Power, Performance And Electronic Surveillance

The disclosure that smart TVs can be used as for surveillance purposes is hardly a revelation. Makers of these devices have been advertising gesture recognition features for several years.

Far from being evil, TV makers were responding to market research that showed voice inputs were a good way to boost sales in a saturated digital TV market. They added cameras so buyers could wave their hands to change channels or adjust the volume, and some have added voice recognition for those who would prefer to sit on the couch and talk to their TVs.

Until this past week, when WikiLeaks published about 900 CIA documents, gesture recognition and voice control were considered must-have features. Amazon’s Alexa and Google’s Home, the latest additions to this era of always-on, always-listening devices, are sold with express purpose of listening to consumers, answering their questions, or responding to orders. Sales have been brisk, and the news media is full of stories about people interacting with their home assistants.

It’s certainly true that most people seem more comfortable with Amazon or Google or Apple listening in on their conversations than the government. But it may not be just their government. If one government can listen in, so can others. And so can criminal organizations with sufficient resources.

The real story here isn’t that a government is listening to people in their living rooms. It’s that people are buying and installing devices in their homes that are, by definition, listening or two-way viewing devices. And it’s not surprising these devices can be hacked. Unless a vendor owns the entire infrastructure—the device, the network, a hard-wired communications channel (preferably optical)—with multi-factor authentication required every time you use the device, then chances are good that it can be compromised.

The last company in the United States to have the kind of control necessary to secure an entire network was AT&T, a regulated monopoly that was broken up by the U.S. Justice Department in 1982 in order to foster competition in the phone market. Ironically, many backers of the breakup feared the phone company monopoly was a threat to free speech, and that it could be used to listen in on conversations without people’s knowledge.

Of course, there are many ways to foil this kind of intelligence gathering. Consumers can deploy authentication that requires iris or retinal scans, ultrasound fingerprint sensors and electronic tokens based on air-gapped random number generators. All of these add great inconvenience to watching TV. They also add to the cost of these devices. In fact, one of the reasons the digital TV market is so saturated is continued and rapid price erosion, which is why these new inputs were added in the first place.

Adding security would raise the cost and make consumers think twice about new purchases. For a device to be truly secure, it requires active rather than passive security. That includes obfuscation of digital signals, so the ones and zeroes tied to specific functions are much more difficult to identify. To make them even more secure, devices should be hard wired into homes using closed networks, which would it much more difficult to deploy them.

Active security also has an impact on how much power these devices draw from a battery or a wall outlet, which in turn equates to higher operating costs. A truly secure system has security built into every function and every part. It even has a secure supply chain, so that counterfeit parts cannot be inserted.

The upside is that by adding in this kind of security these devices cannot be turned into a botnet that can cause security breaches on a grand scale, as the Mirai virus did last October. The downside, is that to run all of this functionality also requires much more processing, which in turn requires much more powerful processors. And all of that begins to make these tiny systems or your flat-screen TV look more like mini-supercomputers, which require active cooling, rather than these slick, user-friendly devices that are supposed to make our lives better.

Related Stories
Side-Channel Attacks Make Devices Vulnerable
The number and type of attack vectors are increasing as more of the world becomes connected and vulnerable to hackers.
Can Low-Power Devices Be Secure?
Demand for low-power, high-performance devices also calls for security measures.
Uncovering Unintended Behavior
First of two parts. Does your design contain a Trojan? Most people would never know, and do not have the ability to find the answer.
What Can Go Wrong In Automotive (Part 2)
Understanding security risks, ECUs vs. SoCs; dealing with an explosion in data.