Telnet control of Toshiba Smart TVs

Here's how to control the Toshiba 49U6863 - and other similar models - using Telnet.

Quickstart

At the command prompt, type telnet 192.168.0.123 4660 then type 1012 and your TV will turn on. MAGIC!

Background

After six years of use, I decided to upgrade my old 37 inch Panasonic TV. I know Toshiba aren't the coolest brand around, but the 49 inch monster was half the price of the old TV. Yay Moore's Law!

BUT! It turns out that Toshiba don't actually manufacture their own TVs. They just rebadge screens made by Vestel - a Turkish company.

And, the Android remote app is made by Cabot Communications. It is pretty crappy.

Neither Vestel nor Cabot are interested in providing documentation, or any technology support. Hmmm... Reminds me, I need to do a GPL request to Vestel...

So it is up to fearless hackers to reverse engineer what they've done.

Open Source To The Rescue!

Before trying anything yourself, see if someone else has done the hard work for you. Teemu Mikkonen had already written some code to control his Vestel TV. It didn't quite work with the Toshiba models, but gave a good starting point.

WebSockets

The TV has a WebSocket interface, which broadcasts some information. Here's a scrap of JavaScript to show you the basics:

⧉ JavaScriptvar TV = new WebSocket("ws://192.168.0.123:7681/")
TV.onmessage = function (event) { console.log(event.data); }

As you play about with the TV, you'll see various messages pop back - but they're not that useful.

Port Scan

Like all good movie hackers I use nmap. Here's what it reported to be open:

⧉ 2870/tcp open unknown
4660/tcp open mosmig
4661/tcp open unknown
4725/tcp open unknown
7681/tcp open unknown
56789/tcp open unknown
56790/tcp open unknown
57707/tcp open unknown

I hit the jackpot with the second port! telnet 192.168.0.123 4660 got me in. 1337 h4x0r!

Who's got the button?

I used JADX to decompile Toshiba's Android remote app.

Here are the button codes I found:

⧉ BUTTON_HOME 1046
BUTTON_POWER    1012
BUTTON_POWER_NAV    1012
BUTTON_POWER_PLAYER 1012
BUTTON_POWER_PVM    1012
BUTTON_POWER_GES_NAV    1012
BUTTON_POWER_GES_PLAYER 1012
BUTTON_POWER_GES_PVM    1012
BUTTON_RECORD   1051
BUTTON_PLAY 1025
BUTTON_PAUSE    1049
BUTTON_STOP 1024
BUTTON_PREVIOUS 1034
BUTTON_REWIND   1027
BUTTON_FORWARD  1028
BUTTON_NEXT 1255
BUTTON_SCREEN   1011
BUTTON_LANG 1015
BUTTON_SUBTITLE 1031
BUTTON_PRESETS  1014
BUTTON_EPG  1047
BUTTON_TEXT 1255
BUTTON_FAV  1040
BUTTON_3D   1040
BUTTON_SLEEP    1042
BUTTON_0    1000
BUTTON_1    1001
BUTTON_2    1002
BUTTON_3    1003
BUTTON_4    1004
BUTTON_5    1005
BUTTON_6    1006
BUTTON_7    1007
BUTTON_8    1008
BUTTON_9    1009
BUTTON_MENU 1048
BUTTON_MUTE 1013
BUTTON_UP   1020
BUTTON_LEFT 1021
BUTTON_OK   1053
BUTTON_RIGHT    1022
BUTTON_DOWN 1019
BUTTON_VOL_UP   1016
BUTTON_VOL_DOWN 1017
BUTTON_VOL_UP_2 1016
BUTTON_VOL_DOWN_2   1017
BUTTON_PROG_UP  1032
BUTTON_PROG_DOWN    1033
BUTTON_BACK 1010
BUTTON_EXIT 1037
BUTTON_RED  1055
BUTTON_GREEN    1054
BUTTON_YELLOW   1050
BUTTON_BLUE 1052
BUTTON_INFO 1018
BUTTON_MMEDIA   1057
BUTTON_SOURCE   1056
BUTTON_SWAP 1034
BUTTON_CHAN 1045
BUTTON_QMENU    1043

The good news is that the codes perfectly emulate a remote button push, so CEC passes the controls onto devices connected via HDMI.

Security? Where we're going, we don't need security!

Sadly, Vestel TV's are notorious for their lax security. This Toshiba branded one seems to have fixed most major flaws - I wasn't able to execute commands as root on the TV, for example.

But two minor privacy flaws are apparent. Any device on your home network can:

1. control the TV.
2. see its status messages.

Other vulnerabilities may be present, but Toshiba helpfully brands its TVs as "Secure".

I couldn't find any details about the Bavarian State Government's certification programme - let's hope it's good!