Following disclosure of widespread residential proxy integration in its app ecosystem, LG Electronics USA has committed to eliminating any smart TV applications that convert devices into always-on proxy nodes. The announcement arrives roughly three weeks after security researchers documented that more than 42 percent of downloadable applications on LG's webOS platform contained code enabling third parties to funnel internet traffic through users' televisions.
On July 2, Spur, a security research firm, published findings examining how prevalent residential proxy software development kits had become across smart TV platforms. The investigation revealed that beyond the 42 percent figure for LG devices, more than one-quarter of applications built for Samsung's Tizen operating system similarly incorporated residential proxy components.
In response to Spur's findings, LG Senior Vice President John Taylor communicated the company's position to KrebsOnSecurity, explaining that LG was actively engaging with application developers to strip out residential proxy capabilities from webOS offerings. Taylor indicated that developers refusing to comply would face suspension of their applications from the platform.
A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If this option is not removed, these apps will be suspended.
John Taylor, LG Senior Vice President
Taylor further emphasized LG's determination to prevent residential proxy networks from becoming embedded in future smart TV applications, noting that the company's evaluation of existing apps was already underway. In a subsequent written statement, Taylor added that LG would strengthen its vetting procedures for developer submissions, particularly those incorporating residential proxy SDKs.
Application developers frequently monetize their products through partnerships with residential proxy services, which compensate creators for embedding SDKs that transform user devices into proxy nodes leased to commercial customers. Across both LG and Samsung platforms, Spur identified these SDKs integrated into diverse applications ranging from basic games such as Pac-Man to screensavers and file management utilities.
Bright Data emerged as the dominant residential proxy network represented across Samsung and LG smart TV applications, according to Spur's analysis. When contacted, Bright Data defended its operations, asserting that participation occurs through explicit user consent and that customers undergo thorough vetting procedures.
Every peer opts in through a dedicated screen and receives value in return; every customer is vetted, and our practices have now undergone a second independent audit by PwC. We remain committed to an open, transparent internet where legitimate businesses, researchers, and institutions can responsibly access data that lives in the public domain.
Bright Data statement
Bright Data and competing proxy providers cited in Spur's research maintain that they implement stringent know-your-customer validation protocols to ensure legitimate service utilization, often connected to data-scraping operations. These companies also claim to deploy technical safeguards preventing proxy service customers from accessing or manipulating other devices connected to the proxy operator's local network.
Spur's assessment distinguishes between the existence of residential proxy networks themselves and their deployment at scale across devices consumers typically do not regard as computers and lack mechanisms to scrutinize. Trevor Sutter from Spur emphasized that a single consent notification embedded within a television application cannot substitute for genuine transparency, continuous user control, and robust platform governance.
A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight. The risk is amplified when consent comes from individuals within the household who use the device but shouldn't give consent, such as minors.
Trevor Sutter, Spur
While LG's decision to eliminate residential proxy SDKs from its app marketplace represents a positive step, the manufacturer has recently faced criticism over another controversial arrangement: bundling McAfee security product promotions through software drivers shipped with its premium LCD monitors.
This week, the YouTube channel Gamers Nexus revealed that specific LG LCD monitors automatically deploy an application promoting paid McAfee antivirus subscriptions, with the application arriving via Windows Update without requiring user authorization.
Source: Krebs on Security