The transition to the new broadcast standard known as ATSC 3.0, or NextGen TV, is currently underway. As part of this shift, broadcasters are moving toward encrypting television signals, a move that renders nearly all existing TVs and tuning unable to receive live broadcasts.
And the tuning boxes that the broadcast industry is requiring consumers to buy to watch free over the air TV are not great. What’s worse, they’re dangerously insecure.
In my latest video, I had a local AI model poke around the lowest price box, from ADTH, and found some dangerous vulnerabilities.
The second-generation ADTH tuning box serves as a primary example of these issues. Upon inspection, the device is running Android 11 with a security patch level dated October 1, 2021. This means the operating system is several years out of date. Google officially sunsetted support for Android 11 in 2024, leaving this hardware with hundreds of unpatched vulnerabilities.
Through testing on a local area network, I have identified several vulnerabilities. I was able to inject a still a still image on the screen while the box still registered as being tuned to an encrypted local NBC affiliate. This was not an attack on the radio frequency signal itself, but rather a local network exploit of the box’s internal software through an unauthenticated API.
Further testing of the ADTH box revealed that it is possible to inject video directly into the program stream too. By running a script from a computer on the same network, I replaced the live broadcast with a custom video file. The device continued to display the interactive feature overlay from the original channel, unaware that the stream had been compromised.
This is possible thanks to an open API server on the box that accepts various commands without any form of authentication. I was able to pull a complete list of available ATSC 3.0 channels and change the channel remotely. While this might only result in minor household pranks in a single-family home, it poses a larger risk in environments like apartment buildings or commercial spaces where multiple people share a Wi-Fi network. Furthermore, an open web server on port 3000 allows anyone on the network to access the device’s unique identifier and monitor what is being watched.
The security flaws also impact the stability of the device. I successfully generated a script that crashes the TV player application on command, forcing it to reset. While I have not yet identified a method for remote code execution or rooting the device, the ability to crash the tuner via a simple network script suggests the potential for more serious exploits, such as buffer overflows that can exploit the out of date operating system.
These vulnerabilities represent a notable level of sloppiness in the security design of a consumer product. Using a local AI model and basic scripting, I was able to gain significant control over the device in less than two days. A more skilled actor with could likely find even more intrusive ways to exploit a system that is five years behind on security updates.
As the broadcast industry continues to push for digital rights management in public interest broadcasts, the quality and security of the required hardware remain under-regulated. The FCC should take note of these security lapses, as consumers deserve both the ability to access public broadcasts and the assurance that the devices they are forced to use are not creating unnecessary risks on their home networks.