Samsung Bans Smart TV Apps That Share Users' Internet with Strangers

The Norwegian firm Mnemonic has published research finding that a number of popular apps for Samsung televisions contain code that routes other people's web traffic through the owner's home connection. Millions of devices could be at risk: some of these apps, according to their developers, are installed on hundreds of millions of televisions.

The issue concerns so-called residential proxy networks (resproxy). An app with this kind of code turns a Smart TV into a permanently running tunnel — an “exit node” through which outsiders push their own traffic, and it keeps working even after the app has been closed.

A Pac-Man Game from “Editor's Choice”

Among the infected apps was a simple Pac-Man game that Samsung itself recommended and featured in its “Editor's Choice” section. After gaining root access to a television, Mnemonic researcher Harrison Sand found residential-proxy code from the Israeli company Bright Data inside it. The code doesn't activate right away: it stays dormant until the user accepts the terms on a consent screen, after which it runs in the background until the app is deleted.

The problem, the researchers believe, is systemic. Many such apps are empty shells of just a few lines of code that merely load content from a third-party server. A review in the store shows only those lines, not what actually gets executed. “What is reviewed isn't necessarily what runs,” Sand writes. What's more, “a simple change to the code on the web server” could instantly turn hundreds of millions of televisions into a potentially malicious botnet.

What's Inside the Proxy Network

Residential proxies are not, in themselves, banned. They're used to circumvent censorship, and AI companies increasingly route mass data collection for training models through them. But such networks have a bad reputation: they let hackers and spies disguise attacks as the traffic of an ordinary household, and the data is usually encrypted and can't be inspected.

Analyzing his television's traffic, Sand saw that a significant portion of it appeared to be mass harvesting of LinkedIn profiles and data for AI training. Even so, he was seeing only a tiny fraction of everything passing through Bright Data's network. The company did not respond to a request for comment.

After being contacted by TechCrunch, Samsung said it had already restricted the registration of new apps with proxy functions and was introducing developer rules that explicitly prohibit resproxy SDKs. The company intends to identify and remove all such apps from its store. LG took a similar step a month earlier, following reports that roughly 42% of the apps in its store were enrolling televisions in proxy networks.

Source: TechCrunch