LG to ban residential proxies from smart TV apps
LG to ban residential proxies from smart TV apps
LG 将禁止智能电视应用使用住宅代理
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. 家电巨头 LG 电子美国公司本周表示，计划暂停所有将其智能电视转变为常驻住宅代理节点的电视应用。
The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV. 在此之前不到一个月，研究人员发现 LG webOS 商店中超过 42% 的游戏和其他可下载应用允许未知的第三方通过用户的电视路由其互联网流量。
On July 2, we featured research by the security firm Spur that examined the prevalence of residential proxy software development kits (SDKs) in smart TV apps. Spur found more than 42 percent of apps available for download on LG smart TVs include SDKs that turn one’s television in a proxy node indefinitely, and that more than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components. 7 月 2 日，我们报道了安全公司 Spur 的一项研究，该研究调查了智能电视应用中住宅代理软件开发工具包 (SDK) 的普及情况。Spur 发现，LG 智能电视上超过 42% 的可下载应用包含可将电视无限期转变为代理节点的 SDK，而三星 Tizen 操作系统中超过四分之一的应用也具有类似的住宅代理组件。
Responding to questions about Spur’s research, LG Senior Vice President John Taylor told KrebsOnSecurity the company was working with app developers to remove the residential proxy option from their apps on the webOS platform. Developers that fail to comply, he said, will find their apps suspended. 在回应有关 Spur 研究的提问时，LG 高级副总裁 John Taylor 告诉 KrebsOnSecurity，公司正在与应用开发者合作，从 webOS 平台的应用中移除住宅代理选项。他表示，未能遵守规定的开发者，其应用将被暂停。
“A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform,” Taylor said. “If this option is not removed, these apps will be suspended.” “住宅代理网络并非 LG 智能电视的预期用途，LG 电子正在与开发者合作，从 webOS 平台的应用中移除住宅代理选项，”Taylor 说道。“如果该选项未被移除，这些应用将被暂停。”
Taylor said LG is committed to keeping residential proxy networks out of its smart TV apps going forward, and that the company’s review of those apps is “well underway now.” Taylor 表示，LG 致力于在未来将住宅代理网络排除在智能电视应用之外，并且公司对这些应用的审查工作“目前正在顺利进行中”。
“As part of our ongoing efforts to enhance platform quality and the user experience, LG will continue to strengthen our evaluation process for developer-submitted apps, including those that incorporate residential proxy SDKs,” Taylor wrote in an emailed statement. “作为我们不断提升平台质量和用户体验努力的一部分，LG 将继续加强对开发者提交应用的评估流程，包括那些包含住宅代理 SDK 的应用，”Taylor 在一封电子邮件声明中写道。
App makers looking for ways to monetize their creations can turn to residential proxy providers, which pay developers to include SDKs that turn the user’s device into a residential proxy node that is rented to paying customers. In the case of LG and Samsung smart TVs, Spur found residential proxy SDKs bundled with everything from simple games like Pac-Man to screensavers and file utilities. 寻求变现的应用开发者可以转向住宅代理提供商，后者会付费让开发者植入 SDK，将用户的设备变成住宅代理节点，并出租给付费客户。在 LG 和三星智能电视的案例中，Spur 发现住宅代理 SDK 被捆绑在各种应用中，从简单的游戏（如《吃豆人》）到屏幕保护程序和文件工具应有尽有。
Spur’s report found the residential proxy network Bright Data accounted for a majority of proxy SDKs across both Samsung and LG smart TVs. In a statement shared with KrebsOnSecurity, Bright Data said its network is built on consent and responsibility and operates by LG and Samsung terms. Spur 的报告发现，住宅代理网络 Bright Data 在三星和 LG 智能电视的代理 SDK 中占据了多数份额。在与 KrebsOnSecurity 分享的一份声明中，Bright Data 表示其网络建立在同意和责任的基础上，并按照 LG 和三星的条款运营。
“Every peer opts in through a dedicated screen and receives value in return; every customer is vetted, and our practices have now undergone a second independent audit by PwC,” the statement reads. “We remain committed to an open, transparent internet where legitimate businesses, researchers, and institutions can responsibly access data that lives in the public domain.” “每个对等节点都通过专用屏幕选择加入并获得回报；每位客户都经过审查，我们的做法现已通过普华永道 (PwC) 的第二次独立审计，”声明写道。“我们仍然致力于构建一个开放、透明的互联网，让合法企业、研究人员和机构能够负责任地访问公共领域的数据。”
Bright Data and other proxy providers named in Spur’s report all say they follow rigorous know-your-customer processes to validate legitimate uses of their services, which is often heavily tied to content-scraping activities by said customers. The proxy companies also say they incorporate technological countermeasures to prevent proxy service customers from being able to interact with and control other devices on the proxy user’s local network. Bright Data 和 Spur 报告中提到的其他代理提供商均表示，他们遵循严格的“了解你的客户”(KYC) 流程，以验证其服务的合法用途，这些用途通常与客户的内容抓取活动密切相关。这些代理公司还表示，他们采用了技术对策，以防止代理服务客户与代理用户本地网络上的其他设备进行交互或控制。
Spur argues the problem is not that residential proxy networks exist, but rather that they are being embedded at scale in devices that most consumers do not think of as computers and are not equipped to audit. Spur 认为，问题不在于住宅代理网络的存在，而在于它们被大规模嵌入到大多数消费者不认为属于计算机、且没有能力进行审计的设备中。
“A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight,” Spur’s Trevor Sutter wrote. “The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors.” “埋在电视应用中的一次性同意提示，并不能替代有意义的透明度、持续的控制和平台监管，”Spur 的 Trevor Sutter 写道。“当同意来自家庭中使用该设备但不应给予同意的人（如未成年人）时，风险会被放大。”
LG’s announcement that it is culling residential proxy SDKs from its app store is welcome news, but the company recently came under fire for another questionable partnership: Pimping McAfee security products via software drivers included in its high-end LCD monitors. Earlier this week, the Youtube channel Gamers Nexus showed that certain LG LCD monitors will automatically install an app that promotes paid McAfee antivirus subscriptions, and that the app arrives through Windows Update without an approval prompt. LG 宣布从其应用商店中剔除住宅代理 SDK 是个好消息，但该公司最近因另一项有争议的合作而受到抨击：通过其高端 LCD 显示器中包含的软件驱动程序推广 McAfee 安全产品。本周早些时候，YouTube 频道 Gamers Nexus 展示了某些 LG LCD 显示器会自动安装一个推广付费 McAfee 防病毒订阅的应用，且该应用通过 Windows 更新静默安装，无需用户批准。