SlideShare una empresa de Scribd logo
1 de 27
Bypassing DRM Protections
at Content Delivery
Networks
Adrián Villa Bermúdez
@AdriVillaB
# whoami
• @AdriVillaB
• Computer Engineering graduate
• Pentester @ Tarlogic
Scope
• OTT configuration flaws
• Objetive
– Distribution of protected content
– Own players
Disclaimer
SQLi or other injection stuff
Privilege scalation
Steal user credentials
Economic proffit
Review implementation and configuration
Disclaimer
OTT infraestructure
• Over-the-Top technologies
– Video on Demand
– Channel live streaming
• Content distribution over CDN
• Content protection using DRM
How it works
How it works
HTTP Dynamic Streaming
• Delivery streaming content over HTTP
• F4V
– De facto standard
Analysis
Orange TV
• Preproduction analysis
• Microsoft Smooth Streaming
• IP-based DRM
– X-Forwarded-For?
Orange TV
Nubeox
• Limit number of devices
• Crossdomain.xml
• Decompile original player
– Device ID generation
• Extra ball
– “Pass the hash”
Nubeox
• Limit number of devices
• Crossdomain.xml
• Decompile original player
– Device ID generation
• Extra ball
– “Pass the hash”
Nubeox
Wuaki.tv
• IP-based DRM
– X-Forwarded-For
– True-Client-IP
Wuaki.tv
• IP-based DRM
– X-Forwarded-For
– True-Client-IP
Wuaki.tv
TotalChannel
• Smooth Streaming
TotalChannel
• Smooth Streaming
TotalChannel
Netflix
• NCCP
• RSA & HMAC
• Obfuscate Silverlight player
• Tamper DLLs
Videoclub: PitM
Videoclub: PitM
Conclusions
• Delegate business logic on the server side
• Not trust HTTP proxy headers
• Implement protections access content
• Obfuscate source code
Thank you
• Special thanks:
– @Tarlogic
– @RootedCON
@AdriVillaB
Adrian.Villa@Tarlogic.com

Más contenido relacionado

Destacado

Destacado (9)

4G wireless system
4G wireless system4G wireless system
4G wireless system
 
OTT Video DRM
OTT Video DRMOTT Video DRM
OTT Video DRM
 
DRM, Digital Content, and the Consumer Experience: More Lessons Learned from ...
DRM, Digital Content, and the Consumer Experience: More Lessons Learned from ...DRM, Digital Content, and the Consumer Experience: More Lessons Learned from ...
DRM, Digital Content, and the Consumer Experience: More Lessons Learned from ...
 
Mobile TV
Mobile TV Mobile TV
Mobile TV
 
Monetizing OTT Video - OTTcon 2010
Monetizing OTT Video - OTTcon 2010Monetizing OTT Video - OTTcon 2010
Monetizing OTT Video - OTTcon 2010
 
Streaming
StreamingStreaming
Streaming
 
Geolocalisation
GeolocalisationGeolocalisation
Geolocalisation
 
Streaming Data Analytics with Amazon Redshift and Kinesis Firehose
Streaming Data Analytics with Amazon Redshift and Kinesis FirehoseStreaming Data Analytics with Amazon Redshift and Kinesis Firehose
Streaming Data Analytics with Amazon Redshift and Kinesis Firehose
 
Mobile TV and IPTV: Enhancing the User Experience, IP&TV World Forum Middle E...
Mobile TV and IPTV: Enhancing the User Experience, IP&TV World Forum Middle E...Mobile TV and IPTV: Enhancing the User Experience, IP&TV World Forum Middle E...
Mobile TV and IPTV: Enhancing the User Experience, IP&TV World Forum Middle E...
 

Similar a Bypassing DRM Protections at Content Delivery Networks

I denti wall_3.0_final
I denti wall_3.0_finalI denti wall_3.0_final
I denti wall_3.0_final
Ilan Meller
 
Exacq 2011
Exacq  2011Exacq  2011
Exacq 2011
admes1
 
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptxCompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
mohedkhadar60
 
Highwinds | CDN | Overview
Highwinds | CDN | OverviewHighwinds | CDN | Overview
Highwinds | CDN | Overview
aadamian
 
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
Amazon Web Services
 
ODMedia Company Presentation
ODMedia Company PresentationODMedia Company Presentation
ODMedia Company Presentation
ODMedia
 
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
Protecting Data with Short-Lived Encryption Keys and Hardware Root of TrustProtecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
Dan Griffin
 

Similar a Bypassing DRM Protections at Content Delivery Networks (20)

I denti wall_3.0_final
I denti wall_3.0_finalI denti wall_3.0_final
I denti wall_3.0_final
 
y3dips hacking priv8 network
y3dips hacking priv8 networky3dips hacking priv8 network
y3dips hacking priv8 network
 
idsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 networkidsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 network
 
Student Presentation Sample (Netflix) -- Information Security 365/765 -- UW-M...
Student Presentation Sample (Netflix) -- Information Security 365/765 -- UW-M...Student Presentation Sample (Netflix) -- Information Security 365/765 -- UW-M...
Student Presentation Sample (Netflix) -- Information Security 365/765 -- UW-M...
 
AWS re:Invent 2016: Accelerating the Transition to Broadcast and OTT Infrastr...
AWS re:Invent 2016: Accelerating the Transition to Broadcast and OTT Infrastr...AWS re:Invent 2016: Accelerating the Transition to Broadcast and OTT Infrastr...
AWS re:Invent 2016: Accelerating the Transition to Broadcast and OTT Infrastr...
 
Exacq 2011
Exacq  2011Exacq  2011
Exacq 2011
 
Best Practices, AWS Elemental and Media Services
Best Practices, AWS Elemental and Media ServicesBest Practices, AWS Elemental and Media Services
Best Practices, AWS Elemental and Media Services
 
Drm landscape and online streaming
Drm landscape and online streamingDrm landscape and online streaming
Drm landscape and online streaming
 
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptxCompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
CompTIASecPLUS-Part1 Unlimited Edition- Edited.pptx
 
Codero Hosting Smart Servers Presentation
Codero Hosting Smart Servers PresentationCodero Hosting Smart Servers Presentation
Codero Hosting Smart Servers Presentation
 
Highwinds | CDN | Overview
Highwinds | CDN | OverviewHighwinds | CDN | Overview
Highwinds | CDN | Overview
 
Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)
Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)
Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)
 
From Containerized Application to Secure and Scaling With Kubernetes
From Containerized Application to Secure and Scaling With KubernetesFrom Containerized Application to Secure and Scaling With Kubernetes
From Containerized Application to Secure and Scaling With Kubernetes
 
BUILD 2014 - Building end-to-end video experience with Azure Media Services
BUILD 2014 - Building end-to-end video experience with Azure Media ServicesBUILD 2014 - Building end-to-end video experience with Azure Media Services
BUILD 2014 - Building end-to-end video experience with Azure Media Services
 
13. The Transition to IPv6 and the Necessity for IP Address Management - Frey...
13. The Transition to IPv6 and the Necessity for IP Address Management - Frey...13. The Transition to IPv6 and the Necessity for IP Address Management - Frey...
13. The Transition to IPv6 and the Necessity for IP Address Management - Frey...
 
Highwinds CDN
Highwinds CDNHighwinds CDN
Highwinds CDN
 
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
AWS Summit 2013 | India - Extend your Datacenter in the Cloud and achieve Hig...
 
Unizen Smart Automation Brochure-2015
Unizen Smart Automation Brochure-2015Unizen Smart Automation Brochure-2015
Unizen Smart Automation Brochure-2015
 
ODMedia Company Presentation
ODMedia Company PresentationODMedia Company Presentation
ODMedia Company Presentation
 
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
Protecting Data with Short-Lived Encryption Keys and Hardware Root of TrustProtecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
 

Último

Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
soniya singh
 
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
imonikaupta
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
Diya Sharma
 
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service OnlineCALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
anilsa9823
 
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
soniya singh
 
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceRohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
 

Último (20)

Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝
 
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark WebGDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
 
How is AI changing journalism? (v. April 2024)
How is AI changing journalism? (v. April 2024)How is AI changing journalism? (v. April 2024)
How is AI changing journalism? (v. April 2024)
 
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298  )#  Call Girls in DubaiRussian Call Girls in %(+971524965298  )#  Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
 
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
 
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
Moving Beyond Twitter/X and Facebook - Social Media for local news providersMoving Beyond Twitter/X and Facebook - Social Media for local news providers
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
 
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated  Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...Top Rated  Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
 
@9999965857 🫦 Sexy Desi Call Girls Laxmi Nagar 💓 High Profile Escorts Delhi 🫶
@9999965857 🫦 Sexy Desi Call Girls Laxmi Nagar 💓 High Profile Escorts Delhi 🫶@9999965857 🫦 Sexy Desi Call Girls Laxmi Nagar 💓 High Profile Escorts Delhi 🫶
@9999965857 🫦 Sexy Desi Call Girls Laxmi Nagar 💓 High Profile Escorts Delhi 🫶
 
VIP 7001035870 Find & Meet Hyderabad Call Girls LB Nagar high-profile Call Girl
VIP 7001035870 Find & Meet Hyderabad Call Girls LB Nagar high-profile Call GirlVIP 7001035870 Find & Meet Hyderabad Call Girls LB Nagar high-profile Call Girl
VIP 7001035870 Find & Meet Hyderabad Call Girls LB Nagar high-profile Call Girl
 
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service OnlineCALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
CALL ON ➥8923113531 🔝Call Girls Lucknow Lucknow best sexual service Online
 
✂️ 👅 Independent Andheri Escorts With Room Vashi Call Girls 💃 9004004663
✂️ 👅 Independent Andheri Escorts With Room Vashi Call Girls 💃 9004004663✂️ 👅 Independent Andheri Escorts With Room Vashi Call Girls 💃 9004004663
✂️ 👅 Independent Andheri Escorts With Room Vashi Call Girls 💃 9004004663
 
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
Nanded City ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready ...Nanded City ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready ...
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
 
Networking in the Penumbra presented by Geoff Huston at NZNOG
Networking in the Penumbra presented by Geoff Huston at NZNOGNetworking in the Penumbra presented by Geoff Huston at NZNOG
Networking in the Penumbra presented by Geoff Huston at NZNOG
 
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
 
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
Call Girls In Ashram Chowk Delhi 💯Call Us 🔝8264348440🔝
 
On Starlink, presented by Geoff Huston at NZNOG 2024
On Starlink, presented by Geoff Huston at NZNOG 2024On Starlink, presented by Geoff Huston at NZNOG 2024
On Starlink, presented by Geoff Huston at NZNOG 2024
 
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
 
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceRohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
 
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507  ))#  Young Call Girls  in Ajman  By Pakistani Call Girls  in ...(+971568250507  ))#  Young Call Girls  in Ajman  By Pakistani Call Girls  in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
 

Bypassing DRM Protections at Content Delivery Networks

Notas del editor

  1. OTT configuration flaws Delegate on the client side HTTP proxy headers
  2. Las peticiones al DRM y al CDN se hacen sin cookies
  3. Manifest -> F4M file Segments -> F4F file
  4. Crossdomain.xml *.nubeox.com *.casadellibro.com RABCDASM
  5. Crossdomain.xml *.nubeox.com *.casadellibro.com RABCDASM
  6. Crossdomain.xml *.nubeox.com *.casadellibro.com RABCDASM