Broadcast Cybersecurity Moves Beyond the Smart-Card-Hack Age

Fighting piracy is a carrot-and-stick game. The carrot is that you have to provide great services and great content — and the stick is to hit the organizations that are trying to make money off of your business model. The threats to broadcast are evolving. Previously, threats were based around smart card hacking of pay-TV systems. This has evolved over the last four years into what we call the key-sharing — a form of redistributing keys over the internet to give access to pay TV content. Another growing threat is the illegal streaming of content.

Latest Trends for Network Security

Hackers are getting much better and have several tools to obtain content, the requirement for effective security solutions is growing. These solutions need to be a combination of software and technology hardware on the clients’ side, which helps protect against these potential attacks.

“In the past we were using smart cards which were a replacement for missing security, but this is not necessarily the case right now,” Verimatrix’s Vice President of Product Management Tom Pollard explains. “In fact, today we use a Trust Execution Environment (TEE) or a chip in the box along with the right software. So, it’s a combination of the set top box side and card software security that makes sure that the system can be protected from potential hackers.”

Watermarking is a new feature that improves system data by modifying the system individually, even if content gets redistributed. Using a special analysis tool, it gives the ability to track back to the hacker. The content is being taken from a satellite set top box and then put on an Over-the-Top (OTT) streaming server over the internet. The hackers inevitably profit from the theft. This is one of the biggest threats today, and an Advanced Encryption System (AES) proves to work better against cyber-attacks. It is required by content owners and will soon replace the Common Scrambling Algorithm (CSA), which is generally only stable because the encryption changes every few seconds. AES will provide more reliability to protect the stream better from an offline attack.

Nagravision (Nagra) works to protect content lines and serves hundreds of operators worldwide. Many are satellite operators or cable operators. Nagra fights piracy through continuous improvements in technology and by developing counter measures to stop hacks and piracy.

“We have been able to really bring down traditional set top box piracy to the minimum in most parts of the world and for most of our customers,” says Nagra Senior Director of Product Marketing Hannu Impola. “Most recently in North Africa we have undertaken major efforts with one of our customers by cracking down on the Virtual Data Room (VDR) — a grey market ecosystem that provides and shares keys over the internet and counter-fed to set top boxes.”

Impola explained how Nagra aims to look at the trends in the industry and come up with solutions, as well as some of the risks and challenges that traditional service providers face. OTT and the rise of Netflix and other players are transforming the industry, and the availability of connected devices on a broadband network is changing the way people consume content.

This has an impact on the positioning of pay-TV service providers, as they look to add further on-demand connectivity to their platforms. Satellite operators are looking into deploying connected set top boxes that provide on-demand content, as well as traditional linear content. It is this combination of mixing traditional with more dynamic real-time content which is a major market trend.

Irdeto also has a lot to offer in protecting video content for pay-TV and OTT providers. One pay-TV market trend is that the threat level increases/decreases depending on the markets. Operators which invest less in security are more prone to losing revenues through piracy. Pay-TV operators are now looking to ensure that they have set top boxes that are capable of doing both OTT and broadcast. This adds a new element to protecting those revenue streams.

“Right now, we are focusing on the fact that pay-TV operators want to have hybrid set top boxes like Apple’s so they can offer those services to their consumers. Another thing that we offer is reliable OTT services to allow competitiveness in that environment,” says Irdeto Vice President of Product Management, Frank Poppelsdorf.

Great Threats

A lot of pay TV operators are moving to more open platforms, which means a bigger attack surface — especially when it comes to set top boxes.

There are two main perspectives for modern security threats. One is from the business model itself where pirates become the competitors and can destroy the business. With service providers becoming in essence broadcasters, and having their IT systems connected to the networks, the cybersecurity risk increases. Kudelski Security looks at cybersecurity issues and provides services and technologies to the media industry. They also provide services to industries that are also at risk to major hacks, including the banking and financial services industries, as examples.

The media industry is lagging behind in cybersecurity investment, which is not a good sign. This will become a challenge, as more content is being distributed over the internet. As media businesses become more and more connected, an increase in demand for cybersecurity solutions is anticipated over the coming years.

Satellite vs. Cable – IPTV

The threat is the highest for satellite TV. The satellite depends on a dish, and all the dish needs is a signal from the satellite. Cable, however, still needs a physical cable connection to your home, and IPTV is the same through a High-Definition Multimedia Interface (HDMI) input.

Currently, cable operators are becoming telecom operators selling broadband services in addition to television. Similarly, we’ve seen telcos adding more TV content to their networks whether through partnerships or acquisitions of SVOD content specifically Telefonica and Netflix, for example.

There is an appetite to add more content to these platforms. Many telcos now compete with satellite players and have major blue chip broadcasting rights in sports, for example. Some satellite operators like Sky in the United Kingdom also started either partnering with telcos or becoming re-sellers of network access services. The strategies are also evolving on satellite broadcaster side. On the other hand, the consumer doesn’t care much about which network to use to receive the content as long as they have access and watch what they like on different screens in different places. The driving force is the need to have broad access and a great user experience across screens.

Are Pay-TV Operators Well Prepared?

This is a difficult question to answer. Some of the largest customers have always been very aware of security risks and they worked with security solution providers over the years that responded with great technology and offered to address their needs. They have invested huge amounts to stay secure. On the other hand, when it comes to smaller operators, and those who do not have high-value content, the understanding of piracy and risks is less understood and sometimes there’s even a complete lack of knowledge. That itself is where it becomes complex to provide an explanation of how the system works and to make sure operators are making the right decision. There are different products for different market segments addressing of course the different packages. When revenues are lower, obviously service providers cannot afford some of the more advanced business solutions. Yet, it is often these systems that are more prone to attacks.

Elevated Threat Level

If we look purely at broadcast networks, the security threat continues to grow because in many ways it is still a very attractive target for hackers.

Streaming piracy maybe relatively new, but it is impossible to calculate the actual impact this is having on traditional pay-TV operator busineses. Recent surveys conducted clearly identify that streaming piracy is the new big elephant in the room for the industry in terms of risks for content owners’ business models. Many of these owners have focused an effort into understanding piracy risks, while remaining concerned about the issue and knowing that it represents an ongoing battle. There is a lot to be done on the policy level and in terms of legislation in several countries, to bring new policies and making sure that the media industry stays properly protected and guarded against the risk and piracy in general.

Recent Story

Based on recent research and ongoing investigations, Viaccess-Orca talks about the need to make broadcasts 'crypto secure' going forward. A recent study of events in Hong Kong underlined the seriousness of the problem that faces pay-TV operators. According to Viaccess-Orca, in Hong Kong, one out of four TV viewers were using illegal set top boxes that are enabled for illegal streaming once switched on and set up. And consequently, one out of four consumers dropped their actual true subscriptions. This emphasizes the scale of the problem. That is a huge percentage of revenues to lose out on.

The FIFA World Cup in Russia makes an interesting case study. Here, Viaccess-Orca monitored almost all of the matches, including the final. As a result, different content platforms like YouTube and Facebook were the most popular for distributing illegal links over the internet to watch these games.

On their report based on the World Cup, Viaccess-Orca took the opportunity to measure the levels of illegal streaming, how many links were out there. The figures of people accessing this content illegally were huge.

All the matches were available from local channels. TF1 received all the matches and access was easy and guaranteed. Yet, despite this, many were still watching the games through illegal streams. This is clearly a worrying trend.

The question remains one of the mindset of the consumer being a good citizen. The piracy problem has not gone away with many seemingly still having no issue accessing content illegally. Sadly, it appears a mindset that will not change in the immediate future.

Abe Peled speaks

Abe Peled of Private Equity firm Permira, who was recently involved in the acquisition of video assets from Cisco, shares his insights on the latest trends of pay-TV piracy. He is an authority on the subject of pay-TV piracy, having previously been the CEO of NDS.

Satellite TV has always been the prime target for piracy because of the nature of its setup compared to cable. What made NDS successful was that it was able to have an impressive track record of not being hacked, he says.

However, the world has changed significantly with the internet as it has facilitated reaching anyone almost anywhere in the world with high bandwidth, and consuming content on the Internet is now incredibly popular.

Peled believes the next frontier in piracy will be the illegal distribution of copyrighted video via the internet. He calls this ‘Streaming Piracy’. It is easy to do, but difficult to track since servers can be anywhere in the world. There is also the presence of Kodi boxes that enable the download of pirated software and connect the user to all sorts of illegal streams. Peled believes operators mainly worry about illegal streaming of sports events or series or even the latest movies, i.e. commercial operators.

Peled says tracking down commercial operations is the next challenge. While pay-TV operators and broadcasters are focused on locking the content by video or watermarking, the main challenge is to disrupt operations in real time. "That is our goal," Peled says. Technologies in this field are available that are capable to disrupt and make it impossible to watch pirated streams. "We are able to detect re-streaming of re-encoded content on the internet. It is now legal in the UK to inform an internet service provider to block a particular stream to stop it. The plan is to apply new technologies to detect streaming piracy and disrupt it at the network level," says Peled.

Consumers don’t care about illegal sharing, like Netflix originally. You can give your password to several friends and they can all use it. Netflix detects concurrent streams from different geographic locations and requires an upgrade accordingly. This is an example of how to address an ongoing problem. We are entering a new phase of tackling the piracy problem. VS