A security researcher known as log4j says Samsung's 2025 TVs collect far more user data than disclosed, apparently to refine targeted advertising. The probe began with ads that seemed too precise: to understand what was happening, the researcher analyzed the Tizen operating system firmware, which was encrypted. After obtaining root access through a zero-day vulnerability, log4j published a series of findings on X.
According to log4j, the system code includes detailed telemetry, audio categorization, screenshots, cross-device tracking through an advertising identifier called AID, and computer vision models running on the TV. The researcher also describes a convolutional neural network that would record which videos are watched, which ads are skipped and playback progress. He suggests this continuous processing may explain why the TVs are sluggish.
The most controversial point concerns models without a microphone. Log4j claims the system would look for connected devices with microphones, such as a soundbar or a Bluetooth accessory, to record audio. A first practical test offered partial support: Hugging Face engineer ngxson, using a Flipper Zero, saw the microphone activate for five seconds and then stop, with no further recordings in the following hours. He noted that his TV was already rooted with several settings disabled, so an unmodified set may behave differently.
Log4j also said OpenAI banned his account for cyber abuse after he used its tools during the analysis. He argues he used them only for local reverse engineering and did not breach the terms of use, suspecting an overly primitive automated classifier.
The case fits a wider picture. A recent Northeastern University study, "Watching the Watchers", found that smart TVs from Samsung, Vizio and Roku keep sending data to automatic content recognition endpoints even after users opt out of tracking. AlexTech had already explained the role of ACR, the technology that identifies on-screen content, while AlexTech documented similar tests on LG TVs. Samsung has not yet responded to log4j's findings, and the full technical write-up he promised has not been published.
No comments yet. Be the first!