- Malware botnets route traffic through the internet connection on many smart TVs
- Roku, Fire TV, Tizen and webOS all affected
- Some manufacturers are removing affected apps
Samsung, Roku and Fire TV televisions and devices may have been part of a malicious “botnet” — and millions of TVs could be affected, though LG and Samsung have committed to removing the relevant apps
FlatpanelsHD rounded up pieces of this puzzle, stretching back several months. Back in April, it emerged that many apps and games included a feature called “residential proxy” that could be abused by bad actors.
One example, IPIDEA, had enlisted millions of smart TVs in a network that could crawl the web for AI training or even carry out coordinated attacks by groups in China, North Korea, Iran and Russia.
The TVs were being used to bypass IP range blocks that affected AI data centers: because each individual TV has its own unique address, such blocks could easily be evaded by seeming to be ‘real’ traffic. And because the proxy feature doesn’t require the app to be open, TV owners would be none the wiser.
According to security researcher Harrison Sand at Mnemonic, one of the malware-infected apps was a Pac-Man game for kids that Samsung featured as an Editor’s Choice.
And according to security firm Spur, 26.5% of apps for Samsung Tizen smart TVs and over 42.5% of LG webOS apps could be dragged into the botnet. That’s a truly shocking statistic,
What is a residential proxy, and why is it bad?
A residential proxy or “reproxy” transmits data through your device, in this case your TV, to make it look as if your TV is the sender of that data.
The feature isn’t necessarily malicious — it can be used for testing and advertising purposes — but as security expert Spur explains, it also “provides attackers with a scalable way to hide automation, bypass geo-controls, and evade reputation-based defenses.”
Spur’s website goes into more detail of how they operate and how they differ from services such as the best VPNs.
It seems likely that at least some of the potentially dodgy apps weren’t made maliciously; developers who use certain software development kits that have residential proxy features may not know those features are there.
LG and Samsung have now vowed to ban any smart TV apps that contain residential proxies. IPIDEA is already banned by Amazon, Roku and Google TV, and they have also restricted the new Bright Data network.
LG says that it working with developers to remove the functionality from their apps, and that it will suspend any apps that don’t remove it. Samsung has restricted new app registrations for apps, and is “working to identify and remove all apps… that contain these components.”
What worries me isn’t so much that the malware exists — the more our TVs become like PCs, the more PC-like attacks will target them — but that it’s made its way into so many TVs and is presumably still there on many of them, despite being publicized back in April.
It just adds to my distrust of smart TVs more widely: with features such as Automatic Content Recognition and ad injection (and here in the UK, prominent placing of TV channels I don’t want anywhere near my TV on the home screen), plus too-frequent updates to terms and conditions that I just know mean more tracking, it seems to me that smart TVs are becoming both privacy and security risks.
Which is why I treat my smart TV like it isn’t smart at all: it’s merely a monitor for my Apple TV 4K.
