The vulnerabilities of IoT household items are well documented. It used to be thought that Smart TVs were safer, but with more reports of sets being used to spy on people, track their viewing habits, and even being hit with ransomware, it appears these televisions can be just as much of a security nightmare as other connected devices.
Oneconsult security researcher Rafael Scheel has outlined an attack that uses terrestrial radio signals to gain root access to sets without having physical access to them. His proof-of-concept uses a cheap transmitter to embed malicious code into a Digital Video Broadcasting - Terrestrial (DVB-T) signal.
"Once a hacker has control over the TV of an end user, he can harm the user in a variety of ways. Among many others, the TV could be used to attack further devices in the home network or to spy on the user with the TV's camera and microphone," Scheel told Ars Technica
Scheel demonstrated the attack on a couple of Samsung smart TVs. It exploits two known security flaws in the web browsers running in the background, and the technique can be used to compromise a number of TVs at once. With a few alterations to the code, it's possible to take over other brands of internet-connected televisions.
As noted by Engadget, the good news is that only certain countries use DVB-T, and even fewer support the hybrid broadcast broadband TV format (HbbTV) that's needed to make the hack work. Additionally, you'll need to have your TV connected to the internet and locked into a DVB-T channel to fall victim to this the attack - most US citizens who are watching ATSC channels are safe.