A Samsung Smart TV app can pass review, remain dormant for months, and later be remotely activated as part of a residential proxy network.<\/p>\n
Samsung told TechCrunch that it will ban Smart TV apps containing residential proxy software after security researchers found that some apps could be remotely converted into proxy nodes. The software allows third parties to route internet traffic through users\u2019 home connections..<\/p>\n
The issue centers on certain software development kits, or SDKs, that developers can add to apps. Once activated, the code can use a television\u2019s internet connection as part of a residential proxy network.<\/p>\n
The findings have renewed concerns about app-store reviews, platform trust, and user privacy because an app\u2019s behavior can change long after it has been approved.<\/p>\n
What exactly went wrong<\/p>\n
Samsung\u2019s policy change comes after LG adopted a similar ban<\/a> following separate research that uncovered residential proxy software in some Smart TV apps.<\/p>\n To investigate, researchers at the Norwegian cybersecurity firm Mnemonic<\/a> obtained root access to a Samsung Smart TV, granting them low-level control over the device. As they analyzed multiple apps, they discovered an app bundled with Bright Data\u2019s SDK.<\/p>\n Software development kits, or SDKs, are packages of prewritten code that developers use to add features without building them from scratch. Mnemonic researchers found one Samsung Smart TV app containing an SDK from residential proxy provider<\/a> Bright Data.<\/p>\n It is also worth noting that the use of proxies isn\u2019t illegal in many standard cases. However, because residential IP addresses are often highly trusted, these proxy services have found ways to route internet traffic using residential IPs, and what better devices to use for this than Smart TVs.<\/p>\n The researchers found<\/a> that the SDK remained dormant within the apps until each application contacted remote servers to retrieve configuration files at launch. That dormancy allowed the apps, whose code appears clean, to potentially evade detection from Samsung during the app review process.<\/p>\n More importantly, it was discovered that these proxy services asked TV viewers for consent before using their IPs for proxy routing. But the researchers argue that most users would simply grant consent<\/a> due to a lack of knowledge about what it actually is, especially if the viewer is a child.<\/p>\n A reminder to trust, but verify<\/p>\n One detail from Mnemonic\u2019s research stood out: one of the apps embedding the proxy SDKs had previously been featured in Samsung Editor\u2019s Choice. The finding shows that marketplace badges and editorial promotion do not guarantee that an app\u2019s third-party components will remain benign over time.<\/p>\n The finding also highlights a broader challenge facing app stores. Modern applications are increasingly built using third-party SDKs<\/a>. These SDKs are typically different from an app developer\u2019s written code. The incident suggests that conventional app reviews may struggle to account for third-party components whose behavior depends on remote configuration after approval.<\/p>\n