Systems and methods for injecting code for tamper detection in a playback application
An embodiment of the invention describes a method for detecting tampering with copy restrictions on a media playback device that includes identifying locations within playback application executable files on a playback device that contain instructions for application programming interface (API) calls, modifying the API call locations to insert pieces of tamper detection code, where the pieces of tamper detection code when executed collects monitoring data about characteristics of the playback device and content being played, collecting monitoring data when API calls are performed by the API call locations, generating a confidence level of tampering from the collected monitoring data, and performing a remediation action in response to the confidence level exceeding a predetermined threshold, where the predetermined threshold is set based on types of monitoring data that was collected.
1 . A method for detecting tampering with copy restrictions on a media playback device, the method comprising:
identifying a plurality of locations within playback application executable files on a playback device that contain instructions for application programming interface (API) calls;
modifying the API call locations to insert pieces of tamper detection code, where the pieces of tamper detection code when executed collects monitoring data about characteristics of the playback device and content being played;
collecting monitoring data when API calls are performed by the API call locations;
generating a confidence level of tampering from the collected monitoring data; and
performing a remediation action in response to the confidence level exceeding a predetermined threshold, where the predetermined threshold is set based on types of monitoring data that was collected.
2 . The method of claim 1 , further comprising:
receiving a new version of the playback application from a developer; and
locating API call locations within the new version of the playback application and making the same modifications to insert the tamper detection code in the API call locations.
3 . The method of claim 1 , wherein the monitoring data includes GPS location, accelerometer information, and ambient light sensor information of the playback device retrieved from an operating system of the playback device.
4 . The method of claim 1 , wherein the monitoring data includes cellular phone status, temperature sensor, and battery status of the playback device retrieved from an operating system of the playback device.
5 . The method of claim 1 , wherein the monitoring data includes a list of installed applications, a list of running applications, and HDCP information of devices connected to the playback device.
6 . The method of claim 1 , wherein the monitoring data includes debugging information, root detection, and virtual machine detection.
7 . The method of claim 1 , wherein the monitoring data includes length of playback of content, trick play usage, frequency of playback, and overlay detection of content played back on the playback device.
8 . The method of claim 1 , wherein at least one of the pieces of tamper detection code executes as a main thread that coordinates the collection of monitoring data from other data sources.
9 . The method of claim 8 , where the main thread generates the confidence level and communicates with a server to receive instructions on how to respond to a particular confidence level of tampering.
10 . The method of claim 8 , wherein the main thread simulates malware on the playback device, generates fingerprints of the executed malware, and creates detection signatures from the fingerprints for future detection of suspected attacks.
11 . The method of claim 1 , wherein the remediation action includes inserting a watermark onto the content and receiving information confirming detection of the watermark on a different device.
12 . The method of claim 11 , further comprising disabling playback on the playback device.
13 . The method of claim 1 , wherein the remediation action reduces visual quality of the content being played.
14 . The method of claim 1 , wherein the remediation action prevents playback of content when the monitoring data indicates that the playback device meets a condition of: having an operating system that is rooted, communicating using a virtual private network (VPN), or running by emulation.
15 . The method of claim 1 , wherein the predetermined threshold is the playback device meeting at least three of the conditions of: not moving, connected to external power, having stable ambient lighting conditions, and a piece of content is played back from beginning to end.
16 . The method of claim 1 , further comprising:
receiving a command profile from a monitoring and control server that provides instructions for determining a confidence level of tampering from the collected monitoring data; and
modifying the performance of the determination of the confidence level according to the command profile.
17 . The method of claim 1 , further comprising:
providing at least some of the monitoring data to a monitoring and control server; and
receiving identification of the remediation action to perform from the monitoring and control server.