Unveiling Residential Proxy SDKs in LG and Samsung Smart TV Apps

Residential proxy software embedded in smart TV apps from LG and Samsung raises security and privacy concerns.

Discovery of Residential Proxy SDKs in Smart TV Apps

A cybersecurity research team identified residential proxy software within applications on LG and Samsung smart TVs. These apps, often appearing as simple tools like fish tank displays or puzzle games, route internet traffic through home networks. The study by Spur Intelligence analyzed 6,038 apps across LG’s webOS and Samsung’s Tizen systems, finding 2,058 contained residential proxy SDKs. 34.1% of the apps across both platforms had such code.

How Residential Proxy SDKs Work

Residential proxy SDKs enable third parties to route web traffic through a user’s home internet connection, making requests appear to originate from a legitimate residential IP. When embedded in a smart TV app, the SDK uses the device’s network to transmit traffic. The primary app remains unobtrusive, often ad-free, while the proxy activity operates in the background, generating revenue for developers.

Smart TVs as Ideal Hosts for Proxy Activity

Smart TVs are well-suited for this purpose due to their constant connectivity and lack of user scrutiny. Unlike computers, they are often perceived as passive devices, remaining powered on for extended periods without drawing attention to network usage. This makes them ideal for hosting proxy operations without detection.

User Consent and App Examples

Consent for proxy functionality is typically granted once during the app’s initial setup. Analysis showed all consent prompts explicitly stated that the proxy service would continue operating after the app was closed. For example, *Galactic Harmony* offered ad-free gameplay in exchange for allowing the app to use the user’s IP address for web indexing. A similar arrangement was observed in a Pac-Man app on Tizen.

Entities Involved in Proxy SDK Distribution

Bright Data, Bright Data Ltd, and Bright SDK accounted for 367 proxy-enabled apps. Honeygain UAB, a subsidiary of Oxylabs, was linked to 16 apps. Many of these apps were categorized as low-value “shovelware,” including games, screensavers, and utility tools designed to host proxy software.

Platform Policies and Restrictions

Amazon and Roku have implemented restrictions against apps facilitating third-party proxy services. Amazon’s Device and System Abuse Policy prohibits such functionality, while Roku blocked developers using Bright SDKs. In contrast, LG and Samsung have not issued comparable guidelines, allowing the practice to persist on their platforms.

Risks to Home Networks

The presence of proxy software in smart TV apps introduces risks to home networks. If the proxy service allows access to internal resources or fails to filter private IP ranges, devices could be exploited to reach sensitive systems like routers, NAS devices, printers, or surveillance cameras. While some samples included blocklists for private ranges, others lacked such protections.

Company Responses and Security Measures

Bright Data emphasized user consent and audits to distinguish legitimate networks from malicious ones, restricting use to verified purposes. Massive stated users undergo KYC processes, with server-side technical controls. Oxylabs claimed to enforce access restrictions through filtering and blocklists, limiting participation to approved apps.

Conclusion: Need for Transparency and Regulation

The findings highlight the need for greater transparency and regulatory oversight of proxy services in consumer devices. As smart TVs integrate more functionality, the potential for misuse remains a critical concern for users and cybersecurity professionals.

About Author

Anuj

See author's posts