LG's Proxyware Ban: webOS Egress Controls & The 42% Stat
It’s about time. LG Electronics USA announced they will ban apps that convert Smart TVs into residential proxy nodes. This comes after researchers revealed that over 42% of apps in the webOS store permitted third-party traffic routing.
This isn't just about ad fraud; it’s a massive OpSec failure for the home user. When your TV acts as a proxy, malicious actors can route attacks (credential stuffing, scanning) through your residential IP. When the victim blocks that IP, they block you, not the attacker.
While LG’s ban is a necessary first step, it relies on policing their app store, which is reactive. The vulnerability is the device's capability to route traffic freely.
If you suspect your devices might be compromised, checking for open proxy ports is a good start. Here is a quick scan for common proxy ports on your local subnet:
nmap -sT -p 8080,3128,8888,1080 192.168.1.0/24 --open
Furthermore, look for high bandwidth usage during idle hours in your firewall logs.
LG is treating the symptom, not the disease. Until IoT manufacturers implement strict egress filtering by default, these devices will remain targets. How are you all segmenting your home networks to handle untrusted IoT devices? Is a VLAN enough, or are you running full IDS on your TV traffic?
VLAN isolation is non-negotiable for me. All my IoT gear, including TVs, goes into a dedicated 'Untrusted' VLAN. They can talk to the internet for updates and streaming, but they have zero access to my LAN. I use firewall rules to block any non-essential outbound ports, so even if a proxy app gets installed, it can't reach the internet. It's a bit of setup, but it's the only way to be safe with these 'always-on' devices.
The 42% figure is terrifying. Most users won't even know they're part of a botnet until their ISP shuts them down for abuse. I've started monitoring for anomalous DNS requests from IoT devices using Pi-hole. If a TV tries to resolve a domain that isn't a known CDN or the manufacturer's update server, it gets flagged. It's amazing how much 'background noise' these things generate even when they're supposedly off.
Beyond isolation, strict egress filtering is a solid layer of defense. Smart TVs rarely need to initiate connections on non-standard ports. If your router supports it, enforce an allow-list for specific MAC addresses so IoT devices can only reach the internet via essential ports. For example, using iptables to drop all non-HTTP/HTTPS traffic from your TV's MAC:
iptables -A FORWARD -m mac --mac-source -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -m mac --mac-source -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -m mac --mac-source -j DROP
If connection attempts spike elsewhere, you’ve caught the proxyware red-handed.
Solid advice. Since simple egress filtering can sometimes be bypassed over port 443, spotting the volume of connections is key. A proxy node maintains many more concurrent connections than a typical streaming client. If you run a Linux-based gateway or firewall, this quick check helps identify the busiest client on your LAN, which can indicate unauthorized proxy activity:
ss -n -t | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -n 10
If your TV's IP appears at the top with a high count, it warrants immediate investigation.
Building on the volume monitoring point, if you manage a Linux-based gateway, you can quickly identify proxy abuse by auditing active connections per IP. A TV maintaining hundreds of ESTABLISHED states is a strong indicator. Run this to spot the outliers:
ss -tan | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access