A scan of 6,038 smart TV apps across the LG webOS and Samsung Tizen stores found proxy software in 2,058 of them, and LG Electronics now says it will suspend any webOS app that does not strip out the residential proxy feature. The move targets apps that pay their developers by routing third party traffic through a viewer’s home internet connection, often without the viewer realizing what the app actually does.<\/p>\n
Researchers at Spur, a threat intelligence firm focused on traffic routed through VPNs and residential proxies, pulled 6,038 apps from the LG and Samsung TV app stores and checked them for embedded proxy SDKs, the software libraries that let an app resell or relay internet requests through the device it is installed on. They counted 2,038 apps carrying that capability. Broken out by platform, 42% of LG webOS apps flagged positive, and 26.5% of Samsung Tizen apps did the same.<\/p>\n
Many of the flagged titles are not the kind of apps a site owner would expect to be network infrastructure. The list skews toward low effort utilities: fish tank screensavers, clock widgets, solitaire, and simple games. The visual layer is a fish tank on the television. The real product is bandwidth.<\/p>\n
Residential proxy services sell access to IP addresses tied to ordinary home connections. Buyers use those IPs to pull public web data, check how ads render in specific countries, run market research, or hide the true origin of a request. The proxy provider pays the device owner, usually through the app developer, in exchange for a slice of the home’s bandwidth.<\/p>\n
The consent flow inside these TV apps is typically a single screen that says the app will use the IP address and free resources to download public web data from the internet. Tap Agree, and the app can keep monetizing the connection for as long as it stays installed, even when the viewer is not using the TV.<\/p>\n
Smart TVs make this attractive for the proxy buyer because they run for hours at a time without showing obvious signs of network strain. There is no battery to drain, no cellular bill to spike, and no fan noise. The traffic blends in with normal streaming.<\/p>\n
The IP address exposure is only the surface layer. If a proxy provider allows requests aimed at private or local addresses, or its filtering is weak, the TV turns into a launching point for traffic that was never meant to leave the local network. Researchers at Spur described the worst case plainly: the TV becomes a foothold for reaching router admin panels, NAS boxes, printers, cameras, developer machines, and other apps listening on local ports.<\/p>\n
That risk is not theoretical. Law enforcement and platform security teams have already taken down large operations built on this same model. Google and the FBI disrupted a residential proxy botnet called NetNut that had recruited more than 2 million consumer devices, including smart TVs and streaming boxes, for covert activity. Earlier in the same year, Google also shut down a separate operation called IPIDEA.<\/p>\n
LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If the option is not removed, the apps will be suspended. That statement came from John Taylor, Senior Vice President at LG. The message was reported by Brian Krebs and tied the suspension to the fact that turning a TV into a proxy node is not the intended use of a smart TV.<\/p>\n
LG’s existing developer guidance already tells app builders to follow Privacy by Design and Secure by Design principles, and to request only the least privilege needed for the app to function. At the time the reporting was published, the developers’ documentation did not call out residential proxy traffic by name.<\/p>\n
Spur’s scan found that a small number of vendors account for most of the proxy SDKs detected in TV apps. The single most flagged SDK came from Bright Data, appearing in 367 proxy flagged apps.<\/p>\n
Bright Data pushed back on the framing. The company said its framework is built around consented networks that are intentionally discoverable, which makes them accountable, and that its practices are reviewed by independent auditors and security companies. Consent, in Bright Data’s view, is the line between a legitimate network and a nefarious one.<\/p>\n
For site owners running technical SEO audits, the lesson is that residential proxy traffic is no longer a fringe signal. If you operate an ad verification pipeline, a rank tracker, a market research scraper, or any service that leans on residential IPs, expect more of those IPs to resolve back to televisions rather than laptops.<\/p>\n
Two practical checks are worth adding to an audit workflow:<\/p>\n
Amazon and Roku have already banned residential proxy software on their platforms, according to Spur. Researchers have urged LG and Samsung to follow that lead. LG’s suspension policy is the first formal response from a major TV platform since those calls went out, and it sets up Samsung as the next platform to watch.<\/p>\n
LG Electronics told Krebs on Security that it is working with developers to remove the residential proxy option from their apps on the webOS platform, and that any app that does not comply will be suspended.<\/p>\n
Researchers at Spur scanned 6,038 apps across the LG webOS and Samsung Tizen stores. About 42% of LG webOS apps and 26.5% of Samsung Tizen apps contained proxy SDKs, for a combined 2,058 flagged titles.<\/p>\n
Bright SDK, from Bright Data, was the most flagged SDK in Spur’s scan, showing up in 367 proxy flagged apps. Bright Data said its framework is designed around consented, discoverable networks that are reviewed by independent auditors.<\/p>\n