The interactive film Black Mirror: Bandersnatch, which was released in December by Netflix, made a big impression on the audience. The unique aspect of this film is that viewers have the ability to choose how the plot will develop. Beyond this film, there are now other interactive programs.
Some researchers from the Indian Institute of Technology Madras have shown that viewers of these programs may be putting data at risk.
In 2016, Netflix moved to encrypt all video streams to strengthen user privacy protection. This could prevent man-in-the-middle attacks. However, it has now been discovered that encrypted interactive video can be analyzed, which allows obtaining information about what users are watching and what choices they have made for the progression of the storyline in interactive programs.
One of the researchers says that the interactions between viewers and the film were similar to interactions he studies in web applications and websites. So he tried some techniques and was able to determine the choices viewers make.
Despite the addition of HTTPS in 2016, many studies have found that attack and access encrypted videos. With the attack, a hacker may be able to understand what viewers are watching. Even without network access, hackers can use malicious scripts to obtain information about viewers' preferences.
The IIT researchers were able to track viewers’ choices in depth. Whenever a choice is made, Netflix considers one of them as the default or most likely choice and the other as a backup .The default video is then processed so that it is ready to play. The service then sends a packet containing a file, known as a JSON file. This file contains information about the viewer’s choice.
The researchers were able to understand the choices made by the viewers and even distinguish at which stage each one occurred. They did this using some characteristics of the stream, the size of the JSON file, and a file header used by the encryption protocol.
However, Netflix does not consider this attack that easy in practice. The company states that access to the network data flow is required for analysis. It also finds the identification of video stream data on the open internet difficult.
On the other hand, researchers point out that users can be misled and connect to routers or access points that are controlled by hackers.
However, beyond the malicious hackers, there are also others who are interested in viewers' preferences and would like to know what people are watching. For example, advertisers and VPNs want to have such information, to know which ads to show to viewers.
Of course, the choices viewers make about how a plot unfolds in a film are not sensitive personal data. The problem has to do with the security of data generated by interactive media and streaming services.
In February, a researcher revealed that Netflix keeps records of viewers' choices in Bandersnatch. This kind of information may not seem like much, but it's possible that some people have made choices they don't want to be public. For example, they may have made the hero do something illegal.
“Encryption can hide content, but it does not hide the data flow, and analyzing the flow can reveal significant secrets without breaking the encryption. As video systems become more interactive, flow analysis will reveal more information about users' private choices”, said another researcher, who was not involved in this particular study.
The researchers submitted their findings to Netflix's bug bounty program and the company recognized their validity. However, the submission was ultimately not accepted because the data leak is related to the encryption protocol. Netflix does not have control over the protocol.
The researchers, however, suggested that Netflix could offer extra protection by compressing the JSON files in a different way so that they cannot be easily analyzed. Of course, additional protective measures are also needed.
