{"id":62431,"date":"2026-06-23T20:32:11","date_gmt":"2026-06-23T20:32:11","guid":{"rendered":"https:\/\/www.europesays.com\/korea\/62431\/"},"modified":"2026-06-23T20:32:11","modified_gmt":"2026-06-23T20:32:11","slug":"nearly-half-of-lg-and-samsung-smart-tv-apps-found-selling-users-ip-addresses","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/korea\/62431\/","title":{"rendered":"Nearly Half of LG and Samsung Smart TV Apps Found Selling Users\u2019 IP Addresses"},"content":{"rendered":"

A new investigation has uncovered that nearly one-third of smart TV applications on LG and Samsung platforms<\/a> are secretly monetizing users\u2019 home internet connections by embedding residential proxy software. <\/p>\n

Researchers at Spur Intelligence Labs scanned 6,038 apps across LG\u2019s webOS and Samsung\u2019s Tizen operating systems and found that 2,058 contained verified proxy SDK code quietly routing third-party internet traffic through household IP addresses, often without users realizing what they had agreed to.<\/p>\n

The apps involved are not obscure or suspicious-looking. They present as screensavers, fish tanks, clocks, solitaire games, and novelty displays, the kind of passive, ambient content people leave running on a television for hours. <\/p>\n

LG and Samsung Smart TV Apps Selling Users\u2019 IP Addresses<\/p>\n

Beneath that calm interface, however, a proxy SDK silently sells access to the home\u2019s internet connection, making money in the background while the user stares at animated fish. Researchers did not rely on app store descriptions or permission screens to reach these findings. <\/p>\n

They downloaded actual LG webOS and Samsung Tizen application packages, unpacked the files, and scanned for confirmed SDK fingerprints, including Bright Data\u2019s brd_api.js, Massive SDK service markers, and Honeygain\/Oxylabs package identifiers.<\/p>\n

\"ProxyProxy SDK (Source: spur)<\/p>\n

Three proxy vendors dominated the findings. Bright Data, including its affiliated entities Bright Data Ltd and Bright SDK, accounted for 367 flagged applications. <\/p>\n

Massive SDK appeared across numerous apps on both platforms. Honeygain, a subsidiary of proxy giant Oxylabs, was listed as the direct publisher on 16 additional apps. <\/p>\n

The publisher detail is significant because it suggests these are not ordinary apps that happened to include a monetization SDK; in many cases, the proxy company built the app itself, shipping thin utility shells and casual games at scale purely to give the SDK somewhere to run.<\/p>\n

The danger goes beyond IP address exposure. Because these SDKs run inside the home network, a compromised or misconfigured proxy session could potentially reach local devices, routers, network-attached storage drives, cameras, and printers that were never intended to face the internet. <\/p>\n

In January 2026, KrebsOnSecurity reported on the Kimwolf botnet<\/a>, which exploited residential proxy infrastructure to tunnel back into home networks and move laterally across locally connected devices. <\/p>\n

While Bright Data\u2019s SDK includes a hardcoded blocklist for private IP ranges, researchers noted that the analyzed Massive and Honeygain samples did not contain equivalent local-network protections. <\/p>\n

\"ProxyProxy SDK (Source: spur)<\/p>\n

The real boundary, therefore, is each vendor\u2019s server-side policy enforcement, something a TV owner cannot audit or verify.<\/p>\n

Spur states that<\/a> Amazon explicitly bans proxy-facilitating apps under its Device and System Abuse Policy, and Roku reportedly blocked Bright SDK and similar services after being contacted by researchers. <\/p>\n

LG and Samsung have issued no equivalent public policy, leaving the same software category that rivals prohibit operating freely on their platforms. All three SDK vendors cited KYC processes, traffic filtering, and third-party audits<\/a> in their responses. <\/p>\n

Those measures may reduce abuse, but they do not change the core reality: millions of smart TVs are silently participating in commercial proxy networks their owners never knowingly joined. The app disappears when you close it, the proxy does not.<\/p>\n

Follow us on\u00a0Google News<\/a>\u00a0,\u00a0LinkedIn<\/a>\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.\u00a0Set Cyberpress as a Preferred Source in\u00a0Google<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"A new investigation has uncovered that nearly one-third of smart TV applications on LG and Samsung platforms are…\n","protected":false},"author":2,"featured_media":62432,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[621],"tags":[5033,10454,315,357],"class_list":["post-62431","post","type-post","status-publish","format-standard","has-post-thumbnail","category-lg-electronics","tag-cyber-security","tag-cyber-security-news","tag-lg","tag-lg-electronics"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/62431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=62431"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/62431\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/62432"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=62431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=62431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=62431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}