Samsung restricts smart TV applications that expose users’ internet connections to outsiders.

Recent security research has revealed that numerous widely-used Samsung smart TV applications contain code that can expose users’ internet connections to external parties, potentially compromising millions of devices.

According to developers, some of these applications have been installed on hundreds of millions of smart TVs globally.

One notable example includes a basic Pac-Man game that Samsung had prominently featured in its “Editor’s Choice” section accessible to customers.

These applications include software that directs external web traffic through standard home and office internet connections, a practice referred to as using residential proxy networks, or “resproxies.” This practice is increasingly associated with criminal activity. When these apps are launched, they can transform the smart TV into a continuous tunnel for outsiders to pass their internet traffic through, even when the app is no longer actively used.

The findings from Norwegian cybersecurity firm Mnemonic illustrate a series of issues that allows subpar applications to flourish on Samsung’s app store, placing users at risk of having their internet connections compromised by questionable applications.

Many of these applications consist of minimal code, primarily designed to display content from another website, such as games. While these smart TV apps may retrieve content from an external server, what is visible during an app review is merely the limited code, not the actual behavior or content it may involve.

“What’s been reviewed is not necessarily what’s actively functioning,” wrote Harrison Sand, an offensive security consultant at Mnemonic.

In response to inquiries about this research, Samsung indicated that it is taking measures to ban applications that utilize users’ internet connections for sharing. The company intends to remove any applications with this functionality.

“We have already restricted new app registrations that include such proxy functionalities on our Smart TV platform,” a Samsung representative stated. “We are instituting strict platform-wide developer policies that explicitly prohibit the use of residential proxy SDKs and are in the process of identifying and eliminating all applications that contain these elements.”

This decision follows LG’s announcement last month about similar restrictions on applications containing resproxy features, after reports revealed that nearly 42% of apps in their store enlisted smart TVs into proxy networks.

Understanding Residential Proxy Networks

The research provides an insight into how residential proxy networks operate.

Resproxy code is not only present in smart TV applications but also in consumer mobile applications and other devices such as digital picture frames and Android streaming devices, which facilitate sharing the device’s internet connection.

When a resproxy application or device connects to the internet, it can enable external users to access its network in exchange for a fee.

While resproxies themselves are not necessarily illegal, they can be employed to bypass censorship by rerouting internet traffic through typical residential homes. For instance, many AI companies utilize resproxies to gather data from various online sources simultaneously to enhance their models.

However, cybersecurity experts express concerns that resproxies can also support hackers and spies in executing cyber attacks and data breaches while concealing their activities.

Cybersecurity services find it challenging to address resproxies, as the traffic appears to originate from ordinary homes rather than malicious actors abroad. Additionally, the encrypted data flowing through users’ devices over resproxies makes it nearly impossible to decode and inspect.

By rooting into the software of a Samsung smart TV, Mnemonic’s Sand gained significant insight into the TV’s internal operations and examined all the network traffic associated with it. This analysis included any applications sharing the TV’s internet connection.

He discovered that the Pac-Man game included resproxy code from Bright Data, an Israeli company offering proxy networks claiming to provide access to millions of residential networks worldwide. This company also operates a marketplace for selling access to scraped datasets accumulated from enlisted smart TVs acting as exit nodes, often used to circumvent anti-scraping systems to collect large volumes of public data.

Sand noted that while the resproxy code loaded upon opening the Pac-Man game, it didn’t automatically transform the Samsung smart TV into an exit node. He explained that the resproxy code remains inactive until a user agrees to a consent prompt, which then allows the code to operate in the background until the app is deleted.

Moreover, he cautioned that a “simple code change on a web server” could potentially activate hundreds of millions of smart TVs, incorporating them into a malicious botnet.

By analyzing the network data flowing through his device, Sand observed substantial evidence suggesting that the resproxy network was being utilized for extensive scraping of LinkedIn profiles and for gathering training data for AI. He emphasized that he observed only a small fraction of the traffic being routed through Bright Data’s network.

Bright Data did not respond to inquiries for comments regarding these findings.