Software Samaritan revamps borked Indian certs to block smart TV ads

A little tinkering can black hole obnoxious Samsung TV ads and some tracking, until a firmware fix ruins the fun

eMudhra's private key exposure has been a security disaster, but it also means that you can block those annoying ads on smart TVs if you’re so inclined. 

Luckily for those with some know-how and a hatred of smart TV ads, Czech software developer Daniel Vrátil has done the work for you and published his project on GitHub for anyone who wants to take a stab at it - and do the legwork to add support for their own ad-riddled television. 

Vrátil said he’d been blocking ads on his Samsung smart TV using a Pi-hole (DNS-based ad-blocking software that can run on a Raspberry Pi, for those unfamiliar), but right around the time the eMudhra certificate leak mess unfolded, he had messed something up while tinkering with his home lab and the ads were back. 

REG AD

First, here's a bit of background on the eMudhra mess. The company, based in India, operated a publicly trusted HTTPS certificate authority and says it has issued more than 60 million digital certificates. As we learned last month, eMudhra wasn't doing its best to keep its cryptographic keys safe: Eight intermediate CA private keys were found to be absurdly weak, with one being the number four and the others consisting of two- or three-digit numbers that could be guessed with little effort.

REG AD

eMudhra has since left the CA racket, saying that it wasn’t a big deal to it since issuing certs was a small part of its business. The company has blamed a bad software script put in place to generate keys that its hardware couldn’t handle as the root of the issue. 

What all that means, in a practical sense, is that anyone could forge an eMudhra certificate to spoof a website and do something malicious. It also means that security researchers who were able to get their hands on devices that still trust eMudhra certificates could have a field day learning how their communications work, which is exactly what Vrátil took advantage of. 

eMudhra private keys were added to the open source mitmproxy service - a fully interactive HTTPS proxy that can be used for good or bad - shortly after they were exposed. Pair that with a 2022 Samsung smart TV that still trusts the compromised eMudhra certificates, and you have a way to inspect its HTTPS traffic and redirect selected requests to a server of your choosing.

By Vrátil’s account, swapping out annoying ads for pictures of his family on his TV’s main screen was a pretty simple task. 

“Luckily for me, Samsung did not yet release an update for my TV that would revoke the certificate,” Vrátil explained in his writeup. “This allowed me to route all traffic from the TV through mitmproxy and get a list of all the domains and endpoints that my TV talks to, but also see the structure of the requests and response payloads.”

The advertising traffic flow was pretty basic, it turns out: Activity on the TV is relayed to an ad server, which serves up ads on the home screen based on a JSON response. By generating a certificate for Samsung's advertising domains using a compromised eMudhra signing key, and configuring his router to direct requests for those domains to a server on his home network, Vrátil was able to replace ads with family photos served from his NAS. He also added code that tosses other requests to those advertising domains, including tracking data, into a black hole rather than forwarding them to Samsung's servers.

As mentioned above, it’s on GitHub for those who want to trick their TV, if it still supports eMudhra certificates, but you’ll have to do the legwork to dissect how your device is getting ads and tweak the code to work. 

“It's not exactly a one-click setup,” Vrátil told The Register in an email. He’s invited people to try it out, but no one has bothered to submit a pull request to add support for their own device to his public repo.

REG AD

It’s also worth noting that this is only going to work as long as vulnerable devices keep trusting eMudhra certificates, which hopefully means you need to act fast. That said, smart TVs that are out of support may never receive such an update, leaving them exposed to the certificate weakness even if their owners block the ads.

“The compromised eMudhra certificates open up a lot of opportunities for understanding and spoofing network requests from embedded devices, especially those that no longer receive security updates,” Vrátil told us. “And while replacing ads on a TV's home screen with pictures of my family is fun, there are also countless much more sinister applications of this vulnerability.”

As for Vrátil, he’s still trying to figure out how to block the firmware update that may eventually render his method obsolete, even though that, as he points out, is a security risk in and of itself. 

“I want to run the traffic through a proxy that would validate the connection against an up-to-date trust store to at least mitigate anyone intercepting traffic from my TV, or spoofing responses, like I do with my little project here, but it won't protect me from other potential security risks, so there's a trade-off,” he explained. 

We suppose at this point you can take your pick of abuse. You can use a vulnerability to block ads and some tracking while leaving your TV exposed to potential interception, or let the manufacturer serve up ads and collect data about your viewing habits. There are safer ways to block ads than relying on a TV to keep trusting a compromised CA. ®