šŸ«ƒ Pierce D. Nipples šŸ«ƒJun 7
hex

But if *I* hijack *their* devices it's a "felony."

https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/

The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy - Include Security Research Blog

In this post we look under the hood of BrightData's SDK and how it turns ordinary consumer TVs into exit nodes of an enormous commercial, residential proxy network leveraged by the AI industry to scrape web data and train language learning models.

Include Security Research Blog
Jun 7 at 4:08amWeb
Show threadhexJun 7
The good side of this is that there's a hijack-able data stream that anyone can use to poison LLM training sets, and they can't do shit because it's on *your* network.
Show threadTelH90Jun 7

@Hex Personally, I'd just flatout refuse to use/buy a "Smart TV"ā€¦

I have a stupid panel and it works fine!

https://kolektiva.social/@Hex/116706856726937559

hex (@[email protected])

But if *I* hijack *their* devices it's a "felony." https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/

kolektiva.social
Show threadAaron Sawdey, Ph.D.Jun 7
@kkarhan Annoy them by buying a smart tv and then denying it access to the internet in your routers rules šŸ˜Ž
Show threadTelH90Jun 7

@acsawdey or better yet:

Don't buy at all.
- If it ain't broken, no need to replace it!
https://mastodon.social/@kkarhan/116707152390010818

Like I'd just flatout refuse to buy a TV that doesn't allow me to just plug & play!

Show threadklausiJun 7

@Hex oh boy, this explains exactly what I see on our network at work.

Millions of IP addresses from global residential networks making exactly 1 request. With a human-looking, but old user agent header.

We had to implement a JavaScript cookie challenge for all users, which is sad but works.

Show threadWolf480plJun 7

@Hex
> with the userā€™s consent, turns their phone or smart TV into one of those exit nodes.

isn't there someone they forgot to ask?

Idk about other countries, but at least in Poland, ISPs typically forbid customers from "letting other people outside of customer premises use the service" in their ToS.

These proxies wouldn't exist if ISPs enforced their own ToS.

Also, why aren't we holding ISPs accountable for the relayed traffic?

Show threadGabriel H. NunesJun 7

@Hex
I am surprised by how easy it is to bypass a VPN on iOS!

"The SDKā€™s config ships a flag ā€œuse_netifsā€: true. That flag triggers code in the SDK binary that constructs its NWConnection with a specific required interface: en0 (WiFi) or pdp_ip0 (cellular), rather than using the system default route.

On iOS, this bypasses any configured VPNā€™s tun0 interface entirely. The peer tunnel does not cross a user-configured VPN, even when the rest of the appā€™s HTTPS traffic does."

#VPN #iOS #privacy

Show threadChristoph SchmeesJun 7

@nunesgh

Surprised not I am.

#unplugapple #unplugTrump

@Hex

Show threadTokyo Outsider (337ppm)Jun 7
@Hex Very interesting. I disconnected my "smart" TV from my wireless router years ago when I noticed it had been sending gigabytes of data without any good reason.
Show threadGhostOnTheHalfShellJun 7

@Hex

I should be the one watching the TV. It should not be watching back.

Show threadStumpy The MuttJun 7
@GhostOnTheHalfShell @Hex In Republican U.S. TV watches you.
Show threadrotsaruckz63Jun 7
@Hex I solved that issue years ago. All my TVs are dumb. And things like my DVD player and TV are not on the internet. Fuck progress and spyware.
Show threadLucie / minuteJun 7
@Hex omg so that's the explanation for what's hitting our gitlab, i already blocked over 1.5 million IPs! > Bright Data is a data-collection company that sells access to what it markets as the worldā€™s largest residential proxy network of 400M+ home IP addresses that its customers route web-scraping traffic through.
Show threadgeistJun 7
@mntmn @Hex Yepp. This is also what ā€œfree VPNā€s do, and there are also companies that pay people to add such code to their apps: https://infatica-sdk.io/
Show threadJonathan CorbetJun 7
@mntmn @Hex It's not just those bozos ... some folks at opscloudio.com asked if they could run banners on our site selling the same sort of SDK. We declined...
OPS

Show threadMark W. Gabby-Li šŸŒJun 7
@Hex Huh? Residential internet is not free of data caps in the USA. Using 200 GB is massive! It could easily cause people to blow past their caps and owe their ISPs money.
Show threadMatt PalmerJun 7
@Hex your malware needs a ToS. Then it's all legit.
Show threadmasukomiJun 8
@Hex šŸ§ I think all you have to do to make it legal, is to get one of their representatives to click through yet another EULA that they can't avoid that gives you permission. That's what made it legal for them to do it to you after all.
Show threadRae KnowlerJun 9
@Hex I got an unsolicited sales email from this kind of company last week (https://shifter.io) and felt a wash of anger that the people who are trying to take down the open data sites I support now want me to give them money as well
Residential Proxies, ISP Proxies & Web Scraping APIs | Shifter

Access 205M+ residential proxies, ISP proxies, Web Scraping APIs, and SERP APIs. Built for data collection, SEO monitoring, market research, and web scraping at scale.

Show threadhexJun 9
@rae_knowler wow, this is a whole level of gross...