New Hacking Threat - Streaming Content Theifs!
 

was looking around and I found a site that would be of major interest to streaming content providers.

your streams are being stolen by thousands of people daily.

they use this software available at

http://24.106.100.133/spooph/index.html

and then use the downloaded list and spoof the referal codes for the websites and in doing so give instant and immediate access to streaming videos and other streaming content. and in turn costing the actual owners of these leased streams alot of money in extra bandwidth from these stream theifs.

well I thought I would post this up here on GFY so best of hunting. I have already shot out an email to [email protected]

Thanks for listening to my rants!

This is quite possibly one of the coolest things I have ever seen.

wow.. now I know why I don't trust referrer auth

please dont post my software here

It's not just streaming content that is accessable for 'free' via this method, AVS is built on referer based authentication.

If nothing else, it's useful for checking out sponsor sites :glugglug

Wow.. welcome to two years ago. Zspoof has been around at LEAST that long.

And most plug-in content providers STILL base their security on referring urls.

Holio is only plug-in content provider that I'm aware of that uses reasonably secure token based system. Last time I checked you had to ask them to use it, otherwise they too were referring url based.

Just this week Homegrown send an email asking their customers to change their link codes to a new system. Now they use sessions to verify the surfer came from the right site. However, they still set those sessions based on the refering url.

What I don't get is that it is so pathetically easy to create a simple token based system but practically nobody wants to do it. All it requires is: the ability to run scripts, an accurate server time, access to a hashing function (such as md5), and a shared "secret". Its easy as pie and in half a day you could write up the necessary scripts (perl, php, asp, etc.) for unix or windows servers.

:1orglaugh

Pretty fucking cool