A security analysis of paid subscription video-on-demand services for online learning = 온라인 수업의 유료 주문형 비디오 서비스에 대한 보안 취약점 분석

다국어 초록 (Multilingual Abstract)

A typical online learning service allows users to watch video lectures in web browsers at any time and any place. In many cases of such services, security solutions (e.g., user authentication and access control) have been deployed to secure access to their premium contents to authorized users only who have paid the subscription fee. In this paper, we demonstrate how security solutions in real-world services can be broken easily. We performed an empirical analysis on the effectiveness of the security solutions deployed in the five popular online learning services using a web proxy to analyze the packets transferred between streaming server and web browser for a streaming service. Our experimental results show that one service out of five was vulnerable to password stealing attacks; three services were vulnerable to URL guessing attacks; and two services were vulnerable to cookie cloning attacks. All the websites tested were vulnerable to at least one attack.

목차 (Table of Contents)

• List of Tables ⅱ
• List of Figures ⅱ
• Abstract ⅲ
• 1. Introduction 1
• 2. Background 4
• 2.1. Overview of video-on-demand services 4
• 2.2. Security technologies for video-on-demand services 6
• 3. Methodology 9
• 3.1. Threat models 9
• 3.2. Three attacks tested 11
• 4. Experiments 14
• 4.1. Security mechanisms of the websites tested 14
• 4.2. Implementation 15
• 4.3. Summary of results 20
• 5. Countermeasures 21
• 5.1. Encryption of web traffic 21
• 5.2. Use of the best practices for capability URLs 21
• 5.3. Expiration of capability URLs and cookies 23
• 5.4. Preventing suspicious URL requests 23
• 6. Conclusion 24
• References 25
• Korean Abstract 27