As reported by Krebs on Security, LG Electronics USA has announced plans to suspend smart TV applications on its webOS platform that silently enroll users' televisions into residential proxy networks — a practice that turns household devices into unwitting traffic relays for unknown third parties.

Key Takeaway: As reported by Krebs on Security, LG Electronics USA has announced plans to suspend smart TV applications on its webOS platform that silently enroll users' televisions into residential proxy networks — a practice that turns household devices into unwitting traffic relays for unknown third parties.

Why This Is More Than a Smart TV Problem

This story deserves attention well beyond the consumer electronics community. Residential proxy networks are a foundational enabler of modern cybercrime infrastructure. They are used to bypass geo-restrictions, commit ad fraud, conduct credential stuffing attacks, and obscure the origin of malicious traffic. When a threat actor routes an attack through a residential IP address — especially one belonging to a smart TV sitting on a home network — it becomes exponentially harder for defenders to distinguish malicious from legitimate traffic.

The statistic buried in this story is striking: over 42 percent of apps available on LG's webOS store were found to be enrolling devices as proxy nodes. That is not a rogue app problem — that is a vetting and governance failure at scale. For context, this mirrors what we saw in mobile app ecosystems years ago before Apple and Google were pressured into more rigorous review processes. IoT app stores are, by comparison, the Wild West.

Who Is Actually at Risk?

The immediate victims are LG smart TV owners, but the downstream risk is distributed across everyone who may be targeted by attacks originating from those residential IPs. Consider the following exposure surface:

Who Is Actually at Risk?
Home users whose bandwidth and IP reputation are being monetized without consent, potentially flagging their IP for abuse or rate-limiting by legitimate services
Enterprise security teams whose IP reputation blocklists and geo-based controls are undermined when malicious traffic appears to originate from residential addresses
Financial institutions and e-commerce platforms that rely on IP intelligence as a fraud signal — residential proxies are specifically designed to defeat these controls
Consumers with shared networks, including anyone on the same ISP subnet, who may face collateral reputation damage

The Structural Problem: IoT App Store Governance

LG's response — while commendable — is reactive. The fact that these apps passed initial review and remained available for download long enough for researchers to catalog them points to a deeper industry-wide problem: IoT manufacturers have not applied the same scrutiny to their app ecosystems that mobile OS vendors have been forced to adopt. Smart TVs, routers, NAS devices, and home hubs all run app ecosystems with far lighter oversight than Android or iOS.

The proxy SDK is almost certainly embedded by third-party monetization libraries that app developers may not even fully understand they are including. This is the same pattern seen in mobile adware campaigns — a legitimate-looking SDK that quietly adds network relay functionality to earn the developer passive income.

This also raises questions about other smart TV platforms. LG is under scrutiny today, but Samsung Tizen, Android TV (Google TV), Roku, and Fire TV ecosystems should be audited with the same lens. There is no particular reason to believe this problem is unique to webOS.

Network-Level Indicators to Watch

Security teams responsible for home office or BYOD environments should understand what anomalous smart TV traffic might look like. Residential proxy nodes typically exhibit:

  • Sustained outbound TCP/UDP connections to cloud relay infrastructure outside typical streaming CDN ranges
  • Unusual traffic volumes outside of active viewing hours (the "always-on" nature of proxy SDKs means the TV doesn't need to be in use)
  • Connections to known proxy network infrastructure (EarnApp, IPRoyal, Honeygain, and similar services have documented IP ranges)
  • DNS queries for domains associated with peer-to-peer traffic routing services

Shield53 Recommendations

For Home Users and IT-Aware Consumers

  • Audit installed apps on your LG smart TV immediately and remove any apps you did not deliberately install or no longer use
  • Segment your smart TV on a separate VLAN or guest Wi-Fi network so it cannot access other devices on your home network
  • Monitor outbound traffic from your TV using a home firewall or router with traffic logging (pfSense, OPNsense, or even a Pi-hole with logging enabled can help identify anomalous destinations)
  • Consider blocking known residential proxy network domains and IPs at the DNS or firewall level

For Enterprise and Security Teams

  • Do not rely solely on IP reputation as a fraud or access control signal — residential proxy proliferation continues to erode the reliability of this signal
  • Review your BYOD and remote work policies to assess whether employee home networks (which may include compromised smart TVs) represent an acceptable risk posture for accessing corporate resources
  • Engage your threat intelligence providers to ensure their residential proxy IP lists are kept current — this is a fast-moving target

For Security Researchers and Vendors

  • LG's action should prompt coordinated research across all major smart TV platforms — this is a systemic IoT ecosystem problem, not an isolated incident
  • Manufacturers should be pushed toward mandatory SDK disclosure in app submissions, similar to how Apple requires developers to declare third-party SDKs and their data practices

LG deserves credit for moving quickly once the research surfaced. But the cybersecurity community should treat this episode as a forcing function to demand higher standards from every IoT app ecosystem — because the living room has quietly become part of the attack surface.