One in Three Smart-TV Apps Quietly Routes Strangers' Traffic Through Your Home
Spur unpacked 6,038 LG and Samsung app packages and found 2,058 carrying residential-proxy SDKs. Nearly half were on the LG side, and the SDKs keep running after the app closes.
The SDKs from Bright Data, Massive and Honeygain route third-party traffic through users' home networks behind one-time consent prompts. The flip: these are third-party apps, not LG's own, and a consent screen does exist, which reframes outrage as weak consent.
Spur scanned 6,038 LG webOS and Samsung Tizen app packages, unpacking each and matching confirmed SDK artifacts rather than trusting store descriptions. It found 2,058 apps, about 34%, containing residential-proxy SDKs, with nearly half on the LG side. These SDKs route strangers' internet traffic through users' home networks, running silently in the background even after the app is closed.
What Spur actually found inside the packages
Bright Data and its subsidiaries published 367 of the flagged apps; Honeygain and Oxylabs accounted for 16. Spur frames smart TVs as uniquely risky because they don't trigger the caution a phone or PC would. The publisher concentration drew notice in the thread.
"'Publishes with the most proxy flagged apps' 1. Desoline (based in Netanya (Israel) 2. Bright Data (based in Israel) Interesting." — a commenter pulling the publisher list
Two replies sanded down the headline. The first drew the line Spur's framing blurs.
"those are third party apps, not first party LG apps. Based on the headline I thought it's the built-in apps." — cube2222, Director of R&D Engineering at Spacelift
The second walked back the assumed worst case after reading more closely.
"This turned out to be more ethical than I thought. I'd thought there wasn't any consent at all, or the actual mention of proxying was buried in a 20 page EULA." — a commenter who noted the consent prompt
And one reader turned on the exposé itself.
"12 minute article. 70% AI. The only content not flagged? Copy and pasted PR comments. Invisible Unicode characters, triads, unnecessary markdown… AI DDOSing should be shameful." — a commenter who ran the post through AI-detection
The distinction that survives: consent exists, but a one-time prompt most users don't parse is a thin barrier between your living room and an open relay for someone else's traffic.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Tablet Makers Won't Help Linux Drivers Because the Repo Is Named After Wacom
David Revoy tried to broker a deal between Gaomon's engineers and Red Hat's driver team. Gaomon declined, balking that the open-source infrastructure carries the name of their biggest competitor.