Don’t Let Your OTT Success Turn You Into A Data Exfiltration Victim

Imagine you are a creative person with technical skills and limited moral constraints. Now imagine you get the opportunity to steal the series finale for Game of Thrones weeks before the episode is broadcast or streamed. That would be worth a lot, wouldn’t it?

Video streaming services, whether they are offered by traditional television broadcasters or digital native companies, are sitting on a gold mine. And many of those services don’t realize just how much their success has attracted the attention of the dark web.

By 2020, the U.S. OTT market is projected to generate $21 billion, up from $16.4 billion in 2014, according to research firm MTM. To the attacker, that growth represents even more opportunity to steal. Just what are they after? Let’s look at OTT’s three pots of gold.

Pot of Gold #1: PII and PCI

Let’s say that a criminal wants to buy a list of username and password combinations on the dark web. He might spend $1 per entry. A list of 100,000 costs him $100,000. But if that list includes subscription credentials for a subscription OTT service, suddenly, those $1 entries are selling for $10 and now the list costs $1,000,000.

Why? Because the list contains personally identifiable information (PII) and payment card information (PCI). Paid OTT services have to capture a lot of PII about their subscribers. The data may include, name, address, phone numbers, and even account numbers. According to Leichtman Research Group, 7 in 10 U.S. households (69 percent) now access a streaming subscription to Netflix, Amazon Prime or Hulu - that’s a whole lot of opportunity for a black hat.

Pot of Gold #2: Mezzanines for Popular Shows and Movies

How much would you pay to watch the cliffhanger episode of Westworld that reveals everything, and watch it before anyone else; $50? $100? $500?

Maybe you wouldn’t pay anything. Maybe you don’t believe in piracy. But not everyone is as ethical as you. We live in an era of peak video. There’s so much good content to watch that no one has time to keep up. But there are still shows that everyone talks about. If you could steal the file for key upcoming episodes, there is a busy market in the dark web for that stolen file.

Meanwhile, piracy is alive and well. According to antipiracy consulting firm Muso, the United States ranked number one for digital pirates, with 27.9 billion visits to piracy sites in 2017.

Port of Gold #3: Executive Communications

People love gossip, especially when it concerns famous or important people such as politicians, industry leaders or celebrities. What if you were able to get access to the email account of an OTT company executive? How much fame and credibility would you earn in the dark web community if you leaked controversial emails? Or what if you wanted to sell confidential communications to a competitor?

The bottom line is that the incredible success of OTT services means that the companies are now prime targets for the bad guys. And those companies need to think differently about themselves because of that. Unfortunately, it means they have to pay more attention to security.

Robbing the Bank of OTT Still Needs a “Getaway Car”

It’s not all bad news. Bank robbers need to get into the vault, but they also need to get out. Let’s say your firewall failed. Or your CEO clicked on that phishing link and accidentally allowed his laptop to be infected by malware that allows the criminal to control the machine. Or your IoT thermostat wasn’t properly patched and is now yoked to a malicious botnet. Just because the black hat made their way inside the network doesn’t mean they automatically get to walk out the door with stolen goods. They still need to exfiltrate the data.

And there is a way to significantly reduce your risk.

Often times, exfiltrating stolen data, whether it’s a customer list, a video mezzanine, or a file of emails, starts with a recursive DNS request to a malicious server. If you had visibility into all of these outbound requests and a way to proactively identify which ones were malicious using either past behavior or probabilistic inference, you could go a long way toward reducing the risk of data walking out the door. 

Maintaining security for an OTT service has unfortunately become more complex. It’s no longer limited to things like DRM and token authentication. Begin by acknowledging that recursive DNS is an attack surface. To proactively monitor and control DNS, you will need the proper tools. When considering security vendors, here are some questions you should ask:

  • How easy is the solution to configure and deploy and how long will that take?
  • Does it require any hardware to be deployed?
  • What DNS and IP traffic does the vendor have visibility into to allow it to create high quality and up to date threat intelligence?
  • How often does the vendor update its threat intelligence lists?
  • How does the vendor ensure that its threat intelligence feeds produce minimal false positive security alerts?
  • Can I integrate my own threat intelligence into the product?
  • Can the product accurately detect low throughput DNS data exfiltration?
  • Does the vendor give a 100% availability SLA for resolving DNS traffic?
  • How many DNS POPs does the vendor have?

As the OTT service market increases, expect even more hackers to view it as just more targets of opportunity. Be sure your security program is up-to-date and sufficiently robust to protect your service and customers. 

Shane Keats, Director of Media Industry Marketing, Akamai.

Shane Keats, Director of Media Industry Marketing, Akamai.

You might also like...

The World Of OTT (Infrastructure Pt8) - The Battle To Beat Content Piracy

Piracy is an ancient issue. In the media industry, piracy is the unlicensed use of content that is protected by copyright. While there are many benefits to OTT video, a downside is that its “over the top” nature where content tra…

TIM Deploys Android Set Top Boxes From Technicolor

Italian telco TIM has deployed Android TV set-top boxes supplied by Technicolor, giving access to streaming services such as Netflix, Amazon, Infinity, Disney+ and DAZN, as well as traditional linear TV.

BT Sport’s Live VR 360 Coverage Of Premier League Brings Fans Closer To The Action

While the merits of 8K delivery is being debated by broadcasters around the world, some are moving forward with plans to deploy the high resolution quality in creative ways that engage viewers and encourage them to interact with a live…

PTP V2.1 – New Security & Monitoring For IP Broadcast Infrastructures - Part 2

In the last article in this series, we looked at how PTP V2.1 has improved security. In this part, we investigate how robustness and monitoring is further improved to provide resilient and accurate network timing.

Public Service Broadcasters Juggle Linear And Online To Maximize Coverage

The decline of public service broadcasting has been one of those long running narratives that is sometimes defied by reality, like the death of the set top box.