WORLDTECHDeveloper uses compromised eMudhra keys to block smart TV ads
According to The Register, as cited by SC Media, software developer Daniel Vrátil used digital certificates compromised by the Indian firm eMudhra to gain control of network traffic on his Samsung smart TV. The case shows how weak cryptographic practices can expose connected devices.
How the certificate keys were exposed
The incident traces back to the exposure of eight intermediate certificate authority private keys, which proved cryptographically weak and could therefore be turned against the devices that trusted them.
eMudhra, which has since left the certificate issuance business, put the failure down to a flawed script used when generating the keys.
Ad traffic rerouted to a local machine
Vrátil relied on the compromised keys to take over his television's network traffic. Requests bound for advertising domains were sent to a server on his own network, which blocked tracking data and promotional material before they reached the screen.
The project is published on GitHub, but it must be configured by hand before it works.
Wider risks for connected devices
Although the approach is an inventive exploitation of the flaw, it exposes serious security risks for embedded devices that still trust the compromised certificates.
Experts caution that many smart TVs no longer receive firmware updates, leaving them permanently open to interception and spoofing attacks. The project is a reminder of the wider dangers that weak cryptographic practices pose across the internet of things industry.
Open questions
- Can affected smart TVs be protected once their firmware no longer receives updates?