Your smart TV may be a proxy exit node — and the SDK is built to slip past your VPN
Researchers found an SDK that turns always-on smart TVs and phones into residential proxies for the AI-scraping economy. The detail that stopped the thread cold: a flag that binds to your physical network interface specifically to route around any VPN you've configured.
The mechanism
IncludeSecurity's investigation shows how Bright Data's mobile/CTV SDK turns consumer devices — especially always-on smart TVs — into residential proxy exit nodes for web scraping and AI-training data collection. The SDK pulls config from an unauthenticated endpoint (clientsdk.bright-sdk.com), then opens a persistent WebSocket to proxyjs.brdtnet.com:443 that dispatches scrape jobs as unsigned JSON with no device attestation. The TLS certificate's name is *.luminatinet.com — Bright Data's pre-2018 "Luminati" identity. Through partners (PlayWorks reaches ~250M TV homes; CloudTV spans 125+ brands), it relays up to 500MB of someone else's traffic per device per month.
The detail that stopped the thread
The article is alarming on its own. The thread isolated the single most indefensible behavior:
"What's a legitimate use case for this API? When/why should an app be allowed to bypass a user-configured VPN?" — a commenter zeroing in on the VPN bypass
That refers to a use_netifs flag that makes the SDK bind directly to the physical interface (WiFi en0 or cellular pdp_ip0), deliberately routing around a user's VPN tun0. Your VPN protects the app's normal HTTPS traffic — and the proxy tunnel steps over it anyway. There is no benign reading of code written specifically to evade the privacy tool you turned on.
Independent confirmation, and a warning the fixes won't hold
A developer who runs a mobile-SDK analysis tool corroborated the spread:
"I found some 60 iOS apps that have the SDK mentioned in the article … I was unable to find related Android SDKs … With 60 iOS apps there must be apps with Android SDK." — a developer who runs the AppGoblin SDK-analysis tool
And another cautioned that the article's mitigations are paper-thin against a motivated vendor:
"Proposed mitigations look weak … I expect BrightData to rotate the endpoints if this issues gains enough attention … TLS fingerprint: unless SDK pins it, it's the cheapest one to rotate continuously." — a commenter on how easily the defenses are evaded
The liability nobody signed up for
The quietest, scariest point was about who takes the blame for traffic leaving your IP:
"running a Tor exit node has: badly behaved users are going to be using it to hide their location. Imagine having the police show up at your door … when the actual culprit is someone that is using your TV as a proxy." — a commenter on the exit-node liability
That's the whole story in one image: you bought a television, and somewhere a scraper is using your home IP address to hoover up the web — past your VPN, under a defunct brand name, with your address on the packets. The AI-data economy needed residential IPs at scale, and it found them in your living room.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
A tool that turns Git into queryable 'code entities' — and the '2.3x more accurate' claim the thread shredded
Sem layers semantic entities on top of Git so you can ask what a function depends on, what calls it, and how many tests a change touches. The idea won the thread over. Its marketing — 'AI agents are 2.3x more accurate' — and its git-hijacking installer did not.