Slashdot Mirror
West Point Researchers Demonstrate Passive Netflix Traffic Analysis Attack (threatpost.com)
hypercard writes: Researchers from West Point recently presented research on a real-time passive analysis of Netflix traffic. The paper, entitled "Identifying HTTPS-Protected Netflix Videos in Real-Time" is based on research conducted by Andrew Reed, Michael Kranch and Benjamin Klimkowski. The team's technique demonstrates frighteningly accurate results based solely on information captured from TCP/IP headers. Even with the recent upgrade to HTTPS, their technique was effective at identifying the correct video with greater than 99.99 percent accuracy against their database of over 42,000 videos. "When tested against 200 random 20-minute video streams, our system identified 99.5 percent of the videos with the majority of the identifications occurring less than two and a half minutes into the video stream," the paper reads. However, there are important points to note. First, the attack described only applies to streams still using Silverlight. Additionally, an attacker would likely need significant resources and access to intercept, fingerprint and process the traffic in real time. Netflix has reacted positively to the team's research and acknowledged the issue as a known drawback to processing video streams with HTTPS.
"only applies to streams still using Silverlight"
Stop using Silverlight, or better yet, stop using anything Microsoft releases to try and accomplish what ActiveX and Silverlight try to?
Some academics are trying to rationalize their work-time bingewatching as "security research" ;)
Seriously, this is pretty interesting nevertheless. It shows how much information can be garnered from side channels. And to think we're leaking them all the time...
And this gem from the PDF paper:
"Additionally, an attacker would likely need significant resources and access to intercept, fingerprint and process the traffic in real time." Hmm.. I don't quite recall but I seem to remember someone talking about ISP's being permitted to monetize collected data from customers..
Within the arms of tragedy, there is little comfort in being right.
Yeah, I don't get it either. Where is the 'attack' part of this? It's more like traffic analysis. Given the access to the traffic you need it might be easier to stand outside their front door and listen for a minute.
You're analogy is quite flawed. This would be akin to security researchers divining the contents of the envelope based solely on the address written on the envelope. Epic fail for you.
This article talks about matching videos with known ones what, unlikely what some people seem to think, is pretty much all what automated image (or video) recognition is about. For example, recognising that a given picture contains a house is usually the result of having compared the given pixels against the ones in a training set of images with houses. Almost any variation with respect to the training image has a relevant impact on this process (e.g., different structure, colours, positions, distorted pixels, etc). Additionally, these analyses usually consume lots of hardware resources.
Even in case of getting a perfect copy of the original video, just automating the recognition of its contents would represent a further layer of complexity. Something like separating the videos about sports from the ones about movies would be very difficult; virtually impossible when dealing with random inputs and expecting a high enough accuracy.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
You're analogy is quite flawed.
As is your grammar.
#DeleteChrome
I thought Silverlight was supposed to be dead. Besides, if you are using Windows, your first concern obviously isn't privacy.
Anons need not reply. Questions end with a question mark.
Average Slashdotters: I'm watching porn! Lots of porn!
Researchers: Actually, we've determined you're watching the Veggie Tales' "Barbara Manatee" song clip, over and over.
#DeleteChrome
Knowing your taste for entertainment makes social engineering a lot more viable.
Why should I care? Netflix already knows what I watch and I have no doubt that they would sell that information.
"Reed and Klimkowski show that this combination of DASH and VBR can produce sequences of video segment sizes (i.e. fingerprints) that are unique for each video." Do we really need yet another lesson to teach us that mixing variably (but deterministically) sized traffic segments with HTTPS is self-defeating? Netflix needs to confront the fact that if they value user privacy over performance, they need to roughly double their bandwidth by appending non-pseudo-random junk traffic to each segment, and enforcing a global minimum segment size. I would go so far as to say, furthermore, that they need to ensure that the latency between segment send times is also highly random (up to some acceptably small limit). Otherwise, at least within the first few hops from their server farm, it would be possible to deduce the video ID just from that stream of latencies, as it's probably being read from the same cache hierarchy using the same processors and busses with roughly consistent behavior. The real threat they've discovered has nothing to do with Silverlight. It regards the implications for doing the same on video sites generally, most notably YouTube, using only modestly more sophisticated techniques. Time to reinvent the DVD rental store...
Rarely has so much research been done to reveal so little of any actual worth. This is West Point funded -- I assume the government is behind this somewhere? Don't.... don't they already have access to Netflix data on the backend?
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
Particular when the "security questions" used as a faux second factor for authentication on many services include "What is your favorite movie?", as I discovered yesterday when creating an account on a web-based income tax return preparation service.
The "attack" is described in the rationale for the Video Privacy Protection Act of 1988, which was a response to the release of D.C. Circuit Judge Robert Bork's video rental history and its publication in Washington City Paper before his unsuccessful nomination to the Supreme Court of the United States.
I guess I am just going to have to stick with vigilante movies
love is just extroverted narcissism
It's Silverlight for chrissake. Is anybody surprised that the envelope is transparent and doesn't protect anonymity and content?
You are welcome on my lawn.
that's all fine until you can't remember what you used.