Consumer Tech

A Pac-Man App Put Strangers on Your Network

Samsung is banning residential proxy SDKs from its smart TV store after Norwegian security firm Mnemonic found proxy code in apps including a featured Pac-Man title. LG acted in July after 42 percent of its apps were implicated.

Consumer TechBy Servola Tech Desk2026-08-046 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A Pac-Man App Put Strangers on Your Network

Key takeaways

Samsung is removing apps that turn smart TVs into residential proxy nodes after researchers found the code in its own store, including in a Pac-Man title Samsung had promoted under Editor's Choice. Any TV on your premises is an unmanaged device inside your perimeter.
LG moved first, in July, after reporting indicated roughly 42 percent of apps on its platform carried proxy network functionality. Two platforms at that scale means this is an app-store economics problem, not a single vendor's defect.
A residential proxy does not buy bandwidth, it buys addresses. The traffic that leaves through your connection carries your public IP, and abuse feeds, blocklists and law enforcement all resolve that address to you.
Samsung's statement covers new registrations, a developer policy ban and removal of existing apps. None of that reaches a television already installed and already running the app in your reception area.
Put display devices on a segregated VLAN with restricted egress this month, and check your public IP ranges against abuse and blocklist databases. A TV should be treated as an unmanaged endpoint, because that is exactly what it is.

What the researchers found in the store

The Norwegian security firm Mnemonic examined apps distributed through Samsung's smart TV platform and found software that creates a residential proxy network. Once such an app runs, an outside party can route their internet traffic through the television's home or office connection. The most uncomfortable single finding was where the code turned up: in a Pac-Man title that Samsung itself had promoted in the Editor's Choice section of its recommended apps, carrying code from Bright Data, a proxy provider based in Israel. Some of the apps involved claimed installation on hundreds of millions of smart TVs.

Samsung's response is unusually specific for a vendor statement. The company said it has already restricted new app registrations that incorporate proxy functionality on its Smart TV platform, that it is implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and that it is working to identify and remove all apps currently in its store that contain these components. Three commitments, each verifiable in time, which is more than these statements usually offer.

This is also not the first platform to act. LG said in July that it would suspend apps capable of turning a customer's television into a residential proxy, following reporting that indicated roughly 42 percent of the apps on its platform carried that functionality. That figure is the part worth sitting with. When two of the largest television platforms in the world are both affected at that scale, the correct conclusion is not that one vendor was careless.

Why a television is the ideal host

The mechanics: a residential proxy service sells access to IP addresses that look like ordinary consumers, because traffic from a household address passes checks that traffic from a data centre fails. Buyers use them for ad verification and price scraping, and also for credential stuffing, fraud and evading geographic restrictions. The supply side is the problem: someone has to provide the addresses, and the cheapest way to get them is to embed an SDK in free software that users install voluntarily.

A smart TV is close to the perfect host for that arrangement. It is powered on or in standby almost permanently, so it is available around the clock. Its apps update on their own schedule and its firmware is patched rarely and often not at all after a few years. It has a fast connection and no user watching a task manager. Above all, nobody in the organisation considers it a computer, so it appears in no asset register, no vulnerability scan and no offboarding checklist. It sits inside the trusted network because someone in facilities plugged it into the nearest port.

The honest version of the risk: this is not an attacker breaking in. It is a commercially operated service using a screen you bought, through an app someone installed, doing exactly what its code was written to do. That makes it far more durable than an intrusion, because there is no breach to detect and nothing on the network that looks anomalous. It is simply outbound traffic from a device that is allowed to make outbound traffic.

The bill arrives as your IP address

For a household this is mostly a story about bandwidth and consent. For a business it is a story about attribution, and that is a different order of problem. Every request a stranger routes through your connection leaves with your public IP address on it. You own that address in every practical sense: it is registered to your company, it appears in your partners' logs, and it is what an investigator sees.

The failure modes are unglamorous and expensive. Your address ends up on a reputation blocklist, and your legitimate mail starts landing in spam folders for reasons nobody can trace. A payment provider or a customer's web application firewall begins throttling or rejecting your traffic because that address has been seen doing credential stuffing. A partner's security team asks you to explain activity you cannot explain, because it did not come from any system you know about. In the worst case the routed traffic is criminal, the address resolves to your company, and you are the one holding the correspondence.

None of these arrive labelled as a smart TV problem. They arrive as deliverability trouble, as an unexplained WAF block, as a compliance question during a supplier review. Firms typically spend weeks chasing the wrong cause, because the device generating the traffic is not on any list of devices they believe they operate. That diagnostic gap is the real cost, and it is why the inventory step below matters more than any single vendor's cleanup.

What to do with the panels you already own

Start from the premise that the vendor fix does not reach you. Samsung's action governs new submissions, developer policy and store removals. The television mounted in your reception area, your meeting rooms, your showroom, your waiting area or your staff canteen has the app installed already, and whether the removal reaches it depends on the device checking in and applying the change. Assume it has not.

Three steps, in order of value: first, write down every internet-connected screen you own, including the ones in rooms nobody books and the ones inherited with a lease. Second, put them on a segregated VLAN or a guest network with egress restricted to what they actually need, which for a display running a signage or streaming app is a short list. Third, check your public IP ranges against the common abuse and blocklist databases, because if the traffic has been flowing you may already be listed and simply have not connected the two facts.

Then apply the general rule this incident illustrates. If a connected device runs free software and shows no advertising and charges no subscription, the revenue is coming from somewhere, and the two things it has to sell are your data and your address. That is a question worth asking at procurement, before the panel is on the wall. Where the budget allows, a display with no smart platform driven by a managed player you control is both cheaper to secure and easier to reason about, and it removes an entire category of this problem permanently.

Frequently asked questions

How would we know whether one of our televisions is doing this?

From the network rather than the device, because the TV interface will show nothing. Look for a display making persistent outbound connections to a wide and changing set of destinations, at volumes that do not match a screen showing a signage loop, and particularly for traffic continuing outside opening hours. Netflow or firewall logs filtered to the device's address will show it. The television itself has no view that would reveal it.

Is using a residential proxy service illegal?

The services themselves operate commercially and have legitimate uses such as ad verification and market research, so this is a question of consent and purpose rather than a simple legal line. The problem here is that the party providing the connection did not meaningfully agree to provide it, and that some buyers use the capacity for fraud and credential attacks. For your business the practical exposure is attribution and contract compliance, not your own criminal liability.

Does resetting the television to factory settings fix it?

It removes apps that were installed after purchase, which addresses the immediate instance, but it does not prevent the same app being installed again and does not help if the component ships inside something preloaded. Treat a factory reset as cleanup rather than as a control. The durable fix is network segmentation, because it limits what the device can reach regardless of what is running on it.

The striking detail in this story is not that malicious code reached an app store. It is that it reached the featured shelf, in a game with a name everyone recognises, on a platform used by hundreds of millions of households and a very large number of businesses that never counted their screens as computers. Samsung and LG are doing the right thing and neither can reach the panel already hanging in your lobby. That one is yours, and the address it is spending is yours too.

SamsungTizenresidential proxyBright DataMnemonicLGsmart TVnetwork segmentation

Samsung Named No Number, New Jersey Did

Samsung's own statement about its US consumer electronics reorganisation contains no number. A New Jersey labour filing puts it at 739 roles, and a second filing adds 179 more.

4 min read

Consumer Tech

Three Firms Now Decide If Your Phone Stays Cheap

AI data centres are eating the memory chips that budget phones and laptops need. The sub-100-dollar phone is collapsing and prices hold high into 2027. What European buyers and fleet owners should plan for.

3 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.