LG to Block Apps That Turn Smart TVs Into Proxy Nodes

LG Electronics USA has announced that it intends to suspend any apps for its smart TVs that turn the device into an always-on residential proxy. The decision came less than a month after the publication of research revealing the scale of the problem.

What the researchers found

The firm Spur studied how widespread residential-proxy SDKs are in Smart TV apps. It turned out that more than 42% of the programs available for download on LG televisions contain such components, which turn the TV into a proxy node for an indefinite period. On Samsung's Tizen-based TVs, similar components were found in more than a quarter of the apps.

The scheme is simple: developers monetize their apps by embedding SDKs from proxy providers, who pay for turning the user's device into a node that is rented out to third-party clients. Spur found such SDKs in a wide range of apps — from simple games like Pac-Man to screensavers and file utilities. For example, a version of Pac-Man from Bright Data offered the user a choice: watch ads in the game or allow the TV to serve as a proxy node. Most of the SDKs found on both manufacturers' TVs were in fact provided by the Bright Data network.

LG's response

LG senior vice president John Taylor told KrebsOnSecurity that the company is working with developers to remove the residential-proxy option from apps on the webOS platform. “A residential proxy network is not within the intended purpose of LG televisions,” he said. Apps from which the option is not removed will be suspended. According to Taylor, a review of the apps is already in full swing, and the process for evaluating programs from third-party developers will be strengthened.

The proxy providers themselves insist that they follow customer-vetting procedures (KYC) and apply technical measures that prevent renters from interacting with other devices on the user's home network. Bright Data did not respond to requests for comment.

The consent problem

Spur emphasizes that the issue is not the existence of proxy networks as such, but the fact that they are embedded in devices that most consumers do not consider computers at all and are unable to inspect. “A one-time consent buried in a TV app is no substitute for real transparency, ongoing control, and oversight by the platform,” writes Trevor Sutter of Spur. “The risk grows when consent is given by a family member who uses the device but should not be granting such permission — a minor, for example.”

Curiously, LG's decision to clean up its store coincided with another controversial episode: the Gamers Nexus channel showed that some LG LCD monitors automatically install, via Windows Update and without asking for confirmation, an app advertising paid McAfee antivirus subscriptions.

Source: Krebs on Security