There’s no such thing as a free lunch, not even on the Internet. But if you do decide to splurge, new research finds your lack of willpower may come with a side order of malware. In this case, that free lunch actually refers to websites that offer free livestreaming of things like sporting events, concerts, and so on.
Turns out there’s a 50 percent chance the so-called ‘overlay’ ads that accompany those sites are malicious. The ads are often disguised as “play” buttons which attempt to fool users into downloading software, often from recognizable brand names in the space, and claim it is necessary to download it in order to play the stream.
That’s the conclusion reached by researchers from the University of KU Leuven in Belgium and Stony Brook University in the US, both of whom used one of their homegrown tools to identify and analyze livestreaming sites. Their research, entitled “It’s Free for a Reason: Exploring the Ecosystem of Free Live Streaming Services,” analyzed more than 23,000 free streaming websites across 5,600 domain names — 50 percent of which ranked within the one million most popular websites in the world.
The researchers then used their system to revisit these sites 850,000 times, analyzing more than a terabyte of traffic. From those visits, researchers discovered that as many as half of the advertisements presented to users trying assiduously to avoid having to pony up for pricey pay-per-view events were malicious. They exposed viewers to potential risks such as identity and data theft as well as financial scams.
For those who aren’t aware (and even for those who are), many overlay adverts on livestreaming sports, fan, concerts and music downloads sites have fake close buttons or close buttons that move when a mouse hovers over them. As a result of these adverts, many users are unknowingly exposed to malware. Further, clicking on any of these ads can prompt a direct (albeit unintended) download of unwanted software into your browser and PC that may audit and store your keystrokes or even spy on your activities. Not surprisingly, say the researchers, a livestream’s sponsors are often complicit in these scams.
These livestreaming websites are simply another vehicle used by fraudsters to deliver malware. In addition, great efforts are put into ensure the design is almost identical to the actual free livestreaming sites, further tricking users into believing that this “new” site is merely an extension of the original one. Not even anti-virus or ad-blocker software extensions are enough to protect consumers as the malware uploaded onto these sites has been purpose-built to actively try and defeat them.
Whatever you choose to do, just realize that when you decide to binge on free livestreaming events in order to avoid paying for them, sooner or later you may wind up paying for it in an entirely unexpected way including identity, data or financial theft.
The post Enter at Your Own Risk: The Perils of Livestreaming Content appeared first on Speaking of Security - The RSA Blog and Podcast.