EvilScreen 攻击：通过多通道遥控器模仿劫持智能电视
EvilScreen Attack: Smart TV Hijacking via Multi-channel Remote Control Mimicry
AI总结：
本文提出 EvilScreen 攻击，利用智能电视多通道遥控器通信缺乏强保护的漏洞，通过重用并组合不同遥控器命令绕过身份验证与隔离策略，实现对八款主流智能电视的远程资源访问与屏幕控制。
摘要：
现代智能电视通常使用多个无线通道（例如红外、蓝牙和 Wi-Fi）与其遥控器（包括智能手机模拟的遥控器）进行通信。然而，这种多通道遥控器通信引入了新的攻击面。一个固有的安全缺陷是，大多数智能电视的遥控器被设计为在良性环境中工作，而不是在对抗性环境中工作，因此智能电视与其遥控器之间的无线通信没有得到强保护。攻击者可以利用这种缺陷来滥用遥控器通信并危害智能电视系统。在本文中，我们提出了 EvilScreen，这是一种新型攻击，利用保护不力的遥控器通信来访问智能电视的受保护资源，甚至控制屏幕。EvilScreen 利用了当今智能电视中存在的多通道遥控器模仿漏洞。其他攻击通过利用代码漏洞或恶意第三方应用来危害电视系统，与之不同的是，EvilScreen 直接重用不同遥控器的命令，将它们组合在一起以绕过已部署的身份验证和隔离策略，最终远程访问或控制电视资源。我们评估了八款主流智能电视，发现它们都容易受到 EvilScreen 攻击，包括一款采用 ISO/IEC 安全规范的三星产品。
英文摘要：
Modern smart TVs often communicate with their remote controls (including those smart phone simulated ones) using multiple wireless channels (e.g., Infrared, Bluetooth, and Wi-Fi). However, this multi-channel remote control communication introduces a new attack surface. An inherent security flaw is that remote controls of most smart TVs are designed to work in a benign environment rather than an adversarial one, and thus wireless communications between a smart TV and its remote controls are not strongly protected. Attackers could leverage such flaw to abuse the remote control communication and compromise smart TV systems. In this paper, we propose EvilScreen, a novel attack that exploits ill-protected remote control communications to access protected resources of a smart TV or even control the screen. EvilScreen exploits a multi-channel remote control mimicry vulnerability present in today smart TVs. Unlike other attacks, which compromise the TV system by exploiting code vulnerabilities or malicious third-party apps, EvilScreen directly reuses commands of different remote controls, combines them together to circumvent deployed authentication and isolation policies, and finally accesses or controls TV resources remotely. We evaluated eight mainstream smart TVs and found that they are all vulnerable to EvilScreen attacks, including a Samsung product adopting the ISO/IEC security specification.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
