Smart TV Apps Turn Homes Into DDoS Proxies

How the attack worked

The pattern described in this research starts with something ordinary: a free app on a smart TV, like a game, screensaver, or streaming front-end. Bundled inside is a relay kit that asks for permission through a consent dialog. The wording is vague, framing the activity as "occasional use" of "spare resources." Once accepted, the app relays third party web traffic through the household's internet connection while the TV appears idle.

This relay function was originally built for commercial web scraping, where residential IP addresses are valuable because they look like ordinary consumer traffic. But researchers found the same infrastructure can be "flipped" from scraping into DDoS packet floods, since the device already maintains a persistent connection to a remote job server. Changing the payload sent down that channel is enough to repurpose it.

Why it succeeded

A few conditions make this approach effective:

• The consent dialog exists, but it obscures what is actually being consented to, using soft language rather than a clear technical description.
• Smart TVs and similar devices are largely unmanaged from a security standpoint, so there is no IT oversight of what apps are installed or what permissions are granted.
• The kit's own configuration reportedly set a default ceiling of 200 gigabytes a month, an amount of bandwidth that would likely go unquestioned on a home network.
• Because the underlying connection can serve both legitimate-looking scraping and malicious traffic, the same access surface supports two different uses without the device owner noticing a change.

Telemetry referenced in the research shows a sharp increase in the number of devices observed participating in DDoS activity, rising from roughly 1 million to over 9 million by June, correlating with disclosure of this residential proxy exposure.

What to watch for

• Vague consent screens on smart TVs or other unmanaged devices that reference "spare resources" or "occasional use" without explaining what data or bandwidth will be used.
• A TV or device on standby making persistent outbound connections when it should be idle.
• Unusually high bandwidth allowances configured for a TV app, especially in the hundreds of gigabytes per month.

Building resistance

Because indicators like IPs and domains can rotate quickly, the research points toward behavior-based detection: watching for household devices opening persistent channels to destinations they have no reason to talk to, rather than relying solely on blocklists. Organizations that allow smart TVs or similar consumer displays on their networks should treat app permission dialogs as security-relevant approvals, not just privacy formalities, and build monitoring that can flag anomalous device behavior regardless of whether the traffic looks benign at first glance.

How do smart TV apps get turned into DDoS proxies?

A relay kit is bundled into a free app, such as a game, screensaver, or streaming front-end. Once a user accepts the consent dialog, the app relays third party traffic through the device's internet connection, and this same channel can later be repurposed for DDoS packet floods.

What does the consent dialog actually say?

It frames the relay activity vaguely, describing it as occasional use of spare resources, without clearly explaining what traffic will be relayed through the device.

Why is this hard to detect with blocklists?

Because the indicators involved can rotate quickly, researchers emphasize watching for behavior patterns, like persistent unexplained outbound channels, rather than relying on known bad IPs or domains.

How big is the scale of devices involved?

Telemetry cited in the research shows devices observed participating in DDoS activity rose from roughly 1 million to over 9 million by June, correlating with disclosure of residential proxy exposure.