LG Electronics USA has announced its intention to suspend any applications developed for its smart TVs that transform a user’s television into an always-on residential proxy node, a move that comes less than a month after researchers uncovered a significant prevalence of such functionalities within LG’s webOS app store. This proactive stance by the home appliance giant addresses concerns raised by security firm Spur, whose research revealed that over 42 percent of downloadable apps on LG’s smart TV platform incorporate Software Development Kits (SDKs) enabling unknown third parties to route their internet traffic through a user’s television.

The findings from Spur’s investigation, initially highlighted on July 2nd, examined the widespread use of residential proxy SDKs across smart TV ecosystems, specifically targeting LG’s webOS and Samsung’s Tizen operating systems. Spur’s detailed report indicated that not only did a substantial majority of LG apps feature these proxy SDKs, but a notable portion of Samsung apps also contained similar components. This practice effectively turns user devices into rental nodes for internet traffic, often without the full awareness or explicit, ongoing consent of the device owner.

In response to these revelations, John Taylor, Senior Vice President at LG, communicated directly to KrebsOnSecurity, confirming LG’s commitment to rectifying the situation. Taylor stated that LG is actively collaborating with app developers to mandate the removal of residential proxy functionalities from their webOS applications. He further emphasized that non-compliant developers will face the suspension of their apps from the LG Content Store. "A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform," Taylor declared. "If this option is not removed, these apps will be suspended."

LG’s commitment extends beyond immediate remediation; the company is also reinforcing its future app evaluation processes to prevent the reintroduction of residential proxy SDKs. Taylor assured that the company’s review of existing apps is "well underway now" and that LG will "continue to strengthen our evaluation process for developer-submitted apps, including those that incorporate residential proxy SDKs." This commitment aims to enhance platform quality and ensure a more secure and transparent user experience.

The monetization model for app developers in this context involves partnering with residential proxy providers. These providers pay developers to embed SDKs within their applications. Upon installation or use, these SDKs prompt users to agree to allow their device to function as a proxy node, effectively renting out their internet connection to the proxy provider’s paying customers. Spur’s research found these proxy SDKs embedded in a wide array of applications, ranging from simple games like Pac-Man to utility apps and even screensavers, highlighting the pervasive nature of this practice.

One of the prominent residential proxy networks identified in Spur’s report is Bright Data, which accounted for a significant percentage of the proxy SDKs found on both LG and Samsung smart TVs. In a statement provided to KrebsOnSecurity, Bright Data defended its operations, asserting that its network is built on principles of consent and responsibility, and that it adheres to the terms set forth by manufacturers like LG and Samsung. "Every peer opts in through a dedicated screen and receives value in return; every customer is vetted, and our practices have now undergone a second independent audit by PwC," a Bright Data spokesperson stated. "We remain committed to an open, transparent internet where legitimate businesses, researchers, and institutions can responsibly access data that lives in the public domain."

Proxy providers, including Bright Data, typically claim to implement rigorous know-your-customer (KYC) processes to verify the legitimacy of their clients, who often utilize these services for web scraping and data collection. They also assert that technological safeguards are in place to prevent customers from accessing or controlling other devices on the user’s local network, thereby mitigating risks associated with malicious activity or unauthorized network access.

However, security researchers like Trevor Sutter from Spur argue that the core issue lies not in the existence of residential proxy networks themselves, but in their integration into devices that consumers may not perceive as traditional computers and are less equipped to monitor. Sutter expressed concerns that a one-time consent prompt within an app, especially one that might be overlooked or misunderstood, does not constitute meaningful transparency or ongoing user control. He further highlighted the amplified risk when consent is granted by individuals within a household who may not fully grasp the implications, such as minors. "A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight," Sutter wrote. "The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors."

LG’s decision to ban residential proxy SDKs from its app store represents a significant step towards enhancing user privacy and security on its smart TV platform. This move is particularly noteworthy given a recent controversy involving LG’s partnership with McAfee. Earlier in July, the YouTube channel Gamers Nexus reported that certain LG LCD monitors were automatically installing an application through Windows Update that promoted paid McAfee antivirus subscriptions, without requiring explicit user approval. This incident, separate from the smart TV proxy issue, has also drawn criticism for its opaque installation process and bundled promotional software. The combined actions signal a period of increased scrutiny for LG regarding its software partnerships and user data practices.