Your Smart TV Has Been Keeping A Pretty Wild Secret

Your smart TV may have been doing more than just streaming programming: Some apps available on Samsung televisions could turn your home internet connection into a proxy for strangers’ online activity.

Security researchers have discovered residential proxy software embedded in apps available for Samsung smart TVs, allowing third parties to route internet traffic through users’ home IP addresses. Samsung is now cracking down on the practice and says it is working to remove apps containing the software from its store.

The findings were detailed in a recent investigation by security researcher Harrison Sand at Mnemonic, which examined residential proxy software found in popular Samsung smart TV apps. 

Earlier research from cybersecurity firm Spur similarly found residential proxy software development kits, or SDKs, in more than a quarter of the Samsung smart TV apps it examined.

Residential proxy networks allow third parties to route their internet traffic through another person’s residential internet connection, making the traffic appear to websites and online services as though it originated from that person’s home IP address. Such networks have legitimate commercial uses but can also be exploited to disguise malicious online activity.

One of the apps identified by Mnemonic was a Pac-Man game that Samsung had promoted to users and featured in its “Editor’s Choice” section.

Installing the game did not automatically enroll a user’s TV in a proxy network. Instead, the app displayed a consent screen asking the user to agree to share their internet connection, according to Mnemonic. The researchers said many users, including children, hit accept in order to get back to the game without realizing it could allow third-party internet traffic to pass through their home connection.

Some developers behind apps containing the software claim their apps are already installed on hundreds of millions of smart TVs, according to TechCrunch.

Following Mnemonic’s report, Samsung told TechCrunch that it had begun restricting the use of residential proxy software on its smart TV platform. 

“We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform,” a Samsung spokesperson told TechCrunch. “We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components.”

Samsung’s move follows a similar crackdown by LG Electronics. Research published earlier this summer by security firm Spur found residential proxy SDKs in more than 42% of the apps it examined in LG’s webOS store.