A carregar...
Publicação
Security on over the top TV services
| Nome: | Descrição: | Tamanho: | Formato: | |
|---|---|---|---|---|
| 1.08 MB | Adobe PDF |
Orientador(es)
Resumo(s)
The widespread availability of high bandwidth internet access on fixed and mobile networks in conjuction with the availability of mobile devices powerful enough to play streamed high quality vídeo, has created the demand for services that deliver television and vídeo contente over the internet to television sets, personal computers and mobile devices. This demand has lead to the appearance of over-the-top TV and video service providers that deliver video over the internet, using networks not operated by them. Video delivery in an open environment, like the internet, requires operators to implement security mechanisms to protect their valuable content from illicit access and distribution. In this thesis, we investigate security properties needed to securely deliver OTT video services. In order to assess the security mechanisms employed to enforce authentication, authorization, digital rights management and geographical restrictions, we survey three prominent OTT service providers. Due to their size and choice of technologies, we selected Netflix, Hulu and Comcast. We studied the interactions between the client applications and the providers’ servers by inspecting the traffic of messages exchanged. For each of the security mechanisms analyzed, experiments were designed to find flaws and test their effectiveness. The most important of the identified security issues are related to the handling and transmission of HTTP cookies when using web browser-based clients. These vulnerabilities are common to all surveyed providers and can be exploited by adversaries to steal authentication cookies and impersonate the customer, allowing illicit access to video assets and private information of the customer. A cookie stealing and session hijacking attack is described and mitigation strategies are presented for OTT service providers, users and wireless network access point administrators. These consist in the use of SSL to protect authentication tokens, the use HTTPS only or VPN services, and the use of WPA2 to protect wireless networks, respectively. An interesting result, observed with the analyzed mobile client for Android devices, is that it uses SSL to protect the transmission of HTTP cookies used for authentication. Thus it is not vulnerable to the described attack.
Descrição
Tese de mestrado em Segurança Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2011
Palavras-chave
Internet Vídeo Segurança OTT IPTV Teses de mestrado - 2011