DARPA controlling cars/TV remotes eavesdropping

[Belligerent Savant]

.

Surprising to no one here.

http://jalopnik.com/darpa-hacks-gms-ons ... 1684593523

In a broad-reaching report by 60 Minutes about DARPA and the Internet of Things, the Department of Defense has shown that it can hack General Motors' OnStar system to remote control a last-gen Chevrolet Impala.

DARPA has a budget of around half a billion dollars a year and its Information Innovation Office is headed by Dan Kaufman, who employs a team of researchers that focus on increasing national security through revolutionary projects. One of those projects involves hacking the connected car, and this is what they found:

According to the report, which is scant on technical details, DARPA engineers dialed in through the Impala's OnStar system, transmitted a data packet that confused the internal computers, and then planted a malicious bit of code that allowed it to reprogram control systems on the ECU.

That allowed them to do everything from turn on the windshield wipers to honk the horn, and even controll the throttle and brakes, putting a hapless Lesley Stahl through a line of cones.

The piece from 60 Minutes, which doesn't exactly have the greatest track record when it comes to automotive reporting (and more), is bolstered by a report from the office of Massachusetts Senator Ed Markey. The report, due out tomorrow, supposedly states that all new cars can be hacked and that, according to 60 Minutes, "only two out of 16 car makers can diagnose or respond to an infiltration in real-time."

We're waiting to get our hands on the report from Senator Markey's office and have reached out to DARPA for more details on how the OnStar vulnerability was exploited. GM has yet to respond to a request for comment.

[Belligerent Savant]

.
Had to throw this one in as well; not only eavesdropping but indexing and searching by an "unnamed third party"

http://www.techhive.com/article/2881653 ... tk.rss_all

Shhh! Your smart TV is eavesdropping on you

Samsung’s Smart TV privacy policy is raising new concerns about eavesdropping, though it’s not the first example of unnerving behavior from our televisions.

Some Samsung TVs now include a microphone on the remote control for entering voice commands. As one Reddit user pointed out, Samsung’s privacy policy effectively warns users to watch what they say, as the TV ships off voice data to an unnamed third party—presumably for the purpose of translating the speech to text.

“Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition,” the policy states.

Samsung says it uses “industry-standard security safeguards and practices, including data encryption” to secure users’ personal information, and notes that users can disable voice commands or turn off Wi-Fi connectivity entirely. (See the bottom of this article for the full statement.) Still, that hasn’t stopped the inevitable comparisons to George Orwell’s 1984, suggesting that we’re well on the way to a dystopian future.

Why this matters: It’s worth noting that Samsung only sends voice data when you’re actually telling the TV to do so (for instance, by hitting the microphone button on the remote control), so the comparisons to Orwell’s omnipresent recording boxes are a bit overblown. Still, Samsung’s policy of shipping the data off to a third party with no guarantees of its privacy is unsettling, especially given the government’s interest in the connected home as a potential trove of personal data.

On a broader level, Samsung is contributing to the idea that smart TVs (and for that matter, all connected home devices) are not to be trusted.

Concerns over the safety of smart TVs date back to at least 2012, when hackers demonstrated the ability to take over televisions with built-in cameras and microphones. But more recently, the real disturbing behavior has come from TV makers themselves.

[Belligerent Savant]

.

http://www.cnet.com/au/news/samsung-cha ... ing-fears/

Samsung changes Smart TV privacy policy in wake of spying fears
Technically Incorrect: Samsung says that it wants to make clearer what really happens when its Smart TVs capture your voice at home.

Should you have a Samsung Smart TV, you may have been practicing sign language or deep whispering whenever someone was using its voice recognition feature.

After all, last week the company's privacy policy was revealed to read, in part: "Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition."

The wording suggested troubling possibilities. Now Samsung has decided to change its privacy policy to, the company told me, "better explain what actually occurs."

In a blog post titled "Samsung Smart TVs Do Not Monitor Living Room Conversations," Samsung said that its Smart TVs have two microphones. One is inside the TV set. The other sits inside your remote.

The one in the TV responds to voice commands that are predetermined. The remote microphone, which you can use to find a particular program or type of program "works like most any other voice recognition service available on other products including smartphones and tablets."

But what of the most contentious part of the privacy policy? What of the recording and transmitting of your living-room chatter? What of your personal or other sensitive information?

Samsung has clarified -- and lengthened -- this particular aspect of its privacy policy. It now reads:

If you enable Voice Recognition, you can interact with your Smart TV using your voice. To provide you the Voice Recognition feature, some interactive voice commands may be transmitted (along with information about your device, including device identifiers) to a third-party service provider (currently, Nuance Communications, Inc.) that converts your interactive voice commands to text and to the extent necessary to provide the Voice Recognition features to you. In addition, Samsung may collect and your device may capture voice commands and associated texts so that we can provide you with Voice Recognition features and evaluate and improve the features. Samsung will collect your interactive voice commands only when you make a specific search request to the Smart TV by clicking the activation button either on the remote control or on your screen and speaking into the microphone on the remote control.

Samsung also makes it clear that voice recognition can be disabled, leaving you still with the power to use certain predetermined voice commands. Voice recognition data collection can also be disabled, but then certain features will be disabled with it.

Samsung insists that it uses industry standard encryption to secure the data. The updated privacy wording was, of course, written by lawyers. So it should be held with an outstretched arm in just two fingers for examination.

What remains unclear is whether the microphones can, indeed, capture background living-room conversations. The wording about "personal or other sensitive information" seems to have been removed. But what does this mean? Although Samsung's blog post insists that the software doesn't "monitor" living-room conversation, the question remains whether it does still record it, however inadvertently.

I therefore asked Samsung to explain further and will update, should I hear.

Any digital device with a microphone will surely be able to listen in to anything that's said when the microphone is on.

The drift toward voice recognition and activation is one that people supposedly crave. It's not as if Samsung Smart TVs are alone in providing such a feature. Cars and phones have voice recognition. So does your Xbox One. I contacted both Philips and LG two days ago to ask what their specific smart-TV privacy policies are, but both companies have been worryingly quiet on the subject.

At the heart of your interaction with all these devices is trust.

When it comes to its voice assistant service, for example, Google creates random identifiers to block its servers from knowing that it's you making the voice request.

However professional Nuance Communications is (and it works with many companies such as LG and Panasonic to, for example, turn speech into text), there is always going to be a little doubt. There's certainly a question as to what happens once Samsung has passed your data to Nuance.

Nuance's privacy policy says, for example: "By using Nuance products and services, you acknowledge, consent and agree that Nuance may collect, process, and use the information that you provide to us and that such information shall only be used by Nuance or third parties acting under the direction of Nuance, pursuant to confidentiality agreements, to develop, tune, enhance, and improve Nuance services and products." Further in the privacy policy is a reference to data use for "advertising and marketing."

I have contacted Nuance to ask whether it feels able to pass voice data information -- in whatever form -- obtained via Samsung Smart TVs to third parties. I will update, should I hear.