LG To Ban Residential Proxies From Smart TV Apps (krebsonsecurity.com) 42
An anonymous reader quotes a report from KrebsOnSecurity: The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV. On July 2, [KrebsOnSecurity] featured research by the security firm Spur that examined the prevalence of residential proxy software development kits (SDKs) in smart TV apps. Spur found more than 42 percent of apps available for download on LG smart TVs include SDKs that turn one's television in a proxy node indefinitely, and that more than a quarter of the apps made for Samsung's Tizen operating system had similar residential proxy components.
Responding to questions about Spur's research, LG Senior Vice President John Taylor told KrebsOnSecurity the company was working with app developers to remove the residential proxy option from their apps on the webOS platform. Developers that fail to comply, he said, will find their apps suspended. "A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform," Taylor said. "If this option is not removed, these apps will be suspended." Taylor said LG is committed to keeping residential proxy networks out of its smart TV apps going forward, and that the company's review of those apps is "well underway now."
"As part of our ongoing efforts to enhance platform quality and the user experience, LG will continue to strengthen our evaluation process for developer-submitted apps, including those that incorporate residential proxy SDKs," Taylor wrote in an emailed statement. [...] "A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight," Spur's Trevor Sutter wrote. "The risk is amplified when consent comes from individuals within the household who use the device but shouldn't give consent, such as minors." LG is also facing criticism for monitors that automatically install software promoting paid McAfee subscriptions through Windows Update without user approval.
Responding to questions about Spur's research, LG Senior Vice President John Taylor told KrebsOnSecurity the company was working with app developers to remove the residential proxy option from their apps on the webOS platform. Developers that fail to comply, he said, will find their apps suspended. "A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform," Taylor said. "If this option is not removed, these apps will be suspended." Taylor said LG is committed to keeping residential proxy networks out of its smart TV apps going forward, and that the company's review of those apps is "well underway now."
"As part of our ongoing efforts to enhance platform quality and the user experience, LG will continue to strengthen our evaluation process for developer-submitted apps, including those that incorporate residential proxy SDKs," Taylor wrote in an emailed statement. [...] "A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight," Spur's Trevor Sutter wrote. "The risk is amplified when consent comes from individuals within the household who use the device but shouldn't give consent, such as minors." LG is also facing criticism for monitors that automatically install software promoting paid McAfee subscriptions through Windows Update without user approval.
It makes me so sad.... (Score:2)
...that I never gave my LG TV a connection to the internet... Now if only I could get rid of that damn nag message warning my that I have no network connection and that I should set it up so I can get updates...
this (Score:2, Interesting)
This is why webos is shit, and also why I never connected my LG TV to a network.
It's too bad that Google has been shitting up android tv. It's super hard to get useful software onto it. Even most apps which will work fine aren't marked as such so you can only sideload them.
As such, all of the choices are now crap except using a PC
Re:this (Score:5, Informative)
That is not a WebOS problem. Privacy advocates and consumer protection groups have been warning about such SDKs for Android and iOS for over a decade.
The deal is simple: The SDK maker says, "Add this zip file and this line of XML, and you get a nice dashboard detailing who your users are. Here are 20 pages of fine print you better not read." The developer adds the SDK and receives a nice dashboard (and possibly even a few cents per installation), while the SDK creator gains a massive amount of user tracking data.
Usually, people say, "Damn, users don't read the fine print," but the first person who should have read it is the app developer. They literally sold their users by failing to read the SDK's fine print. They likely incorporated paragraphs of template Terms of Service from the SDK creator into their own terms (possibly without reading them, too), so legally everything is fine.
In addition to tracking, providing "residential proxies" is another opportunity for these companies. There are all kind of users who like to access something inconspicuously so they cannot just use a AWS IP for their bot, so there is a market for renting out residential internet connections. And giving people making popular apps a few cents you can get a lot of proxies on consumer devices.
The advantage of (LG) TVs is not WebOS (which rather diminishes the choice of compatible SDKs), but that many Smart TVs are always on with only the screen powered down. As they do not run on battery, nobody notices when they are busy as proxy servers, because there is no battery to drain and in standby nobody notices a slowdown of the system and nobody suspects that a possible slowdown of the internet connection is caused by the TV that's on standby.
Re:this (Score:5, Informative)
The answer to this problem is the same as for every other piece of software:
Stop embedding other peoples code into your code if you have not fully vetted and understood it.*
When you embed or link other people's code into your code, it becomes your responsibility. If you are not competent to understand/vet/maintain the full code base, then you are not competent to be in charge (lead developer/maintainer/architect/whatever-you-want-to-call-it).
This is not to say that less proficient coders cannot be part of the team, but someone has to be on top of ALL of the code in the product, no matter who authored it. Larger projects may need multiple people each responsible for portions of the code.
*I know this is inefficient. I know it is counter to modern coding practices. It is the only way to be confident your work is secure: Trust but verify. Verify everything, every time.
Re: (Score:3)
"Stop embedding other peoples code into your code if you have not fully vetted and understood it.*"
Tell us more about how you read every line of your favorite libc.
And your second favorite libc.
Re: (Score:3)
You didn't? I grew up a computer geek. I actually read this kind of stuff for fun... .
But my point only applies to the functions you are using -you don't need to know all of glibc by heart, but if you are including #menumaker_4.0c you should step thru it before trusting it to not be malicious. When you include it in your app -YOU- are accepting responsibility for what it does on your clients machine.
Re: (Score:2)
Re: (Score:2)
> Stop embedding other peoples code into your code if you have not fully vetted and understood it.*
It's an incentive problem. This code gives you a dashboard who your users are and possibly some better crash reports than the plain stacktraces the device provides. It may also make you some cents per installation. For some less ethical developers that's enough incentive to not care about what they do to their users.
To stop this you need a stronger incentive against it. Let's say the appstore owner bans you
Re: (Score:2)
It's too bad that Google has been shitting up android tv. It's super hard to get useful software onto it. Even most apps which will work fine aren't marked as such so you can only sideload them.
That is at least partially on the app developers themselves, who do not add android tv compatibility to the manifest (so the play store will not offer it on the play store for android tv). Admittedly, some developers probably don't think there is sufficient interest to make it worthwhile to make any required changes for android tv (the legacy leanback or modern jetpack compose changes), but others probably don't even test their app on the emulator to see if it works (and could be enabled).
And then there
Re: this (Score:2)
It is, and I understand that, but I still place most of the blame with Google for creating such a distinction. It smacks of incompetence to not plan for users to be able to operate apps intended for one of those environments in theyl other
Why do people buy this garbage? (Score:5, Informative)
Their monitors load malware/spam onto your computer randomly, when they feel like it.
Their TVs turn your network into a Tor node or however the fuck this works.
That's three strikes and it only takes one strike to receive a lifetime brand-wide ban in my game.
Re: (Score:1, Flamebait)
If only there was a way to not connect these things to your network...
Re:Why do people buy this garbage? (Score:5, Insightful)
If only there was a way to not connect these things to your network...
That will likely work for now, but it's only a matter of time before they do what cars do and include cell network connectivity. I'm sure the only reason they don't already is that it's harder to justify the cost on something in the $1k range (rather than the $30k+ for cars), but someday one of them will figure that ongoing revenue streams justify the connectivity costs.
Re: Why do people buy this garbage? (Score:3)
Re: (Score:3)
No LAN cable. Check.
No Wifi access. Check.
Buuuuuuut : If you live far out in the country, you can probably control all Wifi points the TV could realistically connect to. Here in any reasonable dense city, there are about 20 wifi SIDS being broadcast when I'm at home. It only takes one open one for the TV to connect to at the makers bidding, not yours to upload the precious telemetry.
Esim : All bets are off. If $Cost_of_esim_and_sub LESS THAN $Revenue_from_telemetry then you know the tv will have one. Heck,
Re: (Score:2)
Re: (Score:2)
Is there anything about this company that isn't shady? I don't recall ever seeing anything good about them.
Re: (Score:3)
Is there anything about this company that isn't shady?
Their OLED panels
Re: (Score:2)
Re: (Score:2)
Because comparably few people actually have the time to figure out what their TV (or the TVs from other brands) are doing aside from displaying video and emitting audio.
Re: (Score:2)
I used to like LG appliances, they do work well ... until they don't.
My final LG purchase was a double oven, which does cook very well. Unfortunately a very small plastic trim piece was broken, and it took me weeks of pinging LG support and social media teams to get them to replace it under warranty. I only wanted them to comply with the California right to repair law so I could just fix it myself, but they told me their corporate policies did not allow for that. When a tech finally showed up he did replace
Re: (Score:2)
Their LG smart washers sometimes use 42GB of bandwidth per day randomly and nobody knows why.
Firstly it was 3.6GB / day, 40GB in total over the days that the user was monitoring. And everyone who has bothered to follow up on the story rather than committing a headline to memory at one point and never revisiting it knows why. There was a bug that stuck it in a loop downloading a firmware update that wasn't installing correctly. The problem was resolved in a matter of days after discovery.
Their monitors load malware/spam onto your computer randomly, when they feel like it.
No there's nothing "random" about what is going on. There's a very clear causality and a well understood mechanis
Re: (Score:2)
Their LG smart washers sometimes use 42GB of bandwidth per day randomly and nobody knows why.
Firstly it was 3.6GB / day, 40GB in total over the days that the user was monitoring. And everyone who has bothered to follow up on the story rather than committing a headline to memory at one point and never revisiting it knows why. There was a bug that stuck it in a loop downloading a firmware update that wasn't installing correctly. The problem was resolved in a matter of days after discovery.
Thank you for providing this correction to GP's post.
Somewhat amusing that that's at +5, Informative though, whilst your post is languishing at +2 (including, I think, my default +1 user / karma bonus).
How is this a thing? (Score:4, Insightful)
Yes, I understand, "smart" TVs, wouldn't trust them as far as I could throw them.
But nearly half the apps are backdoors to your network?! Isn't this federal pound me in the *&s prison level stuff (or whatever the equivalent would be in the relevant jurisdiction)?
Re: (Score:2)
Re: (Score:2)
Isn't this federal pound me in the *&s prison level stuff (or whatever the equivalent would be in the relevant jurisdiction)?
Practically speaking, maybe not?
If the terms of service that they make you "read" and agree to when you install the app allows this, then they've arguably procured permission, and at that point the criminal justice system bows out -- "it's a civil issue".
Now, using this backdoor access to hack your other internal systems probably isn't covered by what you agreed to, but I would also imagine that most use of these proxies aren't to hack your internal network but just to gain access to new IPs in new countrie
Now we know (Score:3)
The consumer having no control (Score:2)
or visibility of what's in any of these TV apps is the whole reason why smart TV's never get Internet connectivity in my house. I use a Linux PC to serve video via HDMI.
I suppose TV manufacturers could make it impossible to use the smart TV if you never connect it to the Internet, but they'd probably see mass returns to the store if they tried that. Of course, they could make smart TV purchases non-returnable and non-refundable, but that would be cutting off their nose to spite their face.
I have a theory ab
Re: (Score:2)
I suppose TV manufacturers could make it impossible to use the smart TV if you never connect it to the Internet, but they'd probably see mass returns to the store if they tried that.
LOL sure they would! Given how ad supported video streaming is more popular than paid, the number of robot vacuums and smart lights require online setup, don't hold your breath on those TV returns.
Re: (Score:3)
They're getting close. Wal-Mart's TV brands (Onn and they recently bought Vizio too) will not work without a Wal-mart account
Re: (Score:2)
I'm aware of that. If all else fails I guess we'll be watching TV from large computer monitors without tuners and Ethernet jacks. If they some how take that away, there's always books from the public library.
Yes but what apps specifically were proxying? (Score:2)
Most apps are barely used and are garbage. They omit what apps were specifically caught proxying and the number of installations.
Was it any of the big ones such as Netflix, Amazon Prime, Hulu etc?
Re: (Score:2)
No it's not the big ones, because those have reputations to uphold.
It's always the questionable apps - you know the apps you see in ads and such, and there are almost always clones of everywhere. Especially if it's a paid app and suddenly there's a free clone of it.
And they're really there to offer exit nodes for V
LG Speed-Running Bad Reviews and Boycotts... (Score:3)
I give it no more than 2 weeks before it becomes common knowledge that LG is worse than Samsung. Not only do their newer computer monitors automatically install adware on your computer without your permission or notice, but not their smartTVs will stop allowing you access to apps if you use a proxy in your own damn house and on your own damn network.
How financially desperate must they be?
Re: (Score:2)
And they are always forcing updates on you (or annoying you incessantly to where you give in and install the update) that load in new services that make money off you, like ACR. They don't disclose that it is there and enabled by default, and hide the ability to turn it off way down in the settings where 95% of people would never go.
Texas AG just won a settlement with them that they must disclose ACR and only enable it via upfront consumer consent. And no more selling user data to China. That really says ho
Re: (Score:2)
Wrong news for that comment. They for once did something useful.
That's nothing. (Score:2)
Hmmm, just don't buy a LG TV. ! (Score:2)