Free Apps Are Turning Smart TVs Into Web-Scraping Proxies for AI

Summary: Researchers at Include Security and independent researcher Buchodi reverse-engineered the iOS SDK that Bright Data embeds in consumer apps and documented how, with an opt-in screen, it turns devices including always-on smart TVs into exit nodes relaying web-scraping traffic for a residential proxy network advertised at more than 400 million IPs. The research found the peer channel carrying scraping jobs has no real authentication, that on iOS its traffic bypasses a configured VPN (which Bright Data calls an unintended bug it is fixing), and that a Petflix Roku app's configuration set a 200 GB monthly Wi-Fi cap while some countries had far higher limits.
Why it matters: The scraping runs on the user's home IP and bandwidth, and the opt-in screen says Bright Data will use the device 'occasionally' while the configuration permits up to 200 GB a month. The line between this and botnet proxy networks like Aisuru and IPIDEA is consent, and whether a two-step opt-in makes that consent meaningful is the open question.

Read the original at The Hacker News ↗