About this talk
In this talk, the speaker Joseph Stly discusses the process of inspecting IPTV technology for educational purposes, illustrating several exploration attempts with his home setup. He describes a situation where his IPTV service stopped working and the generic responses he received from customer support. To investigate the issue further, he uses a Raspberry Pi as a network tap, allowing him to analyze the traffic between his ISP's router and the set-top box (STB). Throughout the session, he demonstrates how he intercepts and modifies data packets to gain unauthorized access to additional channels. He highlights challenges like changes in data format and protocol complexities but ultimately shows that many ISPs rely on unencrypted HTTP traffic, enabling possible exploits. The talk emphasizes principles of network security while exposing some shocking gaps in ISP technologies.
Full transcript
[Music] ladies and Gentlemen please welcome our next speaker Joseph stly presenting the topic inspecting ipdv for fun and no profit it's all kind inspecting ipv for nonprofit um first a little bit about me uh currently I'm working as a CTO at sasore but this talk has nothing to do with it um it's completely separate stuff uh and before we begin a little disclaimer so everything you see
here may or may not be in the gray zone so uh this is for educational purposes only uh and don't blame me if you um get caught anything okay so with that out of the way we can begin so at my home um I have the internet this is the internet obviously um the little U Black Box um and I have IP TV now the IP TV
is not the one the illegal one you can buy off the internet but the legal one from my I from my uh Telecom provider and I guess most of us nowadays if you're watching TV in your home you are watching it the same way I am and that's you have your router from your ISP and then you have a little black box um and that's why you
have two remotes or three um and that box is connected to the TV and I'm talking about this box this box is called the stb or setup box and um its only purpose is to get the signal from your ISP and to then display play the channels on your TV that's its only use so first a little story so one day um my wife who was pregnant
at the time and this is important so that part that she's pregnant is important so she's at home um she's in her last weeks of pregnancy and if you know pregnant woman at the end of their cycle it's like they're really big and they cannot do much so she was watching t most of the time and I'm at work and I get a call and she told
me um TV is not working uh oh don't mind so TV is not working I I say okay how do you mean it's not working something has to be be working is it black no no no like the TV turns on um but there are no channels on it I cannot watch anything I'm like okay did you try turning it off and on again you know the
classic fix for everything and she said yeah yeah yeah it's not working and I like okay I'm going to get um get home and then then I'm going to look WhatsApp so I get home I turn on the TV and I get this message so this message is in creation because the channels are in creation where I'm from but basically it says um so you do not
have the permissions to see this channel which is weird because I do have the permissions to see that channel because that's the basic package the channel is in the basic package I should be able to watch it but I don't and I know I paid all of my bills on time and everything should be working it was working yesterday so what I do I call the customer
support obviously and I explained to them that okay I try to turn on my TV and my channels aren aren't working and like they should be and I get the most generic response from them which is having triy turning it off and on again and I'm like I have to explain that I'm in it so I kind of know how some things work but I'm I I'm
I'm polite so I say yes of course I tried turning it off and on again and it it's not working and like I the the TV says I have I do not have the subscription so it's on your end your service is not um giving me the the the access and she said no no no like you have to manually turn it off from the power and
then turn it on I'm like wh why and and have you ever heard um when they say you have to turn it off leave it off for 30 seconds and then turn it on which is but fine I say I haven't tried doing that but that will not help like the issue is on your side and she was like no no no just turn it off and
on again and it will work and I'm like why well she said that's because your TV needs to pull which channels you can watch and then you'll be able to watch them I'm like no that's not like that's the same as the things that were being done 20 years ago when you in JavaScript you write your password and and check if my password is equal to this
password then um you can let the the admin in and I'm like that's that's not how this should be done but I did I I listen to her I turned off the stb I turned it on there's a boot time of two minutes you have to wait for it and it worked which was which was strange which was interesting really really interesting um I dabble insecurity a
bit from God knows how long ago and this is something that was stored in the back of my mind okay so the TV decides what I whatnot and um I don't have the time to uh kind of dig into it so I waited until my wife gave birth and if you have children you know that in the first couple of months they just sleep eat and poop
so I have I'm at home and I have time while the child is sleeping so what I do I open the stb the settings and I see this so this is the technical specs of the stb and it's again in creation doesn't matter it says what your private IP is for the stb and it says the MAC address and I'm like okay cool I see that the
IP starts with 10 something something and my IP normally like with with most of you your IP for your laptop starts with 192.168 do something something and I'm like okay so the stb is in its own land um I would like to go there and see if I do a network scan what will I discover so this is the picture of the stb connected to the router
it's really simple so stb directly connected to the rout router and on your router you have four ports right you have two for laptops and network stuff and you have two for TV and I'm like I'm just going to connect to the same port uh where the stb is connected so I did that and I was hoping that I'm going to get that private VLAN to to
be able to scan the network no dice I didn't get anything and I'm like okay so it's probably something to to do with the MAC address I'm going to see the MAC address because you can see it in the technical specs so I read the MAC address I I set the MAC address to be the same on my laptop I tried to connect doesn't work and at
this point I'm like okay I don't have the time to deal with this let's just get the um the child to sleep and I'm going to check it out someday later on and basically what what I wanted to do is I started thinking what can I do without being able to get into the network so this is the layout you have your ISP um you have your
router um your stb is connected to the router and then connected to the TV and what I wanted to do is get in between and see what the traffic is so what's going on between the router and the stb and the way to do this is by using a device called a network tab so basically what it does you just connect it in between it has two
ethernet parts and then you can see flowing and you can buy it online there's a a lot of different um devices this one is um a really popular one it's 100 bucks but the problem is um it takes time for delivery to come and I didn't have the time because I had limited time to kind of play around with this um so I started looking at my
house what what else do I have that can sort of be used as a network T and I have a lot of raspberry pies lying around uh probably some of you do also um but the issue is it only has one internet port so you cannot use it as a tab right um but then I remembered I also have an ethernet adapter which is in USB so
you can plug it into Raspberry Pi now you have two internet ports and you can use it as a network type you can just bridge two interfaces together so that's what I did so going back to the initial setup I just put my Raspberry Pi in between so a signal goes it's just standard TCP IP right so it goes from the router to the to the Raspberry
Pi and then from the Raspberry Pi to the stb and Raspberry Pi is running running Linux um and to do to make it work you have to put the two interfaces in bridge mode um it's difficult to do you just put this inside and it Bridges those two interfaces and then also the other thing you have to do is you have to put you have to tell
the kernel uh to forward packets from one one interface to the other I mean to allow the packets to be forward you do this like like like this and once you do that and reboot the machine uh and also run wire shark on it uh Magic happens so the TV starts streaming even though it's going through my device and on that device I can see everything that's
going on and this is a stream of UDP traffic and that's because um the the uh channels that's actually UDP it's realtime streaming protocol and you get a lot of UDP buckets and I'm like okay this is interesting I can see that something is being played on doesn't mean much that's not really interesting to see what's going on and then I have remember okay I want to
see what's happening when I um turn off and on the stb when the stb actually pulls what I can watch so I did that and I waited for two minutes for the stb to boot and it's a really slow process and then it booted and I got this and this is interesting because this is HTTP I'm like okay I was I thought it's going to be some
kind of crazy weird protocol to communicate but no it's just HTTP and when I opened some HTTP request I saw this and it's a really really really big Json and when you look more closely you can see that it's actually a um me meta uh uh data which says you have these packages and these packages contain these channels so basically when you go to your ISP and
you say I want to have the HBO and some other movies they turn on a specific package for you and I saw okay this is interesting so now now the TV knows all of the channels that exist and it also knows which channels are in which packages and I also found another uh HTTP request actually response and that response told me that uh it's a list of
packages that I have and I could find uh multiple uh packages that I was subscribed to so basically what happens that this was my reasoning you the TV gets a list of channels and then uh a list of packages that have those channels and then what I'm allowed to watch and then it decides on what I'm be able to watch and the interesting thing is this is
HTTP like HTTP is simple everybody knows HTTP you have your headers you have your body it's easy kind of to know what's going on especially with when it's a Json and then I started thinking okay so now that I know this what if what if I could change something on the way from the router to the stb that would be interesting because then I could probably do
something but the thing is um TCP IP it's not that um simple so there's a lot of moving data if you want to change data in TCP uh which is what I wanted to do first you have to know the ordering so you cannot just replace the content with anything you want you have to do it in the correct order because packets can come in any order
you also have check sums so if you change the data you have to recalculate the check sum and there are two of those and it's really difficult to add more data because I wanted to add more descriptions to my to my u TV so you cannot add more data I mean you can to certain point but you cannot add a arbitrary amount of data to a packet
is because of something called MTU maximum transmission unit and that's for ethernet it's a 105 1,500 bytes so it's a really comp complex thing to go into so I started looking around how people do this and there's this really cool tool called man in the- Middle proxy and it basically allows you to do man in the- Middle attacks and change uh stuff on the flight um really
simple to use so I wanted to use it but I couldn't because what the way it works is you have to set your client device to use a proxy but I cannot control the stb it's not mine and it has this mode that's called transparent proxying which you might uh be able to use but the problem is in my um use case it didn't work because man
in the middle proxy needs IP on the bridge interface so I cannot use it because I do not have the IP on the bridg interface because the U modem won't let me um you have to have routing defined which I didn't know what it was and it uses a lot of CPU so I kind of gave up on that and started looking what well what can I
do I I I want to modify the traffic um with end gold to be able to watch any channel but uh I cannot use this so I started looking uh online what's available and there's this thing called net filter queue and not to go into much detail so basically what it allows you is to have a packet forwarded to user space and then you can change it
and it does all the rest and it looks like this so something goes um in my example so the data from the uh ISP goes to the to my program and then I change it and then uh let it go uh back and I didn't want to code this myself because it's a lot of it it seemed like like lot like a lot of work so I
looked if there's something that can work with this nfq in the kernel and I found nfq set now if you know Linux said is a really cool simple bash tool that allows you to change a string one string for another um and nfq said is the same thing but it works on nfq so the way to use it is you forward packets that go on some interface
you forward them to a que and then you just uh use nfq set and say use that same q q is just a number for example zero so in this example you can use IP tables to forward everything that uh originates from Port 80 which is HTTP just forward them to a queue and then use nfq said on that same que and say just replace something with
something else and I'm like okay I want to test this out to see if I'm going to be able to get any results so this is what it would look like um you have a router it goes to my Raspberry Pi I say for forward everything to an nfq and then I have nfq set which changes something to something and that goes to my TV I'm like
okay um I just want to see if it will work and in Croatia you have um the main National Television is HRT um so I just want to see if I changed HRT with TTT just to see what's going to happen with the TV um I didn't have much much expectations I I thought maybe it will break maybe the TV won't start up maybe maybe something good
will happen I don't know so I started up changed it and then like you have to wait two minutes for the stb to put up which is which is kind of you know boring but I waited waited waited and the TV turned on and I got to this screen and this screen shows the HRT program and if you look closely at this part and enlarge it you
see TTT instead of HRT which was like my mind was blown at that that point okay so I can change anything I want and it it will be displayed on the TV um it's nice and now this not this might not seem like much like why would you want to change something that's displayed on the TV that's not the point you can change anything you can change
what channels you have the right to watch for example so I started looking into the Json to see what uh what are the code names for packages that exist and this is there's this package called ipv HBO HD now I don't have HBO I mean I didn't right and I said like okay um so there is this thing called HBO HD and I have my package which
is called um some name doesn't matter um and the important thing is that the the package that I have its name is longer because you can always shorten the package but you cannot extend it so I said okay I'm going to find some long string and I'm going to replace that with HBO so I did with nfq set I ran it and I said replace this what
I have with HBO AG run it and then of course you have to unplug the stb run it again and then you have to wait wait wait and I was really happy waiting for this uh it it looked almost like eternity but then the TV uh up and the channel turned on and then I said okay I'm going to try to see if I can watch the
HBO channel so I turned it on and I turned on the HBO channel and I got it and I was watching HBO and that was like I cannot believe that this is working right so just by going between the router and the stb you can change some stuff uh and it's not really difficult and then you can you can just watch any channel that you want now
the reason that I used the RAs rry Pi is because I had that's something that I had on hand um and Raspberry Pi isn't that expensive um but I was wondering like if is there something that's cheaper that's maybe a better um fit for this so I started looking online and I found this thing that's called the Orange piie R1 um honestly I don't know how I
find it because it's so so obscure you can find it on AliExpress it's it's really cheap it was cheaper before but now the prices and everything went up but like this thing is so obscure that there is no case for it you cannot buy a case for an orange by R1 you can find a 3D model of a case and you can print it but you cannot
buy it so obviously I had to buy a 3D printer and print out the case so I know no seriously about a 3D printer just for this um so if you want to play around with this I don't want to spend a ton of money um and you don't have a Raspberry Pi with an internet adapter um you can buy this off AliExpress and it's really cool
thing to play around with and you can like this talk is specifically about IP TV and what I did with it but you can use it for anything like if you have two devices that are connected with a cable you can just go between those devices and see everything that's going on and then change it on the flight that's that's what the um so when going back
to nfq set um there are limitations so the limitations on nfq sets are it's just a simple replacement you can just um act on a one single package um and you can just replace stuff in that one single package you cannot do anything with encrypted traffic right because it's just gibberish it's it's not it's not a simple string you cannot do anything on comp press content again
because it's encoded probably it spans between couple of um different packets so you cannot do anything with it um and the resulting packet has to fit between U inside the maximum transmission unit and uh the existing tooling around it is not that great so I was started looking is there something more because uh not all of the isps have the same mechanism um they all do it
similarly but they are different so while searching if there's something else that I could do um and not use nfq set um I I wanted to um see how to solve if the data is compressed if it's encrypted if it has multiple packets and if I can increase the packet length and also do conditional matching right so if you want to do some complex stuff you probably
want to use a programming language I don't want to use a simp simple tool that limits me I want to see if I can just code something specifically for my use case and uh when looking into programming languages the simplest one is python it just works right um and the cool thing is python has something called um it has a package for net filter queue so you
can uh write your own um nfq set if you so want to um and there's also this package called scopy which um allows you to play around packets um and kind of do modification packets and so I I started looking okay I want to see if I can not use nfq set but if I if I can um write something in and this is the diagram real
simple and I wrote really simple code not going to go too much in it because it's really not important the main thing is you can do it so basically uh you can intercept a packet and then you can just replace what you want and use scopy to recalculate all of the fields that you want to recalculate so basically uh the only thing you want to uh change
yourself is just this line I want to replace is something with something everything else is just um boiler plate really really simple um and what this allows you to do is you can append data to end of the packet and do complex logic if you want so if if we go back to the thing that I showed you which HBO I had to sacrifice my back my
uh packet that that I have with my ISP to just watch something else I didn't I couldn't watch everything like I wanted to watch everything but that's just too complex so I took Python and I uh wrote a script which would take all of the channels and all of the packages see which packages have what channels and then uh using some dark magic to recalculate which packages
uh what are what is the smallest number of packages from my ISP uh that I have to have to have all of the channels and then the program just spit out a number of packages that uh the packages that I have to include and I wrote a python script which just um took that initial uh packet that I had so with a list of all of my
packages and just replace them with with the packages that that I need to have to have all of the channels and I run that python script and it's really I mean it's not a complex script I didn't include it here because you just append and append and append and append uh until you get to the end of the package and I ran that and I could watch
all of the freaking channels on the TV without actually having them which was mindblowing to me because I could not believe that in 21st century we are still using technology that says oh yeah you just you just choose what you want to watch it's not it's not a problem we're going to trust that you're going to do be doing the the correct thing um and I could
watch all of the channels on my TV and then I started to look okay I want to see um what other uh what other isps have like do they have this same thing is this just something that my ISP has or is this like across the industry so I went to my parents place I turned it on I intercepted the traffic and it's the same thing like
it's not the exact same thing because it's a different IP but the same uh type of thing right they tell your TV you can watch this and then I went to my friend's place with and he has a different IP and I open it up and it's the same thing like your TV gets the information what you can watch and this is not just in Croatia like
this is all like everybody uses this it's like all of the Europe they all have the same freaking thing like your ISP tells your TV you can watch these channels and so they do it um slight different differently so for example one ISP had um you get a really really big list Json list like you have this Channel and you can watch it through all FS like
a Boolean so you have like I don't know 900 Channels with bullan flags yes or no yes or no uh and this was um this was uh compressed and in in a lot of packets so you cannot use nfq set for this because it's just too complex what you want to do is take all of the packages all of the packets and then uh reorder them and
then decode the content and then change what you want to change and then re-encode it put it in packages and let it go and it might seem like it's complicated but it's really not um so this is the python code for it it's really simple so basically you just save all the packages to a list and then you combine them you decode them and then you can
you send them off it's not it's not a complete uh script obviously uh but that's that's the point you just um save the packages in a list and then do what you want with it and then I decoded the second one and um I could watch all of the channels on that ISP and then I went to my friends and then I decoded that one and I
could watch all of channels there and it was like really like still uh we use HTTP which is great um but it's like anybody can can watch anything and they just don't care which is interesting um and then after some time passed I was looking like is it possible to kind of skip all of this oh yeah one other thing so since it's happening on the boot
of the stb so you um inject yourself in between you change everything and then you just disconnect the your network tab because everything the whole negotiation is happening on boot and then you just disconnect it and nobody knows except for your TV because it has everything in the RAM and it's just working so I wanted to see if I can um connect directly without the network tab
uh to do the thing that I wanted to do in the first place to kind of see what's happening so I started looking into that um and you can obviously you can connect directly to the router without actually using the stb and then you can I don't know write your own program to watch TV on your TV um and it's really easy to do um you can
do it with something called DHCP option 60 and basically what it does is it says um I'm this type of device please let me into your really Secret VLAN and the router will say yes sure no problem and this is how it looks in wi shark it might look intimidating intimidating but it's actually really simple you just put this on your Linux or Raspberry Pi or TV
or whatever it's uh it's a configuration for your DHCP client you just say whener option space and something and that's something you can read from uh intercepting the traffic and it will let you connect directly uh to the private VLAN of the of of your ISP which was really really interesting um that works um so I went ahead and uh compiled couple of questions that you might
ask um why does this work I don't know I'm joking like this works because the http traffic that they use is not encrypted right so if it's not encrypted um you can intercept it and you can change it if only they used uh encrypted https traffic this wouldn't work but nobody uses encryption where does it work everywhere like everywhere if I had more time I would uh
look what it's like in Lithuania but you can bet that it works um how would you disable it well the easiest way is to just add encryption right if they added encryption it wouldn't work but they never will why because it's it's all Legacy technology right um and also those little stbs they don't they don't have the power to to encrypt probably it's a really really cheap
and simp simple device why did you show this us I like to see the world burn um that's it thank you do you have any questions slido oh okay we have some can we continue to watch it if you canel large subscription asking for a friend that's a really good question uh maybe depends on how they implemented it I would say probably yes and you can probably
wa um also watch it if you don't have a sub subscription you just have to have the device to connect and know what Mac address to put in there because all of the authorization is basically done where the device says okay I'm this user please tell me what I can watch and you just put any user and they will tell you what you can watch and then
just forward everything else so basically yeah yeah probably uh why you haven't used simple Json injection in wire shck as a response for a given URL um you cannot because um you are not able to change anything in wire shark wire shark is for um VI viewing data if you want to intercept you have to use something like man in the middle proxy you cannot use man
in the middle proxy because you don't have the IP on the bridge interface and even if you did that um like they can see that there are two IPS on the interface probably doing it with the network tab is completely transparent so nobody knows that you're doing something that your TV is displaying something else uh how long did it take for IP to fix it they didn't
still works uh why didn't work with the laptop for the first time okay so maybe this question was um written before but basically with the laptop it didn't work because um you have to have the DHCP option 60 so you cannot just connect uh you could before like I think 15 years ago you you could just plug into the port and it would magically work nowadays it
doesn't you have to uh have DHCP option 60 but if you if you put that um on your laptop or on your Raspberry Pi or whatever it will work so you can connect with the laptop directly and in that metadata you actually get a list of all of the IPS and all of the ports so you can if you want you can load it in an m3u
list and watch it in VC or in Ci or whatever uh program you want to to watch it it's it's really fun um can you also watch pay-per-view content uh this is different so pay-per-view usually the validation is under server it is ISP dependent so your mileage might varry it might you might be able to do it uh but most of the time pay-per-view is implemented with
a newer technology that uses a different kind of validation where they actually check that you are this user who has access to this pay-per-view um content because they have to build you for it so it's a process that's being done on their server but like the the normal streaming Everything is Everything is open if you plug if you plug random devices in your network How likely someone
else will also start watching you uh that's a that's a good question uh so you shouldn't plug in random devices you should plug in devices that you control um that's why I did it um by myself self from from scratch and now you can too if you want to um it's not it's not difficult if somebody wants the slides I can send them um but like like
this is really easy to do once you know um what to look for and once you know that your ISP is actually completely entrusting you uh with with everything uh but yeah it's not a it's not a different device it's my device and that's it I think if anybody has any other questions from the audience I was expecting this no I did not I hate my ISP
they're jerks they are really unhelpful um and I changed my ISP and went to a different one and they also jerks so no I did not report this I had absolutely no incentive and even if I did I'm convinced they would do nothing about it because they're incompetent is this being recorded yeah any other questions yeah so so the question is um I say that it's transparent
but once you start watching the channel um they will be able to see that you're watching the channel you're completely correct yes they will be able to see that something streaming believe you me they will not do so they have no I mean also um the way it works with the with the multicast and everything they're probably don't do it because it's difficult uh there's no authorization
on the stream itself so the Stream is completely open the only thing that you have to know is where to open the stream like what is the IP address and the port everything else is open if you look at ipv online so if you buy um pirated IP TV or some legal one you always have your username and password uh when you're connected to to a stream
and that way they can validate if you have permissions these streams on on on um ISP ipvs they don't have it it's just IP and port and you can watch it and in theory yes they could watch they could see but it's extremely unlikely that they will do so and every like if even if they do so you can just say I don't know like my TV
did that like in my case I couldn't watch anything so the opposite can happen in theory like you can maybe have uh your stb um start misbehaving and allow you to to watch all of the yeah uh so the cheapest fix I mean the the easiest fix would would be to add HTTP s uh so the all of the responses are but I think that's not cheap
uh because they would have to reimplement everything and while it might seem that it's simple to us like you just put s in HTTP uh for them because they have to recompile the firmware and then distribute the firmware and then test everything out and probably those devices will be even slower than they are now that's not really feasible so the way they could fix this um is
by doing authorization on the stream itself so instead of just allowing everyone to watch everything um they could put in a a streaming server that says okay you have to have username and a password or or a token um so that you able to watch this and then you get um you get just uh with every channel that you have the permission to watch you get a
set of tokens and every token is different and then you would only know the tokens for the channels that you're allowed to watch so that's how I would fix it with the constraints of it being a hardware that's really um doesn't have a lot of CPU but again they're not GNA do okay any other questions yeah uh depends uh but basically yeah you have to you have
to get the device but you can buy the device of um um ad um and then you connect the device and you have to change something um or you can connect directly if you have a friend who has a subscription you can just see what the streams are and then connect direct directly and put it in a VLC and just uh no so you cannot watch from
different IPS because you have to be physically connected to that ISP because it doesn't actually go through the internet it goes to internal network of the ISP so it it it wouldn't uh work in that case but you could have couple of isps in your home and just connect everything to one TV and have a really I mean you can even stream those streams outside of your
home for somebody else to watch if you want okay uh I guess this is it if you want if you have some other thank [Applause] you if you have some anonymous questions that you want to ask not in front of the audience I'll be here in the ask me anything corner so feel free to and um see you at lunch
