Samsung Bans Smart TV Apps That Share Users' Internet Connections
- Reference: 0184831076
- News link: https://entertainment.slashdot.org/story/26/08/03/1637257/samsung-bans-smart-tv-apps-that-share-users-internet-connections
- Source link:
> Several popular Samsung smart TV apps contain code that share the owner's internet connection with strangers, potentially putting millions of Samsung smart TVs at risk of hijacking, according to new security research published on Monday. Some of these apps claim to have been installed on hundreds of millions of smart TVs in people's homes, per the app developers. At least one of the smart TV apps was a simple Pac-Man game that Samsung had endorsed and prominently featured in its "Editor's Choice" section on customers' TV screens. These apps contain software that funnels outsiders' web traffic through ordinary home and office internet connections, known as residential proxy networks (or "resproxies"), which are increasingly being linked to cybercrime. When opened, apps with resproxy code can turn the smart TV into an always-on tunnel for outsiders to funnel their web traffic through, known as an exit node -- even when the app is no longer open.
>
> The [1]security research by Norwegian cybersecurity company Mnemonic describes a perfect storm of problems that allows low-quality apps to proliferate across Samsung's app store, containing code that puts users at risk of having their internet connections tapped by a rogue app. Many of these apps are bare-bone shells, made from only a few lines of code, and are designed solely to load content from another website, such as a game. While such smart TV apps load content from another server, any review of these apps sees only the few lines of code within, and not necessarily the content itself. "What was reviewed is not necessarily what is running," wrote Harrison Sand, an offensive security consultant at Mnemonic.
>
> After TechCrunch contacted Samsung with a request for comment about the research, the electronics giant said in an emailed statement that it was [2]banning apps that share their users' internet connections , and will remove apps that contain the functionality. "We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform," said a Samsung spokesperson. "We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components."
LG also recently announced plans to [3]suspend apps containing ResProxy software after a security firm found that roughly 42% of apps in its TV app store allowed unknown third parties to route internet traffic through users' televisions without their knowledge.
[1] https://www.mnemonic.io/resources/blog/samsungs-recommendation-rent-out-your-tvs-internet-connection/
[2] https://techcrunch.com/2026/08/03/samsung-bans-smart-tv-apps-that-share-users-internet-connections-with-strangers/
[3] https://entertainment.slashdot.org/story/26/07/22/0426218/lg-to-ban-residential-proxies-from-smart-tv-apps
So embedded TV apps are getting routable IPs? (Score:2)
I can see why Amazon, Netflix, Disney, etc thought that their embedded TV app needed a routable IP address. However I am having problems seeing how anyone else thought so. And as we move into the more obscure embedded TV apps more so.
Let embedded apps get a DHCP based non-routable IPs from the cable box. Apple TV, Amazon Fire TV, etc.
wait for it (Score:3)
Oh boy, another opportunity for 90% of the people on here to post about how they only use dumb screens and anyone who actually uses a smart TV deserves whatever they get!
Re:wait for it (Score:5, Funny)
This is exactly why I keep my television tuned 24/7 to Fox News Network. There is absolutely nothing you can do to make a TV dumber than that!
Re: (Score:2)
This explains your behavior.
Re: wait for it (Score:2)
You must keep your pipe tuned to crack 24/7 then
Re: (Score:2)
I don't have my smart tv connected 24/7 either, in fact it's only connected when i do the occasional sw update check. It's not connected because it doesnt need to be as all the content displayed is comming through hdmi from the atv4k sitting beside the tv, I personally do it this way because I prefere apples menu system to the tvs. As tomwhst other people are doing thst's their choice, but internet sharing suld becan os level functin controlled vi os level menues rather than third party apps regardless. A
whole of society manipulation (Score:2)
Back in the teens we found a couple of instances where political actors were encouraging people to install screen savers or cryptocurrency wallets that turned their phones into reverse proxies. This was thought to be specifically for the sake of giving hostile foreign operations (read: Russia) access to U.S. domestic politics.
The fact that smart TVs are facilitating this is just ... we're going to need home networks that treat IoT stuff as different than our actual systems.
Oh, wait, TP-Link had well over ha
Okay but why? (Score:2)
And the answer as usual is AI slop.
This has been going on for ages and used for spam and cybercrime and they didn't care.
The reason it's a problem now is AI companies are buying access to your TV so they can use your clean IP address to go scraping data from websites that are blocking them.
Don't get me wrong it's still a good thing that these are getting banned but they have been around apparently for quite some time and none of the TV manufacturers gave a shit. Probably because the problem wasn
Seems like a job for the OS (Score:2)
If this is as widespread as it seems, perhaps the manufacturers should fix the OS to do something about it. Banning "anything that links known SDK x, y or z" is just whack-a-mole.
One simple approach that comes to mind with minimal thought (aside from the obvious "why the fsck does a Pac-Man game need network access at all?") is having the app manifest contain a list of domains to which the app intends to connect, and block anything else at the OS level -- perhaps blocking everything by default, then permit
Re: (Score:2)
But how long would it take to implement in every supported OS version and then get all the developers to declare a manifest and update their app?
A policy change can be enforced tomorrow (for better or for worse).
The AI bros might even get Samsung to change their mind. Apparently their 'subcontractors' use this technique to scrape all the content they use for training.
Would threatening to cancel a year's RAM order from the chip subsidiary cause a decision to change in the TV subsidiary? I have no idea how
OTOH (Score:2)
I'm kinda impressed with this 'surreptitious' business model. I don't condone it, but I wonder what the money flow looked like before this hit the fan?
Botnet (Score:2)
So turning your TV into a part of a botnet is now "increasingly being linked to cybercrime". No shit.
It's either this or view ads for free apps (Score:2)
Given the choice, most people would rather inconvenience someone else than themselves. So of course turning their TV into a botnet wins.
Hm.. (Score:1)
I wonder when Steam and other similar platforms will start banning these kinds of applications, especially those that do it without the user's consent.
Re: (Score:3)
They'll be banned when someone is caught.
Re: (Score:2)
Steam games don't do it because they have a better way to monetize free games: in app purchases and DLC