Media streaming – free services that could prove costly to your data

Streaming for sport events, films and TV shows has been around for a number of years now. But more recently it seems that every other week there is a news story about free streaming services, not least the media streaming service Kodi.

Kodi – along with counterparts such as Plex, Emby, MediaPortal and OSMC – is available to install on a range of devices. Some estimates claim the software is installed on around 20 million devices in the UK. These services themselves are totally legal. However, third party add-ons that allow free access to copyright-protected movies, TV shows, and all the football you can imagine are (generally thought of to be) illegal. The Government’s proposed Digital Economy Bill will potentially enforce prison sentences for users who are either streaming or downloading copyright-protected content.

Even before the Bill is passed, there are other risks for users of the software to consider. Legal and moral issues of free streaming aside, users should also be aware of the potential data security risks they are exposing themselves to.

Free streaming services make most of their money via advertising. This normally takes the form of pop-ups that appear when you try to play a video. Money is then made from clicks on the ad. Malicious links are sometimes used in this advertising that pose virus threats.

Third party add-ons that can be installed take away this potential virus route. They look for live links to relevant content so you are not bombarded with adverts. This means the websites hosting the illegal streams lose their revenue and as such the owners are not happy – the sites have increasingly started to block programmes that try to by-pass adverts.

Also, although the add-ons may limit the risks posed by advertising, you are still vulnerable to other risks. The developers behind media streaming services and their add-ons are providing a free service, and as such their general attitude is that users need to be aware of what they are doing and the risks they are exposing themselves to.

It has been found that free media streaming services are vulnerable to ‘man-in-the-middle’ attacks. This is when a hacker hacks into the connection between you and the service, allowing them to intercept traffic and send modified, malicious code, or add-ons to you, the user. These malicious third party add-ons can expose you to a number of risks, including:

• Virus/botnet installation;
• Access to user systems and subsequent altering of systems;
• Access to your network-connected devices.

Potentially, watching that free movie has now allowed someone with dubious motives access to your personal photos, videos or other documents. This could lead to a ransomware attack – your network-connected devices containing all those personal family pictures and videos being held to ransom. Or someone could place a ‘key logger’ onto your device to snoop for online banking credentials, which could lead to facility takeover fraud, or impersonation.

Although there are things you can put in place to help secure free streaming services and prevent rogue third party add-ons, is it worth taking the risk at all? If the illegality of free streaming is not enough to put you off, then are the personal data security risks something that would make you think twice?

The content you can stream in these professional-looking services can be free, but with identity fraud cases reaching record levels what price do you put on yours and your family’s personal data?

---

We’ll soon be publishing the first in a series of new blogs exploring the changing nature of identity. In the first blog, Sandra Peaston, Assistant Director, Insight at Cifas and author of our annual report Fraudscape, considers what your name means in 2017 when it comes to your identity.