Stream slip
流媒體碎片
The cleverest part, though, is that, unlike other efforts to exploit leaky video streams, it does not actually need direct access to the stream itself, or even to the device the video is being shown on. By planting a small amount of JavaScript code in a web browser on a personal computer or smartphone that is merely attached to the same Wi-Fi network as the viewer’s device, the film being watched can be identified with almost the same accuracy.
最精妙的部分在于登颓，區(qū)別于其他方法需要分析泄露的流媒體內(nèi)容蕉拢，這種方式并不需要直接訪問流媒體內(nèi)容本身倒庵，甚至是不需要訪問播放流媒體的設(shè)備。通過在個人電腦或者智能手機的瀏覽器中植入一小段 JavaScript 代碼，就可以知道使用同一 Wi-Fi 網(wǎng)絡(luò)的用戶的設(shè)備上所觀看的內(nèi)容警没，并且可以達到差不多高的識別率。
Web browsers confine JavaScript—which is ubiquitous in web pages and advertisements, and runs automatically—to a“sandbox” supposed to prevent it from collecting private information. JavaScript code can, however, still communicate with the computer server that sent it—and this is enough for Dr Tromer. It enables his implant to flood the entire Wi-Fi network with random data, creating congestion. The result is that a video stream feeding another device on the network will create bursty delays in the JavaScript’s communications with its own server. Measuring these is enough for the spyware to be able to identify the film being watched.
JavaScript 幾乎出現(xiàn)于所有的網(wǎng)絡(luò)頁面以及廣告之中，網(wǎng)絡(luò)瀏覽器通過將 JavaScript 代碼放入“沙箱”中來保護用戶的個人隱私數(shù)據(jù)不被泄露扣汪。但是 JavaScript 代碼仍然會和發(fā)送它服務(wù)器進行通信，對 Tromer 而言這就足夠了锨匆。這能幫助他在植入代碼以使得整個 Wi-Fi 網(wǎng)絡(luò)中充滿隨機數(shù)據(jù)來制造擁堵崭别。結(jié)果就是播放流媒體的設(shè)備會在 JavaScript 和服務(wù)器的通信過程中知道大量的延遲。通過間諜軟件來觀測這些數(shù)據(jù)就能夠確認所觀看的電影了恐锣。
