Researcher Gains Root Access to Samsung Smart TV, Uncovers Extensive User Tracking

A cybersecurity researcher says he gained root access to a 2025 Samsung Smart TV and found software built to track far more than the picture on the screen. Known online as log4j, he started after the set kept showing ads that seemed oddly specific to his household.

He says the Tizen firmware was AES-encrypted, so keys were not available without opening the hardware. He used zero-day flaws to open a root shell and documented the tracking features with code screenshots. Samsung has not publicly answered. The findings have not been reproduced on an unmodified television.

In posts starting on October 21, 2026, log4j listed automatic content recognition, screenshot handling, geolocation, network mapping, a targeted advertising service, and user profile building. He also described an advertising identifier, often called an AID, that can tie television activity to other devices. A region-specific neural network, he said, tracks which videos play, which ads are skipped, and how far a viewer gets through a title.

Audio is the claim that has drawn the sharpest reaction. He says the firmware includes a package he calls always-on voice, named in one post as csapi-tv-service-alwaysonvoice. He wrote that telemetry counts events such as a dog barking or a baby crying. He also claims that a set without a built-in microphone can look for a connected soundbar or Bluetooth device and use that microphone for audio events. A component he calls rmdemon is described as a way for support staff to reach the device for short diagnostics.

Hugging Face engineer ngxson tested a rooted Tizen set with several settings already off. Tom’s Hardware reported that the microphone opened for five seconds and then stopped. An unmodified television could behave differently.

The claims follow earlier legal pressure on the same kind of tracking. On December 15, 2025, Texas Attorney General Ken Paxton sued Samsung, Sony, LG, Hisense, and TCL over automated content recognition used without informed consent. On February 26, 2026, his office announced an agreement requiring Samsung to stop collecting ACR viewing data from Texas consumers unless they give express consent. The deal covers Texas and does not confirm the new findings.

Cyber Security News reported that Samsung and Vizio sets still sent traffic consistent with content recognition after researchers turned the feature off.

An earlier study covered by this site found that smart TVs can fingerprint what is on screen, including HDMI content, and match those samples to build ad profiles. Samsung’s privacy notice says the company may send video or audio snippets to providers so ads can match what is playing.

Log4j says that material is shared with Samsung and roughly 400 partners. The company’s privacy page does say third parties may receive device details and records of how people interact with ads.

On October 23, log4j posted an email saying OpenAI had deactivated his account for “Cyber Abuse.” He wrote that he never used OpenAI to find or exploit flaws, and that the ban followed local reverse-engineering work that tripped a system he called Daybreak. He said the loss cost about $500 and pushed him to finish a larger research cluster. OpenAI has not publicly explained this case.

On many Samsung sets, Viewing Information Services sits under Settings, All Settings, General and Privacy, then Terms and Privacy. Turning that control off is the maker’s stated way to stop ACR.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Researcher Gains Root Access to Samsung Smart TV, Uncovers Extensive User Tracking appeared first on Cyber Security News.