Pedro Cabrera Camara - SDR Against Smart TVs: URL Channel Injection Attacks
Demonstrates injecting malicious DVB-T broadcast signals to attack Smart TVs using commodity SDR hardware.
Summary
Smart TV DVB-T Injection Attacks
Pedro Cabrera Camara presents research on attacking Smart TVs through injected DVB-T (Digital Video Broadcasting – Terrestrial) broadcast signals using commodity software-defined radio hardware.
DVB-T Attack Surface
Digital terrestrial television (DVB-T) uses broadcast frequencies receivable by any antenna. Smart TVs with built-in tuners receive and render HbbTV (Hybrid Broadcast Broadband TV) applications embedded in broadcast streams — web-like applications running in the TV's browser sandbox.
Malicious Broadcast Signal Injection
Using a GNU Radio flow graph and an HackRF SDR transmitter, Camara injects a malicious DVB-T signal stronger than the legitimate broadcast, causing nearby TVs to tune to the injected channel. The injected HbbTV application exploits vulnerabilities in the TV's embedded browser.
Attack Outcomes
Successful exploitation enables loading malicious web content, extracting stored credentials from the TV's browser, pivoting to home network devices via the TV's network interface, and installing persistent malware in the Smart TV's writable storage.
Related talks
Main Stage·45 min
Romain Cayre · Damien Cauquil
Framework and unified protocol architecture for wireless security research, hardware abstraction, and over-the-air exploitation.
Main Stage·44 min
Ben Gardiner
Ben Gardiner demonstrates using Software Defined Radios (SDR) to transmit and decode SAE J2497 (PLC4TRUCKS) signals over the air, spoofing heavy vehicle trailer brakes.
Main Stage·46 min
Karl Koscher · Andrew Green
Karl Koscher and Andrew Green share how they legally acquired an uplink license to broadcast audio streams across the Western Hemisphere using an old satellite.