From the aether to the ethernet: attacking the internet using broadcast digital television

Abstract

In the attempt to bring modern broadband Internet fea-tures to traditional broadcast television, the Digital Video Broadcasting (DVB) consortium introduced a specifi-cation called Hybrid Broadcast-Broadband Television (HbbTV), which allows broadcast streams to include em-bedded HTML content which is rendered by the televi-sion. This system is already in very wide deployment in Europe, and has recently been adopted as part of the American digital television standard. Our analyses of the specifications, and of real systems implementing them, show that the broadband and broad-cast systems are combined insecurely. This enables a large-scale exploitation technique with a localized geo-graphical footprint based on radio frequency (RF) injec-tion, which requires a minimal budget and infrastructure and is remarkably difficult to detect. Despite our respon-sible disclosure to the standards body, our attack was viewed as too expensive and with limited pay-off to the attackers. In this paper, we present the attack methodology and a number of follow-on exploitation techniques that pro-vide significant flexibility to attackers. Furthermore, we demonstrate that the technical complexity and required budget are low, making this attack practical and realis-tic, especially in areas with high population density – in a dense urban area, an attacker with a budget of about $450 can target more than 20,000 devices in a single attack. A unique aspect of this attack is that, in contrast to most In-ternet of Things/Cyber-Physical System threat scenarios where the attack comes from the data network side and affects the physical world, our attack uses the physical broadcast network to attack the data network. 1