- Messages
- 4,003
- Likes
- 1,873
- Points
- 2,130
Researchers from the Norwegian security firm Mnemonic discovered code in popular Samsung TV apps that turns devices into proxies and routes third-party traffic through them. Following the publication of this research, Samsung announced that it had already banned the registration of new apps with proxy functionality. The company is also preparing new rules explicitly prohibiting the use of residential proxy SDKs and intends to remove all apps with such components from the store.
The researchers explain that the SDKs they discovered turn the TV into an exit proxy node, allowing third-party clients to use the device owner's home or office IP address. Moreover, such a proxy can continue to run in the background even after the app is closed.
The researchers identified one such SDK in a Pac-Man game app, which was approved by Samsung and even featured in the "Editor's Choice" section of the company's TVs.
To conduct their analysis, the researchers obtained root access to the Samsung TV and then analyzed all incoming and outgoing traffic. As it turned out, the aforementioned Pac-Man game contained code from the Israeli company Bright Data, which sells access to millions of residential IP addresses and the datasets collected through them.
When the game was launched, the proxy component was loaded but not activated automatically: first, the user was shown a consent window. If consent was granted, the TV began acting as an exit proxy node (in the background) until the app was uninstalled.
After examining a small portion of the traffic passing through the TV, experts noticed mass scraping of LinkedIn profiles and data collection for AI training. Moreover, this was only a small portion of the requests passing through Bright Data's infrastructure.
According to Mnemonic specialists, the root of this problem lies in the very architecture of smart TV apps and their moderation mechanisms. Many TV apps are simply shells consisting of a few lines of code that load games or other content from an external server. Moderators only check the shell itself, while the content on the developer's server is subject to change.
[td]"The code that passes the test is not necessarily the same as the code that ultimately runs on the device," notes Mnemonic researcher Harrison Sand.[/td]The researcher emphasizes that developers can change the code on their servers at any time and effectively bypass the protection. Theoretically, one such change would be enough to make hundreds of millions of TVs part of a botnet.
Samsung representatives told TechCrunch that they are aware of Mnemonic's research, and the company has already banned the registration of new apps with proxy functionality. The manufacturer is also developing rules that will explicitly prohibit the use of residential proxy SDKs, and all apps with such components will be removed from the official store. It's worth noting that LG made
a similar decision last month . It was then discovered that approximately 42% of apps in the company's store were capable of connecting TVs to proxy networks.
The researchers explain that the SDKs they discovered turn the TV into an exit proxy node, allowing third-party clients to use the device owner's home or office IP address. Moreover, such a proxy can continue to run in the background even after the app is closed.
The researchers identified one such SDK in a Pac-Man game app, which was approved by Samsung and even featured in the "Editor's Choice" section of the company's TVs.
To conduct their analysis, the researchers obtained root access to the Samsung TV and then analyzed all incoming and outgoing traffic. As it turned out, the aforementioned Pac-Man game contained code from the Israeli company Bright Data, which sells access to millions of residential IP addresses and the datasets collected through them.
When the game was launched, the proxy component was loaded but not activated automatically: first, the user was shown a consent window. If consent was granted, the TV began acting as an exit proxy node (in the background) until the app was uninstalled.
After examining a small portion of the traffic passing through the TV, experts noticed mass scraping of LinkedIn profiles and data collection for AI training. Moreover, this was only a small portion of the requests passing through Bright Data's infrastructure.
According to Mnemonic specialists, the root of this problem lies in the very architecture of smart TV apps and their moderation mechanisms. Many TV apps are simply shells consisting of a few lines of code that load games or other content from an external server. Moderators only check the shell itself, while the content on the developer's server is subject to change.
Samsung representatives told TechCrunch that they are aware of Mnemonic's research, and the company has already banned the registration of new apps with proxy functionality. The manufacturer is also developing rules that will explicitly prohibit the use of residential proxy SDKs, and all apps with such components will be removed from the official store. It's worth noting that LG made
a similar decision last month . It was then discovered that approximately 42% of apps in the company's store were capable of connecting TVs to proxy networks.