Smart TV Brands Are Racing To Ban Apps That Let Hackers Access Your Internet
Phones and computers might seem like the most obvious devices to be hacked, but the truth is that these days, just about any Wi-Fi-enabled device is susceptible to hacks and security breaches, including smart TVs. And that's exactly what Samsung and LG are trying to limit with both companies recently announcing that each will be banning certain apps available for download on smart TVs. This comes after alarming threat that was discovered where users were unknowingly allowing hackers access to their internet, which is called a residential proxy.
Also referred to as a resproxy, they are software applications that relay internet traffic from outside the network through the currently assigned IP. Basically, they work like a VPN, but instead of assigning an external IP, they hijack your public IP address. According to research firm Spur, more than 42% of apps available to download on LG smart TVs — and a similar number on Samsung's smart TV apps — contained software development kits (SDKs) that allowed resproxies to occur. Following this finding, LG and Samsung both announced bans on smart TV apps that can open the door to hackers accessing your internet.
Why are residential proxies a threat?
Residential proxies can have a valid and legitimate purpose, mostly for business and marketing, but when used for illicit activities, hackers can perform their nefarious deeds from your IP address to make it look like your device is the source. That's why these are a huge concern for cybersecurity, in general, and have gained a negative reputation. What does this all have to do with your Samsung or LG smart TV, though?
There are a lot of interesting things you had no idea your smart TV could do, including being turned into a proxy node. The affected apps, once installed and opened, expose the device to external influence. Basically, resproxies can turn TVs into an always-on, always-accessible tunnel for hackers to route their web traffic through. The TV then acts as a node, with traffic flowing in and external access available to those in control.
Worse yet, the parties involved can sell access to the networks and data. A Mnemonic researcher named Harrison Sand discovered a licensed Pac-Man game can enable precisely that on Samsung TVs. A company called Bright Data is behind an embedded SDK in Pac-Man and other apps that allows it to access and collect from millions of residential nodes. Meanwhile it sells access to scraped datasets on a marketplace which explicitly uses a network of smart TV nodes to do its bidding.
You'd never suspect some of the compromised apps
What's most alarming is that some of the apps in question would be incredibly difficult for the average person to identify. The Pac-Man game, for example, was featured in Samsung's Editor's Choice section of the smart TV app store, meaning that it was officially supported. The problem, according to Mnemonic's Sands, is that the code for the game that's shipped and available on the app store is a "shell" of sorts, which makes it possible for the developers to swap the external code at any time, including using new or separate SDK data. This is actually common across smart TV apps, as it allows developers to update and maintain the apps more easily without deploying new versions to users.
It remains to be seen if any other TV manufacturers or smart TV ecosystems are affected. In situations like this it helps to know which manufacturers offer smart TVs with the longest software support, but it's also important to uninstall any apps you don't trust or no longer use. Security patches and firmware updates can also help keep devices secure from situations like this. Moreover, there are still other ways for smart TVs to collect your data, so you may still want to look into how you can prevent them from spying on your activities.