Method and integrity

Setup

• Device: Samsung QE55Q9FNA (2018, Tizen), firmware T-KTM2DEUC-1340.4, owned by the author, in Sweden.
• Settings: Interest-Based Ads, Viewing Information Services, Voice Recognition and Online Remote Management all declined, and Auto update Off. The TV used a static internal address, 192.168.131.22, with DNS set manually to 1.1.1.1.
• Network: the owner's own home router and managed switch. The router can block hostnames with layer-7 rules.

How traffic was captured

• Packets on the TV's switch port were captured with the packet-capture function built into the owner's own managed switch and saved as standard pcap files. Only traffic to and from the TV's port was recorded.
• Tests 1 to 3 ran with Samsung's advertising, telemetry, ACR and update domains blocked at the router. For tests 4 to 6, the block rules for samsungads.com, ads.samsung.com, samsungacr.com, samsungcloudsolution.com/.net, samsungqbe.com, samsungrm.net and pavv.co.kr were lifted for about 10 minutes, and then restored. The firmware-download (OTN) hosts stayed blocked throughout. Comparing the two states shows what the TV tries to send when blocked, and what it does send when allowed.
• The switch limits each capture to about 20 MB. In test 4 the TV Plus video stream filled that limit after 221 seconds. Tests 5 and 6 therefore used the capture filter not (src port 443 and greater 1200). That filter keeps every upstream packet but drops large incoming HTTPS packets, so downstream byte counts in tests 5 and 6 are understated.

Analysis

• The pcaps were analysed with tshark (Wireshark). Hostnames came from DNS answers, the TLS Server Name Indication (SNI), and HTTP Host headers. Byte counts are TCP/UDP payload per flow, and per phase of each test.
• Only metadata is visible: hostnames, IP addresses, times, record sizes and certificate fields sent in clear text. HTTPS content was not decrypted, so what the uploads contain is unknown.
• Times in tests 4 to 6 were split into phases from the owner's notes and the switch's port events. In test 6, the standby and power-on times were not noted, and they are inferred from the traffic with low confidence.

What was not done

No hacking, no rooting or modification of the TV, no decryption, no man-in-the-middle certificates, and no access to Samsung systems. The TV was only observed from the owner's own network equipment, while it was used normally with a remote control.

Limitations

• One device, one firmware version, and short windows (5 to 11 minutes per test) on a single day.
• Not seeing ACR traffic in these windows does not prove that ACR never runs, for example at other times, through other channels, or with data stored and uploaded later.
• Test 4 covers only its first 221 seconds. In test 5 the HDMI input never showed a picture. Test 6 is the only test with a working HDMI source.

Raw captures (not published)

The raw captures are not published, because they contain other traffic from the owner's home network. Raw captures available to supervisory authorities on request. They can be checked against these SHA-256 hashes:

Redaction

Device identifiers (serial number, hardware addresses and service IDs), certificate contents, the home network's public address and personal details have been left out of this site. Photos are cropped to the on-screen dialogs and their metadata has been removed.