Paywall Optional: Stream for Free w/ New Technique, RRE

Paywall Optional: Stream for Free with a New Technique, RRE

Speakers: Farzan Karimi

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=UdNhZ17t8M4

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Farzan%20Karimi%20-%20Paywall%20Optional%20Stream%20for%20Free%20with%20a%20New%20Technique%2C%20Recursive%20Request%20Exploits%20%28RRE%29.pdf

Overview

Modern streaming platforms and paywalled services invest heavily in content delivery infrastructure, licensing enforcement, and DRM — yet the authorization logic that gates entitlement to that content is frequently far weaker than the cryptographic machinery around it. Farzan Karimi, offensive security researcher and red team manager, introduces a new attack technique at DEF CON 33 called Recursive Request Exploits (RRE), a systematic method for identifying and automating exploitation of business logic flaws in API chains that grant content entitlements without adequate authentication or authorization at each step.

The technique is framed around two concrete real-world impacts: obtaining full access to a sports streaming service's premium content without payment, and accessing over 1,800 internal company meeting videos — all-hands calls, global town halls, and similar internal communications — on a major streaming platform without authorization. While the paywall bypass framing is deliberately audience-friendly, the underlying technique has broad implications for any application that chains API calls where early-chain responses generate trust tokens consumed by downstream endpoints.

Background

▶ Watch: Introduction: Online video paywalls and streaming DRM (0:36)

The Entitlement Problem

Karimi defines "entitlement" as any digital asset tied to a customer's identity — a content license, an access token for a video, a seat in a virtual event. The paywall problem is fundamentally an entitlement enforcement problem: applications must ensure that the delivery of a high-value digital asset is cryptographically bound to a verified, paid identity, not merely to a session state that can be manipulated.

In practice, many streaming and media applications prioritize user experience over strict authentication at every layer of their API stack. The result is a class of weakness where early-stage API calls — search endpoints, metadata endpoints, actor/content lookups — return data that includes identifiers which downstream endpoints accept as implicitly trusted inputs for generating access tokens. If those downstream endpoints do not perform their own authorization checks (because they "trust" the identifier from the upstream call), a client that can synthesize or predict valid identifiers can bypass the paywall entirely.

The ABSAC Principle

Karimi introduces the ABSAC (Access, Bind, Synthesize, Authenticate, Claim) principle of "first reference" as a mental model for locating the vulnerability. The key insight is to identify the first point in an application's API call chain where a sensitive value — typically an entitlement identifier or a content token — is introduced upstream. This is typically where trust assumptions are strongest but actual authentication and authorization checks are weakest. Any point in the downstream chain that generates a content secret from metadata or an identifier rather than from a cryptographically verified claim represents a potential bypass point.

Traditional Paywall Bypass Techniques

For context, Karimi briefly surveys four traditional techniques before introducing RRE:

1. Soft paywall bypass via JavaScript manipulation: Many news sites implement paywalls via client-side JavaScript that hides content after rendering it in the DOM. Disabling JavaScript or manipulating the DOM can reveal the full article. This is widely documented and only applicable to soft paywalls.
2. Cookie manipulation: Session cookies or entitlement cookies that are checked client-side can sometimes be forged or replayed from a valid session on a different account.
3. Cache/CDN exploitation: Some CDN configurations cache authenticated content responses without stripping entitlement tokens, allowing unauthenticated clients to retrieve cached premium content.
4. Archive/wayback access: For static content (news articles), archived versions on services like the Wayback Machine may predate paywall implementation.

None of these techniques are effective against modern streaming platforms with server-side entitlement checks and signed content URLs. RRE specifically targets this harder class of application.

Key Findings

▶ Watch: RRE (Request Replay Exploitation) technique explained (12:29)

1. API chains in streaming platforms routinely include low-trust steps. Modern media applications are built on microservices architectures where a video playback request triggers a chain of API calls — search, metadata, entitlement check, token generation, CDN URL signing. Each step in this chain does not necessarily validate the source of its input independently.

1. Metadata endpoints are systematically under-secured. Search and content metadata APIs are almost universally public or require minimal authentication, by design — platforms want content to be discoverable. These endpoints return object identifiers (video IDs, show IDs, asset references) that are then consumable by downstream entitlement-generating endpoints.

1. Entitlement-generating endpoints often trust upstream identifiers without re-verifying authorization. A downstream API that accepts a videoId and returns a signed playback URL may assume that if the client knows the videoId, they are authorized to play it — because in the normal application flow, only paid users would be presented that ID. This is an implicit trust assumption that RRE exploits.

1. The technique scales through automation. The manual version of this API chain traversal is expensive for a penetration tester. Automating the recursive traversal — collecting all identifiers returned at each step and feeding them into subsequent endpoint probes — makes the attack tractable at scale.

Technical Deep Dive

▶ Watch: Affected streaming platforms and scale of vulnerability (27:29)

The Recursive Request Exploit Pattern

The RRE algorithm, at a conceptual level, operates as follows:

1. Seed: Begin with a known entry point — a search API, a content catalog endpoint, or any public-facing API that returns structured metadata about content.
2. Extract: Parse all identifiers, references, and object handles from the response. This includes explicit identifiers (video IDs, asset references, content tokens) as well as implicit ones (actor identifiers, show identifiers, season or episode markers that may map to content objects).
3. Probe: Feed each collected identifier into every other API endpoint in the application's API surface, looking for endpoints that accept those identifiers and return new data — particularly data that is more privileged than what the seed endpoint returns.
4. Recurse: Any new identifiers returned in step 3 are added to the working set and the probing cycle repeats.
5. Exploit: When an endpoint is discovered that accepts a low-trust identifier and returns an entitlement or signed playback URL without performing its own authorization check, the bypass is complete.

The key challenge that automation solves is the combinatorial nature of steps 3 and 4. A modern media platform may expose dozens or hundreds of API endpoints, and the recursive graph of which identifier types each endpoint accepts versus produces is not documented. Manual exploration is tractable for a targeted assessment but not for systematic research at breadth.

Concrete Example: Fight Club Mental Model

Karimi's illustrative example: a fictitious streaming site's search API returns metadata for "Fight Club," including a movie identifier and actor metadata. An actors API accepts an actor identifier (Brad Pitt) and returns a list of associated movie and TV show identifiers. A content resolver API accepts a show identifier and returns a list of episode identifiers. A playback API accepts an episode identifier and — critically, without verifying that the caller has an active subscription entitling them to that episode — returns a signed CDN URL valid for 24 hours.

The RRE tool would traverse this chain automatically: starting from the public search endpoint, extracting every identifier type returned, probing the playback endpoint with each, and logging any responses that return playback-grade content rather than authorization errors.

Sports Streaming Service Case Study

Against a named sports streaming platform, Karimi applied the RRE technique to the live content delivery API stack. The platform required a paid subscription for live game streams. By traversing the API chain from the public sports schedule endpoint (which returns game identifiers) through an entitlement API that should have validated subscription status but trusted the game identifier as implicitly authorized, Karimi was able to obtain valid signed streaming URLs for live game content without payment. The complete automation of the traversal allowed this to happen within minutes of the initial probe.

Internal Video Library Case Study

The second case study targeted a major streaming platform's internal video infrastructure — specifically, a portal used for internal company meetings and all-hands sessions. Karimi identified 1,800+ internal meeting videos (including global town hall recordings and executive communications) accessible through the same RRE pattern: a search or directory endpoint returned meeting identifiers, and the video playback endpoint consumed those identifiers without verifying that the requester was an internal employee with access to that specific meeting. An external attacker with knowledge of the platform and ability to traverse its API graph could access these videos without credentials.

Tool Release

Karimi released an open-source tool at DEF CON 33 to automate the RRE pattern. The tool accepts a seed API endpoint, a set of authentication headers (to simulate an authenticated but unprivileged user), and a list of known API paths or a base URL for crawling, and then automatically executes the recursive traversal, logging all identifier-to-endpoint mappings and flagging cases where low-trust inputs produce high-privilege outputs.

Demo / PoC

▶ Watch: DRM architecture and how legitimate streams are protected (38:02)

The talk included live demonstrations of both case studies, though technical difficulties with the presentation display system affected the visibility of the demos for the in-person audience. Karimi walked through the conceptual flow of the attack with voice narration, explaining each API traversal step and the entitlement bypass point. Post-talk, slides and tool documentation provide the full technical walkthrough.

Defensive Implications

▶ Watch: Mitigations for streaming paywall bypass techniques (42:29)

Enforce authorization at every API endpoint, not just at the edge. The fundamental fix for the RRE class of vulnerability is to eliminate implicit trust in identifier provenance. Every endpoint that returns or acts on a content entitlement must independently verify that the authenticated caller has a valid entitlement for that specific resource — regardless of how the caller came to know the resource identifier.

Do not conflate discoverability with authorization. The assumption that "if you know the video ID, you must be authorized" is consistently wrong. Content identifiers appear in browser histories, referrer headers, logs, cached responses, and API debugging tools. A valid identifier proves nothing about the caller's authorization state.

Audit API chains for implicit trust propagation. Conduct explicit trust analysis of multi-step API flows, asking at each step: "Does this endpoint verify authorization independently, or does it inherit trust from the calling chain?" Any endpoint that delegates its authorization check upstream is a potential RRE target.

Implement signed entitlement tokens with short TTLs and caller binding. Signed playback URLs or entitlement tokens should be bound to a specific session or IP range (where legally permissible), should have short lifetimes, and should require a verifiable claim from an authorization server rather than a bare identifier as their input.

Test API surfaces from an unprivileged user perspective. Penetration testing engagements that only assess administrator-level or fully-authenticated flows will miss RRE-class vulnerabilities. Specifically testing the API surface accessible to free-tier or unauthenticated users, and probing for entitlement escalation, is necessary to identify these issues.

Key Takeaways

• RRE is a systematic technique for finding and exploiting business logic flaws in multi-step API chains where early-chain metadata endpoints return identifiers that downstream endpoints trust without independent authorization verification.
• The technique was applied against real-world streaming platforms, yielding both premium content access and unauthorized access to 1,800+ internal corporate video recordings.
• Automation is central to the technique's power — recursive traversal of API identifier graphs is not feasible manually at scale.
• The root cause is implicit trust propagation: endpoints that generate content entitlements based on knowing an identifier rather than verifying the caller's right to that identifier.
• The defensive fix is straightforward but requires re-examining every endpoint in a multi-step API chain independently: no endpoint should skip its own authorization check because it "trusts" upstream inputs.

About the Speaker

Farzan Karimi is an offensive security researcher and red team manager. He has led red team programs at Google (managing the Android red team), EA, and Madna, where he also oversees security operations, incident response, and security engineering. His prior DEF CON appearances include talks on Pixel 6 exploitation with the Android red team and a no-click over-the-air RCE delivered via SMS against cellular-connected devices. His work consistently applies offensive research techniques to platform-scale targets, with an emphasis on finding novel attack classes that automation can make tractable at operational scale.