Jews Developing New Cyber Spy System: It Doesn’t Need to Crack Encryption
A better way for Big Brother to look over your shoulder
REMEMBER that racy film you probably should not have enjoyed on Netflix last weekend? Eran Tromer’s algorithms can tell what it was. Although videos streamed from services such as Netflix, Amazon and YouTube are encrypted in various ways to ensure privacy, all have one thing in common: they leak information. Dr Tromer, of Tel Aviv university, his colleague Roei Schuster and Vitaly Shmatikov of Cornell have worked out how those leaks can identify the film you are watching — even if they cannot directly observe the stream of bits delivering it, or obtain access to the device on which you are watching it.
Videos streamed over the Internet are usually transmitted using a standard called MPEG-DASH. This chops a data stream up into segments that are then encrypted and fetched one at a time by the machine playing the video. The result is an on-off, “bursty” pattern of data arrival. But not all segments are equal. One depicting the mating habits of sloths will contain less information than another showing a car chase. Streaming services use something called variable bit-rate (VBR) compression to take advantage of this. Amorous-sloth segments are compressed to a greater degree than those involving car chases, reducing the overall amount of data that must be transmitted. That means segments of the same duration (in seconds) have different sizes (in bytes). The resulting pattern forms a video fingerprint.
Dr Tromer’s method recognises this fingerprint by comparing it with a pre-assembled library of such prints that a snooper has made from videos the viewership of which he might want to follow. The detection algorithm involved is a version of a program called a neural network, a type of software adept at signal-recognition tasks. Once trained, Dr Tromer’s neural network can identify films with up to 99% accuracy, based on a fingerprint between one and five minutes long.
Such information can reveal a lot about a viewer’s personality, preferences, politics and so forth. As Dr Tromer notes, by being able to monitor this, “I can show personalised ads based on your viewing habits, adjust your insurance premiums or send in the Spanish Inquisition.” That last suggestion, tongue-in-cheek though it may be, is the most troubling. Censors using his technique could spot and block the viewing of things they disapproved of, no matter how highly encrypted those things were.
At the moment, there is no practical way to derail such attacks. Eliminating VBR would increase network congestion, bringing data-buffers into play to deal with information overflow and underflow. That would translate, for viewers, into the resurrection of buffering messages, now largely a thing of the past.
In most countries, placing this sort of spyware on a machine without permission would be illegal. But its ability to spy remotely might get around that. Also, blanket permissions associated with installing new software, carelessly agreed to, might see it arrive on clueless users’ machines within the letter, if not the spirit of the law. Mind how you go, then. And watch what you watch.
* * *