Slashdot Mirror
West Point Researchers Demonstrate Passive Netflix Traffic Analysis Attack (threatpost.com)
hypercard writes: Researchers from West Point recently presented research on a real-time passive analysis of Netflix traffic. The paper, entitled "Identifying HTTPS-Protected Netflix Videos in Real-Time" is based on research conducted by Andrew Reed, Michael Kranch and Benjamin Klimkowski. The team's technique demonstrates frighteningly accurate results based solely on information captured from TCP/IP headers. Even with the recent upgrade to HTTPS, their technique was effective at identifying the correct video with greater than 99.99 percent accuracy against their database of over 42,000 videos. "When tested against 200 random 20-minute video streams, our system identified 99.5 percent of the videos with the majority of the identifications occurring less than two and a half minutes into the video stream," the paper reads. However, there are important points to note. First, the attack described only applies to streams still using Silverlight. Additionally, an attacker would likely need significant resources and access to intercept, fingerprint and process the traffic in real time. Netflix has reacted positively to the team's research and acknowledged the issue as a known drawback to processing video streams with HTTPS.
"only applies to streams still using Silverlight"
Stop using Silverlight, or better yet, stop using anything Microsoft releases to try and accomplish what ActiveX and Silverlight try to?
Some academics are trying to rationalize their work-time bingewatching as "security research" ;)
Seriously, this is pretty interesting nevertheless. It shows how much information can be garnered from side channels. And to think we're leaking them all the time...
And this gem from the PDF paper:
If you are using Silverlight you have bigger problems than this to worry about.
The attacker would then send spoilers by mail or something, ruining the series for the victim. The horror!!
I've also heard that security researchers have found that they can predict where a letter is being sent based solely on the address written on the envelope.
You are welcome on my lawn.
Do you really think Google isn't turning around and selling that data? As many times as it can?
"Additionally, an attacker would likely need significant resources and access to intercept, fingerprint and process the traffic in real time." Hmm.. I don't quite recall but I seem to remember someone talking about ISP's being permitted to monetize collected data from customers..
Within the arms of tragedy, there is little comfort in being right.
Yeah, I don't get it either. Where is the 'attack' part of this? It's more like traffic analysis. Given the access to the traffic you need it might be easier to stand outside their front door and listen for a minute.
This article talks about matching videos with known ones what, unlikely what some people seem to think, is pretty much all what automated image (or video) recognition is about. For example, recognising that a given picture contains a house is usually the result of having compared the given pixels against the ones in a training set of images with houses. Almost any variation with respect to the training image has a relevant impact on this process (e.g., different structure, colours, positions, distorted pixels, etc). Additionally, these analyses usually consume lots of hardware resources.
Even in case of getting a perfect copy of the original video, just automating the recognition of its contents would represent a further layer of complexity. Something like separating the videos about sports from the ones about movies would be very difficult; virtually impossible when dealing with random inputs and expecting a high enough accuracy.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
I thought Silverlight was supposed to be dead. Besides, if you are using Windows, your first concern obviously isn't privacy.
Anons need not reply. Questions end with a question mark.
Average Slashdotters: I'm watching porn! Lots of porn!
Researchers: Actually, we've determined you're watching the Veggie Tales' "Barbara Manatee" song clip, over and over.
#DeleteChrome
Knowing your taste for entertainment makes social engineering a lot more viable.
Why should I care? Netflix already knows what I watch and I have no doubt that they would sell that information.
"Reed and Klimkowski show that this combination of DASH and VBR can produce sequences of video segment sizes (i.e. fingerprints) that are unique for each video." Do we really need yet another lesson to teach us that mixing variably (but deterministically) sized traffic segments with HTTPS is self-defeating? Netflix needs to confront the fact that if they value user privacy over performance, they need to roughly double their bandwidth by appending non-pseudo-random junk traffic to each segment, and enforcing a global minimum segment size. I would go so far as to say, furthermore, that they need to ensure that the latency between segment send times is also highly random (up to some acceptably small limit). Otherwise, at least within the first few hops from their server farm, it would be possible to deduce the video ID just from that stream of latencies, as it's probably being read from the same cache hierarchy using the same processors and busses with roughly consistent behavior. The real threat they've discovered has nothing to do with Silverlight. It regards the implications for doing the same on video sites generally, most notably YouTube, using only modestly more sophisticated techniques. Time to reinvent the DVD rental store...
Rarely has so much research been done to reveal so little of any actual worth. This is West Point funded -- I assume the government is behind this somewhere? Don't.... don't they already have access to Netflix data on the backend?
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
Particular when the "security questions" used as a faux second factor for authentication on many services include "What is your favorite movie?", as I discovered yesterday when creating an account on a web-based income tax return preparation service.
The "attack" is described in the rationale for the Video Privacy Protection Act of 1988, which was a response to the release of D.C. Circuit Judge Robert Bork's video rental history and its publication in Washington City Paper before his unsuccessful nomination to the Supreme Court of the United States.
I guess I am just going to have to stick with vigilante movies
love is just extroverted narcissism
That is why you never answer those recovery questions honestly and never use the same answer for more than one site. Make up a fake answer (like "correct horse battery staple") and store it in a password vault.
whoops, screwed up the link: "correct horse battery staple"
This was a demonstration of identifying the video only looking at the TCP headers. TLS should be mutating the video frames such that you can't tell all-black from anything else.
The root of the problem might be that compression algorithms are too successful, because when compressed then encrypted, it's easier to deduce what might be in the unencrypted payload.
that's all fine until you can't remember what you used.
Military intelligence organizations has used Traffic Analysis for a century or more. Surely even before the dawn of the radio age.
To keep the enemy from reading your messages you encipher them. Those messages still need to be routed to their proper nets so the header information might be plain text. Even if routing information is encrypted Radio Direction Finding and/or measuring the traffic volume can still provide actionable intelligence. It is likely that a unit receiving the most messages is some sort of headquarters. Tapping a telegraph line was done during the American Civil War by both sides.
No surprise, then, that West Pointers are honing their skills an open information source. Practice does help.
Looking at header information can tell a lot about your internet usage too. One would have to be totally naive to believe various governmental agencies don't bother to look at, and analyze, that sort of meta-data.