Free apps are quietly turning smart TVs into web-scraping proxies for AI, according to a recent report by Include Security and independent researcher Buchodi. This revelation highlights a concerning trend where consumer devices, particularly always-on smart TVs, are being co-opted for malicious purposes. The issue stems from the embedding of the iOS SDK by Bright Data in consumer apps, which then turns these devices into exit nodes for web-scraping traffic, primarily for the AI industry. This is particularly insidious because the scraping occurs from the user's home IP, not the customer's, and the risk is not a hacked account or stolen data, but rather the misuse of a home connection's bandwidth for scraping activities.
The researcher found that the peer channel carrying scraping jobs has no real authentication and bypasses a configured VPN on iOS. This means that the app can fetch pages from other websites using the user's home internet connection without detection. The SDK allows up to 200 GB of traffic a month, and in some countries, the limits are set even higher, allowing the device to keep working almost until the battery runs flat. This raises a deeper question about the meaning of consent, as the opt-in screen does not match what the SDK actually allows.
The use of smart TVs as web-scraping proxies is not new in concept, but the scale and the buyer have changed. Anti-bot defenses from companies like Cloudflare and DataDome block scrapers coming from datacenter IPs, so AI scrapers now route through residential connections, including those from smart TVs. This shift has been fueled by the Aisuru botnet, which was dismantled by Google in January. The model of selling free users' bandwidth as exit nodes through Luminati, the predecessor to Bright Data, is now being applied to always-on devices in the living room.
The researcher also noted that the traffic is easy to spot and block on a home network. By blocking specific web addresses used by the SDK, such as proxyjs.brdtnet.com and clientsdk.bright-sdk.com, the device can be prevented from acting as a relay without affecting Bright Data's paid service. However, this requires constant vigilance, as Bright Data could change how the SDK connects in the future, necessitating regular updates to any blocklist.
This issue highlights the need for better transparency and user control over the data being collected and used by apps. Consumers should be fully informed about the data they are sharing and how it is being used, especially when it comes to devices that are always on and connected to the internet. As AI continues to advance, it is crucial to address these concerns to ensure the responsible and ethical use of technology.
