Samsung has committed to banning smart TV apps that expose users' internet connections to outside parties, after researchers discovered that apps on its platform were secretly turning televisions into residential proxy exit nodes.

Norwegian cybersecurity firm Mnemonic identified the problem. Certain apps distributed through Samsung's smart TV app platform included code capable of routing someone else's web traffic through a user's home internet connection. That traffic would appear to come from the user's own IP address rather than from whoever actually requested it Engadget.

A residential proxy, in brief, is a service that lets a third party send web requests through an ordinary household internet connection instead of through a data center. Because the traffic looks like it comes from a regular home, it is hard to filter or block. Residential proxies are valued for circumventing geo-restrictions, scraping websites at scale, or hiding the origin of automated and potentially malicious activity.

One of the apps Mnemonic flagged was a licensed Pac-Man game that Samsung had featured in the Editor's Choice section of its app store. Installing it could turn a Samsung smart TV into a residential proxy exit node, allowing unknown third parties to route web requests through the device Mnemonic.

The mechanism is relatively simple. A residential proxy SDK — a software development kit, a bundle of code that developers embed inside an app — can remain dormant after installation. It activates later to route someone else's web traffic through the TV's connected internet. From the outside, that traffic looks like it originates from the TV owner's household IP address. The TV owner absorbs the bandwidth cost and, more critically, the reputational and legal exposure tied to whatever the proxied traffic turns out to be.

After TechCrunch contacted Samsung about the findings, the company said it would ban any apps that shared users' internet connections TechCrunch. Samsung also said it would implement platform-wide developer policies explicitly banning residential proxy SDKs Engadget.

The issue extends beyond Samsung. LG separately said it would suspend any apps capable of turning a customer's TV into a residential proxy Krebs on Security. The parallel response from two major smart TV manufacturers indicates the problem is structural to the category rather than isolated to a single vendor's review process.

The attack surface this reveals is worth attention. Smart TV app stores have historically operated with less scrutiny than mobile app stores, despite the devices sitting on home networks with access to other local devices. A residential proxy SDK dormant inside a casual game, one that Samsung itself promoted, shows how easily the trust model of a curated app store can be subverted when the monetization incentive for proxy operators aligns with the distribution reach of a popular consumer device.

The Pac-Man app's placement in the Editor's Choice section is a concrete data point. Samsung's curation did not catch the embedded proxy functionality before promoting the app to users. The gap between editorial endorsement and actual security vetting is the kind of thing platform operators tend to address reactively rather than proactively, and Samsung's policy announcement follows that pattern.

Samsung has framed its response as a platform-wide policy change rather than a targeted removal. Banning residential proxy SDKs at the developer-policy level is a meaningful step if enforcement follows, because it gives Samsung a clear basis for rejecting or removing apps without needing to prove that proxy traffic has already occurred. The dormancy of these SDKs makes detection after the fact harder; a policy-level prohibition addresses the problem at intake rather than at incident response.

LG's parallel commitment suggests the industry may be converging on a baseline norm: consumer devices should not silently serve as network infrastructure for unknown parties. Whether that norm holds will depend on enforcement rigor, not policy text.

The broader lesson for anyone building or managing app ecosystems is that residential proxy networks are a commercial product category with legitimate use cases, but their deployment through consumer devices without informed owner consent crosses a line that is now being codified, at least by Samsung and LG. The pattern — SDK ships dormant, activates later, monetizes the host device's network identity — is not new in the mobile world. It is newer in the smart TV context, where fewer users think of the device as a general-purpose computer that can be repurposed without their knowledge.

For security teams advising consumers or managing home-network policies, the takeaway is direct. A smart TV is a networked compute device running third-party code, and it should be treated as such on any network where it has access to sensitive resources. Network segmentation for IoT and smart-TV devices — placing them on a separate network from laptops and phones — has been best practice for years. Discoveries like Mnemonic's are the reason that guidance persists.