i understand how smart TV can be a problem. But monitors too?
They’ll install the spyware via your hdmi / display port or what?
This was already answered multiple times in the comments when you posted this. And also in the article. Are you running in write-only mode?
This is because as soon as a monitor is connected to a Windows computer, it automatically installs both the LG Monitor App Installer and McAfee Scam Detector without ever asking the user for permission.
Is this not a felony under U.S. law? Computer hacking has HUGE criminal liability.
Name something you do as a corporation to avoid any laws or accountability with the current administration
BRIBE THE DOJ
let’s see if that answer’s on the board…survey says…!
DING
It’s actually windows doing it
Another win for Linux
The more I learn about windows the more I wish I would’ve ditched it a long time ago instead of last month…
It probably says somewhere in the ToS, which is still a fucking disgrace that those exists, without having to make clear and obvious bullet points you click “consent”.
Even having to make consent multiple times should be mandatory for every shit they try to do.
Solution if users shouldnt hit consent multiple times? Dont do shady shit.
Just a reminder that terms of service or any other contract never override law
I can’t remember the specifics right now, but in Gamers Nexus video from yesterday, according to LG ToS you must disclose something regarding spying and wiretapping laws to your family and anyone visiting your house
Literally insane that you can even put that in an agreement to being with.
I have a plan: we pass a law that any contract intended for the public (ToS, various other terms and conditions, privacy policies, etc) must be at the average reading level of the American public. We’ll either incentivize better education or better contracts. Maybe both!
Doesnt matter if it’s in kindergarten level reading, as long as it’s a few paragraphs long, people will accept it.
Or standardize agreements that can be agreed to with just clicks so you can tell what’s up from just seeing which agreement modules are included and what parameters they have (along with a bunch of sites that explain them in easier terms for the less literate, which will be useful because they are standards used by many agreements rather than needing a unique one for each version of each document).
Apparently it’s windows doing it. Not the monitor via the HDMI or something. I guess that’s what you get for using windows.
Yep. Windows installs manufacturer “helper” apps automatically like drivers. Got a Logitech mouse? You probably have a Logitech app in there you never asked for too because you plugged it in.
Stop using windows.
I don’t use windows
I think that was more of a PSA for other people reading along.
Stop using Windows.
lol jk. I’m glad that we here all ditched Windows. amirite or amirite?..
Than this won’t affect you
I had to go and find the Logitech app and install it myself. Otherwise it just used the minimal drivers that were built into windows.
Maybe wired mice and those without rainbow barf behave differently.
I’ve got a corsair rainbow barfer and I also had to install its control program manually. Mileage probably varies by manufacturer, most likely.
Soon-to-be-illegal-tooltip: openRGB is a thing.
OOOH! Can we manually add entries for unwanted software to windows defender?
Also, implied consent is not consent, and if there is no consent, the entire contract is unenforceable and therefore void.
Let me guess, proprietary drivers cause this and the open source or generic drivers lack “functionality”.
If it turns on, reaches its peek resolution and refresh rate that is good enough for me, I genuinely can care less for HDR or the nitty gritty features.
Monitors don’t need drivers. Your GPU needs drivers, and you might need color correction for your monitor.
Microslop decided that any device that is plugged in might need drivers. They allow device manufacturers to specify an arbitrary program to be downloaded and executed by Windows Update, any time a device they make is plugged in.
And if that driver/software does evil or is so poorly written it meets driver verification but exposes vulnerabilities, how is that Microsoft’s fault
Microsoft is the company that approved the software to automatically download and run as admin when a specific device is plugged in. The OEM submitted malware and Microsoft approved it. Both are at fault for letting malware download and run on your device.
In the case of vulnerabilities, MS is fully aware of this happening frequently and has announced they want to do something about it, but hasn’t actually done anything about it.
Old monitors need it for absolutely nothing, like my 2020 LG. Every feature works out of the box, because it has to over display cables.
I think at most it adds an ICC profile, but it’s not matched to the panel anyway and you can just install that seperately.
No, no no. That’s only if you do it. If a huge corporation does it, see, that’s different. Corporations are “people” for the purposes of free speech (with money) or even voting (example), but when it comes time to throw somebody in jail for overtly criminal behavior, all of the sudden the legal system can’t find anyone to target.
Ironic
Bought a LG TV and a Monitor three years ago. Last time I will do that. Really happy about my decision not to let the TV have access to the internet.
deleted by creator
Good luck finding a brand NOT doing it by the time you’re ready for a new one.
A lot of bad ones out there, but some are worse than others. For example, I’m not going to consider a Samsung TV because of how many times they’ve done something sketchy
LG is also falling down the list with this incident
Yeah fist time I saw an ad on my smart monitor I reset it and never connected it to my wifi again
What’s the point of a smart monitor? It’s connected to a PC. The PC is smart.
I’d love to know who wants all that extra crap
About 90% of Society. If you told my mom she was going to have to plug in a device and use another button on her remote (input) she’d look at you like you were asking her to replace a CPU on a computer. Can I do that? Yeah, I can but it’s delicate work fraught with danger.
Yep, mine has never reached the internet, it is connected but is blocked at the firewall so I can still hook home assistant up to it.
deleted by creator
I was responding to his TV mention.
Not only that but my old LG smart TV (47LM8600, I think manufactured in 2012) has literal suicide timers in its built in apps. Mine has never been connected to any network and yet it mysteriously informed me after approximately three years of ownership that all of its player apps such as Youtube, Hulu, Netflix, etc. would stop working because they were “no longer supported,” all of them within the time frame of the same couple of weeks. It knew this somehow, apparently via magic, or quantum fluctuations, or psychic brain waves. Without internet connectivity.
Obviously I don’t use any of those features so I didn’t give a rat’s ass and I still don’t. But I still find that deeply suspicious.
The only technical explanation that’s not malice would be that some certificate store on the device had expiring certificates and would need an update to continue to function (or rather connect to remote servers).
Are there ever certs that expire in 3 years?
Yes. Certs can expire after whatever time the issuer wants to set for them. That could be six months or 20 years. Some infrastructure has limits on max and min lengths (more max than min usually) but not all and there are best practices as well.
More importantly the certs could have been five years old by the time this person got the TV for a total age of 8 years.
It depends on their use. The most common certificates that you will “use and check” (implicitly) all the time are probably those, that get served by websites and the APIs that apps talk to. Those are usually quite short lived. Let’s Encrypt IIRC issues them with a default life time of ~90 days and there’s a push industry wide to reduce their lifespan generally to… IIRC something around 40 days. But there are more usecases and certificates and those may be valid longer. E.g. a developer that signs their code/compiled binaries.
Or - and thats more relevant - when you check a certificate you do not only check it’s content, you also check that it was issued and signed by someone “you” trust (or rather the software on your device trusts). Ususally there’s a central store on your PC managed by Microsoft (for Win), Apple (for Mac) or your Linux Distribution with a list of certificates that your device trusts. Those are usually quite long lived (often several years, probably even more than a decade). But will also end. And there will be new ones to replace the old ones. Or new vendors that get added to this trust store. If you do not update your device, this trust store won’t change.
There are now several versions how this can affect the apps in this case, e.g.
- They might not be able to talk to servers using “newer” certificates, as they cannot validate them. There might even be the problem, that the update mechanism breaks, as it wouldn’t be able to get updates from the server to get new certs effectively locking you out.
- They might only allow apps that are signed by them, but their old cert is running out and if it’s invalid, they might prevent the apps from running (as their cert is now untrusted) - note that you can provide ways around that (e.g. checking if the cert was valid when it was issued vs. checking if it would be valid now), but for a device that’s designed to be able to get updates, you might have forgotten that or didn’t think it was an issue or…
Planned obsolescence is one of those things that just infuriates me so much about capitalism.
Need to fill the landfills.
Luckily for me at least, like so many of us dweebs here, I drive my TV with a little media center PC anyway. So I couldn’t care less which of their services they disable. The more the merrier, as far as I’m concerned. The real annoying part is that these don’t work (presumably), but you still can’t remove the icons from the thing’s home screen.
Same. My TV is a second monitor and really only gets use during football season. Who wants to watch TV in real time anymore anyway?
There was some controversy a while ago about Samsung TVs finding and connecting to open WiFi networks autonomously if they weren’t connected to a network explicitly
Could be something as simple as a timeout. Three years of no connection, and it cuts you off.
I’ve used an LG monitor for about 5 years, and never install the manufacturer’s software unless it looks genuinely useful. When I saw the Gamers Nexus video I went to check my installed apps, and sure enough there was LG’s monitor app, installed silently without my knowledge. I used Bulk Crap Uninstaller to get rid of it.
To prevent this kind of thing in future, run gpedit.msc and enable “Prevent automatic download of applications associated with device metadata” under Computer Configuration → Administrative Templates → System → Device Installation.
Or you could just change to an os that doesnt piss on its users constantly
Indeed. I use Linux most of the time, and MacOS a bit of the time, but the old Windows desktop is still there for the infrequent times when I need it to work on old music projects. I have it too dual-booting into Linux, so even it spends most of its time in a more sane OS.
Unfortunately, dual gpu and ray tracing setups don’t work very well on linux.
Sounds like a hostage situation
Mine works, but I guess it depends on your setup. My main GPU is a 7800XT and my secondary is a 3090 I use for video encode/decode. OBS while streaming and recording simultaneously (if I ever have time), video editing and HandBrake conversions. It just works with EndeavourOS. I can do ray tracing on the 7800 XT but it’s not something I care about in games so I always turn it off.
I’m sure if I ran dual 3090’s in SLI it would be a pain in the ass but that’s why I didn’t try for that when upgrading my system, plus the power draw.
I couldn’t tell you about ray tracing, but it’s been pretty painless for me to run specific apps on igpu/dgpu using switcheroo-control
Multiple GPUs work fine in Linux. You can have one playing a game while you wait for the others to finish the real work.
Great; what OS has the equivalent of Group Policy and Active Directory besides windows?
The funny thing is, the people who care about Group Policy and Active Directory are the same people who aren’t happy about their network potentially being compromised because someone hooked up their work laptop up to a monitor at their home.
Still didn’t answer the question.
This is the one thing holding open source back, and the thing Linux users keep pissing on without understanding it.
The CTOs inept nephew can manage your fleet of windows machines and you get all the checkbox security you need for compliance (and some real security):
- Centrally managed
- Logs that are fairly hard to manipulate
- SecureBoot + Bitlocker
That same feature set on Linux will cost you a ton of money in skilled staff if you want to check the same compliance checkboxes. (As for real security, who cares, no one is doing that anyway)
Kind regards: someone who has managed Linux fleets.
THANK YOU!
So many people just don’t get it; happy to see someone rational who does.
I WISH Linux had something like this, but it’s like NT 4.0; it doesn’t have it.
It’s getting there, slowly.
- Clevis can do network and TPM pinned disk decryption.
- With Linux UKIs you can do self signed secure boot, we still need the mechanisms for central signing. This would actually be better that windows, you control your own PKI and Microsoft can’t sign garbage your machines boot.
- Logs is a somewhat bogus argument - log falsification on Windows has been done too. But linux is rather unprotected in comparison.
But the biggest issue is the mentality of ”I own my computer”. Sure, you own your private machine, but your company owns the computer you use for work and the data on it and has an interest in protecting that data from you. That particular threat model is hard to communicate, as Linux users normally don’t think of themselves as a threat vector.
Good to know they’re working on boot; what about something similar to AD and GPO?
I hope no one tries to push GPO-like stuff on Linux. I get where you are coming from, but for example Puppet will give you a lot more power and and flexibility. There is no registry. ”Everything is a file” is actually true, you just manage a bunch of config files instead.
As for AD, you have FreeIPA as the major contender. It works. You can also just join your Linux clients to your AD. Kerberos works just as expected.
(RedHat actually tried pushing management of Gnome via FreeIPA á la GPO. It sucks, because the desktop environment is just a tiny part of what you might want to manage, so suddenly you need to have both that bullshit and your normal configuration management tool.)
I didn’t watch the video, but maybe they said how this done.
If it installed silently, it must be getting pulled in via Windows update right? Where Microsoft just sees this a regular old driver for a device I would imagine?
I have an LG monitor, maybe about 5 years or older. But I don’t have windows so I assume it knows nothing.
EDIT: Nevermind. I went and watched the section at the beginning, and yep that is exactly how it is done. Does windows not even vet what a vendor hands them as a driver? Perhaps they don’t care, but this seems like an easily exploitable route.
I suspect the thoroughness of the vetting is inversely proportional to the size of the kickback to Microsoft.
Got me curious. Quick search and I found three windows drivers that had keyloggers hidden in them. Go figure it was HP!
-
HP Notebook Keyboard Drivers: Keylogging code was discovered in the SynTP.sys file, which was part of the Synaptics Touchpad driver shipped with certain HP notebook models.
-
HP Audio Drivers: Researchers found keylogging features within the Conexant HD Audio Driver (specifically version 1.0.0.46 and earlier) used in various HP laptops and other Windows systems.
-
That’s what I thought was happening here. The headline is a bit incorrect… the monitor didn’t install the bloatware, Windows did.
Now the drivers/software that Windows installed is likely from the MS store/update path and was made and signed by LG, but still. Plug this monitor into linux and it’s not going to do it because linux doesn’t have that mechanism.
Same. I noticed earlier this month when I got a popup to install Mcafee, out of nowhere. I was mortified.
Oh my God, I just checked and me too.
I have an LG TV that has never been exposed to the internet and it’s amazing.
Same! I jailbroke mine and can watch YouTube and Twitch ad-free, and it’s got Jellyfin on the homebrew channel, so I can access my server off my TV :)
Omg you can jailbreak smart TVs now? HELL yeah
EDIT: I am especially interested in LG webOS because I was a Palm Prē enjoyer back in the day and I rooted the fuck out of that phone (still have it somewhere)
Check out rootmy.tv to jailbreak your LG smart TV. Depending on the model and firmware, there could be additional steps you need to take, but in my case, since I still had the stock firmware installed, it was just a single slide of a button on the TV’s web browser.
So are there downsides to rooting? Like do the apps no longer work or is there functionality limited?
I’m running pinhole on my network currently so I think most if not all of the bad LG behavior is restricted and I use a Shield for most things, but I’m still tempted to root it anyway. Just want to know the downsides, if any, before I update my family’s TV
I’m probably an unsuitable person to ask this since my TV is basically a glorified monitor, but from what I could tell there are no downsides except for the obvious one being that I can’t update my TV. But considering much bloat and spying is going on with (LG) smart TVs, I don’t mind it all.
I use Twitch, YouTube, and Jellyfin on mine, and it’s been awesome. I hadn’t used any other functionality or apps the TV comes with before rooting and I likely won’t in the future. So even if some of them didn’t work, I couldn’t care less.
Maybe do some research and find out for your specific model?
I had to put malicious mp3 files on a USB for my newer C2, but my older C8 was rooted in the browser
malicious mp3 files on a USB
LOL, this is hilarious, while simultaneously infuriating that the owners of hardware are required to install a Trojan Horse to uninstall the malicious software installed by the manufacturer.
Thanks so much for the rootmy.tv recommendation, exactly what I need but didn’t know to look for!
on my 5+ year old TVs that didn’t work. you need a developer account, an app, and a few commands over SSH
That phone was the coolest thing, it’s such a shame how it died. I’ve still got mine lol, I can get it to boot and play that one flight sim game you could buy on the app store.
You don’t even need to jailbreak LG ones, just enable developer mode, install webosbrew, and install things like youtube adfree and space cadet pinball
That’s awesome. Mine is 42" and I’m using it as my monitor for my desktop. I had no idea you could jailbreak TVs now, what a time to be alive. I recently picked up a Raspberry Pi 5 and I’m planning on using it to replace my stupid Chromecast on my living room TV. As long as the Pi can stream from my Jellyfin server and watch YouTube then that’s all I need.
There’s a website called rootmy.tv that can help you find or execute roots right off the TV’s web browser. When I bought the TV, I hadn’t connected it to the Internet a single time, so it still had the stock firmware. I could just type in the URL and click a single button - that’s it. Depending on the firmware, model and brand, this could look different for you. Also I’m not sure if this only works for LG TVs - might have to do some research to find a suitable method for yours.
That also sounds very practical. I’d love to get into Pis sometime, but the RAM fiasco is making them quite expensive for my current budget, sadly.
This is it. Skip all the setup screens and just use it
I went through the nonsense of putting the LG tv and some other stuff on a separate network that has no internet access but I can still connect to them. It’s annoying that’s needed.
That won’t save you. It’ll still install the driver if its hooked to Windows.
So, I don’t get this; if you let it install the drivers and then uninstall the drivers and use it, will it just keep reinstalling the drivers with each next connection?
Apart from the obviously superior solution of switching to Linux, would someone need to connect while fully offline to prevent it from installing drivers and just watch predownloaded stuff (or play games offline) or what?
By default? Maybe.
But there are both global and granular Windows policies to tweak this. I disabled the device driver specifically, as I do like plug-and-play for other devices.
It will install the drivers… through HDMI? I don’t think so.
No, I just mean windows update will pull an LG “driver” and install it to your system automatically when it detects the display.
My LG TV is just so old it isn’t allowed to connect anymore lol. I just keep my old gaming laptop connected and it’s a far better experience then any modern smart TV with all the image smoothing junk.
My wife and I bought a TV on the internet. What brand? I have no idea but it’s the type they have in waiting rooms and restaurants. Zero internet. Zero apps. You push the button and it turns on. It’s the best fucking purchase we’ve made in the last five years.
I recently purchased a current year TCL, I don’t remember the model number but it’s the one right under their flagship.
It’s 75" and is the most beautiful tv I’ve owned. Fast, almost OLED levels of dimming, I’m in awe when watching the right content.
I’d pay an extra $500 for a version with no smart capabilities. Let me turn it on and boot into my android box, or console, or whatever.
Got ours second hand from a buy nothing group. It has no apps. It doesn’t know what the internet is. It has D-SUB and RCA ports. It’s perfect
Where’d you find it?
Look for “digital signage” displays - but beware that some of those are “smart TVs” too.
Amazon, unfortunately.
Commercial displays are like that. I have a couple that haven been decom’d from work I use. They don’t have speakers but I don’t need those anyway
A lot of commercial displays are smart now too.
This is 100% also Microsoft fault and they are to be held accountable for this. With many drivers it can happen that one manufacturer goes rogue, but Microsoft needs to have a zero tolerance policy for this: do it once and your signature is permanently revoked for all your drivers
LG clearly stands for “Literal Garbage”. The DisplayPort and HDMI ports on the gaming monitor I bought a few years ago failed approximately 6 months in.
My old LG monitor (32GK850) would occasionally ‘crash’ and require powering off at the mains.
Only monitor I’ve ever had do that.
The HDR was worse than useless too, obviously you can’t do much with edge-lit VA, but the tonemapping was just plain awful.
I wish we would stop using smart to describe surveillance technology. Smart sounds nicez but there’s nothing smart about it…
That is the neat thing about language, it adapts. Euphemisms wear off and something like “smart device” increasingly sounds like “nasty anti-consumer surveillance home appliance” all by itself.
you need popular public sentiment for that. most people just shrug it off if even that
And you think the other manufacturers are different?
Only solution is NO NETWORK. Use as a simple TV. I have 2 fairly new LGs and none are network connected. They work perfectly that way. I learnt the lesson with my 15y old Samsung SmartTV, one of the first to the market, and it wanted to use a Samsung account for almost everything, even to use the Youtube client. Nope.
These are computer monitors, not TVs. Plugging them into a Windows box triggers Windows to silently install their “driver,” which silently installs a handful of other startup apps. It’s an escalation of the smartTV-wifi path.
Anybody truly worried about being monitored isn’t going to be running windows.
Better alternatives existing doesn’t give Windows a free pass to be as shitty as they want.
Of course it does. Your whining sure as fuck won’t change anything kiddo. You can downvote this fact all night long if it makes you feel better though 🤣
Yes… No true Scotsman would use Windows.
I grabbed a used Samsung dumb tv off fb market place but I haven’t decided how im going to configure a streaming device to it. All the streaming sticks do the same thing. Building my own sounds like a pain.
I have a little server but I want a remote and a basically have to make my own box to be able to cut out these 3rd party spies.
All of this is true but I really hate the headline. Headlines for this SHOULD SAY “Microsoft’s Windows update feature is distributing adware.”
Both LG and Microsoft share responsibility. LG for doing it and Microsoft for allowing it.
This has been going on forever, though. I had an Asus motherboard that literally installed adware, and an even older Sony laptop that topped it.
LG is on my permanent vendor shitlist for related reasons.
Lol, “monitor” app, because it monitors users.
Im sorry. Im drunk.
deleted by creator
Straight to the list of things “I will never buy in my life”.
Yeah, Same here honestly
