LG Electronics Bans Residential Proxy Apps From webOS Smart TVs

The move follows findings that a substantial portion of the app ecosystem on LG’s webOS—and Samsung’s Tizen OS—had been quietly turning consumer devices into conduits for third-party internet traffic.

The Scale of Residential Proxy Integration

The decision comes less than a month after security firm Spur published research detailing how common these proxy software development kits (SDKs) had become. According to the report, more than 42 percent of apps available on LG’s webOS store contained components that allowed unknown third parties to route traffic through the user’s television indefinitely. Samsung’s Tizen operating system also showed significant exposure, with more than a quarter of its apps containing similar proxy components.

These SDKs are often bundled into seemingly innocuous software, ranging from simple games like Pac-Man to file utilities and screensavers. By embedding these kits, app developers can monetize their creations by renting out a user’s home IP address to paying customers, who often use the nodes for content-scraping activities.

LG Electronics’ Enforcement and Developer Policy

LG has taken a firm stance against the practice, designating it an unintended use of their hardware.

“A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If this option is not removed, these apps will be suspended.”

John Taylor, Senior Vice President, LG Electronics USA

Taylor indicated that the review process to identify and flag these apps is well underway now. Furthermore, the company intends to refine its app submission and evaluation process to ensure future developer-submitted software does not incorporate these residential proxy SDKs. The goal, according to Taylor, is to enhance platform quality and the user experience.

Security Risks and the Transparency Gap

The primary criticism leveled by security researchers is not that proxy networks exist, but that they are being deployed in devices—like televisions—that consumers rarely view as computers capable of being subverted. Trevor Sutter of Spur argued that standard consent mechanisms in these apps are fundamentally inadequate for the level of access being granted.

“A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight. The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors.”

Trevor Sutter, Spur

While proxy providers like Bright Data—which Spur identified as accounting for a majority of the proxy SDKs found—maintain that they perform rigorous know-your-customer processes and employ countermeasures to prevent proxy users from controlling devices on the local network, the industry remains under scrutiny for the lack of consumer visibility into these background connections.

Broader Scrutiny of LG Software Practices

The crackdown on proxy apps arrives as LG faces separate scrutiny regarding its software bundling practices. Reports from the YouTube channel Gamers Nexus recently highlighted that certain LG LCD monitors were automatically installing software to promote paid McAfee antivirus subscriptions. The software arrived via Windows Update without an explicit user approval prompt, adding to a challenging month for the company regarding its relationship with user-installed software and third-party partnerships.

Sources: Krebsonsecurity, healsecurity.com.