The piracy concerns and the security solutions that can help combat illegal restreaming on Android TV-powered operator devices.
One of the major themes in the OTT industry in recent years has been the growth of Android TV. From a slow start where it underperformed on a range of devices, streaming media players in particular, it has found a vibrant home in the STB market. We wrote about this earlier this year (see How Android TV Platforms are Becoming Increasingly Important to the Pay-TV Market) where it was noted that the number of operators using Android TV in their STBs had exploded from eight in 2016 to 140 by March 2019. It is probably even higher now.
There is no doubt that Android TV is attractive to operators. It offers a robust STB solution and an Operator Tier that adds a significant amount of customisation at a much reduced cost compared to a wholly new bespoke solution. It features a rich set of apps and services, and it offers the end user an outstanding experience.
However, it is also attractive to hackers. It tends to offer a powerful STB which is often deployed in large volumes and is also often a conduit for high value premium content. As such, it is firmly in the targets of sophisticated video piracy operations worldwide.
Why content protection for Pay-TV devices is no longer enough
One of the main problems facing operators as we look at the threat landscape in the latter part of 21019 is that content protection remains key in the war against piracy but can’t address the new cases of piracy enabled by the development of high speed broadband, the easy-to-setup cloud infrastructure, and the new open source technology, . It still allows operators to gain access to premium content, including 4K HDR, and it prevents the protected device being used for any illicit purpose. But against that we have to measure the fact that HDMI/HDCP 1.4 has been compromised and its output can be recorded on simple devices that are widely available and only cost a few dollars. The outcome is that premium content is exposed to the chance of illegal restreaming.
And there is another problem for the new generation of devices. While applications are enablers for operators and allow them to offer a range of new services to their end users, from TV experiences through to games, music and more, they are also enablers for pirates. Hackers are also capable of developing their own apps that can give users easy — effectively one-click — access to illegal content without any of the previous hoops that they would have had to jump through involving BitTorrent technologies, for example.
Illegal streaming has changed the game markedly. According to a beIN Sports survey, 3.5 million people in France alone use illegal streaming sites just to watch football matches. And topically the company’s CEO, Yousef Al-Obaidly, spoke strongly about the subject in a recent Sport Business Summit in London.
“We now live in a world where exclusive broadcast rights are, effectively, wholly non-exclusive,” he warned. “And I can tell you that as the largest buyer of sports rights in the world… we now regard all sports rights as non-exclusive and our commercial offers will reflect that.”
Moving from content protection to cybersecurity
Hacking is becoming increasingly insidious and is attacking the industry at all levels. Here are a few examples of the sort of attacks that can be undertaken:
- Screen-scraping a shared communication session such as Skype
- Recording the screen during play, using a software application
- Tampering with video playback software
- Breaching the secure video pipeline in device hardware
- Tampering with the STB OS, which is open source
- Interception of decrypted video from a wire-based connection between a video output device and a screen, by using an HDCP stripper connected to a set-top box HDMI port, or by using a recorder connected to analog outputs
- Tampering with digital video content, to defeat a watermark that may be present; attacks include format conversion, digital-to-analog-to-digital conversion, re-sampling, and re-quantization
- Sharing access credentials to a streaming video service, or theft, using a ‘man-in-the-middle’ attack over a network
- Transport of video content to an out-of-market location via a Virtual Private Network (VPN)
- Data center breaches in a video provider’s headend, in a video production facility or in a DevOps pipeline, which can result in the theft of user credentials, cryptographic keys or the theft of video content
And there are more where those came from. The point is that we’ve moved on quite a long way from content protection and we need to think of a multidisciplinary approach to the problem. To build a proper anti-piracy solution you need to harness the power of several different areas. You need a knowledge base, you need appropriate technologies (which are often cutting edge), you need to have dedicated processed in place, and you need a dedicated team of security experts, engineers, data scientists, and support staff to make it happen. None of this is cheap, which is why we set up our own Anti-Piracy Center earlier this year.
Anti-piracy as a Service
The thing about the VO Anti-Piracy Center is that it gives companies access to just that sort of dedicated team who have access to the cutting edge technology that is needed to combat piracy. It acknowledges that the sheer scale of the problem is so large, especially as the attack vectors move on to Android TV, that any one company is unlikely to want to invest in the resources to battle it on their own.
Instead, in the same way that companies can use the Operator Tier of Android TV to customise their services, we can engage with operators on an individual level and give them the anti piracy protection that they need. It is effectively anti-piracy as a Service and this is the level of commitment that is required in the industry today.
Anti-piracy services need to cover the following processes:
Risk assessment
- Pirated content evaluation
- Illegal IPTV/OTT services scanning
- Hardening evaluation
- Security policies review
- Pentesting
Monitoring
- Identification of web restreaming platforms
- Monitoring of illegal IPTV/OTT offering
- Monitoring suspicious behaviours
- Monitoring vulnerability
Remedy
- Removal illegal distributed content
- Watermarking & CAS/DRM counteractions
- Technical & Legal assistance
- Lobbying & Awareness
And above and beyond this they must be elaborated further with a core and structured security intelligence process . This encompasses the ability to monitor vulnerabilities in software and at other points in the complete value chain; they need to be vigilant and list all the growing number of illegal pirate platforms and applications in a knowledge database; and they need to harness all that effort to data science. We talk a lot about the value of analytics in other areas of our business when it comes to understanding audience behaviours, reducing churn for operators, and increasing the depth or personalisation services. Here, we are using the same data science approach to build Artificial Intelligence and Machine Learning rules for behaviour analysis.
Eventually as a cornerstone, VO is introducing an innovative real-time and dynamic watermarking to the industry, a concept we have developed working with b<>com, a French technological research institute. It gives the ability to take down illegal streams with great agility and quickly enough to have an impact: a significant impact for the operators and an uncomfortable one for the pirates.
Fighting Android TV piracy
Android TV is growing steadily in popularity. And while it is a coincidence that it is currently proving most popular in regions which also suffer the most from video piracy, such as APAC, it does not make for a happy one for operators. As more STBs based on the operating system come onto the market so the attack surface widens and, depending on the direction taken with software development, so vulnerabilities in one custom implementation can be exploited and used to attack another system.
Any effort to stop piracy is important. But looking at the industry as a whole it is too late to assume that efforts made to patch security flaws at the device level will have a lasting effect on the volume of pirated content now available on illegal streaming sites. The pirates have moved on and the efforts to take them down must move on too.
Image by Pasi Mämmelä from Pixabay
