Samsung is cracking down on Smart TV apps that quietly route outsiders' web traffic through owners' home connections, banning the proxy code and removing offending apps from its store. The move follows new security research from Norwegian cybersecurity firm Mnemonic, which rooted a Tizen-based Smart TV to trace how residential proxy SDKs end up on consumer devices.
Mnemonic's investigation turned up apps that funnel strangers' traffic through ordinary home and office internet connections, a practice known as residential proxy networking, or "resproxies," that is increasingly linked to cybercrime. When opened, apps carrying the code can turn a television into an always-on exit node for that traffic, even after the app is closed.
The good news, the researchers found, is that Samsung TVs were not automatically sharing their owners' connections.
Many of the affected apps are lightweight shells built from a few lines of code that download the bulk of their actual content from remote servers. That design masks what is really running, since a review sees only the shell code rather than the remote-loaded function.
According to the research, at least one offending app was a simple Pac-Man game Samsung had endorsed and featured in its Editor's Choice section on customers' TV screens. Some developers of these apps claim their software has been installed on hundreds of millions of smart TVs.
Samsung said in an emailed statement that it is banning apps that share users' internet connections and will remove apps containing the functionality. The company has already restricted new app registrations that incorporate proxy features on its Smart TV platform, and it is implementing platform-wide developer policies that explicitly ban residential proxy SDKs while working to identify and purge existing apps with those components.
LG recently announced plans to suspend ResProxy-containing apps after a security firm found that roughly 42% of apps in its TV store allowed unknown third parties to route traffic through users' televisions.
