LG Electronics USA announced this week that it will suspend any smart TV applications that embed residential proxy software development kits (SDKs) within its webOS app store. The announcement follows research published by security firm Spur earlier this month, which found that more than 42 percent of apps available on LG's webOS store silently enrol users' televisions as proxy nodes, routing third-party internet traffic through the household's IP address without meaningful informed consent. The full Krebs on Security writeup is available here.
The numbers are striking on their own, but the more analytically interesting question is how we arrived at a situation where nearly half of an app ecosystem is quietly monetising end-user network connectivity, and what this tells us about the structural incentive failures embedded in the smart device supply chain.
The Residential Proxy SDK Model: How It Actually Works
Residential proxy networks operate by recruiting consumer devices as egress nodes. Paying customers, typically engaged in large-scale web scraping, ad verification, or geo-restricted content access, route their HTTP/S requests through these nodes. Because the traffic originates from a genuine residential IP address, it is far harder for target servers to detect and block than traffic from datacenter IP ranges.
The SDK model is the supply-side mechanism. Developers of free or freemium applications are offered a revenue share by proxy network operators in exchange for bundling a lightweight SDK. When a user installs the app, the SDK registers the device with the proxy network's control infrastructure and begins accepting relay tasks. The user typically sees a single consent prompt, often framed as an alternative to watching advertisements, buried within the app's onboarding flow.
Spur's research identified Bright Data as the dominant SDK provider across both LG's webOS and Samsung's Tizen ecosystems. Bright Data has responded by emphasising opt-in consent, customer vetting, and a PwC audit of its practices. These are not trivial claims; Bright Data is one of the more operationally transparent actors in this space. But Spur's Trevor Sutter correctly identifies the category error in treating a consent prompt as equivalent to informed, ongoing, and revocable consent, particularly when the consenting party may be a minor using a shared household device.
Why Smart TVs Are a Particularly Problematic Vector
The residential proxy problem is not new. Researchers have documented SDK-based proxy enrolment in mobile applications for several years, and platform operators including Google and Apple have tightened their review processes in response. What makes the smart TV context structurally different comes down to several compounding factors.
- Always-on network presence: Unlike a smartphone that spends significant time in a pocket or on charge with limited connectivity, a smart TV is typically connected to a home network continuously. The proxy node is available around the clock, maximising throughput for the proxy operator.
- Shared household device: A television is rarely a single-user device. Consent given by one household member binds the network connectivity of all members, including children. The legal and ethical dimensions of this are underexplored in current consent frameworks.
- Low auditability: Consumer expectations around smart TVs do not include the mental model of a general-purpose networked computer. Users do not typically inspect running processes, monitor outbound connections, or review SDK manifests. The attack surface is effectively invisible to the vast majority of users.
- Platform review gaps: App store review processes for smart TV platforms have historically been less rigorous than those for mobile operating systems, reflecting both the relative immaturity of these ecosystems and the lower perceived security stakes.
The 42 percent figure for webOS is not an anomaly caused by a few bad actors slipping through. It reflects a systemic review failure. When nearly half of an app catalogue shares a common monetisation SDK that fundamentally alters the device's network behaviour, the SDK was never being screened for at the platform level.
SDK Supply Chain Risk and the Broader IoT Security Context
This episode fits into a well-established pattern in IoT security research: the attack surface of a consumer device is frequently determined not by the device manufacturer's own code, but by the third-party SDKs bundled into the application layer. The manufacturer's firmware may be perfectly well-hardened, while the app ecosystem introduces components the manufacturer neither wrote nor audited.
This is structurally analogous to the software supply chain vulnerabilities that have received considerable attention in the server and cloud context following incidents like the SolarWinds compromise and the Log4Shell vulnerability. The difference is that in the IoT consumer device context, the end user has essentially no tooling to audit their exposure. There is no equivalent of a software bill of materials (SBOM) for the average smart TV app installation.
Spur's methodology, which involved static and dynamic analysis of apps to identify SDK fingerprints and network behaviour, is the kind of third-party ecosystem auditing that platform operators should arguably be conducting themselves as a condition of app distribution. The fact that an external security firm produced this analysis rather than LG or Samsung's own security teams is itself informative about where platform security investment has been directed.
It is also worth noting that the proxy providers' stated countermeasures, specifically that their SDKs prevent proxy customers from interacting with other devices on the local network, address only one of the risk dimensions. The more immediate concern for most users is not lateral movement from a proxy customer but the unrestricted use of their internet bandwidth and IP reputation. A residential IP address used for large-scale scraping or other proxy traffic can end up on blocklists, affecting the household's ability to access services that perform IP reputation checks.
LG's Response: Necessary but Structurally Insufficient
LG Senior Vice President John Taylor's statement that residential proxy networks are not an intended use for LG smart TVs and that non-compliant apps will be suspended is a reasonable first-order response. The review process is described as well underway, and the company has committed to strengthening its evaluation process for developer-submitted apps going forward.
The critical question is whether this response addresses the structural conditions that produced the problem. A reactive ban on identified SDK instances does not prevent future proxy SDK variants from entering the ecosystem if the review process remains primarily manual and signature-based. Proxy SDK operators are technically sophisticated; obfuscating SDK behaviour to evade static analysis is not a high bar.
A more durable solution would require:
- Mandatory disclosure of all third-party SDKs at app submission time, with machine-readable metadata equivalent to an SBOM.
- Automated dynamic analysis of network behaviour during app review, specifically looking for outbound connections to known proxy infrastructure or unexpected relay patterns.
- Ongoing runtime monitoring with the ability to remotely suspend apps that exhibit newly identified proxy behaviour post-publication.
- Clear platform policy that prohibits any SDK that routes user network traffic to third parties for commercial purposes, regardless of the consent mechanism employed.
Samsung's Tizen ecosystem, where Spur found proxy SDKs in more than a quarter of apps, has not yet made a comparable public commitment. Given that both platforms share the same dominant SDK provider and similar app monetisation pressures, the expectation that Samsung will act independently without comparable public pressure seems optimistic.
Consent Architecture and the Regulatory Gap
The consent question deserves more careful treatment than it typically receives in industry statements. Bright Data's position, that every peer opts in through a dedicated screen, is technically accurate but analytically thin. Meaningful consent in the context of network relay services requires that users understand what they are consenting to, that consent is ongoing and easily revocable, and that the consenting party is legally capable of giving consent on behalf of all affected parties.
None of these conditions are reliably met by a one-time in-app prompt on a shared household device. The EU's GDPR framework and the UK's PECR regulations both impose requirements around consent for network access and data processing that arguably apply here, though enforcement in the smart TV app context has been limited. The FTC in the United States has broader authority under Section 5 to address unfair or deceptive practices, and the description of proxy enrolment as an alternative to ads, without clearly communicating that the user's internet connection is being sold to third parties, sits uncomfortably close to the deceptive end of that spectrum.
LG's intervention is welcome and the speed of the response, less than three weeks after Spur's research was published, suggests the reputational pressure was effective. But platform-level bans on identified SDK instances are a trailing indicator response. The more important work is building review infrastructure that makes this class of SDK detectable before it reaches 42 percent market penetration in a major app store. Until smart TV platforms invest in the kind of continuous automated behavioural analysis that has become standard practice in mobile security research, the structural conditions for the next proxy SDK wave remain firmly in place.