LG to Suspend Smart TV Apps Secretly Selling Your Internet Connection as a Proxy

Your smart TV might be moonlighting as someone else's internet connection.

According to KrebsOnSecurity, cybersecurity firm Spur examined 6,038 apps across LG's webOS and Samsung's Tizen platforms and found 2,058 of them contained code that sells access to your home IP address. Nearly half of all LG apps tested were affected.

In response, LG has pledged to crack down on developers using its platform this way and says it will suspend apps that don't stop the practice, per KrebsOnSecurity's reporting.

How This Actually Works

Proxies themselves aren't illegal. Businesses use them constantly for data collection, market research, and routing traffic. Regular people use them to change their apparent location or get around geographic content blocks.

The problem is what's called a "residential proxy." These make internet traffic look like it's coming from an ordinary home address instead of a data center, which makes it far harder for websites to detect and block. That's valuable to anyone doing large-scale web scraping, ticket scalping, ad fraud, or worse, hiding malicious activity behind a residential IP that looks legitimate.

Smart TV apps have become a target for exactly this reason. According to ZDNET's reporting on the Spur findings, developers bundle proxy software into free apps and bury the permission in the terms and conditions, often phrased as letting the app "use your IP address and free resources" even after you've closed it. Nobody reads that fine print. The app runs ad-free, seems harmless, and your TV becomes a proxy node generating revenue for a developer you've never heard of.

Add in the fact that TVs are almost always plugged in and connected to WiFi around the clock, and you've got a device that's a near-perfect, low-effort proxy host. Unlike your phone or laptop, most people never think about their TV as something that needs security scrutiny.

Why This Matters Beyond Privacy

This isn't just about your IP address getting quietly resold. If a proxy operator's filtering breaks down or gets abused, a device roped into that network can end up carrying traffic tied to botnets, the same infrastructure used to launch large-scale attacks on websites and services. Your living room TV could be an unwitting participant in someone else's cybercrime operation, without a single warning light going off.

The Response So Far

LG's commitment, as described by KrebsOnSecurity, is to suspend apps that keep running proxy code without user knowledge or consent. That's a reasonable first step, though it's reactive. It relies on outside researchers like Spur finding the problem first, and on LG actually enforcing the crackdown across thousands of third-party apps rather than a handful of high-profile offenders.

Samsung's Tizen platform has the identical issue, according to the same Spur findings, but ZDNET's reporting does not indicate Samsung has made a comparable public commitment to suspend offending apps. That's a real gap. If half the problem gets fixed on LG TVs while Samsung's remain exposed, consumers who don't know which platform they own are still at risk.

What You Can Actually Do

There's no indication either company plans a full audit disclosure telling consumers which specific apps were flagged. The practical options are limited: disable ACR (automatic content recognition) tracking where possible, avoid installing obscure free apps promising ad-free streaming, and consider routing smart TV traffic through a router-level VPN, which at least limits what a compromised app can see or redirect.

None of that stops a proxy SDK already embedded in an app you've already installed. It only limits the damage.

What's Unresolved

LG hasn't published a list of which apps are being suspended or a timeline for full enforcement. Samsung hasn't issued a matching public response to the Tizen findings as of this reporting. And there's no indication any regulatory body, the FTC or otherwise, has opened a formal inquiry into whether burying proxy permissions in dense terms-of-service language constitutes deceptive practice under existing consumer protection law. The fix depends entirely on the manufacturers policing their own app stores.