Roku Mobile App

Help with the Roku Mobile app on Android and iOS, adding channels, using remote control functionality, playing content from The Roku Channel, using Play on Roku, mobile private listening, and more.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 8

External Control>Disabled does not work

Summary: I do not seem to be able to prevent a remote device/app from controlling my Roku Express.  This is not an issue of my not understanding how to configure the Express, it's that the configuration options are not working. This appears to be the exact security problem that 2 years ago Roku denied that is had in https://blog.roku.com/consumer-reports-got-wrong

 

Here are the details:

I have a Roku Express, and have

  •  Settings>System>Advanced System Settings>Device Connect>Disable
  •  Settings>System>Advanced System Settings/Control by Mobile Apps>Network Access>Disabled

I then install the Roku Mobile App on my iPhone, and then select the Express as a device to control, and voila!, I can control the Roku Express. I'm not even prompted to pair the app with the Express, nor does the Express show the iPhone as a paired device. It just works, and nothing I do stops it from working.  I have tried rebooting the Roku, the settings remain as they should be, but the app can still control the device.

What gives? Seems like a security problem to me...

0 Kudos
6 Replies
Highlighted
Level 19

Re: External Control>Disabled does not work

@AbeSinger  Thanks for letting us know. Had you previously connected to your Roku device using that mobile phone, prior to disabling 'Control by mobile apps' on your Roku device? 

I will pass this along to the team to take a closer look and share any updates that I hear. 

 

Thanks,

Tanner

0 Kudos
Highlighted
Level 8

Re: External Control>Disabled does not work

I believe "Control by Mobile Apps" was disabled, but I'm not entirely sure.

 

However, I tested again using a different phone, with both "Control by Mobile Apps" and "Network Connect" disabled and got the same results -- the app on the phone was able to connect immediately, without any need to authorize the pairing on the Roku Express, and without any indication on the Roku that the phone/app is paired.

This is definitely a reproducible bug.

 

0 Kudos
Highlighted
Level 19

Re: External Control>Disabled does not work

@AbeSinger  Thanks for the follow-up. A quick update with further clarification to share here. This feature is designed to allow you to prevent 3rd party mobile apps from being able to connect to your device, such as other remote apps. It does not prevent the Roku mobile app from connecting to your device. We appreciate you reaching out! 

 

Thanks,

Tanner

0 Kudos
Highlighted
Level 8

Re: External Control>Disabled does not work

@RokuTannerD 

okay, so what you're telling me is that anyone on the network with the Roku can install the Roku App and take over control of the Roku Player, there is no way to identify what devices are doing so, and there is no way to stop them.  Did I get that right?

Assuming I did get that right, then you definitely have a security problem.  On its face, not being able to detect or deny access is a problem.

But more importantly, if your app can control a Roku device without authorization, someone can reverse engineer the app and create a malicious app that can do the same.

Highlighted
Level 7

Re: External Control>Disabled does not work

Do you have any plans on fixing this issue? I live in a college dorm and just had someone use the app to connect to my tv and start playing aggressive porn super loudly on my TV while I'm doing homework. Maybe a password needed to connect to the TV each time? I don't have the option of using a private network up here but my friends and I are now scared to leave out TVs plugged in since anyone can access it at any time.

Highlighted
Level 7

Roku remote

How to I block someone from accessing the remote off their phone because I have a Roku but my sister has the app on her phone and can connect to my tv anytime and change what I’m watching without my permission so how can I turn it off or disable it from her phone 

0 Kudos