As Internet streaming of live content has gained on traditional cable TV viewership, we have also seen significant growth of free live streaming services which illegally provide free access to copyrighted content over the Internet. Some of these services draw millions of viewers each month. Moreover, this viewership has continued to increase, despite the consistent coupling of this free content with deceptive advertisements and user-hostile tracking. In this paper, we explore the ecosystem of free illegal live streaming services by collecting and examining the behavior of a large corpus of illegal sports streaming websites. We explore and quantify evidence of user tracking via third-party HTTP requests, cookies, and fingerprinting techniques on more than @math unique video streams provided by @math unique illegal live streaming domains. We compare the behavior of illegal live streaming services with legitimate services and find that the illegal services go to much greater lengths to track users than most legitimate services, and use more obscure tracking services. Similarly, we find that moderated sites that aggregate links to illegal live streaming content fail to moderate out sites that go to significant lengths to track users. In addition, we perform several case studies which highlight deceptive behavior and modern techniques used by some domains to avoid detection, monetize traffic, or otherwise exploit their viewers. Overall, we find that despite recent improvements in mechanisms for detecting malicious browser extensions, ad-blocking, and browser warnings, users of free illegal live streaming services are still exposed to deceptive ads, malicious browser extensions, scams, and extensive tracking. We conclude with insights into the ecosystem and recommendations for addressing the challenges highlighted by this study.
Recent years have seen extensive growth of services enabling free broadcasts of live streams on the Web. Free live streaming (FLIS) services attract millions of viewers and make heavy use of deceptive advertisements. Despite the immense popularity of these services, little is known about the parties that facilitate it and maintain webpages to index links for free viewership. This paper presents a comprehensive analysis of the FLIS ecosystem by mapping all parties involved in the anonymous broadcast of live streams, discovering their modus operandi, and quantifying the consequences for common Internet users who utilize these services. We develop an infrastructure that enables us to perform more than 850,000 visits by identifying 5,685 free live streaming domains, and analyze more than 1 Terabyte of traffic to map the parties that constitute the FLIS ecosystem. On the one hand, our analysis reveals that users of FLIS websites are generally exposed to deceptive advertisements, malware, malicious browser extensions, and fraudulent scams. On the other hand, we find that FLIS parties are often reported for copyright violations and host their infrastructure predomi- nantly in Europe and Belize. At the same time, we encounter substandard advertisement set-ups by the FLIS parties, along with potential trademark infringements through the abuse of domain names and logos of popular TV channels. Given the magnitude of the discovered abuse, we engineer features that characterize FLIS pages and build a classifier to identify FLIS pages with high accuracy and low false positives, in an effort to help human analysts identify malicious services and, whenever appropriate, initiate content-takedown requests.