If you have a smart TV from LG or Samsung, this news is for you. Both brands have begun banning and removing from their app stores the programs that use your internet connection to benefit strangers. And all of it, without you finding out. We explain what’s happening in simple words.
What exactly were those apps doing?
A smart TV (what are called Smart TVs) is a television with an internet connection. Just like on a phone, you can install apps on it: games, recipe programs, sports, news… The problem is that some of those apps carried a small hidden program that turned your TV into an “exit node”.
To understand it with an everyday example: imagine your internet connection is the hallway of your house. Those apps opened that hallway to outsiders so they could use it as a shortcut to other places on the internet, without you knowing. They didn’t enter your rooms or see your data, but they did use your hallway. And you paid for that hallway’s electricity, that is, your bill and your connection speed.
How many apps were affected?
Many more than you imagine. The security company Spur calculated that more than 42% of the apps available in LG’s stores and more than 25% of Samsung’s contained that kind of code. Almost half of a store’s programs, hiding a tool that shared your internet.
The most striking finding was made by the Norwegian security company Mnemonic. One of its researchers, Harrison Sand, managed to get inside a Samsung TV and discovered that this kind of code was even inside a simple Pac-Man game that Samsung itself recommended in its store as an “editor’s choice”. That game included a program from the company Bright Data, a firm dedicated to this business.
When did it start working?
The most curious thing is that the program didn’t work from the start. It remained dormant until the user accepted a consent screen. From that moment on, the app kept sharing your connection’s bandwidth… even after you closed the game. In other words, the TV kept lending your internet to others, in the background, without anything being visible on the screen.
The researchers also uncovered another concern: many of these apps are simple empty shells. The real code doesn’t come inside the app, but is downloaded from external servers after the store has approved it. That means what Samsung or LG technicians review when they approve an app isn’t necessarily what ends up running on your TV afterwards. And a small change on a remote server could activate millions of TVs at once.
Is this illegal?
Not always. These shared-connection networks have legitimate uses: they serve to access content from other countries, to protect privacy or so that artificial intelligence companies can collect public data with which to train their programs. That’s why users often accepted the consent screen without giving it a second thought.
But they’re also the perfect hiding place for criminals. When an attacker uses your connection to do something illegal, the traffic seems to come from a normal home, not from a server in a distant country. That makes it very hard for police or security companies to track who’s behind it. That’s why more and more experts are asking for these practices to be reined in.
What have LG and Samsung done?
The two brands have reacted quickly. John Taylor, vice president of LG Electronics in the United States, announced that using these networks wasn’t an intended purpose for their TVs and that they will suspend the apps containing this kind of code. For its part, Samsung confirmed it has already tightened its policies: it has banned registering new apps with these functions, is applying strict rules for developers and is identifying and removing from its catalogue all the apps that contain them.
What can you do?
While the stores get cleaned up, it’s worth checking your TV. Look at the list of installed apps and delete the ones you don’t use, especially simple games or programs you don’t recognise. Be wary of apps that ask for strange permissions or show confusing consent screens. And remember: when you accept a permission, read what you’re accepting. Your connection is yours, and nobody should use it without you knowing.
