Samsung bans smart TV apps that share usersâ internet connections with strangers
Several popular Samsung smart TV apps contain code that share the ownerâs internet connection with strangers, potentially putting millions of Samsung smart TVs at risk
Several popular Samsung smart TV apps contain code that share the ownerâs internet connection with strangers, potentially putting millions of Samsung smart TVs at risk of hijacking, according to new security research published on Monday. Some of these apps claim to have been installed on hundreds of millions of smart TVs in peopleâs homes, per the app developers. At least one of the smart TV apps was a simple Pac-Man game that Samsung had endorsed and prominently featured in its âEditorâs Choiceâ section on customersâ TV screens. These apps contain software that funnels outsidersâ web traffic through ordinary home and office internet connections, known as residential proxy networks (or âresproxiesâ), which are increasingly being linked to cybercrime. When opened, apps with resproxy code can turn the smart TV into an always-on tunnel for outsiders to funnel their web traffic through, known as an exit node â even when the app is no longer open. The security research by Norwegian cybersecurity company Mnemonic describes a perfect storm of problems that allows low-quality apps to proliferate across Samsungâs app store, containing code that puts users at risk of having their internet connections tapped by a rogue app. Many of these apps are barebone shells, made from only a few lines of code, and are designed solely to load content from another website, such as a game.
While such smart TV apps load content from another server, any review of these apps sees only the few lines of code within, and not necessarily the content itself. âWhat was reviewed is not necessarily what is running,â wrote Harrison Sand, an offensive security consultant at Mnemonic. After TechCrunch contacted Samsung with a request for comment about the research, the electronics giant said in an emailed statement that it was banning apps that share their usersâ internet connections, and will remove apps that contain the functionality. âWe have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform,â said a Samsung spokesperson. âWe are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components.â The move comes after LG said last month that it would ban apps that contain resproxy software after recent reporting found that around 42% of apps on the companyâs app store enlisted a smart TV into a proxy network. Inside a residential proxy network The research also offers a rare look inside a residential proxy network. Resproxy code can also be found in regular consumer phone apps, as well as other consumer electronics, like digital frames and Android streaming boxes, which then share that deviceâs internet connection.
