Security Research On The Android SmartTV Customization

The rapid development of IoT technology has brought security research into a new world.Generally speaking,the OS(Operating System)of SmartTV is often developed based on Android TV OS.Venders often introduce some customized features during the development process,such as introducing the screen casting function to enrich the user’s experience,or making some customized modifications to system files to fit different hardware.During these customizations,some new security risks are often introduced.Therefore,research on SmartTV customization security is an urgent task that needs to be carried out.This thesis studies the security issues introduced by SmartTV vendors in the process of customizing their devices.On the one hand,we focused on the security of a unique feature of SmartTV,the screen casting service.We chose a prevailing screen casting standard in the consumer market,the DLNA(Digital Living Network Alliance)protocol,as our main research target.This protocol was established by a group of tech giants,including Microsoft and Intel.We systematically evaluate the security of DLNA deployments in the SmartTV ecosystem.Specifically,we identify a series of critical security issues in the interactions between SmartTV and casting apps on the smartphone,ranging from non-mandatory encryption to unauthorized file access.The identified security risks can be exploited by a malicious app on the victim’s phone,without requesting sensitive permissions,to launch multiple attacks,including arbitrary command execution,data theft,MitM(Man-in-the-Middle)attack,and DoS(Denial-of-Service)attack.To evaluate the impact of the identified security issues,we designed semi-automated analysis solutions to facilitate the measurements and conducted real-world experiments on 10 on-shelf TV boxes.The results show that most DLNA implementations of products and apps in the wild are insecure.On the other hand,this paper also studies the changes made by vendors in the system configuration and analyzes the security risks introduced by these changes.These security risks include using network ports for built-in apps on SmartTV without restrictions,resulting in long-term open ports for sensitive services;misconfigured permissions during customization of hardware drivers,allowing unauthorized users to access sensitive data;failure to timely update and patch device system,greatly increasing the threat to the device.Once these security risks are maliciously exploited,they could lead to threats such as malicious control of the device and leakage of sensitive data.We also conducted evaluations on 15 TV boxes to detect the scope of these security risks.The results showed that most devices have some security issues.