LG Moves to Block Apps That Turn Smart TVs Into Residential Proxies
LG Electronics has announced a ban on apps that secretly convert its smart televisions into nodes within residential proxy networks — a discovery that has sent shockwaves through the cybersecurity community and raised serious questions about the security posture of consumer IoT devices. The move follows a report by threat intelligence firm Spur, which found that nearly half of all apps available on LG's smart TV platform contained code from residential proxy software development kits (SDKs). For IT professionals and privacy advocates, the implications are significant: millions of living-room televisions may have been quietly co-opted as infrastructure for cybercriminals.
A residential proxy network operates by routing the internet traffic of paying clients through the real home internet connections of unsuspecting consumers. Because the traffic appears to originate from legitimate residential IP addresses, it is far harder to detect or block than traffic from commercial data centres. The clients purchasing access to these networks are not always benign — they can include credential-stuffing attackers, fraudsters, and other threat actors seeking to disguise the origin of their malicious activity. This model essentially turns ordinary households into unwitting accomplices, without their knowledge or informed consent.
How Residential Proxy Networks Exploit Consumer Devices — and Why That Matters
To understand why this discovery is alarming, it helps to understand the threat model. When a cybercriminal attempts to breach an organisation's systems — whether through credential stuffing, account takeover, or scraping — their IP address can be flagged and blocked if it originates from a known data centre or a suspicious foreign location. A residential proxy sidesteps this entirely. By routing the attack through a residential IP address in the same city or country as the target organisation, the malicious login attempt appears far more legitimate. According to research tracked by cybersecurity analysts at KrebsOnSecurity, this geographic spoofing capability is one of the primary selling points of residential proxy services on underground markets.
The Netherlands' National Cyber Security Centre (NCSC) has formally identified residential proxies as a threat to national digital security — a rare designation that underscores the seriousness of the problem. For European businesses and public sector organisations, any device on a home or office network that participates in such a proxy network without consent is a potential compliance and security liability, particularly under the GDPR framework, which requires organisations to have meaningful control over how personal data flows through their infrastructure.
Residential proxy services recruit devices through several distinct channels. The most insidious — and the one relevant to the LG case — involves paying app developers to embed a proxy SDK directly into their applications. Once a user installs the app, the SDK silently enlists the device into the proxy network. Other recruitment methods include VPN providers that bury proxy participation clauses in their terms of service, compromised IoT devices exploited via known vulnerabilities, malware infections, and individuals who knowingly install proxy software in exchange for small payments. The LG case primarily involves the SDK-in-app method, according to Spur's findings.
LG's Enforcement Plan: Cooperation First, Suspension as a Last Resort
In a statement reported by IT security journalist Brian Krebs, LG confirmed it would work directly with app developers to remove residential proxy code from their applications. The company stated that developers who fail to comply will have their apps suspended from the platform. This measured approach — cooperation before punishment — reflects the complexity of enforcing app store policies at scale, but privacy professionals and IT decision-makers may question whether the timeline is aggressive enough given the active nature of the threat.
"When nearly half of your app ecosystem is compromised by proxy SDK code, that is not a fringe problem — it is a systemic one that demands urgent, transparent remediation and clearer vetting processes for future submissions."
— Cybersecurity industry analyst commenting on the LG smart TV proxy discoveryThe enforcement challenge LG faces is not unique. Apple and Google have both grappled with SDK-level abuse in their app ecosystems, where third-party libraries and SDKs introduced by developers can carry hidden functionality that violates platform policies and user trust. The difference with smart TV platforms is that they have historically received less rigorous scrutiny than mobile app stores, making them fertile ground for exactly this kind of abuse. Research from Wired has previously highlighted how smart TV ecosystems lag behind smartphones in terms of both security auditing and user awareness.
The SDK Supply Chain: A Hidden Risk in Every Smart Device App Store
The LG situation is a case study in what security professionals refer to as supply chain risk at the SDK layer. When an independent app developer integrates a third-party SDK — for analytics, monetisation, or advertising — they do not always audit the full behaviour of that SDK at the network level. Proxy SDK providers actively market themselves to small developers as an easy revenue stream: embed our library, earn passive income. The developer may be unaware that their users' devices are being sold as proxy exit nodes to third parties, including criminal actors.
| Recruitment Method | How It Works | User Awareness | Prevalence |
|---|---|---|---|
| Embedded SDK in apps | Developer monetises app by including proxy SDK | None — completely hidden | High (LG case) |
| VPN with hidden terms | Free VPN sells bandwidth as proxy capacity | Buried in ToS | High |
| Compromised IoT devices | Exploiting unpatched vulnerabilities | None | Medium |
| Malware infection | Malicious software converts device to proxy node | None | Medium |
| Voluntary participation | Users knowingly install proxy software for payment | Full awareness | Low |
From a GDPR and digital sovereignty perspective, this SDK model represents a particularly troubling data flow. When a device in a European household is used to route third-party traffic — potentially including traffic associated with attacks on European organisations — the household's internet connection becomes an involuntary participant in cross-border data transfers and potentially unlawful processing activities. European data protection authorities have been increasingly attentive to these kinds of opaque data flows, and this case may attract regulatory scrutiny beyond LG's own enforcement actions.
Security researchers at organisations including the Electronic Frontier Foundation and academic institutions have long warned that smart home devices present an under-examined attack surface. Unlike smartphones, smart TVs are rarely rebooted, seldom receive timely security patches, and are not typically monitored by endpoint detection tools. This makes them attractive long-term assets for proxy operators, who benefit from stable, persistent nodes on residential networks.
Adware Controversy and the Broader Pattern of Smart TV Privacy Erosion
The timing of LG's proxy ban announcement is notable given that the company simultaneously faced criticism for reportedly automatically installing adware on users of certain LG monitors — a practice that drew sharp condemnation from privacy advocates and consumers. Together, these incidents paint a picture of smart display ecosystems where user control over their own devices is being steadily eroded in favour of third-party monetisation, whether by the manufacturer itself or by developers operating within its ecosystem.
For IT decision-makers and privacy professionals, this raises important procurement questions. Organisations that allow employees to use smart TVs in meeting rooms, home offices, or client-facing spaces should consider what level of network access those devices have. A compromised smart TV in a corporate environment — or on a network shared with work devices — could provide a persistent, low-visibility proxy node that bypasses perimeter security controls entirely. The principle of network segmentation, long recommended by bodies such as ENISA (the European Union Agency for Cybersecurity), becomes particularly relevant in this context. According to guidance from ENISA, IoT devices should be isolated on separate network segments precisely to limit the blast radius of compromises like these.
