KrebsOnSecurity ran a piece this week that I have not stopped thinking about. Security firm Spur went through the LG webOS app store and found that more than 42 percent of the apps there ship with an SDK that quietly turns the TV into a residential proxy node. Not obscure sideloaded junk either - games, screensavers, file utilities. Samsung comes off barely better, with over a quarter of Tizen apps carrying the same kind of code.
What that means in practice is that somebody else's traffic goes out through your home IP address, indefinitely, and you have no easy way to see it happening. The router shows nothing odd because the TV is a device you already expect to talk to the internet. If that traffic gets used for something ugly, the address on the log is yours.
LG's answer, via SVP John Taylor, is that developers who do not strip the proxy code will have their apps pulled outright, and the catalog review is already running. Bright Data, the network behind most of these SDKs, says users opt in on a dedicated screen. Spur's counter is the one I land on - a single consent prompt buried inside a TV app is not consent when anyone in the house, including a kid mashing OK to get into a game, can accept it.
What bothers me is that this is a review problem, not a technology problem. Phone stores catch this sort of thing. TV stores apparently do not, and LG only moved after an outside firm published numbers.
Has anyone here actually put their TV behind a monitored router and looked at what leaves it? I would like to see what a clean webOS set looks like next to one running a handful of store apps.
What that means in practice is that somebody else's traffic goes out through your home IP address, indefinitely, and you have no easy way to see it happening. The router shows nothing odd because the TV is a device you already expect to talk to the internet. If that traffic gets used for something ugly, the address on the log is yours.
LG's answer, via SVP John Taylor, is that developers who do not strip the proxy code will have their apps pulled outright, and the catalog review is already running. Bright Data, the network behind most of these SDKs, says users opt in on a dedicated screen. Spur's counter is the one I land on - a single consent prompt buried inside a TV app is not consent when anyone in the house, including a kid mashing OK to get into a game, can accept it.
What bothers me is that this is a review problem, not a technology problem. Phone stores catch this sort of thing. TV stores apparently do not, and LG only moved after an outside firm published numbers.
Has anyone here actually put their TV behind a monitored router and looked at what leaves it? I would like to see what a clean webOS set looks like next to one running a handful of store apps.
