Your Smart TV May Be Sharing Your Internet Connection With Strangers

A smart TV is usually the last device in the house anyone expects to turn rogue. It sits in the living room, connects peacefully to the Wi-Fi and seems to do nothing more sinister than stream series. Research from HUMAN Security proves otherwise. Applications available on Samsung smart TVs were caught hiding secret SDKs that quietly enrolled the screen into a residential proxy network, broadcasting third-party traffic through the home connection without the owner knowing.

Samsung has restricted new app registrations and removed the affected apps following the research. LG took similar action after a parallel discovery on its own platform. The apps involved were not obviously malicious in their stated functions. The proxy behaviour was embedded in SDKs that developers integrated into applications. The app developers may not have fully understood what the SDK was doing when they included it.

How A Residential Proxy Turns Your Home IP Into A Shield For Strangers

Instead of using commercial data centres, a residential proxy network passes online traffic through ordinary household IP addresses. This makes the traffic appear to originate from a genuine home internet connection rather than from a commercial hosting provider. Residential proxies are used legitimately for purposes like market research, ad verification and geographic content testing. They are also used for credential stuffing attacks, web scraping at scale, bypassing fraud detection systems and evading IP-based blocks and restrictions.

The key issue in the Samsung case is consent. Legitimate residential proxy services recruit participants with full disclosure, typically offering payment or other compensation in exchange for bandwidth sharing, and make clear what the participant’s connection will be used for. The SDK behaviour identified in the Samsung TV apps involved no such disclosure. The household’s internet connection was being used as an exit node for third-party traffic without the owner’s knowledge.

Households face multiple practical problems from this setup. Secret background traffic discreetly consumes internet bandwidth without the owner ever knowing. The household IP address becomes associated with whatever activity the proxy traffic involves, which could include activity that triggers fraud detection, IP reputation damage or, in more serious cases, association with illegal activity. If the proxy network is used for a cyberattack, the attack appears to originate from the household’s IP address.

What Makes Smart TVs Such Easy Targets For Background Hijacking?

Smart TVs occupy a strange middle ground in home network security. They log into the same network as laptops, phones and work devices, yet nobody monitors them with the same caution. Most households don’t have antivirus software monitoring their television or review the network traffic it generates. They don’t apply the same scepticism to installing a TV app that they might apply to installing software on a computer.

Smart TV app stores carry an underlying assumption of trust that listed software has been checked for security risks. The Samsung and LG situations demonstrate that this review process can miss SDK-level behaviour that isn’t obvious from the application’s stated functionality. An app that legitimately offers, for example, weather information or a screensaver may contain an SDK that does something entirely unrelated in the background.

Smart TVs are also rarely updated with the same frequency as phones or laptops. Once a device is a few years old, firmware updates may slow or stop entirely, and apps that pass review at one point remain installed and active without ongoing scrutiny. The combination of always-on connectivity, low security oversight and infrequent updates makes smart TVs an attractive target for SDK-level exploitation.

What The Cleanup By Samsung And LG Tells Us

The fact that both Samsung and LG acted after the research was published is encouraging. The fact that apps containing this behaviour were available on major smart TV platforms for a period before the research identified them is the more noteworthy finding. App store review processes on major platforms, including those with substantial resources and established security teams, didn’t catch SDK-level proxy behaviour before it reached consumers.

This fits a much bigger pattern in platform security. Review processes looking only at what an app does on the surface easily miss what embedded SDKs are up to on the network level. The same dynamic has appeared in mobile app stores, where SDK-level data collection and traffic routing have repeatedly passed initial review before being identified by researchers.

Treating the smart TV with the same security care as any other connected device is the starting point. That means keeping firmware updated where updates are available, reviewing which apps are installed and periodically checking whether the TV manufacturer has issued any security advisories about specific apps or SDKs. For households with particularly sensitive home networks, isolating smart TVs and other IoT devices on a separate network segment reduces the risk that compromise of one device affects others.