dhy@ironhide: ~/site
dhy@ironhide:~/site$cat header.html
_____ _ _ _ _ | __ \| | | | | | | | | | | |_| | | | | | | | | _ | |_| | | |__| | | | | _ | |_____/|_| |_|_| |_| ~/dhy.tr — personal notes & technical writing

Bright Data SDK: Your Smart TV Isn't Yours — It's an AI Scraping Node

Jun 08, 2026 • ~1400 words • Privacy, IoT Security, Linux Self-Defense

Introduction: There's No Such Thing as a Free App

If an app isn't charging you money, it's almost certainly selling you. This old cliché has taken on a fresh dimension in 2026: a "free" app on your smart TV is selling your home internet connection to AI companies — without you even knowing.

On June 5, 2026, security researchers reverse-engineered the iOS SDK that Bright Data (formerly Luminati) embeds in consumer apps. The findings paint a dystopian picture: the smart TV in your living room, plugged in, on a fast connection, and "unattended," is the perfect web-scraping exit node. These devices crawl the internet on behalf of AI training-data firms, using your IP address.

In this post I'll walk through the technical side of the story, what the "consent" screen actually means, and how to set up defenses on your home network. Good news for Linux users: you can cut this traffic in minutes with Pi-hole or NextDNS.

The Problem: The Residential Proxy Economy

First, the size of the picture. Anti-bot defenses from Cloudflare, DataDome, and Akamai have long since blocked requests from datacenter IPs. When AI companies want to scrape the web for training data, they need residential user IPs to bypass those defenses. Your home internet has become one of the most valuable raw materials in the AI industry.

Bright Data operates a network claiming over 400 million residential IPs worldwide. A significant chunk of those come from an SDK embedded in free apps, collected via "consent" — the company's wording for its 150 million+ IP "consent-sourced" pool.

The critical point of the research: the scraping traffic exits from your home IP, not the customer's. The risk isn't "your account got hacked" — it's "your home bandwidth is now someone else's scraping infrastructure."

A smart TV is tailor-made for this: plugged in, on fast Wi-Fi, usually unmetered, and often you're not even watching it — so background activity goes unnoticed. The SDK can scrape while the device sleeps, while you're on a phone call, or even while something else is on screen.

The Solution: Inside the SDK — Weak, Even Dangerous

The researchers' technical findings are chilling. When the SDK runs, it contacts a Bright Data server and accepts commands. That command channel:

  • Carries no real authentication. The server hands instructions to the device without meaningfully checking who's asking.
  • Bypasses VPN on iOS. Even if the user is running a VPN, this traffic slips past the tunnel. None of the usual monitoring tools see it.
  • Runs in the background. As long as the battery allows, scraping continues with the screen off or another app in front.
  • Correlates devices across the household. Your phone and laptop that carry the same SDK get grouped as "one user" — your IP, your device inventory, and your usage patterns collapse into a single profile.

The researcher described this channel as having weaker security controls than most malware. The SDK behaves like a botnet designed for scraping; the only difference is that the operator shows a "consent" screen.

The Consent Trap: The "Occasionally" Screen

This is where the ethics come in. Apps carrying the SDK display a "consent" screen — on the Roku app Petflix, the screen says the device and its connection will be used "occasionally." In reality the SDK's configuration allows up to 200 GB of traffic per month. In some countries (the researcher names Uzbekistan and Oman) the limits are far higher, and the device is cleared to keep working almost until the battery runs flat.

Bright Data publishes a public list of its app partners. The list includes smart TV app makers such as PlayWorks Digital, CloudTV, and Longvision. Important caveat: being on the list only means the company worked with Bright Data at some point — not that its app still carries the SDK today. Each one would need to be checked individually.

This model is not new. Bright Data is the successor to Luminati, the paid proxy service that grew out of the Hola VPN scandal. In 2015 Hola was caught selling its free users' bandwidth as exit nodes at $20 per gigabyte. A decade later the same model runs on the "smart box" in the living room. What changed is the buyer: the AI industry is hungry for residential IPs to defeat anti-bot defenses.

The Threat Landscape: In the Same Category as Criminal Botnets

Brian Krebs reported in October 2025 that the Aisuru botnet had pivoted from DDoS to residential proxies, fueling large-scale AI data harvesting. Google dismantled the criminal IPIDEA proxy network in January 2026. Those operations hijack consumer devices. Bright Data claims its exit nodes opt in through a consent screen.

The thin line between the two is whether that consent is meaningful. Marketing a 200 GB/month SDK with the word "occasionally" puts it in a gray area most users can't technically evaluate.

On the platform side, Google, Amazon, and Roku have restricted background proxy SDKs, and Bright Data has dropped those platforms — though it still lists Samsung's Tizen and LG's webOS as supported.

Linux Defense: Pi-hole and NextDNS, Done in 10 Minutes

Now the good news. The researchers say this traffic is easy to spot and block. The SDK talks to a handful of fixed Bright Data domains. Drop those domains at DNS level on your home network and the device stops being a relay immediately — Bright Data's paid service uses different addresses, so it isn't affected.

The domains to block:

proxyjs.brdtnet.com
proxyjs.luminatinet.com
proxyjs.bright-sdk.com
clientsdk.bright-sdk.com
clientsdk.brdtnet.com

With Pi-hole (Raspberry Pi or Linux server)

If you already have Pi-hole running, head to the admin panel → Adlists → Group Management → Blacklist and add the five domains above one by one. Or from the terminal:

# In your Pi-hole admin shell
sqlite3 /etc/pihole/gravity.db "INSERT INTO domainlist (domain, type, comment) VALUES \
  ('proxyjs.brdtnet.com', 1, 'Bright Data SDK'), \
  ('proxyjs.luminatinet.com', 1, 'Bright Data SDK'), \
  ('proxyjs.bright-sdk.com', 1, 'Bright Data SDK'), \
  ('clientsdk.bright-sdk.com', 1, 'Bright Data SDK'), \
  ('clientsdk.brdtnet.com', 1, 'Bright Data SDK');"

pihole -g

pihole -g (gravity) regenerates the blocklist and updates the DNS cache. Within seconds, your whole network stops resolving those domains.

With NextDNS (faster setup, no install required)

NextDNS is a cloud-based alternative that doesn't need a Raspberry Pi. Sign up at nextdns.io, paste the domains above into the Denylist tab, grab your profile ID, and point your router's DNS to NextDNS (the 45.90.28.x or 9.9.9.9 forwarded addresses). Three minutes, and the whole network is protected.

Caveats

  • Mobile traffic slips through. When a device leaves Wi-Fi for cellular, your DNS block doesn't reach it. If you manage company phones, use an MDM to detect apps carrying the SDK.
  • The SDK can change domains. Bright Data may roll out new endpoints in the future. The list above is current as of today, but refresh your blocklist periodically. r/BrightData and the Include Security blog (blog.includesecurity.com) are good sources.
  • Check your smart TV itself. Your TV may carry the SDK too. Review Tizen or webOS updates, and read the manufacturer's privacy policy.

Conclusion: The Real Price of "Free"

The Bright Data case once again exposes the hidden cost of free software. In 2015 the Hola scandal taught us the same lesson: your "free VPN" or "free app" might be selling your bandwidth. A decade later, paired with the AI industry's hunger for data, the same model has the potential to turn billions of devices into a proxy network.

What it means for you:

  • Think twice before installing third-party apps on your smart TV. Any APK or channels/IPTV app loaded from outside the manufacturer's official store is a potential SDK carrier.
  • If your bandwidth is being used by someone else, check your ISP modem's Traffic Monitor or Bandwidth Usage page. If your TV is uploading at 3:00 AM with the screen off, be suspicious.
  • If you already run Linux + Pi-hole, block those five domains today. Zero cost, immediate gain: control of your home network back in your hands.

This case shows IoT security is broader than "the device got hacked." The modern threat is your device being quietly integrated into someone else's economy without your knowledge. The most concrete thing we can do is learn to observe and block at the network level. DNS-layer control is the highest-protection-per-effort tool we have for this.

dhy@ironhide:~/site$