The webOS Proxy Nightmare: LG's Ban and the 42% Infection Rate
Just saw the news that LG Electronics USA is finally banning apps that turn their smart TVs into residential proxy nodes. Frankly, it’s about time. The report that 42% of apps in the webOS store were essentially weaponizing consumer TVs is staggering.
For those who missed the details, these apps offered users free premium content or gift cards in exchange for background bandwidth usage, effectively turning the TV into a SOCKS5 or HTTP CONNECT node for third parties. In a corporate environment, if an LG TV bridges your guest Wi-Fi to a proxy network, you have a serious data exfiltration risk on your hands.
From a blue team perspective, spotting these requires correlation between user agents and unusual high-duration connections to known proxy ports. If you are monitoring your firewalls, watch for non-standard traffic on 80, 443, or 1080 originating from devices identifying as LG webOS.
Here is a basic Suricata rule to help flag suspicious handshake patterns from these devices:
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"POTENTIAL RESIDENTIAL PROXY webOS"; flow:to_server,established; content:"User-Agent: LG webOS|0D 0A|"; http_header; pcre:"/CONNECT\s+/i"; sid:9000001; rev:1;)
It’s good to see LG taking a hard stance, but the fact that the vetting process failed to catch this for so long is concerning.
For those managing large estate deployments or MSPs handling smart home setups, are you completely blocking smart TV internet access, or are you inspecting their traffic?
We stopped trusting Smart TVs on the main network years ago. Everything IoT goes into a dedicated VLAN with strictly egress-filtered traffic. They only get access to specific update servers and CDNs (Netflix, Hulu, etc.).
If you're using pfSense/OPNsense, you can alias the known LG webOS update domains and block everything else:
# Block all traffic from IoT VLAN except specific allowlists
block log quick from $IOT_NET to any
pass quick from $IOT_NET to $LG_UPDATES keep state
It's the only way to sleep at night knowing your TV isn't part of a botnet.
Solid writeup. The detection logic is sound, but be careful with false positives. Legitimate streaming apps on webOS sometimes behave weirdly with CDNs, mimicking proxy behavior due to chunked transfers.
I’d recommend adding a check for destination IP reputation. If the TV is connecting to a VPS provider or an ASN known for hosting VPNs (not CDNs), that’s the real smoking gun. You can enrich your KQL query with a threat intelligence lookup:
let SuspiciousASNs = dynamic(["AS14061", "AS16276", "AS20940");
DeviceNetworkEvents
| where DeviceType == "SmartTV"
| where RemoteASN in (SuspiciousASNs)
That usually filters out the noise from standard Netflix/YouTube traffic.
I actually tested a few of these 'gift card' apps for a client last month. The obfuscation was surprisingly low-level. They weren't just standard HTTP proxies; some were running modified binaries that hid the traffic within encrypted SSL tunnels to look like standard telemetry.
LG banning them is great, but the devices are already in the wild. We need to push for firmware updates that revoke the signing keys of those specific malicious apps, otherwise, existing installs will keep running until the user factory-resets the device.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access