GoKawiilThe takeaway: Samsung is cracking down on a group of smart TV apps that can turn users' internet connections into pass-through networks for outside traffic, following new security research that raised concerns about how widely the practice has spread. The apps embed residential proxy software that routes third-party web traffic through household devices, often without users fully understanding how their bandwidth is being used.
After being contacted by TechCrunch, Samsung said it has started blocking new apps that include this capability and is working to remove those already in its app store. "We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform," a Samsung spokesperson told the publication. "We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components."
The move comes after research from Norwegian cybersecurity firm Mnemonic found that several Samsung smart TV apps contain code tied to residential proxy networks, or "resproxies." These networks route internet traffic through everyday consumer devices, masking the original source behind residential IP addresses.
Some of the apps identified by Mnemonic claim to have hundreds of millions of installs. One example was a basic Pac-Man game that had been featured in Samsung's "Editor's Choice" section.
In practice, the technology can turn a smart TV into what's known as an exit node. Once activated, the device can carry traffic for third parties in the background, even when the app itself is not in use.
Mnemonic's report points to weaknesses in how these apps are reviewed. Many are simple shells that load content from external servers. That means the code reviewed by a platform like Samsung may not reflect what ultimately runs once the app is live. "What was reviewed is not necessarily what is running," wrote Harrison Sand at Mnemonic.
To see how this worked in real time, Sand rooted a Samsung TV and monitored its network activity. That allowed him to track which apps were sending and receiving traffic on behalf of outside users.
In the Pac-Man app, he found proxy code linked to Bright Data, a company that operates a large residential proxy network and sells access to scraped datasets. According to the research, the proxy function only activates after a user accepts a consent prompt, and then continues running in the background until the app is removed.
Sand warned that the setup could be easily scaled. A "simple code change on a web server" could activate proxy behavior across a large number of devices at once, potentially turning them into a coordinated network.
Residential proxies are not illegal and have legitimate uses. They are commonly used to bypass censorship or facilitate large-scale data collection. AI companies, for example, rely on them to gather training data from multiple sources.
... continue reading