"Luckily for me, Samsung did not yet release an update for my TV that would revoke the certificate," Daniel Vrátil told The Register.
eMudhra's exposed keys and the practical consequences
The problem began with a simple, avoidable failure at an Indian certificate authority. eMudhra — which the company says issued more than 60 million digital certificates — left eight intermediate CA private keys absurdly weak. According to reporting, one key was literally the number four and others were two- or three-digit numbers that could be guessed with little effort. eMudhra has since exited the public CA business, blaming a bad key-generation script and hardware it said could not handle the intended process.
The immediate technical consequence: anyone able to obtain those weak private keys could forge an eMudhra certificate and spoof HTTPS properties. Researchers and operators quickly incorporated the leaked keys into the open-source mitmproxy HTTPS proxy, and that capability created a straightforward way to inspect and spoof traffic from devices that still trust eMudhra-signed certificates.
How mitmproxy plus a 2022 Samsung smart TV made ad replacement possible
Vrátil combined two conditions: a 2022 Samsung smart TV that continued to trust eMudhra certificates, and mitmproxy builds that incorporated the exposed keys. By routing the TV’s traffic through mitmproxy, he could see the list of domains and endpoints the TV contacted and the structure of the JSON payloads used to populate the home-screen ads.
Using a certificate forged with a compromised eMudhra signing key for Samsung's advertising domains, and routing requests for those domains to a server on his home network, Vrátil replaced on-screen ads with family photos served from his NAS. He also configured the proxy to drop other requests to advertising domains, including tracking data, so those requests never reached Samsung's servers.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDaniel Vrátil's proof-of-concept and public tooling
Vrátil has published the work on GitHub so others with similar devices can attempt the same approach. He began by blocking ads on his Samsung TV with a Pi-hole — a DNS-based ad-blocker that can run on a Raspberry Pi — but after a home-lab change caused ads to reappear, the exposed eMudhra keys enabled a deeper fix.
Vrátil describes the project as hands-on rather than a one-click consumer tool: “It's not exactly a one-click setup,” he told The Register. The repo includes code to emulate Samsung ad responses and to blackhole tracking requests, but users must dissect how their own devices fetch ads and adjust the code. Vrátil has invited pull requests to extend device support, but the project had not received contributions to add additional devices at the time of reporting.
Trade-offs: blocking ads by exploiting a compromised CA versus remaining exposed
Vrátil acknowledged the trade-offs his approach presents. He said he is exploring ways to validate the TV’s connections against an up-to-date trust store to reduce the risk of interception, but noted such measures would not eliminate other security risks. He is also trying to prevent a firmware update that could revoke the forged certificate approach — an action that would fix the weakness but, in his words, is itself a security risk if it is blocked.
He warned of the darker side of the exposure: “The compromised eMudhra certificates open up a lot of opportunities for understanding and spoofing network requests from embedded devices, especially those that no longer receive security updates,” he told The Register. While replacing ads with family photos is benign, the same mechanics could be used for “countless much more sinister applications,” according to Vrátil.
What this means for technologists, manufacturers, and end users
- Technologists and security teams: The exposed keys are a learning and testing opportunity — and a live hazard. Researchers can use the keys and mitmproxy to map device network behavior and to test mitigations, but the same tools can be repurposed for spoofing and interception.
- Manufacturers and firmware teams: Devices that continue to trust a compromised CA remain exploitable until a revocation or trust-store update is pushed. Devices that are out of support may never receive such updates, leaving them permanently vulnerable.
- End users: Practical ad-blocking via this method requires technical skill, custom network configuration, and a willingness to accept the risk that routing traffic through a local proxy may expose the device to interception. Safer ad-blocking alternatives exist, but they were not detailed in the reporting.
The episode is a compact demonstration of how a small operational failure — weak keys, a bad script, hardware limits — can ripple into unexpected places: a living room TV, a family photo replacing an ad, and a reminder that many embedded devices still trust roots they should not. The remaining question, given the facts reported, is how long vulnerable devices will keep trusting eMudhra certificates and what proportion of those devices will ever receive the updates that remove that trust.
