URGENT - WE GOT HACKED

[IVEN2024]

we are using latest enterprise version on ubuto 22.4 , and because both the m3u8 or the webrtc link accually have the streaming key
so people just used the streaming key to stream back , m3u8 or the webrtc player should not have the streaming key at all ,
???!!!!!! explain to me please

[lastpeony]

Which security feature are you utilizing?

Read https://antmedia.io/docs/category/stream-security/ again carefully please

[IVEN2024]

no no this is not the security we need , above , the stream key is always everywhere , in webrtc player , in the name of the .m3u8 file etc. this is not good at all

[lastpeony]

After you receive the one time token for example, you should consume it by passing it to .play() function or if you are using ant media server web player pass it to web players constructor.

Do not store it. Also you dont need to pass the tokens through url parameter.
Webhook play authorization can be also used.

[IVEN2024]

why its hard to explain something so simple , if you have a live stream , share with me your ebmedded that you copy from AMS , then i will show you what is the problem , in any link you share i will have your streaming key , cause the m3u8 have the streaming key , the webrtc player have the streaming key , why you dont want to understand is has nothing to do with tokens ??!!

[lastpeony]

what do you mean by streaming key? there is stream id and tokens in ant media server. there is no stream key.

[IVEN2024]

how you stream ??

[rahul78275]

Hello @IVEN2024

Thank you for raising the security concern, I can understand your frustration at this time. I am sure AMS have solution of it. Just help @lastpeony to understand your issue. If you are an enterprise user you can create a ticket, may be provide a video recording of the issue in the ticket that can be reproducible, also do follow the issue raising template like below.

Short description

Brief description of what happened

Environment

• Operating system and version:
• Java version:
• Ant Media Server version:
• Browser name and version:

Steps to reproduce

Expected behavior

Put as much detail here as possible

Actual behavior

Put as much detail here as possible

Logs

Place logs on pastebin or elsewhere and put links here

Ask your questions on Ant Media Github Discussions

[IVEN2024]

its on both , when you copy the publish url to put it on the streaming software , you will have a stream key , for example
https://yourdomain.com/stream1/stream2222
the stream222 is the stream key that streaming software will use to make you broadcast the live stream , this key is found public everywhere , in the webrtc player , on the m3u8 filename , so ?!!!!

[burak-58]

Hi @IVEN2024,
Stream id is available in the URL but it is not enough to be hacked. If you need to make your streaming more secure, you should use tokens. Here you can find the security documentation.

[IVEN2024]

how to use token with VMIX ??