Instead of you watching TV, your TV might be watching you! :-D It could give an attacker the ability to access any file available on the remote device, as well as external devices (such as USB drives) connected to the TV. And, in a Orwellian twist, the hole could be used to access cameras and microphones attached to the Smart TVs, giving remote attacker the ability to spy on those viewing a compromised set.

In an e-mail exchange with Security Ledger, the Malta-based firm said that the previously unknown (“zero day”) hole affects Samsung Smart TVs running the latest version of the company's Linux-based firmware. It could give an attacker the ability to access any file available on the remote device, as well as external devices (such as USB drives) connected to the TV. And, in a Orwellian twist, the hole could be used to access cameras and microphones attached to the Smart TVs, giving remote attacker the ability to spy on those viewing a compromised set.

Samsung sells a variety of so-called “Smart TVs.” The devices combine traditional high-definition televisions with tablet-like features, including web browsing and a variety of applications designed for the TV itself. Among the accessories sold for the Smart TVs is a Smart TV SKYPE Camera that adds a high-definition camera and microphone to the TV, allowing users to log into their SKYPE account and chat with other SKYPE users from their television.

Update: In the event a TV is behind a router that uses network address translation, Auriemma's attack won't work at the moment. But with more work, he says it could be possible to use exploits based on IPv6, the next-generation Internet routing protocol, to bypass that protection. He also said readers shouldn't discount the ability to carry out the attack on local networks, since TVs may be plugged into office networks.