EvilScreen Attack: Smart TV Hijacking via Multi-channel Remote Control Mimicry

Abstract

Modern smart TVs often communicate with their remote controls (including those smart phone simulated ones) using multiple wireless channels (e.g., Infrared, Bluetooth, and Wi-Fi). However, this multi-channel remote control communication introduces a new attack surface. An inherent security flaw is that remote controls of most smart TVs are designed to work in a benign environment rather than an adversarial one, and thus wireless communications between a smart TV and its remote controls are not strongly protected. Attackers could leverage such flaw to abuse the remote control communication and compromise smart TV systems. In this paper, we propose EVILSCREEN, a novel attack that exploits ill-protected remote control communications to access protected resources of a smart TV or even control the screen. EVILSCREEN exploits a multi-channel remote control mimicry vulnerability present in today smart TVs. Unlike other attacks, which compromise the TV system by exploiting code vulnerabilities or malicious third-party apps, EVILSCREEN directly reuses commands of different remote controls, combines them together to circumvent deployed authentication and isolation policies, and finally accesses or controls TV resources remotely. We evaluated eight mainstream smart TVs and found that they are all vulnerable to EVILSCREEN attacks, including a Samsung product adopting the ISO/IEC security specification.

Acoustic Keystroke Leakage on Smart Televisions

“…However, this attack only works for IR remotes. Newer remotes communicate over Bluetooth [35], [69], and HomeSpy does not succeed on Bluetooth remotes. In contrast, the audio attack is agnostic to the remote control communication protocol.…”

“…Third, and finally, HomeSpy steals user keystrokes by sniffing unencrypted infrared signals between Smart TVs and their remotes [21]. However, many Smart TVs support remotes that communicate over Bluetooth [35], [69], and HomeSpy cannot view such signals. Our attack works with any communication medium employed by the remote controller.…”

“…SPOOK gains root access to Smart TVs through a weakness when pairing virtual remotes [35]. EvilScreen compromises Smart TVs using issues supporting multiple communication protocols [69]. Other work exploits software vulnerabilities to control Smart TVs [1], [40].…”

“…Unlike their traditional counterparts, Smart TVs allow users to browse the Web, access video streaming applications (e.g., Hulu), and purchase products. This increased functionality brings about new security risks [1], [21], [35], [40], [42], [69].…”

“…Second, HomeSpy sniffs unencrypted infrared (IR) signals between Smart TVs and their remote controllers, enabling keystroke recovery [21]. Recent Smart TVs, however, have remotes that do not use IR [35], [69], and the HomeSpy attack does not succeed on such devices. Our acoustic attack is agnostic to the TV remote's communication medium.…”