Security on over the top tv services

• Main Author: Pereira, Carlos Filipe Zambujo Lopes
• Publication Date: 2011
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/10451/13937
• topic: security; IPTV; video; OTT; Internet

The widespread availability of high bandwidth Internet access on fixed and mobile networks, in conjunction with the availability of mobile devices powerful enough to play streamed high quality video, has created the demand for services that deliver television and video content over the Internet to television sets, personal computers and mobile devices. This demand has lead to the appearance of over-the-top TV and video service providers that deliver video over the Internet, using networks not operated by them. Video delivery in an open environment, like the Internet, requires operators to implement security mechanisms to protect their valuable content from illicit access and distribution. In this thesis, we investigate security properties needed to securely deliver OTT video services. In order to assess the security mechanisms employed to enforce authentication, authorization, digital rights management and geographical restrictions, we survey three prominent OTT service providers. Due to their size and choice of technologies, we selected Netflix, Hulu and Comcast. We studied the interactions between the client applications and the providers’ servers by inspecting the traffic of messages exchanged. For each of the security mechanisms analyzed, experiments were designed to find flaws and test their effectiveness. The most import- ant of the identified security issues are related to the handling and transmission of HTTP cookies when using web browser-based clients. These vulnerabilities are common to all surveyed providers and can be exploited by adversaries to steal authentication cookies and impersonate the customer, allowing illicit access to video assets and private information of the customer. A cookie stealing and session hijacking attack is described and mitigation strategies are presented for OTT service providers, users and wireless network access point administrators. These consist in the use of SSL to protect authentication tokens, the use HTTPS only or VPN services, and the use of WPA2 to protect wireless networks, respectively. An interesting result, observed with the analyzed mobileclient for Android devices, is that it uses SSL to protect the transmission of HTTP cookies used forauthentication. Thus, it is not vulnerable to the described attack.