the-fight-to-make-netflix-and-hulu-pay-cable-fees

The fight to make Netflix and Hulu pay cable fees

Streaming services are slowly turning into cable TV — complete with bundles, an ever-growing list of channels, and a reinvented TV guide. And a series of lawsuits could portend the return of something even worse: the hidden cable fee.

Three municipalities in Georgia are suing Netflix, Hulu, and other streaming video providers for as much as 5 percent of their gross revenue in the district — joining a nationwide group of towns and counties that want these services regulated more like cable TV. It’s a small but growing front in the war over cord-cutting, challenging regulators to decide which matters more: the increasing role streaming services play in American media diets or their significant practical differences from traditional TV.

The federal lawsuit, reported earlier this month by Atlanta Business Chronicle, was originally filed in state court last year. It argues that Netflix and Hulu — along with satellite providers Dish Network and DirecTV, as well as Disney’s entertainment distribution division — violated a 2007 law called the Georgia Consumer Choice for Television Act. That rule specifies that “video services” must pay a quarterly franchise fee to local governments, unless they’re part of a larger internet service package or operate wirelessly.

Georgia isn’t the only place where local towns are pushing for streaming fees. As The Hollywood Reporter reported last year, two law firms recently filed similar suits on behalf of towns in Texas, Indiana, Ohio, and Nevada. And in 2018, the city of Creve Coeur, Missouri paved the way by suing Netflix and Hulu under that state’s franchise laws. With municipal budgets cratered by the pandemic, slapping a franchise fee on cash-heavy tech companies has never been more appealing.

A single successful lawsuit could cost these companies millions. Gwinnett County, one of three municipalities named in the suit, charges 5 percent of a company’s local gross revenue in franchising fees. A filing calculates that Netflix made $103 million from Gwinnett County subscribers over the past five years — which would translate to $5.15 million in retroactive fees for that area alone. (Netflix declined to comment on the numbers cited in the story.) The plaintiffs in these cases are seeking class action status, which would make companies liable for any “similarly situated” state locales as well.

TV providers have opted to directly bill subscribers for franchise fees, and companies like Netflix and Hulu could follow their lead, passing the costs to users. Those fees aren’t why cable costs so much, and they help fund important services — but they’re also something many consumers find irritating or bewildering.

If the cases succeed and aren’t preempted by any federal laws, they could draw streaming services — a category that’s exploded in popularity — under a new regulatory umbrella. Even traditional TV providers have moved to online streaming: the suit notes that Dish and DirecTV chose to “fundamentally change” their satellite-only options by adding services like the Dish-owned Sling TV, which routes live TV over broadband networks.

The Georgia suit in particular could have broader, potentially unpredictable effects. Its definition seems to potentially encompass many smaller and less profitable streaming video companies, although there’s far less incentive to sue them. Meanwhile, the exemption for internet service packages could give telecom-run streaming offerings — like Comcast-owned NBCUniversal’s Peacock service — a built-in advantage over competitors like Netflix.

The Consumer Choice for Television Act wasn’t passed with streaming video in mind. Passed in 2007, the law amended existing rules meant for cable TV providers, which pay franchise fees for the right of way to lay wires along public infrastructure like roads. “It’s a remnant of how we did cable franchising,” says John Bergmayer, legal director of the internet-focused nonprofit Public Knowledge. And it specifically exempts some services that don’t require that physical access, like programming from mobile services.

Despite this, the municipalities contend that streaming companies tick the same legal boxes as cable TV. The complaint says people are getting a similar service; in the complaint’s words, they “view professionally produced and copyrighted television shows, movies, documentaries, and other programming.” More technically, it argues that this programming counts as a “video service” because it’s carried over public internet lines that require the right of way.

But conversely, the suit also notes that streaming giants like Netflix aren’t just running over a global internet backbone. They’re building local content delivery networks (or CDNs), like Netflix’s Open Connect, which route user traffic to a nearby server. Internet service providers in many states — including Georgia — already pay for broadband rights of way, and the servers are located in data centers, not underground pipes or utility poles on public land.

The companies have objected to the string of franchise fee lawsuits. “These cases falsely seek to treat streaming services as if they were cable and internet access providers, which they aren’t,” a Netflix spokesperson told The Verge. “They also threaten to place a tax on consumers that the legislature never intended, and we are confident that the courts will conclude that these cases are meritless.”

Franchise fee claims — all based on different local laws — remain mostly untested in court. But earlier this month, a Missouri state judge rejected an early bid to toss that state’s lawsuit, agreeing with the claim that these companies were “video service providers.” The judge specifically noted the presence of CDNs like Open Connect, a system that “bypasses the ‘public internet’” and distinguishes streaming giants from smaller services. She also rejected claims that the federal Internet Tax Freedom Act provided blanket protection from the fees.

With little precedent, it may take years to understand the implications of these cases. Companies will likely appeal any decision, and unless the Supreme Court takes up one of the cases, states will be covered under a patchwork of lower court rulings. But an increasing number of local governments see these fees as an opportunity to recover money from the services that are slowly replacing cable TV. “They need money now, and they’ve got this law on the books,” says Bergmayer. With the status of streaming services in flux, they’ve settled on an optimistic approach: “let’s go for it and see what happens.”

dnspooq-is-the-new-series-of-dns-vulnerabilities:-beware-of-phishing,-credential-theft,-ddos-attacks

DNSpooq is the new series of DNS vulnerabilities: beware of phishing, credential theft, DDoS attacks

7 software vulnerabilities identified DNS widely used by connected device manufacturers and which threatens to jeopardize millions of devices

di Andrea Bai published on , at 15: 41 in the channel Security

JSOF, an Israeli company operating in the field of cyber security, today revealed the existence of seven vulnerabilities, known together with the name of DNSpooq , referring to Dnsamsq. The vulnerabilities are particularly serious as they allow for “DNS poisoning” attacks, remote code execution and denial-of-service attacks against a potential pool of millions of devices . Dnsmasq is an open source software involved in DNS forwarding and which allows you to add DNS caching functionality, DHCP server to Internet of Things devices.

Currently Dnsmasq is widely used in the sector and its diffusion does not allow to draw up an exhaustive list of all the companies that use it. JSOF limited itself to compiling a list of 40 reality among the best known, in which we see names like Android / Google, Asus, Cisco, Redhat, Netgear, Qualcomm, Linksys, IBM, D- Link, Dell, Huawei and Synology , just to name a few.

DNSpooq: seven serious vulnerabilities put millions of devices at risk

In DNSpooq vulnerabilities there are three, indicated by the codes CVE – 2020 – 25686, CVE – 2020 – 25684 and CVE – 2020 – 25685 , which allow you to perform “DNS cache poisoning” or “DNS spoofing” attacks. This type of attack allows the perpetrator to replace the DNS on a target device with arbitrary DNS of their choice .

Small step back: DNS is the acronym for Domain Name Service and, in summary, is the system that allows you to translate the domain names of websites into IP addresses. When configuring the devices connected to the internet, it is necessary to specify the IP address of a “DNS server” which has the task of carrying out this “translation” by consulting the appropriate tables.

It then becomes evident how a DNS Spoofing attack allows the attacker to redirect users to server under its control, while the user has the impression of visiting a legitimate website . This opens up the possibility of carrying out phishing attacks, credential theft or malware distribution from what the user perceives to be a trustworthy reality. The first DNS spoofing attack was illustrated in 297 by security researcher Dan Kaminsky, who demonstrated that DNS software can be exploited to steal data and forge any website address.

“Traffic that could be compromised includes normal Internet browsing, but also other types such as e-mails, SSH communications, remote desktop functions, voice calls, software updates, etc. Possible attack scenarios also include JavaScript-based DDoS, reverse DDoS, and wormable attacks in the case of mobile devices that change networks regularly, “JSOF points out in its report.

Other vulnerabilities, identified by codes CVE – 2020 – 25687, CVE – 2020 – 25683, CVE – 2020 – 25682 and CVE – 2020 – 25681 , are buffer overflow types and potentially allow you to execute code remotely on vulnerable network devices when Dnsmasq is configured to use DNSSEC.

Compounding the situation is the fact that perpetuating attacks exploiting the set of DNSpooq vulnerabilities are fairly simple to conduct and do not require the use of unusual tools or knowledge of techniques details: “The attack can be successfully completed in seconds or minutes and requires nothing special. We found that many instances of Dnsmasq are misconfigured to listen on the WAN interface, making the attack possible directly from the Internet “says JSOF.

DNSpooq: resolve by updating to the latest version or, if not possible, mitigate with some countermeasures

Over 1 million Dnsmasq servers are currently exposed on the Internet according to Shodan, while they would be 630 thousand according to BinaryEdge , but there would be millions of routers, VPNs, smartphones, tablets, infotainment systems, modems, access points, drones and any other kind of equipment vulnerable to attack while not directly accessible from the Internet: ” Some of the DNSpooq vulnerabilities allow DNS cache poisoning and one of the vulnerabilities could allow remote code execution capable of acquiring many brands of home routers and other network equipment, with millions of affected devices and over a million instances directly exposed to the Internet “said JSOF.

JSOF explains that it is possible to completely protect yourself from attacks that attempt to exploit DNSpooq vulnerabilities by updating the Dnsmasq software to latest version available which is currently 2. 83. If, on the other hand, it is not possible for any reason to proceed promptly with the update of Dnsmasw, JSOF has prepared a series of possible alternatives that allow to partially mitigate the problem . We report them below:

  • Configure Dnsmasq to avoid listening on the WAN interface unless it is necessary in the operating environment you are in.
  • Reduce the maximum number of queries that can be forwarded via the dns-forward-max = option. The default value is 150, but it may be useful to lower it.
  • Temporarily disable the DNSSEC validation option until you can install a patch or update the DNSpooq version.
  • Use protocols that provide DNS transport security (such as DoT or DoH). This is a measure that can mitigate Dnspooq, which however could have other security and privacy implications depending on the configuration and operating environment.
  • Reducing the size of EDNS messages could mitigate some of the vulnerabilities. This is an untested measure and is inconsistent with the RFC recommendations 5625.