A software developer has demonstrated how compromised digital certificates enabled the interception and modification of network traffic from a Samsung smart TV. The incident involved eight intermediate certificate authority private keys associated with Indian firm eMudhra, according to reporting by SC Media and The Register.
The exposed keys were described as cryptographically weak. eMudhra, which has since left the certificate issuance business, attributed the failure to a faulty script used to generate the keys. Devices that continue to trust the affected certificates may accept traffic that would otherwise be expected to pass through a valid encrypted connection.
How the television traffic was modified
Software developer Daniel Vrátil used the compromised keys together with the mitmproxy service to intercept HTTPS requests made by his television. He redirected requests for advertising domains to a local server, allowing him to replace the television’s home-screen advertisements with personal photographs.
The demonstration also blocked promotional material and tracking data. The project has been published on GitHub and requires manual configuration. The reported activity involved Vrátil’s own television; the published account does not describe a broader compromise of Samsung televisions or a campaign affecting multiple users.
- Eight intermediate certificate authority private keys were exposed.
- The keys were characterized as cryptographically weak, with eMudhra citing a faulty key-generation script.
- The demonstrated setup used mitmproxy, domain redirection and a local server to alter advertising requests.
Firmware lifecycle remains a consideration
Security experts cited in the report warned that smart TVs that no longer receive firmware updates can remain exposed to interception and spoofing risks. The warning is relevant to connected-display deployments because televisions often remain in service for years after their initial installation, while their software, trust stores and network dependencies may not be reviewed as part of a replacement cycle.
The case centers on certificates trusted by an embedded device rather than on a newly disclosed Samsung application flaw. It nevertheless illustrates how the certificate trust built into an internet-connected display can affect traffic beyond the panel itself, including home-screen advertising and related tracking requests.
For installers and integrators, the incident reinforces the need to account for device software support when specifying connected displays. The published project required deliberate manual configuration, and the reporting does not state that ordinary users can reproduce the result without that setup. Its significance is the persistence of trust in compromised credentials on devices that may not receive future firmware updates.
