Recently working on a custom player implementaion on ustream.com using their api, i found a huge loophole that i would like to share. Ustream lets you create public/private channels and then broadcast on them using fmle or swf based publisher. Private channels can be password protected, so only people with right password can view it. But here is the catch !! The password based security system is pretty invalid in itself.
While programming on the platform i noticed that the player uses amf protocol to send receive data to server. So here is how you can hack any one’s private channel (password protected).
1. Go to https://addons.mozilla.org/en-US/firefox/addon/1843/ and install firebug extension for firefox.
2. Go to the page which hosts the private channel and open the firebug debug panel. Make sure you have enabled the Net panel.
3. Next without much effort if you see you will notice that, while going through the requests made by the site to ustream, the amf call with the password tagged to it is very clearly visible.
So there you have it both channel id and password for the stream !. Not so protected is it now ? 🙂