Samsung has begun removing Smart TV apps that include residential proxy software, a tool that routes internet traffic through users’ home connections. This marks a key step in addressing growing concerns about privacy and misuse.
The discovery came after Norwegian cybersecurity firm Mnemonic conducted an in-depth investigation into Samsung’s Tizen platform. During the analysis, the researchers uncovered Bright Data’s residential proxy SDK embedded in several popular apps, including the game Pac-Man. Notably, this app was once highlighted in Samsung’s recommendations. According to the findings, these apps would only start using the proxy feature after the user gave explicit consent through a prompt. However, once enabled, the service would run continuously in the background, even after the app was closed. To Bright Data’s credit, the dormant proxy functionality would need user consent to activate.
How the apps worked
The structure of the affected apps is designed as lightweight shells that fetch most of their actual code from remote servers. This approach allows developers to push updates quickly without waiting for app store approval, but it creates a serious security issue. Samsung cannot fully verify what users are running because features and functions could change after an app has been approved. This gap in oversight leaves the company with no way to ensure users are only operating verified, safe software. After gaining root (admin) access on their Samsung Smart TV, a process which involved desoldering the TV's flash chip to read the firmware directly, the researchers were able to analyze network traffic from the TV and the Tizen-compatible apps installed on it.
Broader industry trend
Samsung is not the only company facing this issue. The use of residential proxy software has been found in Android apps, Android TV boxes, and even in digital picture frames. These devices are often always connected to the internet, making them attractive targets for bad actors. Cybercriminals can exploit the background activity of these devices to route malicious traffic through legitimate IP addresses, which helps them avoid detection. While this is a licensed port, it was also handled by development studio Play.Works, who simply pay larger publishers for the license to port games like Pac-Man and Space Invaders to smart TV platforms like Samsung's Tizen OS.
Google recently took a strong step against residential proxy abuse by disrupting the NetNut network and updating Google Play Protect to warn users about Android apps that include the NetNut SDK. The tech giant also revealed that millions of devices, including smart TVs and streaming boxes, had unknowingly been enrolled in such proxy networks. This could allow attackers to use these networks to mask their activities by hiding behind the IP addresses of unsuspecting users.
LG also began cracking down on residential proxies in early August, following research that found over 42% of webOS apps contained proxy SDKs. The company announced a similar policy shift to remove such software from its app store. Samsung’s recent decision suggests that the broader tech industry is finally recognizing the risks these networks pose and is starting to take meaningful action to address them. As more companies become aware of the widespread presence of residential proxies, stronger measures appear likely to follow. When investigating, Mnemonic realized that Play.Works games use the Bright Data SDK, and Bright Data openly operates as a data collection company with a massive residential proxy network. After gaining root (admin) access on their Samsung Smart TV, a process which involved desoldering the TV's flash chip to read the firmware directly, the researchers were able to analyze network traffic from the TV and the Tizen-compatible apps installed on it. This is how Mnemonic discovered the Bright Data SDK hidden within an Editor's Choice Pac-Man port, and "uncomfortably" noted that the distance between it and an exit node in your living room "is one server-side configuration change and one button press from whoever happens to be holding the remote."