognition firmware to 11 million televisions without meaningful consent. In 2013 the researcher DoctorBeet found LG televisions transmitting viewing habits and unencrypted USB file names to LG servers even with the relevant setting switched off.

None of this is a hack. It is the product working as designed, over and over, across brands.

The Consent Problem Is a Security Problem

Under GDPR, microphone audio, viewing fingerprints, network identifiers and device inventories are personal data. Processing them needs a lawful basis, normally consent that is freely given, specific, informed and unambiguous. Article 5 demands data minimisation, Article 25 protection by design, Article 32 appropriate security. Bundled agreements, pre-ticked boxes and a wall of legal text navigated by remote control are not accidents of design; Germany's Bundeskartellamt said as much in its 2020 smart TV sector inquiry. In December 2025 the Texas Attorney General sued Samsung, LG, Sony, Hisense and TCL over content-recognition data collection without affirmative consent. Samsung settled first, in February 2026, and LG followed on 11 May 2026, agreeing to clearer consent screens, simpler opt-outs and limits on onward data transfer. On the set the researchers tested, the "Do Not Sell My Personal Information" toggle was off by default and stayed off until the device had already been online.

For a security practitioner the takeaway is blunt: the telemetry channel and the update channel are part of your attack surface, and a consent model that is designed to be ignored is also a trust model that cannot be relied on. You cannot secure what you cannot see, and you cannot see what the vendor is deliberately obscuring.

What to Actually Do

This is unglamorous, and it works.

  • Opt out by real names, not a generic privacy menu. On LG that means Live Plus, Far Field voice recognition and interest-based advertising. Re-check the toggles after every firmware update.
  • Treat off and standby as different states. If the set sits where private conversations happen, unplug it at the wall. It is the one intervention the demonstration could not route around.
  • Segment. Put IoT and smart devices on a guest or dedicated VLAN with egress filtering, so an enumeration sweep cannot reach the rest of your network and a rogue proxy SDK cannot quietly relay traffic.
  • Trust the port, not the panel. A good display with no internet connection plus a cheap, replaceable streaming stick keeps the screen and fires the computer inside it.
  • Patch, and monitor egress. The RCEs are real, and a patch is the difference between a microphone with a lock and one without. Egress monitoring is how you notice when a device starts talking to someone new.

Takeaway

The scandal was never that a screen can hear. It is that the capability and the shipped vulnerabilities coexisted for years while the question was waved away as paranoia. A smart TV is a general-purpose computer with sensors, a persistent network connection and an advertising business model attached to it, and the same three-layer model - sensor, firmware, network - applies to your vacuum, your speaker, your watch and increasingly your car. The living room did not stop being a room. It became a network with a sofa in it. Treat everything in it as an untrusted endpoint, and the boring question keeps turning out to have been the right one.

Build one lab. Capture the packets. The rest is just reading.