Pac-Man took over Samsung smart TVs to share home internet

When not gobbling ghosts, Pac-Man has been giving away the internet connections of Samsung smart TV owners.

Research by cybersecurity company Mnemonic that was covered by TechCrunch found that several Samsung smart TV apps, including a Pac-Man one that was billed as an “Editor’s Choice” could potentially turn the TVs into a digital way to launder cybercrime.

Related

5 smart TV features that could be spying on you and how to stop them

These smart TV features could be spying on you

Posts By  Stanley Martin

Laundering internet traffic

Mnemonic determined that some of the apps, particularly those that are just a few lines of code that act as a shell to load content from a website, as in the case of Pac-Man, can be used as residential proxy networks.

This lets others use them to route their own web traffic while making it look like it originated from the owner of the Samsung smart TV. The app does not even have to be active for it to turn the TV into a residential proxy network.

In the case of the Pac-Man game, Mnemonic said that the malicious code was activated by a user accepting a consent screen. Once that was done, the code ran in the background until the app was deleted.

The Pac-Man app code came from Israel data company Bright Data. Mnemonic said that it appeared to be scraping LinkedIn profiles and collecting data for AI training.

Samsung says it’s shutting down apps

TechCrunch contacted Samsung for a comment and was told that it is banning all such apps.

“We have already restricted new app registrations that incorporate such proxy functionalities on our Smart TV platform,” a Samsung spokesperson told TechCrunch. “We are currently implementing strict platform-wide developer policies explicitly banning residential proxy SDKs, and we are working to identify and remove all apps currently available in our store that contain these components.”

Risk for all smart TVs

Late last month, KrebsOnSecurity revealed a similar issue with LG smart TVs. In response, LG said it was working with app developers to remove the residential proxy option from their apps, and that any developers who failed to comply would have their apps removed from the platform.

While residential proxy networks can be installed on other devices, including phones, smart TVs are one of the easiest targets because they’re not going to exhibit the same battery drainage or errors that a phone or computer would.

To reduce the risk to your own smart TV, be cautious when downloading apps, read and research the consent agreements for them, and delete any apps that are not being used or are not truly useful.