In this episode of Cyber Security Inside, Tom and Camille dive into how content producers and distributors are keeping content secure in a world of piracy and streaming. What makes it possible for us to safely stream content directly into our homes? How do we know what we’re streaming isn’t pirated in some way?

Avi Wachtfogel, Engineering Fellow and Senior Director of Security Strategy at Synamedia, is just the person to cover the evolution of media content security and share the latest threats and best strategies for keeping content secure.

The conversation covers:

• Macrovision

• VHS + DVD

• Torrenting and peer-to-peer sharing

• BitTorrent

• VOD

• Over-the-top (OTT)

• Hulu, YouTube, HBO Max, Netflix, etc.

• Credential fraud

• Deep fakes

• Content protection and service protection

• Watermarking

• Take down notices

... and more Don’t miss it!

Here are some key take-aways:

• With video being distributed more broadly and going straight to streaming, protecting and securing media content has become even more challenging.

• Hardware and software technologies have been used on the service protection side to solve the problem of bootleg cable and other content security concerns of the 90s and 2000s.

• Over the top (OTT) refers to the distribution of video content over a high-speed Internet connection. This covers streaming services like Netflix, HBO Max, etc.

• It’s relatively simple to start an OTT service, so it’s more important than ever to keep media content protected against piracy. If pirates get access to the content, they can re-stream/distribute it.

• Pirates also create distribution chains, selling to other pirates who then sell to consumers. You see this often with live events. There are even salesmen who go door-to-door selling these IPTV services. Content consumers are often confused about whether the content they’re getting is legal or not.

• Licensing agreements that limit when and where content can be consumed can actually drive consumers to seek out pirate streaming sites.

• Credential fraud allows people to access content without legally subscribing to a streaming service. This is another way service providers lose money.

• Using encryption to keep OTT video content secure is a tricky thing. You need to allow those with the device to access the content, but pirates may also be accessing the content legitimately. Protecting that content using encryption is not as straightforward as it is with protecting personal info against external attacks.

• The line between content protection and service protection blurs once the content is distributed.

• The phases of protection are Protect, Detect, and Disrupt. Protecting won’t always be possible, Detecting involves figuring out who’s distributing the content and where and how they’re distributing it, and Disrupting is taking action and putting a stop to that distribution.

• A major challenge with the streaming industry is that everything is so fragmented, and this fragmentation actually encourages piracy. After all, if we’re already subscribed to dozens of services and then a new service creates content we want, where do we draw the line? When do we start seeking that content elsewhere? At some point, these services will have to work together.

• If you find that your own content is being distributed on YouTube, Facebook, or on search engines illegally, you can approach the platform. They’re required to take down those illegal links.

• The challenge of countering piracy requires technological means (like watermarking and tracking pirate services), as well as legal means (like Take Down notices), and a group effort to make it easier for legal content to be consumed than it is for illegal content to be consumed.

Some interesting quotes from today’s episode:

“Because the technologies are out there that make it easy to start a [OTT] service, pirates can do the same. And it's just a matter of having access to the content… If you have any device that outputs content -- that can be a set-top box, that can be a PC -- and that content is being output, it can be captured, whether through the HTMI port, or using the screen grabbing software, or even, an extreme case of just taking a camera and having it opposite the monitor. You can capture that content. And once you can capture that content, you can re-stream it.”

“One pirate will take a stream, a live stream, say of a sports event, and then they will sell that on to other pirates. So, you have a whole distribution chain and then those pirates will sell it on directly to consumers. And there’ll be resellers who are taking that content and selling it further and further along. There’s a lot of confusion very often among customers actually, as to what they're actually getting -- whether it's legal or not.”

“A lot of these services, they call them IPTV services. We've seen in some countries, there will actually be a salesman going door to door. They'll knock on the door and I'll say, you know, ‘For $10 a month, would you like access to these 200 channels? We’ll set it up for you.’ They'll come in, they'll take a box of some sort and go plug it into your TV, and they'll set you up and set up the billing. Some of these guys have got 24/7 support -- pick up the phone and you have support -- and they look really legitimate. And then very often the customers themselves can't tell whether they're signing up for legitimate service or not.”

“Very often these kinds of [licensing] arrangements actually drive consumers to use pirate services… We're actually seeing that kind of tendency. People are looking for content. There's actually a rise in the amount of content that's being viewed over Torrents these days because of these kinds of limitations.”

“You can go on the dark web -- you can buy a set of credentials for a variety of streaming services and pay a lot less for those than you would if you were subscribing legally. And that’s also a major problem for the service providers today. There's a lot of money that they're losing to those kinds of attacks.”

“In the case of video, it's a much more difficult problem because you're trying to protect the content on the device from the person who's holding the device. The pirate actually has a legitimate device with the content on it. And obviously you want a legitimate user to be able to view the content.”

“There are different ways of capturing that content and then re-encoding. Today, just encrypting the content is really not enough.”

“Whether it's Disney+, HBO Max, Netflix -- these new services are appearing every other day. And we all talk about the ‘streaming wars,’ but at some point they're going to have to recognize that they need to sort of get together and solve, what is really going to be a piracy problem. Because people are going looking for the content. People aren't going to sign up for ten different services. And if they don't happen to be subscribed to the particular service where there's content that they want, they're going to go look for it on Torrents. And so, they're going to have to find some way to work together after this fragmentation happens to sort of re-aggregate the content.”

“Today, if you sign up for Spotify or Apple Music or Amazon, you're paying one monthly fee… You don't care what the label is behind the music. You’ve got access to all the music you could want. And when the video industry reaches a point where they make it easier to access content legally than it is to access it illegally, they will have largely solved a lot of the problems that they're seeing today.”