Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs
Short summary
Security researchers found that nearly half of tested LG smart TV apps include SDKs that turn living-room devices into residential proxy nodes without proper private-range blocklists. These proxy connections run silently, exposing home networks and sidestepping meaningful user consent or ongoing control.
- Nearly half of tested LG Smart TV apps bundle residential proxy SDKs (Bright Data, Massive, Honeygain/Oxylabs) that turn TVs into proxy nodes for others' traffic.
- Bright Data's code blocks private IP ranges (proving the capability to reach them), while Massive and Honeygain/Oxylabs samples open raw TCP sockets with no private-range filtering at all.
- These proxy connections run silently with no post-install disclosure, ongoing consent, bandwidth visibility, or user control—even trivial apps like screensavers or clocks can carry them.
Full summary
Nearly half of LG’s Smart TV apps pack proxy SDKs from services like Bright Data, Massive, and Honeygain/Oxylabs. Bright Data’s code even lists local IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16, 192.168.0.0/16, 255.255.255.255) to block, proving the TV can reach those addresses if policy allowed. In contrast, Massive and Honeygain/Oxylabs samples take a host:port from the server and open a raw TCP socket—with no private-range filters in the local versions we saw.
That means a TV app can quietly turn your living room device into a node on a residential proxy farm. Screensavers, novelty games or clocks can tap your home’s bandwidth. None of the apps we reviewed prompt you again after installation or explain how much traffic will flow through your network, what locations your IP will appear in, or how third parties might use that connection.
Consumers assume a TV is just a display. They don’t expect it to run hidden network services. Worse, consent screens in TV apps are one-off, easy for anyone in the house—including kids—to click past without understanding. There’s no ongoing control panel, no per-app bandwidth meter, and no strong platform rules forcing clear disclosures. Platforms need to demand meaningful transparency and real controls before letting these SDKs into mass-market devices.