Samsung Bans Smart TV Apps That Share Users' Internet Connections with Strangers

The Discovery

Several popular Samsung smart TV apps contain code that sh the owner's internet connection with strangers, potentially putting millions of Samsung smart TVs at risk of hijacking, according to new security research published on Monday.

Some of these apps claim to have been installed on hundreds of millions of smart TVs in people's homes, per the app developers . At least one of the smart TV apps was a simple Pac-Man game that Samsung had endorsed and prominently featured in its "Editor's Choice" section on customers' TV screens .

The research, conducted by Norwegian cybersecurity company Mnemonic, describes what it calls a "perfect storm" of problems that allows low-quality apps to proliferate across Samsung's app store, containing code that puts users at risk of having their internet connections tapped by a rogue app .

What the Code Does

These apps contain software that funnels outsiders' web traffic through ordinary home and office internet connections, known as residential proxy networks (or "resproxies"), which are increasingly being linked to cybercrime . When opened, apps with resproxy code can turn the smart TV into an always-on tunnel for outsiders to funnel their web traffic through, known as an exit node, even when the app is no longer open.

A residential proxy network rents out the internet connections of ordinary households. Traffic from a paying customer enters the network and leaves through a consumer device, arriving at its destination with a residential IP address attached rather than one belonging to a data center. Within the industry, the shorthand is "resproxy," and the enlisted device is described as an exit node.

The Mnemonic research explains that this arrangement creates a significant security risk because the network traffic that flows through a user's device over resproxies is generally encrypted, which is practically impossible to unscramble and inspect. This makes it difficult for cybersecurity companies to distinguish legitimate traffic from malicious activity .

How Apps Evade Detection

Many of these apps are bare-bone shells, made from only a few lines of code, and are designed solely to load content from another website, such as a game. While such smart TV apps load content from another server, any review of these apps sees only the few lines of code within, and not necessarily the content itself .

"What was reviewed is not necessarily what is running," wrote Harrison Sand, an offensive security consultant at Mnemonic . This structural weakness in the app review process allows potentially harmful code to pass through the moderation process unnoticed .

The Technical Investigation

By rooting a Samsung smart TV's software, Sand gained deep access to the television's internals and analyzed all of the network traffic that flowed in and out of the TV. This included any app that was sharing the smart TV's internet connection with someone else .

He found the Pac-Man game contained resproxy code from Bright Data, an Israel-based company that provides proxy networks touting access to millions of residential networks around the world . The company also has a marketplace for selling access to scraped datasets. These datasets are derived from a network of enlisted smart TVs as exit nodes, which are used to download large amounts of public data from the web from multiple sources at once, often to circumvent systems designed to prevent scraping.

Sand found that Bright Data's resproxy code loaded when opening the Pac-Man game, but noted that this did not automatically turn the Samsung smart TV into an exit node . Sand said the resproxy code is dormant until the user accepts a consent screen, which immediately activates the resproxy code to run in the background until the user deletes the app .

The Consent Problem

The activation sequence matters for any assessment of consumer exposure. Sand found that the Bright Data code loaded when the game opened, but did not by itself convert the television into an exit node . The code remained dormant until the user accepted a consent screen. Acceptance activated it immediately, and it then ran in the background until the app was deleted.

However, consent screens on smart TVs are notoriously easy to click through without reading, and the research highlights concerns about whether users truly understand what they are agreeing to when they opt in . In some cases, the consent language is vague, referring to "occasional" use of the device's resources without clearly explaining the full scope of the arrangement .

Systemic Risk

Aside from the user themselves consenting to enlisting their device into a resproxy, Sand warned that a "simple code change on a web server" could instantly activate hundreds of millions of smart TVs into a potentially malicious botnet . This dependency on a single remote trigger represents a significant systemic vulnerability .

With access to the network data flowing through his smart TV, Sand could see that much of it appeared to suggest the proxy network was used for large-scale scraping of LinkedIn profiles, and for collecting AI training data . Sand said he only saw a tiny percentage of what was routed over Bright Data's network .

The Broader Context: Not Just Samsung

The issue extends beyond Samsung. Resproxy code can also be found in regular consumer phone apps, as well as other consumer electronics, like digital frames and Android streaming boxes, which then share that device's internet connection . Any time a resproxy app or device connects to the internet, an outsider can also pay to use it .

Previous research by the security firm Spur found that more than 42% of apps available on LG smart TVs contained similar proxy SDKs, and that more than a quarter of apps built for Samsung's Tizen operating system carried such components . Last month, LG announced it would ban apps that contain resproxy software .

Samsung's Response

After TechCrunch contacted Samsung with a request for comment about the research, the electronics giant said in an emailed statement that it was banning apps that share their users' internet connections, and will remove apps that contain the functionality.

"We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform," said a Samsung spokesperson . "We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components" .

Samsung's policy change involves three distinct commitments: a registration gate for new submissions, a written developer policy prohibiting the software development kits outright, and a retrospective sweep of the existing catalogue.

Resproxies: Legal but Controversial

Resproxies are not inherently illegal. Some are used for evading censorship by routing internet traffic through ordinary looking residential homes . AI companies, for example, increasingly rely on resproxies to scrape data from multiple places on the internet in one go to train their AI models .

But cybersecurity companies say resproxies have gained a reputation for allowing hackers and spies to carry out cyberattacks and data breaches while hiding their malicious activity . Cybersecurity companies find proxies challenging to tackle because the network traffic looks like it's coming from an ordinary household, rather than a malicious hacker located overseas, as they might expect .

AI Data Collection and Smart TVs

The use of smart TVs as proxies for AI data collection is particularly concerning given the growing demand for training data. With AI companies facing scrutiny over their environmental impact, treatment of intellectual property, and potential to replace human labor, some consumers may feel uneasy about their TVs gathering data to train AI models .

Bright Data has been pitching its SDK to streaming service operators as an alternative revenue source that allows publishers to offer content without ads or high fees. "We don't do any kind of tracking," explained Bright Data's chief product officer during a webinar for streaming industry insiders. "We work silently in the background, and completely anonymously. Users don't actually see or don't feel anything" .

What Consumers Can Do

Consumers concerned about their smart TV being used as a proxy node have several options:

• Check for and delete any unused apps on their smart TV, especially games or free apps that may contain proxy code .

• Be cautious when accepting consent screens on smart TV apps, reading the terms carefully before agreeing .

• Consider blocking DNS hostnames associated with residential proxy services at the router level .

Security researchers have also published specific domain names associated with Bright Data's proxy network that users can block to prevent their devices from being used as exit nodes .

The Samsung case highlights the growing tension between the demand for AI training data and consumer privacy. As companies seek ever-larger datasets to train their models, they are increasingly turning to residential proxy networks that enlist consumer devices as data collection nodes.

The fact that a Pac-Man game endorsed by Samsung could turn a smart TV into a proxy node illustrates the challenges facing app store moderation. The thin-shell design of many apps allows them to pass review while executing behavior the reviewer never sees.

The research also underscores the importance of transparency and consent. While some users may be willing to trade their bandwidth for ad-free content, the complexity and vagueness of consent screens raises questions about whether users truly understand what they are agreeing to.

As Samsung and LG take action against these practices, the hope is that other smart TV manufacturers will follow suit. In the meantime, consumers should remain vigilant about the apps they install and the permissions they grant.