Hisense smart TV privacy flaw exposed 5.7 crore viewing records: What happened?
Your smart TV might know more about your viewing habits than you realise. Cybersecurity researchers have discovered a serious privacy flaw involving Hisense’s VIDAA operating system that exposed more than 5.7 crore viewing records from over 10 lakh smart televisions. The records were accessible through a server that did not even require a password. Anyone who found the server could potentially see what television owners were watching.
The discovery comes from a study titled conducted by researchers at Northeastern University in the US. The team examined 12 smart TVs running eight operating systems and carried out 5,943 tests. One of the biggest findings involved VIDAA OS, which sent viewing information over the internet without encryption. The researchers found that the exposed records included device identifiers and information capable of revealing users’ interests, including politics, religion and health.
:
How did Hisense TVs expose viewing records?
The problem involved a technology called Automatic Content Recognition (ACR). It identifies what people watch by checking audio or video samples against a database of known content.
Think of it as a system that recognises the movie playing on your television, even when the content comes through an external device.
The researchers found that VIDAA transmitted viewing information to servers associated with advertising technology company Unruly.
The exposed records included:
| Data exposed | What it could reveal |
|---|---|
| Permanent TV ID | Link viewing activity to a particular television |
| Audio fingerprint | Identify the content being watched |
| App and input details | Which app or input source was being used |
| Content categories | Interests involving politics, religion or health |
| Time zone | Approximate geographical region |
In just three hours of limited testing, the researchers observed more than 5.7 crore content recognition results, covering over 10 lakh televisions and 82 content categories.
:
Has Hisense fixed the privacy problem?
VIDAA acknowledged the problem after researchers reported it. The company subsequently added a login requirement to the affected server.
That addresses the publicly accessible server, but researchers say the viewing information continues travelling without encryption.
The team even demonstrated that a previously captured message could be sent back to its test television, raising concerns about possible message manipulation. No malicious attack was demonstrated.
Importantly, there is no confirmed evidence that criminals downloaded the exposed records or misused them.
:
What should Hisense smart TV owners do?
The researchers found that turning off ACR worked on the VIDAA television they tested. Owners can check their TV’s privacy settings and disable content recognition or enhanced viewing features.
Keeping television software updated is sensible too.
The findings highlight a bigger concern. Smart TVs can collect detailed information about viewing habits, and poor security can expose that information far beyond the living room.