Inspecting IPTV for Fun and No Profit
summary
Built a cheap network tap with a Raspberry Pi bridge tap (USB Ethernet), runs Wireshark and forwards packets into netfilter queue, using nfq-set string replacement and a small Python + scapy program to rewrite unencrypted HTTP JSON. The boot negotiation pulls package lists over HTTP so replacing package names (example: spoofed HBO entry) lets a box unlock channels — HBO and then all channels work. Also demos DHCP Option 60 and an Orange Pi R1 alternative.
AI-written summary · about
chapters (21)
- 0:00IPTV inspection intro
- 1:04Understanding IPTV setup boxes
- 5:37TV subscription issue
- 8:07Network tap with Pi
- 10:39UDP traffic analysis
- 11:21HTTP metadata for channels
- 13:11Modify network traffic
- 15:35nfqset packet manipulation
- 17:27Channel substitution with nfqset
- 20:40Unauthorized channels success
- 21:01Cheaper Pi alternatives
- 23:10nfqset limits and encryption
- 24:14Python traffic modifier
- 26:43Automate channel substitution
- 27:50Test across ISPs
- 30:20Bypass with DHCP option 60
- 32:27Why vulnerability persists
- 33:33Motivation behind revealing this flaw
- 33:54Audience questions
- 38:52Q&A on security
- 42:05Final thoughts
related talks
44mInspecting IPTV for Fun and No Profit
28mInspecting IPTV for fun and no profit
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering
37mSecurityPI: IronClad your Raspberry PI
41mModding Security & Privacy
26mNetwork monitoring with FOSS
36mHTTPS Is Not Enough
30mSpying on my Network for a Day: Data Analysis for Networks