Your Smart TV Works for AI While You Sleep and You Don't Know It
In recent days, a security research detailed how the Bright Data iOS SDK, included in various free apps, turns users' devices, including the always-on smart TVs in living rooms, into exit nodes that forward web scraping traffic on behalf of the company's clients. The work, authored by Include Security along with independent researcher Buchodi, is relevant not for a hacked account or stolen data, but because the scraping originates from the user's home IP address: their connection and bandwidth become data collection infrastructure for someone else.
Bright Data is the successor to Luminati, the paid proxy service born from Hola VPN: in 2015, Hola was caught reselling the bandwidth of its free users as exit nodes through Luminati, at $20 per gigabyte. What changed was the buyer: anti-bot defenses from Cloudflare, DataDome, and others block scrapers coming from data center IPs, so those collecting data for AI reroute requests through residential connections. Bright Data, presenting itself as the largest network of residential proxies in the world with over 400 million IPs, extracts a share from a “consenting” pool of over 150 million addresses fueled precisely by that SDK.
In this context, the smart TV is almost the ideal node: typically always plugged in, on a fast connection, and rarely under surveillance. It never drops below 1% battery, doesn’t frequently change networks, and doesn’t shut down when the user is sleeping.
How the app becomes a scraping node
The reconstruction, obtained by decompiling the iOS framework and observing thirty days of traffic, shows that upon launch, the app contacts a Bright Data server that provides the configuration without really verifying who is making the request: the app's identifier, obtainable from the App Store, and the SDK version are enough. At this point, the device opens a persistent channel to the company's infrastructure and waits for instructions, which are typically individual scraping jobs that the SDK executes as HTTP requests to third-party sites, using the user's home IP as the sender. That channel, the researcher notes, does not require any message signatures or device authentication, and is described as less secure than typical commercial malware command and control mechanisms.
The definition of "inactive device" for the SDK simply means that CPU, memory, and battery remain within certain thresholds. Two explicit settings allow traffic forwarding even while the screen is on and while the user is on the phone. On iPhones, moreover, the channel that carries the scraping jobs bypasses a configured VPN on the device, connecting directly to the physical interface, and much of what the app does evades the tools with which security teams normally monitor applications.
The gap with consent
The most delicate point is the disparity between what the consent screen states and what the SDK actually allows. In the Roku app mentioned in the research, Petflix, the opt-in text states that the device will be used "occasionally"; instead, the downloaded configuration sets a cap of 200 GB of traffic per month over WiFi. The thresholds then change by geographical area: most devices worldwide can forward up to 500 MB a month and only when above 20% battery, but in countries like Uzbekistan and Oman, the limit rises to 30 GB monthly, sixty times that, and the device remains operational even when the battery is low. The SDK is also capable of linking phones and computers that run apps of the same brand, treating them as a single user.
The technical analysis by Inside Security mostly focuses on the iOS SDK, while the scope of the problem impacting smart TVs rests instead on Bright Data's platform support, its public partner list, and a previous coverage. The television aspect was first highlighted last February by an investigation by the Lowpass newsletter. Bright Data publicly publishes its partner list on an accessible page that includes TV app developers like PlayWorks Digital, CloudTV, and Longvision; however, the research warns that appearing on that list only indicates an integration existed at some point in the app's history, not that the currently distributed app necessarily includes the SDK. Each case should be individually verified.
How to defend yourself
The traffic leaves fairly unequivocal traces and is easy to block. On the home network, simply preventing the resolution of the domains that the SDK uses to connect, starting with proxyjs.brdtnet.com and other proxyjs addresses, with a router-level tool like Pi-hole or NextDNS; according to the research, the block stops the forwarding without touching Bright Data’s paid service, which runs on separate domains. Meanwhile, Google, Amazon, and Roku have restricted background proxy SDKs, and Bright Data has abandoned those platforms, while continuing to list Samsung's Tizen and LG's webOS.
The difference between botnets that hijack devices without the owners' knowledge and Bright Data's model lies in one element: here the exit nodes consent through a consent screen, which, in the case of a TV, is provided via the remote control on a line of text that mentions “occasional” use. How informed that consent truly is remains to be proven.