Key facts
- Samsung is banning and removing smart TV apps that share users' internet connections.
- Research found residential proxy code in popular Samsung smart TV apps, including a featured Pac-Man game.
- These apps can turn smart TVs into exit nodes for outsiders to route web traffic.
- The functionality can be activated even when the app is not actively open.
- Samsung stated it is implementing strict developer policies against residential proxy SDKs.
Samsung is banning and removing smart TV applications that share users' internet connections with strangers, following security research that identified such code in popular apps. The research, conducted by Norwegian cybersecurity firm Mnemonic, found that some apps, including a featured Pac-Man game, contained residential proxy software. This software can turn a user's smart TV into an exit node, allowing outsiders to route their web traffic through the home or office internet connection, potentially for cybercrime or data scraping.
According to Mnemonic's Harrison Sand, these apps can function as an always-on tunnel for external web traffic, even when the app is no longer open. The security firm noted that many of these apps are basic shells designed solely to load content from other websites, making it difficult for app store reviews to detect the underlying proxy functionality. Sand highlighted that the code from Bright Data, an Israeli company providing proxy networks, was found in the Pac-Man game. While consent is typically required to activate the proxy, Sand warned that a simple server-side code change could potentially turn millions of smart TVs into a botnet.
In response to inquiries from TechCrunch, Samsung stated it has already restricted new app registrations with proxy functionalities and is actively working to identify and remove all existing apps containing such components. This action follows a similar move by LG last month, which also announced a ban on apps utilizing residential proxy software after reports indicated a significant percentage of apps on its store engaged in this practice. Cybersecurity experts note that residential proxies are challenging to combat as traffic appears to originate from ordinary households and is often encrypted.