Residential Proxy SDKs in Smart TV Apps Expose Users to Hidden Traffic Routing
Third-party SDKs embedded in LG webOS smart TV apps were silently routing internet traffic through users' home networks without their knowledge or consent, effectively turning consumer devices into residential proxy nodes. This is a supply chain risk because app developers introduced malicious or privacy-violating components through third-party SDK integrations, bypassing platform-level oversight. The issue highlights the danger of insufficient vetting of third-party libraries before they reach an app marketplace. Users had no visibility into this behavior, meaning their bandwidth, IP reputation, and potentially sensitive network data were being exploited. Platform owners like LG bear responsibility for enforcing SDK policies before apps reach consumers.
Tactical Insight
Immediate actions
- Audit all published apps in your platform or ecosystem for unauthorized or privacy-violating third-party SDKs.
- Suspend or quarantine any app confirmed to contain residential proxy or covert traffic-routing SDKs pending remediation.
- Notify affected users about the data exposure risk and steps being taken to resolve it.
Long-term improvements
- Establish a mandatory SDK/third-party library vetting process as part of app submission review before marketplace approval.
- Require developers to submit a Software Bill of Materials (SBOM) for all apps listing every third-party dependency.
- Implement contractual developer agreements that explicitly prohibit SDKs that route user traffic without informed consent.
Detection measures
- Deploy continuous automated scanning of marketplace apps to detect known malicious or privacy-violating SDKs post-publication.
- Monitor platform network telemetry for anomalous outbound traffic patterns indicative of proxy or relay behavior.
- Establish a responsible disclosure or bug bounty program to incentivize external researchers to report SDK abuses.