Modern smart TVs often communicate with their remote controls (including
those smart phone simulated ones) using multiple wireless channels (e.g.,
Infrared, Bluetooth, and Wi-Fi). However, this multi-channel remote control
communication introduces a new attack surface. An inherent security flaw is
that remote controls of most smart TVs are designed to work in a benign
environment rather than an adversarial one, and thus wireless communications
between a smart TV and its remote controls are not strongly protected.
Attackers could leverage such flaw to abuse the remote control communication
and compromise smart TV systems. In this paper, we propose EvilScreen, a novel
attack that exploits ill-protected remote control communications to access
protected resources of a smart TV or even control the screen. EvilScreen
exploits a multi-channel remote control mimicry vulnerability present in today
smart TVs. Unlike other attacks, which compromise the TV system by exploiting
code vulnerabilities or malicious third-party apps, EvilScreen directly reuses
commands of different remote controls, combines them together to circumvent
deployed authentication and isolation policies, and finally accesses or
controls TV resources remotely. We evaluated eight mainstream smart TVs and
found that they are all vulnerable to EvilScreen attacks, including a Samsung
product adopting the ISO/IEC security specification.
Lup Yuen Lee 李立源
All GNU social JP content and data are available under the