Samsung has begun blocking new smart TV apps that embed residential proxy software and is working to remove existing ones from its app store, after security researchers found that several apps were quietly routing outside internet traffic through household TVs. The action follows research from Norwegian cybersecurity firm Mnemonic, which identified proxy code inside multiple Samsung TV apps, including one featured in Samsung’s Editor’s Choice section.<\/p>\n
Mnemonic’s research focused on residential proxy networks, sometimes called “resproxies,” which route third-party web traffic through everyday consumer devices. That setup masks the original source behind residential IP addresses, making the traffic look like it is coming from an ordinary home.<\/p>\n
Some of the apps Mnemonic identified claim to have hundreds of millions of installs. One example was a basic Pac-Man game that had been promoted in Samsung’s Editor’s Choice section. According to Mnemonic researcher Harrison Sand, once a user accepts a consent prompt inside the app, the proxy function activates and keeps running in the background until the app is uninstalled. The TV then acts as what’s known as an exit node, carrying traffic on behalf of outside users even when the app is not in active use.<\/p>\n
Sand rooted a Samsung TV to observe the behavior directly. He confirmed proxy code linked to Bright Data, a company that operates a large residential proxy network and sells access to scraped datasets. From the traffic he could see, some of it appeared tied to large-scale scraping, including LinkedIn data and other sources used in AI training. Sand noted that his view covered only a small portion of the overall activity.<\/p>\n
Mnemonic’s report points to a structural gap in how these apps are reviewed. Many of the apps are simple shells that load content from external servers, so the code reviewed by Samsung may not match what ultimately runs once the app is live.<\/p>\n
“What was reviewed is not necessarily what is running,” Sand wrote.<\/p>\n
Sand also warned that the setup could be scaled easily. A simple code change on a web server could activate proxy behavior across a large installed base at once, turning many devices into a coordinated network without any further user interaction.<\/p>\n
A Samsung spokesperson said the company has already restricted new app registrations that include proxy functionality and is putting platform-wide developer policies in place to ban residential proxy SDKs. Existing apps that contain these components are being identified and removed.<\/p>\n
“We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform,” the spokesperson said. “We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components.”<\/p>\n
Residential proxies are not illegal and have legitimate uses. They help researchers bypass censorship and let AI companies gather training data from a wide range of sources. The same traits also make the networks attractive to abuse, and hard for defenders to flag.<\/p>\n
Traffic routed through these networks appears to originate from ordinary households rather than from centralized servers or known suspicious locations, which makes it harder for security systems to block. The traffic is also typically encrypted, limiting visibility into what is actually being transmitted through any given device.<\/p>\n
Samsung is not the only smart TV platform affected. LG said last month it would also ban apps containing residential proxy software after reports found that roughly 42% of apps in its store were using similar technology.<\/p>\n
Norwegian cybersecurity firm Mnemonic found code tied to residential proxy networks inside several Samsung TV apps, including a Pac-Man game featured in Samsung’s Editor’s Choice section. The code routes third-party web traffic through household TVs.<\/p>\n
After a user accepts a consent prompt inside the app, the proxy function activates and runs in the background until the app is uninstalled. The TV then acts as an exit node that carries traffic for outside users, even when the app itself is not in use.<\/p>\n
Samsung says it has restricted new app registrations that include proxy functionality, is rolling out platform-wide developer policies that ban residential proxy SDKs, and is working to identify and remove existing apps that contain these components.<\/p>\n