0x0E: Romaric Duvignau - I See What You’re Watching on SVT Play

### Overview In this presentation, Romaric Duvignau, an assistant professor at Chalmers University in Gothenburg, demonstrates how eavesdroppers can identify the exact video titles and playback timestamps being streamed over encrypted HTTPS connections. Focusing primarily on the Swedish streaming service SVT Play (with confirmed applicability to Netflix), Duvignau explains research executed by a team of six students he supervised. Despite transport-layer encryption via TLS hiding URLs, HTTP headers, and payload contents, the attack exploits packet sizes and transmission patterns inherent to adaptive streaming protocols.

### Key Topics - **HTTPS/TLS Limitations**: While HTTPS conceals URLs and video data, network-layer details such as destination IP addresses and individual packet/payload sizes remain observable to an adversary on the local network (such as public cafe Wi-Fi or cellular networks). - **Dynamic Adaptive Streaming over HTTP (DASH)**: SVT Play and Netflix divide video streams into discrete chunks (e.g., four-second segments) encoded across multiple quality levels. Manifest files dictate chunk locations across CDNs, allowing clients to adaptively request quality based on available bandwidth. - **Traffic Fingerprinting via KD-Trees vs. Machine Learning**: Rather than relying on complex machine learning models like SVMs, the researchers leveraged classical k-d tree data structures, which proved drastically faster, less resource-intensive, and more scalable. - **Threat Implications**: Video fingerprinting leaks sensitive personal preferences, enabling hyper-targeted spear-phishing attacks or profiling, while potentially allowing network observers to categorize or censor content.

### Technical Details To reconstruct playback activity without full packet decryption, the attack proceeds through several structured stages: 1. **Metadata & Size Harvesting**: SVT Play hosts approximately 20,000 videos, accounting for roughly 39 million four-second segments (totaling ~33 TB of raw video data). Instead of downloading content, a web crawler parsed the service's program catalog, acquired manifest files, and sent HTTP HEAD requests to CDN servers to record the byte length of each segment across all quality levels. Crawling took 80 hours across four machines (20 wall-clock hours) and requires lightweight periodic updates to handle rolling catalog additions and removals. 2. **Windowing & Synchronization**: Eavesdropping on network traffic using standard utilities like `tcpdump`, the attacker observes bursty transmission patterns. A burst followed by an idle period indicates a segment boundary. Bytes are summed over consecutive segments into fixed multi-segment "windows" (e.g., 3 segments totaling 12 seconds of video, up to 30 seconds). 3. **KD-Tree Search & Pearson Correlation**: Window segment lengths are treated as points in a $k$-dimensional space (where $k$ equals window length). A k-d tree containing the precomputed segment profiles from the SVT Play database enables nearest-neighbor lookups in roughly one minute using around 2 GB of RAM. In contrast, training an SVM required hours and failed to fit the complete database into memory on commodity hardware. Candidate matches returned by the k-d tree are validated using Pearson correlation to confirm closeness and eliminate spurious matches, achieving roughly 98% accuracy on 12-second windows and approaching 100% on 30-second windows.

### Takeaways Traffic analysis attacks are not prevented simply by encrypting the underlying transport with TLS or switching from public Wi-Fi to cellular data. The fundamental root cause lies in variable bitrate (VBR) video compression across adaptive chunked protocols like DASH and Apple's HLS: because scene complexity dictates segment byte counts, packet volume bursts create distinctive, identifiable signatures. Mitigating these side-channel leaks would require techniques like constant bitrate encoding or dummy traffic padding, which introduce bandwidth and performance overheads that major streaming services currently avoid.