Czech developer exploits weak eMudhra certificates to replace Samsung TV adverts with family photos

Czech developer Daniel Vrátil used a weakness in eMudhra certificates still trusted by his Samsung smart TV to inspect its web traffic and replace home-screen adverts with family photos. The project also blocks some advertising-related tracking, showing how a serious certificate security failure can expose device communications as well as enable unwanted changes.

India-based eMudhra said it had issued more than 60 million digital certificates, but eight intermediate certificate authority private keys were found to be weak enough to guess. Vrátil routed traffic from his 2022 Samsung TV through mitmproxy, then redirected requests for advertising domains to a server on his home network. The open-source project requires technical work and only applies to devices that still trust the compromised certificates; a firmware update revoking them could end the workaround.