Samsung Electronics says it’s taking action after researchers discovered that certain apps could transform user’s TVs into proxies for stranger’s web traffic. As a result, it’s banning all apps on the Tizen platform that share user’s internet connections with third-parties.
The company announced the decision shortly after research published by the Norwegian cybersecurity firm Mnemonic unearthed a number of Tizen-based applications containing code capable of routing third-parties’ online activities through someone else’s TV. The apps make it appear as if that traffic is coming from the TV owner’s household, despite someone else being responsible.
Samsung told TechCrunch in a statement that it has already blocked new apps with these proxy functions from listing on its app store, and is now implementing strict rules aimed at "explicitly banning residential proxy SDKs.” "We are working to identify and remove all apps currently available in our store that contain these components," a spokesperson for the company said.
Mnemonic’s research, published on Monday, highlighted how residential proxy networks, known as “resproxies,” are increasingly being used to try and mask cybercrime. They basically hijack stranger’s internet connections and funnel their malicious web activities through those devices, in an effort to mask their own IP address and avoid being traced.
Harrison Sand, an offensive security consultant at Mnemonic, explained that he rooted a Samsung smart TV running the Tizen operating system in order to analyze the network traffic running through it. He discovered that a Pac-Man game that was once featured in Samsung’s “Editor’s Choice” section contained resproxy code from the Israeli proxy network company Bright Data. The code lies dormant until the user clicks on a consent screen, at which point it then runs in the background whenever the TV is connected to the web.
According to Sand, this kind of resproxy could be used to build up a giant botnet made up of thousands of devices that could be used for malicious activities, without any of the device owners realizing.
Sand’s team found dozens of apps in Tizen’s marketplace that contained resproxy code, and said that some of them claimed to be installed on millions of smart TVs. But Mnemonic warned that it’s not only Samsung TVs that are at risk. Last month, LG Electronics said it will also suspend smart TV apps that have the ability to turn user’s TVs into residential proxies, after a report emerged that claimed 42% of apps listed on the webOS app store had such capabilities.
Other devices can also run apps with resproxy code, including smartphones, digital frames and Android streaming sticks and boxes. Although resproxies aren’t illegal, they’re known to be widely used by hackers and spies to mask cyberattacks. They’re effective, because they make it look as if web traffic originates from a normal household. They also tend to encrypt the data flowing through them.
However, in the case of the Bright Data resproxy code found in the Pac-Man game on Samsung TVs, Sand was able to see that much of the traffic being routed through it was linked to the large-scale scraping of LinkedIn profiles. It was also being used to scrape the wider web for AI training data, which is one of the applications Bright Data markets its tools for.
Samsung’s decision to ban apps with resproxy code could have a significant impact though, potentially prompting other TV brands to follow suit. After all, having your TV hijacked and running slower is never a good look.
Users can also take their own precautions by reviewing the permissions of any apps they download, as this should reveal if they have the ability to share the TV’s internet connection. Experts also recommend that users simply delete any unused apps they may have installed on their TV.
