Your home could become a data proxy for IA thanks to Bright Data's SDK

A recent technical analysis disposes of a tactic that, although ancient in its features, has climbed to a magnitude that deserves attention: Bright Data's mobile SDK - the company that inherited Luminati's business - can convert consumption devices into output nodes that redirect scraping traffic for customers competing for data used in training IA models. The real risk is not so much that they "steal" your account, but that your domestic connection and bandwidth are used as third party infrastructure without you perceiving it.

The most detailed test comes from the inverse engineering of the SDK iOS, which documents a work channel (jobs) with few authenticity checks: when the app is started, the SDK contacts platform servers and receives instructions that can order the device to download other pages using the IP and home network. On iPhone, the traffic of this channel can even avoid a configured VPN, and many of the activities do not appear in conventional app monitoring tools, which complicates detection for security equipment and medium users.

The ideal devices for this practice are those that are always plugged and with fast and stable connections: the smart TV fits perfectly. They are plugged, often in domestic networks with "unlimited" data, and little observed. The SDK can keep the reshipment in the background as long as the battery is not low; in addition, the consent screens showing some apps do not accurately reflect the real limits that the SDK can impose: configurations that allow up to 200 GB per month or even much higher limits in certain countries.

That the technical model resembles the old scheme of Hello / Luminati is no coincidence. The difference is that the demand now comes from legal customers and the data market for IA, not just from botnet operators. This border between "consent" and "misuse" is the key: if consent is misleading, partial or uninformed, it is no longer an ethical and legally robust defence.

The practical implications are of several orders. For domestic users, the immediate consequence is bandwidth consumption, possible network slowing and exposure to outgoing traffic that can be labelled as malicious by third parties. For companies, the danger goes through employee devices that act as tunnels outside the visibility of the corporate perimeter, in particular because on mobile the connection can skip the Wi-Fi of the office and operate by mobile network, avoiding perimeter controls.

There are technical measures that, according to researchers, block behavior without affecting the official services of Bright Data: filter in the router or in the DNS resolution the addresses used by the SDK. The domains identified in the research include proxyjs.brdtnet.com, proxyjs.luminatinet.com, proxyjs.Bright-sdk.com, clientsdk.Bright-sdk.com and clientsdk.brdtnet.com. Home and digital home tools such as Pi-hole or NextDNS allow you to apply that type of lock at network level, and are a first line of defense accessible to users and network administrators ( Pi-hole, NextDNS). It is also recommended to review the public list of Bright Data partners on your website to identify possible relevant apps and, if a suspicious app is detected, contact the supplier or uninstall it ( Bright Data).

However, this mitigation has limits: Bright Data could change the control addresses and then any lock list will require continuous update; in addition, if the device uses mobile network instead of Wi-Fi, the router lock is not used. For organizations with managed mobile, the response should include mobility policies, MDM / EMM application inspection and unusual outflow detection at corporate egress points. For domestic users, it is prudent to monitor the router's data consumption, review apps installed on TV and mobile and restrict permits and background activities where possible.

Beyond the technique, there is a regulatory and responsibility issue: platforms (Google, Amazon, Roku) have started to limit SDKs that act as background proxies and some have forced changes. Bright Data has responded by withdrawing support on certain platforms, but it still appears associated with systems such as Tizen and web OS from TV manufacturers. If the consent offered to the user does not reflect actual uses, data protection authorities and policy makers may have elements to act on; in the meantime, independent public pressure and security reviews are valuable tools to force transparency and corrections.

In summary, the immediate practical recommendation is block SDK-related addresses at DNS level, audit installed apps (especially on smart TV) and apply MDM / EMM controls on corporate devices. In the medium term, it is appropriate to require manufacturers and app stores to have more controls on third-party SDK and regulators to clarify when a "consent" masks the transfer of network resources to third-party businesses. If you think a device in your home or company is being used as a relay without your permission, document the traffic (router log, data consumption) and contact the app developer and the platform manufacturer for explanations and corrective actions.