The home appliance giant LG Electronics USA said this week it plans to stop any apps built for smart TVs that turn a person’s television into an always-on living room. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download from LG’s webOS store allow unknown third parties to route their Internet traffic through a user’s TV.
The prevalence of proxy SDK between LG smart TV applications (webOS) and Samsung televisions (Tizen OS). Photo: Spur.us.
On July 2nd, we showed the research done by the security company Spur examined the prevalence of local proxy software development kits (SDKs) for smart TV applications. Spur found more than 42 percent of the apps available for download on LG smart TVs include SDKs that turn one’s television into a permanent proxy, and that more than a quarter of the apps created for Samsung’s Tizen operating system have similar proxy components.
To answer questions about Spur research, LG Vice President John Taylor told KrebsOnSecurity that the company has been working with app developers to remove the resident proxy option from their apps on the webOS platform. Developers who fail to comply, he said, will find their apps suspended.
“Residential proxy networking is not an intended use of LG smart TVs, and LG Electronics is working with developers to remove the proxy residential option from their applications on the webOS platform,” said Taylor. “If this option is not removed, these applications will be suspended.”
Taylor said LG is committed to keeping residential proxy networks out of its smart TV apps going forward, and that the company’s review of those apps is “well underway now.”
“As part of our ongoing efforts to improve platform quality and user experience, LG will continue to strengthen our testing process for developer-submitted applications, including those that include residential proxy SDKs,” Taylor wrote in an emailed statement.
App makers looking for creative ways to monetize can turn to residential proxy providers, which pay developers to install SDKs that turn a user’s device into a residential proxy node that is rented out to paying customers. In the case of LG and Samsung smart TVs, Spur has found residential proxy SDKs bundled with everything from simple games like Pac-Man to screensavers and file utilities.
The Pac-Man smart TV app from Bright Data gives users the choice between watching ads in the game or allowing their TV to act as a proxy home. Photo: Spur.us.
The Spur report found a proxy residential network Light Data listed most of the proxy SDKs for all Samsung and LG smart TVs. Bright Data did not respond to requests for comment.
Bright Data and the other proxy providers named in the Spur report all say they follow strict know-your-customer procedures to ensure legitimate use of their services, which are often tied to content scraping activities by said customers. Proxy companies also include technical countermeasures to prevent clients of the proxy service from being able to interact with and control other devices on the proxy user’s local network.
Spur argues that the problem isn’t that residential proxy networks exist, but rather that they’re embedded to a degree in devices that most consumers don’t think of as computers and aren’t equipped to scan.
“A one-time consent notice buried in a TV app is no substitute for meaningful transparency, ongoing control, and oversight of the platform,” Spur’s Trevor Sutter he wrote. “The risk increases when consent comes from people in the household who use the device but who should not give consent, such as children.”
LG’s announcement that it’s ending proxy SDKs for its app store is welcome news, but the company recently came under fire for another questionable partnership: Pimping McAfee security products using software drivers installed on its high-end LCD monitors.
Earlier this week, the YouTube channel Gamers Nexus showed that some LG LCD monitors will automatically install an app that promotes a paid McAfee antivirus subscription, and that the app comes via Windows Update without a consent prompt.
