- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,684
How homemade IP addresses have become a product and what to do about it.
A free application on the phone or smart TV can work not only for the user. Inside the game, video service or screen screensaver may be SDK Bright Data. This component connects the home Internet to the network of resident proxies: other queries to the sites go through a regular home IP address, and not through the Bright Data client servers.
The scheme was dismantled by Include Security and independent researcher Buchodi. They looked at the iOS version of SDK Bright Data and showed how the app gets web page downloads, executes requests through a home connection, and helps the platform’s customers collect data from the network. The main risk here is not similar to the usual hack: the user does not steal files and does not intercept the account, but the home communication channel, traffic and reputation of the IP address begin to work on someone else's service.
Bright Data calls itself the operator of the world’s largest resident proxies network. The company is talking about more than 400 million home IP addresses through which customers can send requests to the sites. Part of the network is assembled through Bright SDK: developers add the component to free applications, show the consent screen and get another way to earn money. Bright Data describes this pool as a network of more than 150 million IP addresses connected with the consent of device owners.
Home IP addresses are especially needed by companies that collect data for AI. Sites have long learned to notice mass queries from data centers and cloud services. The anti-botsystems Cloudflare, DataDome, HUMAN and other companies limit such traffic. A resident proxy helps to bypass some of the filters: the site sees an appeal from a regular Compact subscriber, T-Mobile or another provider, and not from a cloud platform.
Smart TV is suitable for the role of a proxy node even better than a phone. The TV is almost always connected to the outlet, sits on a fast Wi-Fi, rarely disappears from the network and often goes unattended. The phone gives out the problem faster: the battery sits down, mobile traffic ends, corporate settings or security applications work. The TV has less control, and the user reads the phone with the couch and scrolls through the remote.
The most detailed technical data, the researchers received from iOS SDK. Communication with smart TV is confirmed by supported Bright Data platforms, public listings of partners and earlier content on TV applications. Buchodi separately clarifies: the presence of the company in the Bright Data partner list does not prove that each of its application right now contains SDDK. But the list shows that Bright Data had developers of applications for connected TVs, including PlayWorks Digital, CloudTV and Longvision.
SDK starts when the application starts. The component accesses the Bright Data server for the settings and transmits the application ID, the SDK version and the generated UUID. According to the researcher, the server almost does not check the source of the query: it is enough to specify the bundle ID of the application from the App Store, the SDK version and the arbitrary identifier, after which the server returns settings similar to the response for the present device.
These settings contain the flags of functions, downtime rules, battery thresholds, processor and memory, restrictions for Wi-Fi and mobile network, country limits and affiliate manifesto. After downloading the SDK configuration, opens a constant connection between WebSocket and proxyjs.brdtnet.com on the 443rd port. The TLS certificate refers to the domain luminatinet.com, the old name Bright Data before rebranding.
The server then opens the session, returns the public IP address to the client and assigns the connection identifier. SDK regularly sends the condition of the device: whether Wi-Fi is connected, whether the mobile network is available, how much charge is left, whether the screen works, whether the screen is running, how the processor is loaded and the memory is supported, whether IPv6 is supported, which application contains the SDK and what version of the component is installed. If the settings fit the rules, the server sends the cmd_tun or tun command. After that, the device makes an HTTP request to a third-party site from its home IP address.
The protection of the channel is weak. WebSocket messages are transmitted to JSON footage with commands and service fields, but the researcher has not found message signatures, HMAC, client certificates or a full authentication of the device. The control is based on TLS and reputational filtration, which decides which nodes will receive real tasks.
The consent screen describes the work softer than the SDK settings. In the Petflix application for Roku, the user was explained that the device and connection will be used from time to time to download public web data. But the researcher found a configuration with a monthly Wi-Fi budget of up to 200 GB. In iOS, the EU analysis also shows country limits: for most countries, 500 MB per month is set, for Uzbekistan and Oman the limit rises to 30 GB, and the device in these countries can operate almost to a full battery discharge.
On iOS, the researcher found another problem: peer traffic can bypass a configured VPN. SDK uses the use_netifs flag and creates an NWConnection with a specific physical interface, such as en0 for Wi-Fi or pdp_ip0 for mobile communication. The connection does not pass through tun0, where VPN usually works. The rest of the HTTPS traffic application may be visible through interception, but the Bright Data tunnel goes away from another route.
The analysis also complicates the choice of network mechanisms. Instead of familiar to iOS URLSession or NSURLConnection, the component uses CFNetwork and CFHTTPressessage. Because of this, protective tools see the application’s network behavior worse: some notice requests for configuration, but skip the tunnel, others show only a part of the activity.
The story of Bright Data stretches from Luminati and Hola VPN. In 2015, Hola got into a scandal due to the sale of the bandwidth of users of free VPN through Luminati. Then other people’s traffic went through the devices of ordinary people. Now a similar idea works more carefully: the application shows consent, the developer receives money, Bright Data sells access to the resident network, and buyers are more likely to look for data for AI services.
The boundary between legal and criminal proxy infrastructure because of this becomes less obvious. Botnets like Aisuru and proxy networks like IPIDEA capture devices without permission. Bright Data claims that its nodes are connected through the user’s consent and do not collect personal data other than the IP address. But the consent button itself does not mean that a person understands that the TV or the phone will transmit other people’s requests to the sites through the home Internet.
The first materials about smart TV in this economy appeared in February in Lowpass, later the material was released through The Verge. After Google’s publications, Amazon and Roku limited the background proxy-SDK in their ecosystems, and Bright Data removed support for these platforms. At the same time, the company’s public materials still feature the Samsung Tizen and LG webOS.
Such traffic can be blocked at the home network level. The researcher indicates domains without which the device will not be able to participate in the peer-to-peer tunnel: proxyjs.brdtnet.com, proxyjs.bright-sdk.com,dktk.bright-sdk.com and clientsdk.brdtnet.com. For locking is suitable Pi-hole, NextDNS, Cloudflare Gateway, DNS filtering on a router or a similar tool.
For organizations, one blocking in the network is small. If the iPhone switches to a mobile connection, traffic will bypass enterprise Wi-Fi along with filters. Managed devices should be checked for applications with Bright SDK, including the BrdWebSocketFacade and BrdNetwork.DNTRANSword features inside binary files. The block sheets also do not give eternal protection: Bright Data can change domains, transfer peer-to-peer transport to other protocols or use prepared flags for HTTP/3 and QUIC.
Home devices have already fallen into the data collection chain for AI. The user sees a free application and a short consent screen. The developer receives a new source of income. The Bright Data client receives requests from regular home IP addresses. Between them there is a TV in the living room or phone in the pocket, which can transmit someone else’s traffic without an understandable explanation for the owner.
A free application on the phone or smart TV can work not only for the user. Inside the game, video service or screen screensaver may be SDK Bright Data. This component connects the home Internet to the network of resident proxies: other queries to the sites go through a regular home IP address, and not through the Bright Data client servers.
The scheme was dismantled by Include Security and independent researcher Buchodi. They looked at the iOS version of SDK Bright Data and showed how the app gets web page downloads, executes requests through a home connection, and helps the platform’s customers collect data from the network. The main risk here is not similar to the usual hack: the user does not steal files and does not intercept the account, but the home communication channel, traffic and reputation of the IP address begin to work on someone else's service.
Bright Data calls itself the operator of the world’s largest resident proxies network. The company is talking about more than 400 million home IP addresses through which customers can send requests to the sites. Part of the network is assembled through Bright SDK: developers add the component to free applications, show the consent screen and get another way to earn money. Bright Data describes this pool as a network of more than 150 million IP addresses connected with the consent of device owners.
Home IP addresses are especially needed by companies that collect data for AI. Sites have long learned to notice mass queries from data centers and cloud services. The anti-botsystems Cloudflare, DataDome, HUMAN and other companies limit such traffic. A resident proxy helps to bypass some of the filters: the site sees an appeal from a regular Compact subscriber, T-Mobile or another provider, and not from a cloud platform.
Smart TV is suitable for the role of a proxy node even better than a phone. The TV is almost always connected to the outlet, sits on a fast Wi-Fi, rarely disappears from the network and often goes unattended. The phone gives out the problem faster: the battery sits down, mobile traffic ends, corporate settings or security applications work. The TV has less control, and the user reads the phone with the couch and scrolls through the remote.
The most detailed technical data, the researchers received from iOS SDK. Communication with smart TV is confirmed by supported Bright Data platforms, public listings of partners and earlier content on TV applications. Buchodi separately clarifies: the presence of the company in the Bright Data partner list does not prove that each of its application right now contains SDDK. But the list shows that Bright Data had developers of applications for connected TVs, including PlayWorks Digital, CloudTV and Longvision.
SDK starts when the application starts. The component accesses the Bright Data server for the settings and transmits the application ID, the SDK version and the generated UUID. According to the researcher, the server almost does not check the source of the query: it is enough to specify the bundle ID of the application from the App Store, the SDK version and the arbitrary identifier, after which the server returns settings similar to the response for the present device.
These settings contain the flags of functions, downtime rules, battery thresholds, processor and memory, restrictions for Wi-Fi and mobile network, country limits and affiliate manifesto. After downloading the SDK configuration, opens a constant connection between WebSocket and proxyjs.brdtnet.com on the 443rd port. The TLS certificate refers to the domain luminatinet.com, the old name Bright Data before rebranding.
The server then opens the session, returns the public IP address to the client and assigns the connection identifier. SDK regularly sends the condition of the device: whether Wi-Fi is connected, whether the mobile network is available, how much charge is left, whether the screen works, whether the screen is running, how the processor is loaded and the memory is supported, whether IPv6 is supported, which application contains the SDK and what version of the component is installed. If the settings fit the rules, the server sends the cmd_tun or tun command. After that, the device makes an HTTP request to a third-party site from its home IP address.
The protection of the channel is weak. WebSocket messages are transmitted to JSON footage with commands and service fields, but the researcher has not found message signatures, HMAC, client certificates or a full authentication of the device. The control is based on TLS and reputational filtration, which decides which nodes will receive real tasks.
The consent screen describes the work softer than the SDK settings. In the Petflix application for Roku, the user was explained that the device and connection will be used from time to time to download public web data. But the researcher found a configuration with a monthly Wi-Fi budget of up to 200 GB. In iOS, the EU analysis also shows country limits: for most countries, 500 MB per month is set, for Uzbekistan and Oman the limit rises to 30 GB, and the device in these countries can operate almost to a full battery discharge.
On iOS, the researcher found another problem: peer traffic can bypass a configured VPN. SDK uses the use_netifs flag and creates an NWConnection with a specific physical interface, such as en0 for Wi-Fi or pdp_ip0 for mobile communication. The connection does not pass through tun0, where VPN usually works. The rest of the HTTPS traffic application may be visible through interception, but the Bright Data tunnel goes away from another route.
The analysis also complicates the choice of network mechanisms. Instead of familiar to iOS URLSession or NSURLConnection, the component uses CFNetwork and CFHTTPressessage. Because of this, protective tools see the application’s network behavior worse: some notice requests for configuration, but skip the tunnel, others show only a part of the activity.
The story of Bright Data stretches from Luminati and Hola VPN. In 2015, Hola got into a scandal due to the sale of the bandwidth of users of free VPN through Luminati. Then other people’s traffic went through the devices of ordinary people. Now a similar idea works more carefully: the application shows consent, the developer receives money, Bright Data sells access to the resident network, and buyers are more likely to look for data for AI services.
The boundary between legal and criminal proxy infrastructure because of this becomes less obvious. Botnets like Aisuru and proxy networks like IPIDEA capture devices without permission. Bright Data claims that its nodes are connected through the user’s consent and do not collect personal data other than the IP address. But the consent button itself does not mean that a person understands that the TV or the phone will transmit other people’s requests to the sites through the home Internet.
The first materials about smart TV in this economy appeared in February in Lowpass, later the material was released through The Verge. After Google’s publications, Amazon and Roku limited the background proxy-SDK in their ecosystems, and Bright Data removed support for these platforms. At the same time, the company’s public materials still feature the Samsung Tizen and LG webOS.
Such traffic can be blocked at the home network level. The researcher indicates domains without which the device will not be able to participate in the peer-to-peer tunnel: proxyjs.brdtnet.com, proxyjs.bright-sdk.com,dktk.bright-sdk.com and clientsdk.brdtnet.com. For locking is suitable Pi-hole, NextDNS, Cloudflare Gateway, DNS filtering on a router or a similar tool.
For organizations, one blocking in the network is small. If the iPhone switches to a mobile connection, traffic will bypass enterprise Wi-Fi along with filters. Managed devices should be checked for applications with Bright SDK, including the BrdWebSocketFacade and BrdNetwork.DNTRANSword features inside binary files. The block sheets also do not give eternal protection: Bright Data can change domains, transfer peer-to-peer transport to other protocols or use prepared flags for HTTP/3 and QUIC.
Home devices have already fallen into the data collection chain for AI. The user sees a free application and a short consent screen. The developer receives a new source of income. The Bright Data client receives requests from regular home IP addresses. Between them there is a TV in the living room or phone in the pocket, which can transmit someone else’s traffic without an understandable explanation for the owner.
