LG Smart TV App Store Harbours Widespread Residential Proxy Abuse: Platform-Level Policy Response
LG Electronics discovered that 42% of apps in its webOS app store were allowing unknown third parties to route internet traffic through users' televisions as residential proxy nodes. LG now plans to suspend affected apps, addressing a significant privacy and network abuse risk.
Affected
LG's discovery that 42% of apps in its webOS store were facilitating unauthorised residential proxy functionality represents a systemic failure in app vetting and permission enforcement rather than a singular vulnerability. The researchers' findings suggest that app developers either intentionally included proxy capabilities or incorporated third-party SDKs that performed this function without transparent user consent. This is particularly concerning because smart TVs are long-lived devices in home networks, typically left running continuously, making them ideal persistent nodes for proxy botnets.
Residential proxies operate by routing web traffic through consumer devices, obscuring the requester's true origin and defeating IP-based security controls. This abuse vector is particularly valuable for attackers performing credential stuffing attacks, accessing geo-restricted content, conducting reconnaissance against targets, and evading detection by security services. When multiplied across hundreds of thousands of compromised televisions, this creates substantial infrastructure for organised cybercriminal activity.
The root cause appears to lie in webOS's app permission model and review process. Modern smart TV platforms grant apps broad network access by default, and app store review processes, if they exist at all, may lack the sophistication to detect proxy functionality, particularly when obfuscated through third-party libraries or APIs. Unlike smartphone app stores with more mature security practices, IoT platforms have historically prioritised developer convenience over security controls.
LG's suspension policy is a necessary remediation step, but reactive bans do not address the underlying architectural problem. Defenders should assume that similar vulnerabilities exist across other smart TV platforms, connected appliances, and IoT devices with app stores. Organizations managing corporate or educational IoT deployments should implement network segmentation to isolate smart TVs from sensitive infrastructure, monitor egress traffic for proxy patterns, and consider disabling app store access entirely if not required.
The broader implication is that consumer IoT devices are becoming infrastructure weapons without meaningful consent from users or device owners. Platform vendors have been slow to implement permission transparency comparable to mobile operating systems. This incident should accelerate adoption of capability-based security models, mandatory permission auditing, and cryptographic app signing standards across IoT ecosystems.
Sources