# Your LG Smart TV Has Been Moonlighting as Someone Else's VPN
There is a decent chance the television in your living room has been renting out its internet connection — without your meaningful knowledge — to whoever was willing to pay for it. LG Electronics just admitted as much, promising to boot apps that turn its webOS smart TVs into residential proxy nodes. The announcement matters, but it also arrives late, leaves a big question mark over Samsung, and papers over a consent framework so weak it barely deserves the name.
## 42 Percent Is Not a Rounding Error
Last month, security firm Spur published research showing that more than 42 percent of apps available on LG's webOS app store contain SDKs that transform the television into a residential proxy — a device that routes strangers' internet traffic through your home IP address, indefinitely, in the background. Samsung's Tizen platform wasn't clean either: over a quarter of its apps carry the same components.
Residential proxies are valuable precisely because they look legitimate. Traffic routed through a residential IP at a real home address is much harder to block or flag than traffic from a datacenter. Businesses use them for ad verification, price monitoring, and web scraping. Less scrupulous actors use them for fraud, credential stuffing, and evading geo-blocks. The proxy provider doesn't always know which.
Bright Data — formerly Luminati Networks, which settled with the FTC in 2022 over concerns about its proxy network — accounts for the majority of these SDKs across both LG and Samsung platforms, according to Spur. The company didn't respond to requests for comment on this story. It maintains, as it always has, that it runs rigorous KYC processes and prohibits abuse. The presence of its SDK inside a Pac-Man clone on a smart TV app store suggests those controls have limits.
## The Business Model Behind the Screensaver
The mechanic here deserves to be stated plainly, because it is genuinely unusual.
App developers — building games, screensavers, file utilities — can generate revenue in two ways: display ads or integrate a residential proxy SDK. Some apps, like the Pac-Man title Spur documented, present this choice directly to the user. Others embed the proxy functionality without surfacing a meaningful choice at all.
From the developer's perspective, this is a clean transaction. The proxy provider pays for SDK integration; the developer gets a revenue stream without charging for the app. The device owner becomes the product. Their idle bandwidth, their home IP address, their electricity bill — all monetized by an app they downloaded to play a game while their kids are watching TV.
The specific danger Spur's Trevor Sutter flagged: "The risk is amplified when consent comes from individuals within the household who use the device but shouldn't give consent, such as minors." A ten-year-old who downloads a Pac-Man app and taps through an agreement they don't understand has not given meaningful consent on behalf of the household. But under current frameworks, that's exactly how this has been working.
## LG Steps Up. Samsung Has Been Quiet.
LG SVP John Taylor confirmed to KrebsOnSecurity that the company is "working with developers to remove the residential proxy option from their apps on the webOS platform," with suspensions for those who don't comply. Taylor's statement was direct: "A residential proxy network is not an intended use for LG smart TVs."
That's a reasonable position, though it required a public research report to prompt it.
Samsung has not made a comparable announcement. Samsung's Tizen store had more than a quarter of its apps carrying proxy SDKs. Samsung owns a larger global share of the smart TV market than LG. If you own a Samsung TV and downloaded something in the last few years, there's a non-trivial chance your device is currently on a proxy network's active roster.
The asymmetry is worth watching. LG just handed Samsung a free PR problem — and Samsung can either move quickly to match the policy or wait until another researcher drags the numbers back into the news.
## The Consent Theater Problem
Even if you accept that opt-in proxy SDKs are technically legitimate, the implementation on smart TVs fails basic transparency standards.
A one-time consent prompt buried inside an app install flow — on a device that most people don't think of as a networked computer — isn't consent in any meaningful sense. Smart TV owners don't typically audit what their apps are doing at the network layer. They don't run packet captures on their living room traffic. They have no dashboard showing which apps are sending traffic off-device, or to whom.
Residential proxy providers argue they have safeguards that prevent proxy customers from accessing the local network of the proxy host — your other devices, your NAS, your printer. That may be true. But it's a claim made by the same industry that profits from the arrangement, and it's unverifiable by the consumer.
LG's own record here has a footnote worth acknowledging: the company recently came under separate criticism for serving ads in its webOS interface and for data collection practices that go well beyond what most TV owners would expect. The proxy issue isn't an isolated lapse — it reflects a category-wide pattern of smart TV platforms treating the device as an ongoing revenue extraction mechanism rather than a product that was paid for at the register.
---
## HackWire Analysis
This story belongs to a pattern that's been building for years: IoT manufacturers treating the post-sale device as a second revenue stream, and app ecosystems doing the same through third-party SDK embedding.
The residential proxy angle is new terrain for most consumers, but the underlying logic isn't. The same dynamic drove the controversy around mobile apps bundling location data SDKs — documented extensively by The Markup and others — where apps sold to consumers were simultaneously selling their real-time GPS coordinates to data brokers. The TV proxy SDK is that pattern applied to bandwidth instead of location.
What's different here is the *scale of exposure* and the *passivity of the attack surface*. A phone user at least holds an active device they interact with constantly, with some chance of noticing anomalous battery drain or data usage. A smart TV sits in standby mode for hours. Many households never check their router's traffic logs. The proxy SDK is nearly invisible in normal use.
For defenders: if you're responsible for a network — home or office — this is a legitimate argument for putting smart TVs on an isolated VLAN. Treat them like guest devices. They don't need access to the rest of your network, and given what we now know about what these apps do in the background, restricting their reach is cheap insurance.
For the industry: LG's action is welcome, but the enforcement mechanism matters. "Work with developers to remove the option" is a softer posture than "ban the SDK class outright." If the same proxy functionality can be repackaged or disguised, the policy wins the press release and loses the technical battle. Samsung owes its users a similar statement, and an actual timeline.
The question nobody has answered yet: how long have these SDKs been active, and how much residential proxy traffic has already flowed through living room televisions without anyone noticing?
— HackWire Editorial
---
## Related Coverage