LG bans residential-proxy SDKs from webOS TV apps
LG will suspend webOS apps that ship residential-proxy SDKs, a month after Spur documented such SDKs in 42% of LG apps and 25% of Samsung Tizen apps.
Loop The residential-proxy SDK inside a smart-TV app is a compact piece of code: a client bundle from a provider like Bright Data, Massive, or Honeygain/Oxylabs that opens a persistent outbound connection to the operator’s control plane, waits for HTTP fetch requests submitted by that operator’s paying customers, and executes them out of the TV’s home internet connection under the TV’s own residential IP address. The consent prompt runs once when the app is first opened. The forwarding process keeps running after the app is closed, because a webOS or Tizen TV in a nominally “off” state is still a small ARM computer running housekeeping tasks over Wi-Fi — and once the SDK has registered itself as one of those tasks, the difference between “TV off in the living room” and “TV in the middle of forwarding a fraud vendor’s HTTP request through your DSL line” is not visible from the couch.
LG Electronics USA said this week that it intends to end that pattern on its own store. Per Krebs on Security’s July 22 writeup, LG’s statement is that “a residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If this option is not removed, these apps will be suspended.” LG did not publish a hard enforcement deadline — the company told Krebs the review is “well underway now.”
What Spur found on June 22
The move is a response to a June 22 research post from Spur that scanned 6,038 apps across LG’s webOS and Samsung’s Tizen and matched confirmed proxy-SDK fingerprints — Bright Data’s brd_api.js and brd_sdk service, Massive client artifacts, Honeygain/Oxylabs SDK files and tokens — against the packaged app bundles rather than the store descriptions. Krebs pinned the LG figure at roughly 42 percent and the Samsung Tizen figure at over 25 percent, with Bright Data accounting for the majority of the SDK inventory on both platforms. Spur named specific apps carrying the code: Galactic Harmony, TV Cooking Hub, Trick Shot Ball, and, on the Tizen side, a version of Pac-Man.
Spur’s Trevor Sutter, quoted by Krebs, framed the disclosure/consent gap as: “a one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight.” Spur’s original post is somewhat blunter about the mechanics — the SDK sits in the app, the consent flow is a single OK-and-forget screen, the proxy persists after the user closes the app, and removal requires explicit uninstallation.
Where this fits in the residential-proxy market
The physical layer here is not exotic. A residential IP address is valuable to a fraud vendor for exactly one reason — it does not sit inside an ASN that a bank’s or a retailer’s fraud model treats as suspect — and the supply side of that market has been going through a difficult few weeks. The FBI’s July 2 seizure of the NetNut proxy platform and disruption of the Popa botnet cut roughly two million compromised home routers out of the pool. Infoblox’s July 9 writeup on the “Lurking Lizard” 230-domain fake-7-Zip campaign described a smaller operator running the same model out of drop-catch domains. Flare’s July 17 read of underground carding forums found buyers auditioning replacements for the seized supply.
Smart-TV SDKs are not a replacement for NetNut in shape or scale — the operators here are commercial vendors selling nominally-consented traffic to legitimate customers, not black-market resellers of compromised routers. What they share with the black-market side is the underlying supply: a residential IP that a fraud model cannot filter on the network layer. LG’s decision to strip the SDKs from its store narrows one channel into that supply. It does not touch the demand, and it does not bind Samsung, which the Spur research also implicated and which, per Spur’s post, has not drawn an equivalent public line.
What to do with this on your side
The concrete defensive detail is the one the Flare data pointed at last week: if your IP-reputation feed is your primary signal for suspicious residential traffic, note that a growing share of residential IPs being resold as “clean” belongs to consumer devices — smart TVs, and by extension anything else sharing the same home network — that will not carry a hosting-provider ASN, will not sit in a datacenter block, and will not appear on any existing residential-proxy IP blocklist for weeks or months after the SDK operator adds a new device to its pool. The fingerprint and behavioral signals — browser configuration, request cadence, session shape — are where LG’s move on its store shifts the ground least. Weight them accordingly.
Sources
Found this useful? Share it.
