Samsung Smart TVs with voice recognition are sending information to an unofficial text-to-speechover an unencrypted channel, a researcher has discovered.
The voice recognition capability of Samsung allows the user to give voice commands to the TV, which are interpreted as data commands on the device for execution.
Last week, the news was officially released regarding the ability to record more sounds than should be and to send them to a third‑party service (Nuance Communications) for conversion into commands for the television.
The company revised the global privacy policy, which previously stated that «if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition».
Now it states that voice commands are collected only when the TV's microphone is activated by saying the phrase «Hi TV» and only the related text is captured, for the purpose of improving voice recognition functionality.
However, there is still a big concern about the way the data is delivered, which must be done over a secure channel (HTTPS).
As it turns out, Samsung uses only the standard HTTPS port (443/TCP) and does not attempt to encrypt the information, so that it becomes unreadable if someone happens to monitor the data.
The researcher who conducted the test collected the data using Wireshark, which showed everything clearly. He noticed that the network inspection utility displayed a mix of XML and custom binary data, rather than encrypted information, as it should for greater security.
