# Samsung Q80A TV & JA3 SSL-Client fingerprint **URL:** \ **Category:** Rules\ **Created:** [April 12, 2022, 3:52pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393 "2022-04-12T15:52:54Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![SecurityDad](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@SecurityDad](https://forum.suricata.io/u/SecurityDad)\ **Post date:** [April 12, 2022, 3:52pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/1 "2022-04-12T15:52:54Z")
I am running Suricata in my Home. Recently my daughter connected us with a Sumsung Q80A 55" TV. It’s nice, until I noticed that it is throwing Malicious JA3 SSL-Client Fingerprint (CoinMiner). Has anyone else detected this? I don’t know if there was a software update perform or not. I am concerned about the opportunities which can exist in our home as well. I’ve never owned a Samsung TV (or device before), and I am concerned about their ability to perform CoinMining in my Home (I’ve had it 10 years ago). ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [April 14, 2022, 12:44pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/2 "2022-04-14T12:44:41Z")
My suggestion has nothing to do with Suricata – it’s correctly identifying activity and bringing it to your attention. Disable/block the network connection for the TV. Suggest one of the many capable devices that provide streaming entertainment – Roku, Apple TV, etc. ---
**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://forum.suricata.io/u/bmurphy)\ **Post date:** [April 15, 2022, 12:22pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/3 "2022-04-15T12:22:39Z")
> [@SecurityDad](#): > > Malicious JA3 SSL-Client Fingerprint (CoinMiner) Do you happen to have the SID for this rule? I can’t seem to find it, was going to try looking up the hash and doing some research myself. If you can provide the JA3 hash/string this rule matching on, that’d be great. I’ve found [ja3er.com](http://ja3er.com) to be useful in helping determine how unique a JA3 hash is. In general I’d say that JA3 hashes are likely to cause false positives, especially when used as the sole indicator of maliciousness. Because of the reuse of many TLS Libraries, overlaps are pretty common. ---
**Author:** ![SecurityDad](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@SecurityDad](https://forum.suricata.io/u/SecurityDad)\ **Post date:** [April 15, 2022, 4:20pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/4 "2022-04-15T16:20:32Z")
The SID is 906200068 Can a fingerprint actually be faked? I think that a lot of Bio-metrics will have problems. ---
**Author:** ![SecurityDad](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@SecurityDad](https://forum.suricata.io/u/SecurityDad)\ **Post date:** [April 15, 2022, 4:21pm UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/5 "2022-04-15T16:21:31Z")
I believe that the Roku devices I have seen in my home are not as safe as you would think. ---
**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://forum.suricata.io/u/bmurphy)\ **Post date:** [April 16, 2022, 12:55am UTC](https://forum.suricata.io/t/samsung-q80a-tv-ja3-ssl-client-fingerprint/2393/6 "2022-04-16T00:55:28Z")
> [@SecurityDad](#): > > 906200068 this rule appears to be from the [Abuse.ch JA3 rules](https://sslbl.abuse.ch/blacklist/ja3_fingerprints.rules). it is looking for the hash of `40adfd923eb82b89d8836ba37a19bca1` - details of this hash, and associated samples, can be found on [abuse.ch’s ja3 page](https://sslbl.abuse.ch/ja3-fingerprints/40adfd923eb82b89d8836ba37a19bca1/) You might be able to find additional context from the details in the logs, for instance, are there any corresponding TLS events which contain the same IP address? If you can identify the destination IP address in the alert, to a domain name or TLS certificate, you might learn some valuable context to help determine if it is a true positives or false positive. > [@SecurityDad](#): > > Can a fingerprint actually be faked? I think that a lot of Bio-metrics will have problems. These aren’t those kind of fingerprints.