Thursday, December 27, 2018

ROKU Smart TV security flaws

SpyAdvice
SpyAdvice > News > Roku and Samsung Smart TVs are Vulnerable to Hacking

NEWS
Roku and Samsung Smart TVs are Vulnerable to Hacking
Smart TVs can make you fall a prey to hackers – Finds Consumer Reports!
Abeerah Hashim
Abeerah HashimNo Comment
posted on Feb. 07, 2018 at 9:44 pm
Smart TVs are entering into our lives just as overwhelmingly as did the smartphones. However, it is great that they have not yet invaded our lives completely.

Wondering why did we say so?

Well, the smart TVs are still under research about their pros and cons, and the subsequent impact on our routine.

Thanks to Consumer Reports that has unveiled a horrifying aspect of Smart TVs for us. According to their study, Smart TVs can actually be used as a tool for hacking attacks.

Hackers Can Access Your Smart TVs to Gain Information
Consumer Reports has recently reported about its findings regarding Samsung and Roku Smart TVs.

They purchased and analyzed the smart TVs from the top five selling brands – Samsung, TCL, Sony, LG, and Vizio.

These TVs were brought under various privacy and security tests.

Roku Samsung Smart TVs Vulnerable Hacking
Specific smart TVs can not only raise the privacy concerns; but also the hackers could control them remotely, and even spy on you. (Image: by Janitors/Flickr)
According to the results, Samsung and TCL badly failed even on the most basic security tests. Whereas, the other three brands also showed potential vulnerabilities to hacking.

However, those vulnerabilities were not as dangerous and did not contribute to leaking user data.

The reports highlighted that hackers could attack Samsung and all the models of TCL that work on Roku’s technology.

According to the researcher, the hackers might not steal a user’s personal or sensitive information from the smart TV.

Nevertheless, they can do horrifying things to your TV, even when you are watching – such as changing the channels, raising the volume up, play offensive content, and other similar actions like spying on you via the set.

The hacking attacks are easily possible over the web.

Is it Threatening?
Eason Goodale, the lead engineer of Disconnect, pointed out that Roku devices sport a less secure API which makes them vulnerable to cyber-attacks.

According to the CR security test reports, the user data may not be retrieved from a smart TV unless the user connects the TV to the home network, and then downloads a malicious app or file on the laptop or smartphone through the same network.

For the privacy tests, Consumer Reports mentions that all the brands asked for permissions to gather user data.

Though it sounds like a restriction, it actually plays no significant protection.

During various installations, a user is bound to give full access to the apps to enjoy all features.

Denying even the most basic features will result in your smart TV becoming dumb!

Hence, it is easier to gain access via a smart TV when you have given full access to it.

The Guilty TV Brands’ Stake
Upon highlighting the flaws, Samsung modestly thanked the reporters for highlighting this issue. They also committed to upgrading the API for more secure functionality.

However, Roku authorities denied the results by saying that the Roku API features are secure and that the user can swiftly turn off any external features through the settings.

They claim that they use to take strict measures for consumer privacy. They further urge the users to keep their Wi-Fi connections protected via passwords to prevent any potential hacker attacks.

Possible Solution a Consumer Could Do
Buy a dumb older TV!

This is what you would have just thought of after knowing this news.

But, obviously, you cannot revert back to your tech advancements only because of a probable hacker attack.

Nor you can find more of such TVs in the market right now.

According to Consumer Reports, only 16 out of the 200 TV sets in 2017 were not among the smart TVs.

This year, we can thus expect a further drop in this percentage of old TVs.

So what preemptive measures can you take to protect you and your smart TV? A slight changing in the settings may help such as the ones listed below.

Reset Factory Settings – revert back all the changes you had made to your smart TV to the preset factory settings. Then, while reconfiguring, just choose the most basic options for your TV, that doo, without allowing any collection of data.
Turn off ACR – Digging down deep into the settings will reveal all the ACR settings to you. Turn them off and protect yourself. If you face difficulty, contact the maker’s customer support and ask them about ACR. In this way, you will also indirectly make them realize that you are concerned about your privacy! Probably they could strengthen their security systems!
Turn off WiFi – That is painful, but a permanent solution. Forget that you once had a smart TV. Just turn off the WiFi connection on the TV and enjoy safe viewing. Or, if you have become too reliant on technology, get a separate connection for your TV.
The CR’s latest report suffices to jolt our minds regarding this new means of hacker attempts. Undoubtedly this could trigger further studies about how to make the user experience for smart TV safe and secure.

Subscribe To Our Weekly Newsletter For Free
We pull together the top advice and news each week to keep you informed on all the spying and privacy related topics, do not miss it!

Your Email Address
We do not spam, and won't - EVER.

Tags:HackingPrivacyRokuSamsungSmart TVs
PREVIOUS ARTICLE
The Ultimate Qustodio Review that is Worth Your Time
NEXT ARTICLE
Why Privacy Matters in this Digital Spy Age
Abeerah Hashim
ABEERAH HASHIM
Staff Writer
Abeerah is a passionate blogger/web writer for several years with particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about hacking, spying, and gaming has always enchanted her. When she is not writing, what else can be a better pastime for her than web surfing and staying updated about the tech world!
ABEERAH HASHIM
LEAVE A REPLY
READINGS YOU MIGHT ALSO LIKE
Spying
ASS Access: The Australian government goes honest about spying
3 Days Ago
Privacy
Canadian Privacy Breach Notification Law in Force Now
1 Month Ago
Facebook Google
Tech giants Facebook and Google accused of spying on users locations
2 Months Ago
Facebook Spy
Facebook vows not to spy as the social giant introduces video chat portal
2 Months Ago
Online privacy security
12 Quick Tips to Ensure Your Online Privacy and Security
3 Months Ago
14 Top Free Tools to Protect Privacy Online
14 Top Free Tools to Protect Privacy Online
5 Months Ago
LATEST POSTS
ASS Access: The Australian government goes honest about spying
3 Days Ago
So You Like to Use Free Public Wifi? How Safe are You, Really?
2 Weeks Ago
9 tips for you to stay safe this holiday season while shopping online
2 Weeks Ago
Canadian Privacy Breach Notification Law in Force Now
1 Month Ago
Tech giants Facebook and Google accused of spying on users locations
2 Months Ago
POPULAR READINGS
Android Keylogger
12 Best Android Keylogger Apps in 2018 (no-Root, Hidden)
10 Months Ago
How to Spy on Spouse without Them Knowing Ever
11 Months Ago
2 Easy Ways to Let You Spy on Internet of Anyone
12 Months Ago
25 Best Free Web Proxies for Safer and Anonymous Surfing
10 Months Ago
How to Spy on Someone without them Knowing
1 Year Ago
Disclaimer
Spying is NOT a good act, in most of the cases. This website and all of its content including the links to other sites are presented in general form - just for the informational purposes. Please be advised to seek a legal advice for all the topics you wish to follow on with if your mind raises any doubt.

SpyAdvice
ABOUT US
SpyAdvice publishes latest spying news, guides, best spy software reviews and other detailed analysis around spy industry to help users make right choices and get all the information they need about spying. Know more

© Copyright 2017 SpyAdvice.
About Us Privacy Policy Career Affiliate Disclosure Contact Us All Entries
9
SHARES

Wednesday, December 19, 2018

Cpap device spying on you?


Medpage Today

Enter Search Terms
Home
Specialties
Education
Health Policy
Meetings
Practice Mgmt
Videos
Columns
Condition Centers
Careers
More
Back
Allergy & Immunology
Anesthesiology
Cardiology
Critical Care
Dermatology
Emergency Medicine
Endocrinology
Gastroenterology
Genetics
Geriatrics
HIV / AIDS
Hospital-Based Medicine
Infectious Disease
Nephrology
Neurology
Nursing
OB / GYN
Oncology / Hematology
Ophthalmology
Orthopedics
Pain Management
Pathology
Pediatrics

CPAP or Surveillance Device?
You snooze, you lose personal information to insurers
SAVESAVED




by Marshall Allen, ProPublica
November 27, 2018
Last March, Tony Schmidt discovered something unsettling about the machine that helps him breathe at night. Without his knowledge, it was spying on him.

From his bedside, the device was tracking when he was using it and sending the information not just to his doctor, but to the maker of the machine, to the medical supply company that provided it and to his health insurer.

Schmidt, an information technology specialist from Carrollton, Texas, was shocked. "I had no idea they were sending my information across the wire."

Schmidt, 59, has sleep apnea, a disorder that causes worrisome breaks in his breathing at night. Like millions of people, he relies on a continuous positive airway pressure, or CPAP, machine that streams warm air into his nose while he sleeps, keeping his airway open. Without it, Schmidt would wake up hundreds of times a night; then, during the day, he'd nod off at work, sometimes while driving and even as he sat on the toilet.

"I couldn't keep a job," he said. "I couldn't stay awake." The CPAP, he said, saved his career, maybe even his life.

As many CPAP users discover, the life-altering device comes with caveats: Health insurance companies are often tracking whether patients use them. If they aren't, the insurers might not cover the machines or the supplies that go with them.

In fact, faced with the popularity of CPAPs, which can cost $400 to $800, and their need for replacement filters, face masks and hoses, health insurers have deployed a host of tactics that can make the therapy more expensive or even price it out of reach.

Patients have been required to rent CPAPs at rates that total much more than the retail price of the devices, or they've discovered that the supplies would be substantially cheaper if they didn't have insurance at all.

Experts who study health care costs say insurers' CPAP strategies are part of the industry's playbook of shifting the costs of widely used therapies, devices, and tests to unsuspecting patients.

"The doctors and providers are not in control of medicine anymore," said Harry Lawrence, owner of Advanced Oxy-Med Services, a New York company that provides CPAP supplies. "It's strictly the insurance companies. They call the shots."

Insurers say their concerns are legitimate. The masks and hoses can be cumbersome and noisy, and studies show that about third of patients don't use their CPAPs as directed.

But the companies' practices have spawned lawsuits and concerns by some doctors who say that policies that restrict access to the machines could have serious, or even deadly, consequences for patients with severe conditions. And privacy experts worry that data collected by insurers could be used to discriminate against patients or raise their costs.

Schmidt's privacy concerns began the day after he registered his new CPAP unit with ResMed, its manufacturer. He opted out of receiving any further information. But he had barely wiped the sleep out of his eyes the next morning when a peppy email arrived in his inbox. It was ResMed, praising him for completing his first night of therapy. "Congratulations! You've earned yourself a badge!" the email said.

Then came this exchange with his supply company, Medigy: Schmidt had emailed the company to praise the "professional, kind, efficient and competent" technician who set up the device. A Medigy representative wrote back, thanking him, then adding that Schmidt's machine "is doing a great job keeping your airway open." A report detailing Schmidt's usage was attached.

Alarmed, Schmidt complained to Medigy and learned his data was also being shared with his insurer, Blue Cross Blue Shield. He'd known his old machine had tracked his sleep because he'd taken its removable data card to his doctor. But this new invasion of privacy felt different. Was the data encrypted to protect his privacy as it was transmitted? What else were they doing with his personal information?

He filed complaints with the Better Business Bureau and the federal government to no avail. "My doctor is the ONLY one that has permission to have my data," he wrote in one complaint.

In an email, a Blue Cross Blue Shield spokesperson said that it's standard practice for insurers to monitor sleep apnea patients and deny payment if they aren't using the machine. And privacy experts said that sharing the data with insurance companies is allowed under federal privacy laws. A ResMed representative said once patients have given consent, it may share the data it gathers, which is encrypted, with the patients' doctors, insurers and supply companies.

Schmidt returned the new CPAP machine and went back to a model that allowed him to use a removable data card. His doctor can verify his compliance, he said.

Luke Petty, the operations manager for Medigy, said a lot of CPAP users direct their ire at companies like his. The complaints online number in the thousands. But insurance companies set the prices and make the rules, he said, and suppliers follow them, so they can get paid.

"Every year it's a new hurdle, a new trick, a new game for the patients," Petty said.

A Sleep Saving Machine Gets Popular

The American Sleep Apnea Association estimates about 22 million Americans have sleep apnea, although it's often not diagnosed. The number of people seeking treatment has grown along with awareness of the disorder. It's a potentially serious disorder that left untreated can lead to risks for heart disease, diabetes, cancer, and cognitive disorders. CPAP is one of the only treatments that works for many patients.

Exact numbers are hard to come by, but ResMed, the leading device maker, said it's monitoring the CPAP use of millions of patients.

Sleep apnea specialists and health care cost experts say insurers have countered the deluge by forcing patients to prove they're using the treatment.

Medicare, the government insurance program for seniors and the disabled, began requiring CPAP "compliance" after a boom in demand. Because of the discomfort of wearing a mask, hooked up to a noisy machine, many patients struggle to adapt to nightly use. Between 2001 and 2009, Medicare payments for individual sleep studies almost quadrupled to $235 million. Many of those studies led to a CPAP prescription. Under Medicare rules, patients must use the CPAP for four hours a night for at least 70% of the nights in any 30-day period within three months of getting the device. Medicare requires doctors to document the adherence and effectiveness of the therapy.

Sleep apnea experts deemed Medicare's requirements arbitrary. But private insurers soon adopted similar rules, verifying usage with data from patients' machines -- with or without their knowledge.

Kristine Grow, spokeswoman for the trade association America's Health Insurance Plans, said monitoring CPAP use is important because if patients aren't using the machines, a less expensive therapy might be a smarter option. Monitoring patients also helps insurance companies advise doctors about the best treatment for patients, she said. When asked why insurers don't just rely on doctors to verify compliance, Grow said she didn't know.

Many insurers also require patients to rack up monthly rental fees rather than simply pay for a CPAP.

Dr. Ofer Jacobowitz, a sleep apnea expert at ENT and Allergy Associates and assistant professor at The Mount Sinai Hospital in New York, said his patients often pay rental fees for a year or longer before meeting the prices insurers set for their CPAPs. But since patients' deductibles -- the amount they must pay before insurance kicks in -- reset at the beginning of each year, they may end up covering the entire cost of the rental for much of that time, he said.

The rental fees can surpass the retail cost of the machine, patients and doctors say. Alan Levy, an attorney who lives in Rahway, New Jersey, bought an individual insurance plan through the now-defunct Health Republic Insurance of New Jersey in 2015. When his doctor prescribed a CPAP, the company that supplied his device, At Home Medical, told him he needed to rent the device for $104 a month for 15 months. The company told him the cost of the CPAP was $2,400.

Levy said he wouldn't have worried about the cost if his insurance had paid it. But Levy's plan required him to reach a $5,000 deductible before his insurance plan paid a dime. So Levy looked online and discovered the machine actually cost about $500.

Levy said he called At Home Medical to ask if he could avoid the rental fee and pay $500 up front for the machine, and a company representative said no. "I'm being overcharged simply because I have insurance," Levy recalled protesting.

Levy refused to pay the rental fees. "At no point did I ever agree to enter into a monthly rental subscription," he wrote in a letter disputing the charges. He asked for documentation supporting the cost. The company responded that he was being billed under the provisions of his insurance carrier.

Levy's law practice focuses, ironically, on defending insurance companies in personal injury cases. So he sued At Home Medical, accusing the company of violating the New Jersey Consumer Fraud Act. Levy didn't expect the case to go to trial. "I knew they were going to have to spend thousands of dollars on attorney's fees to defend a claim worth hundreds of dollars," he said.

Sure enough, At Home Medical, agreed to allow Levy to pay $600 -- still more than the retail cost -- for the machine.

The company declined to comment on the case. Suppliers said that Levy's case is extreme, but acknowledged that patients' rental fees often add up to more than the device is worth.

Levy said that he was happy to abide by the terms of his plan, but that didn't mean the insurance company could charge him an unfair price. "If the machine's worth $500, no matter what the plan says, or the medical device company says, they shouldn't be charging many times that price," he said.

Dr. Douglas Kirsch, president of the American Academy of Sleep Medicine, said high rental fees aren't the only problem. Patients can also get better deals on CPAP filters, hoses, masks and other supplies when they don't use insurance, he said.

Cigna, one of the largest health insurers in the country, currently faces a class-action suit in U.S. District Court in Connecticut over its billing practices, including for CPAP supplies. One of the plaintiffs, Jeffrey Neufeld, who lives in Connecticut, contends that Cigna directed him to order his supplies through a middleman who jacked up the prices.

Neufeld declined to comment for this story. But his attorney, Robert Izard, said Cigna contracted with a company called CareCentrix, which coordinates a network of suppliers for the insurer. Neufeld decided to contact his supplier directly to find out what it had been paid for his supplies and compare that to what he was being charged. He discovered that he was paying substantially more than the supplier said the products were worth. For instance, Neufeld owed $25.68 for a disposable filter under his Cigna plan, while the supplier was paid $7.50. He owed $147.78 for a face mask through his Cigna plan while the supplier was paid $95.

ProPublica found all the CPAP supplies billed to Neufeld online at even lower prices than those the supplier had been paid. Longtime CPAP users say it's well known that supplies are cheaper when they are purchased without insurance.

Neufeld's cost "should have been based on the lower amount charged by the actual provider, not the marked-up bill from the middleman," Izard said. Patients covered by other insurance companies may have fallen victim to similar markups, he said.

Cigna would not comment on the case. But in documents filed in the suit, it denied misrepresenting costs or overcharging Neufeld. The supply company did not return calls for comment.

In a statement, Stephen Wogen, CareCentrix's chief growth officer, said insurers may agree to pay higher prices for some services, while negotiating lower prices for others, to achieve better overall value. For this reason, he said, isolating select prices doesn't reflect the overall value of the company's services. CareCentrix declined to comment on Neufeld's allegations.

Izard said Cigna and CareCentrix benefit from such behind-the-scenes deals by shifting the extra costs to patients, who often end up covering the marked-up prices out of their deductibles. And even once their insurance kicks in, the amount the patients must pay will be much higher.

The ubiquity of CPAP insurance concerns struck home during the reporting of this story, when a ProPublica colleague discovered how his insurer was using his data against him.

Sleep Aid or Surveillance Device?

Without his CPAP, Eric Umansky, a deputy managing editor at ProPublica, wakes up repeatedly through the night and snores so insufferably that he is banished to the living room couch. "My marriage depends on it."

In September, his doctor prescribed a new mask and airflow setting for his machine. Advanced Oxy-Med Services, the medical supply company approved by his insurer, sent him a modem that he plugged into his machine, giving the company the ability to change the settings remotely if needed.

But when the mask hadn't arrived a few days later, Umansky called Advanced Oxy-Med. That's when he got a surprise: His insurance company might not pay for the mask, a customer service representative told him, because he hadn't been using his machine enough. "On Tuesday night, you only used the mask for three-and-a-half hours," the representative said. "And on Monday night, you only used it for three hours."

"Wait -- you guys are using this thing to track my sleep?" Umansky recalled saying. "And you are using it to deny me something my doctor says I need?"

Umansky's new modem had been beaming his personal data from his Brooklyn bedroom to the Newburgh, New York-based supply company, which, in turn, forwarded the information to his insurance company, UnitedHealthcare.

Umansky was bewildered. He hadn't been using the machine all night because he needed a new mask. But his insurance company wouldn't pay for the new mask until he proved he was using the machine all night -- even though, in his case, he, not the insurance company, is the owner of the device.

"You view it as a device that is yours and is serving you," Umansky said. "And suddenly you realize it is a surveillance device being used by your health insurance company to limit your access to health care."

Privacy experts said such concerns are likely to grow as a host of devices now gather data about patients, including insertable heart monitors and blood glucose meters, as well as Fitbits, Apple Watches, and other lifestyle applications. Privacy laws have lagged behind this new technology, and patients may be surprised to learn how little control they have over how the data is used or with whom it is shared, said Pam Dixon, executive director of the World Privacy Forum.

"What if they find you only sleep a fitful five hours a night?" Dixon said. "That's a big deal over time. Does that affect your health care prices?"

UnitedHealthcare said in a statement that it only uses the data from CPAPs to verify patients are using the machines.

Lawrence, the owner of Advanced Oxy-Med Services, conceded that his company should have told Umansky his CPAP use would be monitored for compliance, but it had to follow the insurers' rules to get paid.

As for Umansky, it's now been two months since his doctor prescribed him a new airflow setting for his CPAP machine. The supply company has been paying close attention to his usage, Umansky said, but it still hasn't updated the setting.

The irony is not lost on Umansky: "I wish they would spend as much time providing me actual care as they do monitoring whether I'm 'compliant.'"

This post first appeared on ProPublica, a Pulitzer Prize-winning investigative online service.

LAST UPDATED 11.27.2018

Next: Toxic Baby Powder; NIH Stiffens Funding Rules; Child Psychiatrist Probe Continues
10 Comments
Latest on MedPage Today
The Key to Successful Rounding
Robert Centor, MD, shares how to help your learners
CME/CE
COPD Ups Death Risk in Heart Failure Patients
But increased risk was specific to patients who received most intense COPD medication regimens
Risk of Pelvic Floor Disorders Varied by Child Delivery Mode
Less likelihood of stress urinary incontinence with C-section, researchers say
Antidepressants Improve Disease Course in IBD
Tied to lower risk of relapse, step-up medications, and IBD-related hospitalizations
Game of Upcodes: PCI for Stable Angina Slipping Through the Cracks
Research finds potential fraud in the cath lab
HHS Secretary Azar Just Doesn't Get It
His arguments against "Medicare for All" are flawed, says Caroline Poplin, MD, JD
Pelzman's Picks: Is a COI Fail Really Research Misconduct?
Also, why pharma pays patients to stick with branded drugs
About Help Center Site Map Terms of Use Privacy Policy Advertise with us   AdChoices Accessibility Statement
The material on this site is for informational purposes only, and is not a substitute for medical advice, diagnosis or treatment provided by a qualified health care provider.
© 2018 MedPage Today, LLC. All rights reserved.

Accessibility Statement
At MedPage Today, we are committed to ensuring that individuals with disabilities can access all of the content offered by MedPage Today through our website and other properties. If you are having trouble accessing www.medpagetoday.com, MedPageToday's mobile apps, please email legal@ziffdavis.com for assistance. Please put "ADA Inquiry" in the subject line of your email.