Security in a connected TV world

Sitting in my inbox, I have a press release from one of the companies that makes TV middleware – that’s the stuff that typically does things like the interactive services, and increasingly provide access to online content, like iPlayer, LoveFilm and other material.

I’ve been thinking about what, if anything to write about it. On the face of it, their press release struck me as containing a certain amount of FUD: it essentially said that they’d included protection against viruses in their middleware, so TVs that used it would be better protected on the internet. And yes, while there might be a theoretical possibility, is it really that great? After all, what could a virus on your TV do? Force you to watch Corrie instead of Eastenders?

There are probably more important things to worry about and so, beyond chatting about it with a couple of more knowledgeable people, I put it to the back of my mind. But, following the news of the hacking of the Sony PlayStation Network, I think it’s worth revisiting.

Attacking your TV

First, it’s worth considering exactly how a connected TV works. They’ll all be slightly different, but I’ll take Panasonic’s VieraCast as an example, partly because I have one myself, but also because there’s information about there about how it works, notably here.

Essentially, when you press the VieraCast button, the set goes to a specific URL, and fetches the main page, and there’s not much in the way of security involved. Does that make it a big issue? Well, not really. In theory, if you could hijack the DNS servers, either on a widespread scale or just on a user’s home network, you could make the TV fetch content from a different site. And perhaps that content could ask people for credit card info, and some of them might enter it.

But that’s not hacking or infecting the TV, really – you’d have to attack the internet infrastructure, or a user’s home network. And if you’re attacking someone’s network, you’ll probably find richer pickings on the PC than you will by trying to work out which brand of connected TV they might have and how to subvert it.

Despite what the press release claimed, I’ve not yet seen a connected TV that actually has important information stored in it, like credit card details. My VieraCast set has my YouTube login, sure, but that’s not going to be much use to anyone. One friend’s TV offers them LoveFilm, but the only identifying information the TV has to know is a long number that’s obtained from the web site – again, no credit card details stored on the TV.

And I think it’s pretty unlikely anyone’s going to suggest your TV does store that. Of course, there is a theoretical risk – and people who know more about this stuff than I do tell me that there’s very little in the way of security included in the specifications for services like HbbTV, or many of the manufacturer portals. And yes, that should probably be addressed.

The PlayStation attack

With many of these services at a relatively young age, in fact, I think now might be the time for some of those working on them to go back and look at how security can be beefed up – but not just in the connected devices like TVs and set top boxes that will be becoming increasingly prevalent over the next couple of years.

The full details of how the Sony PlayStation Network were hacked aren’t available, and may never be – but clearly a lot of personal information has been obtained, for more people than live in the whole of the United Kingdom.

There’s no excuse for not securing your own PC with firewalls, and anti-virus software, but the Sony hack should remind us all that the richest pickings will seldom be found by attacking lots of individual computers. They’ll come from companies like Sony, or TJX (owners of TJ Maxx) – formerly believed to be the biggest hack ever, at a mere 45 million users – who have lots of data gathered in one place, and not properly secured.

Mostly forgotten amidst all the fuss over the PlayStation Network is that Sony’s Qriocity streaming service has also been affected by this hack. It provides streaming music, videos and feature films to Bravia TVs and Blu-ray players. It’s fairly new, and given the lack of fuss, I suspect not that widely used – if you’re in the US and want streaming films, the name you look for is NetFlix, while in the UK it’s LoveFilm.

But, I do wonder if the scale of the problems with the PlayStation Network will have a knock on effect on people’s willingness to use online entertainment services. It’s received much press coverage and I suspect that for an awful lot of people, it’s been their first encounter with entertainment of any sort delivered over the internet. For it to have such a spectacular security failure surely can’t be good for consumer confidence.

After Sony

In the UK, internet entertainment is still pretty young, at least in terms of paid services. It’s growing, as more people produce TVs with LoveFilm, and services like YouView will provide access to even more paid content. Across Europe HbbTV is being deployed alongside other platforms from TV manufacturers.

Some of these services are more mature than others – we’re unlikely to see anything with a YouView badge for some months yet, for instance. But I think they could all do with taking some time to consider security issues.

The potential of attacks on your TV itself is still, I think, a pretty slim chance – but that doesn’t mean that manufacturers shouldn’t stop and think about how they can make sure their systems are more robust.

The groups creating standards like HbbTV should perhaps take time to see how they can be updated to increase security – hopefully in ways which can be implemented via software updates to equipment that’s already deployed.

And, given that what seems to have happened with PlayStation Network was a problem with the service provider not taking decent security precautions, perhaps there’s also a need for more transparency, or information about compliance to be made available.

Would it be a good idea, for instance, if YouView were to have a requirement that services available via its platform never stored billing data in unencrypted form? And if encrypted connections were mandatory for transferring personal information between the box and the remote servers?

Some people might say “Won’t that lock out smaller players? Or introduce compliance requirements? And you can never be 100% secure anyway.” Yes, all that is correct. But I still think that any connected TV or online entertainment service that wants to be sure it has the confidence of customers should be thinking long and hard about how they can avoid the mistakes made by Sony, and make sure that their customers know they take these things seriously.

Connected TV platforms are still young, and deployed in relatively small numbers. It’s far better to address the question of security now than to wait until there are tens of millions of TVs and set top boxes, running on platforms that could have been made more secure.

PlayTV – a quick response to a quirky update

Some readers of The Register passed on news of a problem they’ve been experiencing with PlayTV – the add-on to the PS3 that lets you use it to watch and record Freeview.

It appears that, after updating to version 2.02, some users are experiencing PlayTV hanging, and the advice from Sony’s support line is that you should re-install the software.

It’s important to point out that if you do that, then your recordings will be lost; you need to export them to XMB first if you want to keep them.

I’ve written a news item about this for RegHardware, and in that I described the Sony response as a “corporate shrug.” I think, actually, that’s being quite generous. Users have paid for an update; it’s clearly affected enough of them for Sony to say it’s heard about the problem, and this is their response:

We are aware of the issues some PlayTV users are currently experiencing. We will fix these issues through future updates.

When I first received that response on Friday afternoon, I pointed out to the PR that I didn’t think it would be terribly appreciated by the users affected, and that it amounts to little more than “we know, we’ll get to it sometime.”

Specifically, is there a time-frame for an update? Will those who paid for the current version be able to get a refund? And can Sony suggest any work-arounds in the meantime? I think those are all reasonable questions.

The PR told me he’d try to get an answer on Monday; in the event, I waited until Tuesday lunchtime before submitting the story.

As some commenters on the RegHardware story point out, it’s hard to get a feel for exactly how many people are affected; but certainly some are – and whether it’s a dozen people, 120 or 1,200 that have ended up losing all their recordings as a result of re-installing, or simply not getting what they thought they would when they paid for an upgrade, I do think that they deserve a little more information than they’re getting at the moment.

Waterstones cuts price of Sony Reader to £99

Sony's PRS-300 Reader Pocket Edition - £160 at a Sony Centre, but just £99 from Waterstones, starting August 10th

Waterstones has confirmed to me that their pricing for the Sony Reader Pocket Edition will drop to £99 tomorrow (August 10th), both in store and online.
The company says that will make it the cheapest branded reader on the UK High Street, and pointed out that it’s also cheaper than the new Kindle – though of course it also lacks WiFI.
Even so, it’s a welcome development – but still a shame that the books themselves cost so much in ePub format.

The end of the affair

As I’ve written about before, the demise of the 4TV programme guide has left owners of several brands of Freeview recorders without an easy way to schedule recordings. And now, I think, we can say that the coffin lid has been pretty well nailed down, and the chances of a resumption of the EPG service are pretty much extinguished.

I’ve said before that I think it would be unlikely, despite the online petition (which now stands at around 1500 signatures), that anyone would step in and take over the service. So why am I even more certain? Because of Sony.

As mentioned in some of the comments to stories on this site, and elsewhere, Sony told the owners of their SVR-S500 that they were “looking into the matter” and some people gained the impression they might consider taking over the EPG service (though given they no longer run their own TVTV EPG on Freeview, that would have been an odd decision).

What makes that look even less likely is this email, sent to an SVR-S500 owner (I’ve removed identifying information):

Thank you for your recent e-mail received on 09/07/2010 08.00 AM.

Thank you for contacting Sony regarding your Sony SVR-S500.

In recent weeks we have been contacted by a number of customers with reference to the loss of EPG service on their SVR-S500 Freeview recorder.

This loss of service is, very basically, due to the EPG data stream, specific for this product, no longer being broadcast as of the 29th June.

Since this date, the electronic programme guide will now only display the ‘Now’ and ‘Next’ information; where before it would display up to 8 days of programme lists.

As a result, we are aware that you will no longer be able to see forthcoming programmes or use the EPG to record them in advance. However all other functions will continue as before, with the product still able to display the Freeview broadcast and record programmes via the manual timer function.

However, with the change in service firmly in mind, we have put in a place an offer to give you the option to trade-in your SVR-S500 and get £100 off of one of the following Freeview HDD/DVD recorders:

RDR-DC200

RDR-DC100

Details of these models and their full features and specifications can be found on www.sony.co.uk. Please note however that new ranges do not feature twin Freeview tuners but these products do come with built in DVD recorders which is an added benefit.

If you wish to participate in the trade-in, you can either do this by contacting our Sony Centre Sales line on 0845 6000 124 (select option 1) where they can arrange for you to reserve and collect the new product via your local Sony Centre, or, you can visit your local Sony Centre directly. The offer will run from midday on 29 July. Details of your nearest Sony Centre can be found via www.sonycentres.co.uk. Please note you will need to return the SVRS500 to the Sony Centre to obtain the discount.

I hope that this offer helps you with the current situation.

I’ve called the number in that email to verify the offer, and it is indeed correct – select option 1 first, then option 3 from the next menu; the person I spoke with told me you have to have registered with the support line first to let you know there’s a problem, but they’ll be able to transfer you.

Sony's offer to SVR-S500 PVR owners: £100 off a new Freeview+ DVD/hard disk recorder

You can see the specs for the RDR-DC200 and RDR-DC100 on the Sony web site; they’re single tuner Freeview+ units with a DVD recorder; the DC100 has a 160GB hard drive, and the DC200 a 250GB drive.

So, if Sony are handing out discounts and arranging trade-ins of their affected PVRs, I think it’s fair to say that they’re not going to be suddenly starting up an EPG service for even fewer people, especially when the majority of those people will probably not even be their customers.

And, I think this is the final nail in the coffin because the other companies involved don’t have a presence in the UK market for PVRs at the moment. Sony is the only company that would perhaps have suffered from goodwill issues if nothing was done, and so they’re addressing that – and good on them for making an offer. The replacement products might not be exactly what you want, but £100 is a pretty reasonable deal, in my opinion.

The only other company that might really be in a position to do something about restarting the EPG is Beko – and while those who are online and reading about this issue will know of their involvement, I suspect that the vast majority of people affected aren’t aware at all. As I’ve commented before, would you be more likely to buy a Beko fridge, if the guide reappeared on a Thomson or Digifusion PVR?

I don’t think so – and so I don’t think Beko will view this as their problem at all. If there was ever going to be a resumption of the EPG, then Sony would have been the best bet. And their offer to affected customers suggests that they’ve done the sums, and decided a trade-in scheme is far more cost-effective than buying capacity, licensing an EPG, and paying someone to transmit it. They got out of that business in the UK with TVTV, and leaping back in for an obsolete product was never likely to happen.

So, unless something unexpected happens, I think that’s the end of the 4TV affair.

Freeview – who makes what, and why it matters

Following on from my recent post about the various names of the Vestel T8300 HD receiver, Marc over at PVR Junction has helpfully sent a list of some of the other brands that have rebadged Vestel equipment for the UK, together with a link to an unofficial web site with more information.

So, these are the brands that have sold Vestel Freeview PVRs under their own name in the UK:

• Akura
• Alba
• Bush
• Digihome
• Dual
• Durabrand
• Evesham
• Ferguson
• Goodmans
• Grundig
• Hitachi
• Linsar
• Logik
• Luxor
• Maplin
• ONN
• Proline
• Sharp
• Technika
• Techwood
• Wharfedale

As again, note that this doesn’t mean that everything with that badge on was made by Vestel; check the label on the bottom and see if any part of the model number corresponds to one of the Vestel ‘T’ numbers listed on the Futaura site.

Some companies will simply buy in what looks best at the time. For example, there has also been a Wharfedale PVR that was a rebadged TVonics, and while Goodmans and Grundig have used Vestel kit in the past, their current Freeview HD boxes are made by someone else, as far as I can tell – they certainly aren’t the Vestel T8300.

A big boy did it and ran away

On the subject of rebadging, you might think it’s just the second and third tier brands who do this sort of thing, while the big well known global companies diligently create shiny new products in their test labs.

That’s not the case. Sony’s SVR-S500 Freeview PVR wasn’t really a Sony product at all. It was a twin tuner recorder, with a miserly 80GB hard drive – though to be fair, it was released around four years ago.

Rather than being a Sony design, it was really a re-badged Digifusion FVRT200. And this is where things start to become curiouser and curiouser. The Digifusion was one of a few products that didn’t use the main Freeview programme guide. Instead, it relied on a channel which some people might remember, called 4TV. This was a data channel that seemed to do nothing most of the time, and if you watched it, you would think it was a waste of space.

What it actually did was broadcast a fourteen day programme guide in the middle of the night, which was stored by various devices, including the Digifusion models. Sony, for whatever strange reason of their own, cut the programme guide down to seven days on the SVR-S500, effectively meaning that you paid extra money to get a Sony badge on a Digifusion recorder, and had only eight days of EPG, rather than fourteen.

Fast forward to this year; 4TV is now InView, and they’ve announced that since the contract hasn’t been renewed for them to broadcast the programme guide, they’re stopping. So, if you have a Digifusion recorder, or the Sony clone (both were made by Beko, another Turkish firm), you’ll find that there isn’t a programme guide any more, making it much harder to schedule recordings.

Of course, a four year old Freeview recorder that can only record one thing at a time, and has just an 80GB hard drive sounds like pretty ancient technology now. But wouldn’t you think that if you paid for a big brand name like Sony, you wouldn’t be left with something that had vastly reduced functionality, just four years later?