As reported by The Register, a security vulnerability involving compromised digital certificates from the Indian firm eMudhra has enabled a software developer to intercept and modify traffic on his Samsung smart TV.
The incident stems from the exposure of eight intermediate certificate authority private keys, which were found to be cryptographically weak. eMudhra, which has since exited the certificate issuance business, attributed the failure to a faulty script used for key generation. Software developer Daniel Vrátil leveraged these compromised keys to gain control over his television's network traffic. By utilizing the mitmproxy service, he intercepted HTTPS requests, allowing him to replace home screen advertisements with personal photos. The process involved redirecting advertising domain requests to a local server, effectively blocking tracking data and promotional content. While this method demonstrates a creative use of the vulnerability, it highlights significant security risks for embedded devices that continue to trust the compromised certificates. Experts warn that because many smart TVs no longer receive firmware updates, they remain permanently exposed to potential interception and spoofing attacks. The project, available on GitHub, requires manual configuration and serves as a reminder of the broader dangers posed by weak cryptographic practices in the internet of things industry.
Source: The Register
