Your TV Is Listening: What Gamers Nexus Found Inside LG Smart TVs (ACR, Microphones and Vulnerabilities)

You paid a couple of thousand dollars for a TV. Does it behave like a display, or like a small Linux server with a microphone, a network scanner and an advertising business attached? A new investigation from Gamers Nexus argues it is closer to the second.

In a recent video, Gamers Nexus worked with security researchers to examine LG smart TVs and monitors using Wireshark, firmware analysis and a rooted TV. This post pulls out the technical substance: what ACR is, what the TV reportedly sends home, what the researchers could do with a compromised set, and what you can do about it.

Source video: "216,000,000 Spy TVs | The LG Smart TV Problem" by Gamers Nexus (2:15:52). All credit for the original research goes to Gamers Nexus and the researchers they credit. This post summarizes their claims; LG's own responses are noted where the video quotes them.

First, What Is ACR?

Automatic content recognition (ACR) captures what is on the screen, including screenshots and audio snippets from the speakers, and turns it into a fingerprint that is matched against media databases. Per the video, the TV sends those fingerprints to servers run by LG Ad Solutions (formerly Alphonso), and ACR can also run when the TV is used as a monitor over HDMI.

According to the researcher who decompiled the firmware, the audio side works roughly like this:

audio -> downsample to 8 kHz mono
      -> FFT over 40 chunks of 100 ms each
      -> combine into one fingerprint
      -> upload

Gamers Nexus estimated about 4 GB per month of ACR data from their TV, mostly text fingerprints.

What the Network Captures Showed

The team mirrored the TV's switch port and captured traffic. Here is what they reported for roughly hour-long samples:

Two things stand out. First, "dumb monitor" use did not stop ACR traffic once the agreements were accepted. Second, the team says the payloads are encrypted, so they could not confirm exactly what was in them without a man-in-the-middle certificate.

The TV Scanned the Whole Network

The researchers say the TV swept the local network and found at least 38 other devices, including a 3D printer, a dev board, an air purifier, a TeamViewer-running editing PC, smartwatches, phones with staff usernames exposed, and even thermostats. One researcher's explanation: some of this is plausible auto-discovery, and some is likely tracking, such as seeing an older phone model and serving ads for a newer one.

Separately, the video lists data the TV and LG's ad platform can collect, including:

• Advertising ID and a non-resettable device UUID
• MAC address, IP address and location
• Nearby Wi-Fi network names, signal strength and channel numbers
• Active input and active app
• Power on/off timestamps and privacy consent flags

On LG Channels, the researcher noted DNS queries that include the channel name, which means anyone on the LAN or at the ISP could infer what you are watching.

Opt-Out Is Not a Clean Break

From the firmware analysis, the video claims:

• Opting out still sends a final snapshot of tracking data to Alphonso.
• The TV still sends "I'm online" beacons on boot and network changes.
• The device ID is built by encrypting (not hashing) the MAC address plus a random salt, so anyone with the per-model secret key could recover the MAC. That key is reportedly stored on the device.
• Some settings are worded in ways that are easy to misread, such as a "cookies" toggle that reportedly maps to ad frequency capping cookies.

What a Compromised TV Can Do

The most dramatic section used a rooted TV and, per the researchers, vulnerabilities still in responsible disclosure, so the details are withheld. What they showed:

1. Recording with the screen "off." Microphone and webcam audio captured while the TV looked off, and while the network was unplugged, then exfiltrated after reconnecting.
2. Mic switch is not the whole story. With the hardware mic switch off, the shell still listed other audio sources: HDMI audio, Bluetooth, USB webcams and speakers, and the remote's microphone.
3. Menu settings can be flipped from a shell. Voice features disabled in the menu were re-enabled with a command.
4. Speaker capture. Audio from a conference call played through the TV was recorded.
5. Voice transcripts in plain text. After using the voice feature, the TV kept a text log of nearby speech, and the capture window stayed open for roughly 10 to 15 seconds after speech stopped.
6. Range. The team reported clear audio from nearly 70 feet away.

LG's statement, as quoted in the video, is that its TVs "do not collect, record, or store ambient conversations" and that voice recognition is optional and user-initiated. Gamers Nexus disputes this based on its own tests.

One caveat from the video itself: they are not claiming every LG TV is being used as a listening device, only that the capability may exist and that an attacker, or the vendor, could use it.

webOS App Store Risks

• Security firm Spur reported that 1,213 of 2,851 tested webOS apps (about 43%) allowed developers to turn TVs into residential proxies. LG said this is not an intended use and that apps keeping the option would be suspended.
• A researcher also described a UPnP API that any app with standard partner trust could use to list and control UPnP devices on your LAN, for example a NAS.

Terms and Dark Patterns

The team counted 1,246 remote clicks to read six agreements and 1,459 more for four account documents. They say the combined terms and policies run close to 50,000 words, or roughly 2.8 to 3.8 hours of reading. They also describe installing an app triggering six agreements with "select all" highlighted, and an arbitration clause added after their first video.

What You Can Do

Based on the video's findings, here is a practical checklist. The first items are directly from the video; the last two are my own inference, not claims from the video.

• ☐ Do not accept optional agreements you do not need (voice, ACR, "select all").
• ☐ Find and disable ACR and "do not sell" settings, but do not assume this stops all traffic.
• ☐ Do not rely on unplugging Ethernet: the researchers note neighbor or ISP open Wi-Fi can reconnect devices.
• ☐ Use a separate computer monitor or an external streaming box if you want a truly dumb display. (my inference)
• ☐ Put TVs on an isolated VLAN or guest network with outbound filtering. (my inference)

An example of the DNS-level blocking approach I would try on the isolated network (my inference, and the domain names must come from your own captures, not from the video):

# Example only: log what your TV asks for, then decide what to block
sudo tcpdump -i br0 -n host <TV_IP> and udp port 53

DMCA Section 1201 and the Right to Repair

Near the end, Gamers Nexus talks with Kevin from the Fulu Foundation, which works alongside Louis Rossmann and organized the "Own Your Tour." His argument, as presented in the video:

• The DMCA passed in 1998 to stop piracy of media on CDs and DVDs. Its authors did not anticipate computers in pockets, cars and tractors.
• Under Section 1201, circumventing a digital lock in front of a copyrighted work, including source code, can itself be a copyright crime. Kevin's analogy: picking the lock on your own house is not breaking and entering, but for digital devices the rule is different.
• That matters for this story because removing ACR software from a TV, or building an easy consumer tool to do it, would, in his reading, violate Section 1201. He cites penalties of up to $500,000 and five years in federal prison per offense.
• He says the law's architect negotiated the WIPO treaty after Congress balked at the framework, then returned to Congress arguing the U.S. needed to comply with it.
• His advice is to contact your representatives, since many members of Congress do not understand technology or copyright law, and to follow the Fulu Foundation and the Consumer Rights Wiki for updates.

Wendell's Debrief

The closing interview with Wendell of Level One Techs adds several technical details:

• ACR is built around about 6-second captures of audio or video, followed by a dormant period. Hashes, not full screenshots, are what the TV needs to send. The team did intercept the audio before it was hashed and saved the clips.
• Storage: the TV has 16 GB of flash, roughly 4 GB usable out of the box. A USB stick could extend how much audio a compromised TV could store.
• Logs: the debug logs live on a RAM disk. They contained text of what was said to the TV, including a test "social security number" spoken after the wake phrase. They survived a reboot and the "clear data" command, and disappeared only after the power was physically pulled. Other logs persisted.
• Wi-Fi geolocation: the TV appears to inventory nearby wireless networks and access points, which can be used to locate it without GPS.
• Remote code execution: the one that worked came from the TV's own browser, a Chromium build the speaker calls old. A web page triggered a "mobile device wants to pair" prompt, and approving it gave the researchers access.
• Old TVs: Wendell says a TV with no agreements accepted gained an advertising ID after a firmware update, with no notice.

The video closes with Gamers Nexus saying it would not recommend any LG smart products, that the researchers advise disconnecting LG smart TVs from any network, and that it hopes to test other brands in a follow-up funded by its store campaign.

The Takeaway

The video's central argument is that these devices are powerful computers whose business model rewards data collection, so the risk comes from both the vendor and anyone who can compromise the set. Gamers Nexus also notes some uncertainty: they could not test every model or firmware, and the transmitted data is encrypted. Treat the findings as strong reasons to check your own TV's settings and network placement, not as a verdict on every unit.