There’s yet another way for cybercrime to strike the enterprise, and it’s hiding in plain sight in your lunch room or employee lounge. It hides in the video conference room; it hides anywhere a large TV lives. It’s a smart TV, and according to security researchers, it may be the next major attack vector.

Why a Smart TV?

Smart TVs are basically computers. They have many of the same operating systems and capabilities as mobile devices but usually don’t require any authentication or security controls to function. They are not designed to be secure; they are designed to be bought and used by everyday consumers.

TVs are not typically considered to be malicious. But by running mobile operating systems such as Android, smart TVs can present a fairly soft target to cybercriminals because manufacturers stress convenience for users over security — a trade-off that could have severe consequences.

Not Just for Consumers

Sales of smart TVs are expected to grow by more than 20 percent per year through 2019, according to a study by Research and Markets. Such a high rate of adoption makes them attractive to cybercriminals who seek any new portal of entry.

CSO Online spoke with Phil Marshall, chief research officer for Tolaga Research, who was dismissive of manufacturers’ security efforts. “Many of the solutions aren’t even adapting the best practices that are already known in the IT world,” he said. “The ecosystem is fragmented, and there is an emphasis on getting the solution to market quickly.”

Major manufacturers such as Samsung, LG and Sony have built legitimate app stores for their smart TVs. But users could also be convinced to download malicious apps from third-party stores. This is an attack method that has been used against smartphones and could also be leveraged in smart TVs as well.

Other Cybercrime Attacks

There are other obvious security flaws. For example, some of these televisions do not use Secure Sockets Layer (SSL) or Transport Layer Security (TLS) encryption when downloading an update. That would make it possible to trick a TV into downloading malicious firmware that modifies its operating system. Certain models don’t even take the basic step of verifying the integrity of the downloaded firmware.

Another concern is the leak of personal payment information. As smart TVs become more integrated with commerce, people will enter their payment card details into their TVs to make purchases. If exposed, such information could put both the consumer and the vendor at risk.

Many of the issues surrounding smart TVs are the same as those in play for a whole range of devices that are now being network-enabled or connected to the Internet of Things (IoT). There will be no simple resolution for this kind of cybercrime. Enterprises have to be aware of the potential risks that can be associated with this sort of device.