# Investigating IPTV Malware in the Wild
## 1 Introduction  
As many illicit content providers supply copyright-infringing IPTV content for free, they often rely on intrusive advertising, tracking, scams, and malware to make a profit. Illicit content providers also get paid by malware authors to infect their own illicit IPTV websites or software, which are frequently malware families that can generate indirect income with ease, such as cryptocurrency-mining malware [1; 2]. One study found that dozens of illicit IPTV websites contained \"download now\" adverts, redirecting users to landing pages with instructions for downloading malicious browser extensions [3]. Another study found that for the Australian population, 99% of advertisements on illicit content-sharing websites were categorised as high risk, with 46% of these advertisements classified as malicious [4]. Overall, this implies that using copyright-infringing IPTV technologies poses a significant risk to users' devices, as illicit content providers cannot be trusted and may use malware to increase their revenue. Internet Protocol Television (IPTV) is a service that provides TV programmes and on-demand video content under the TCP/IP internet protocols [5]. Most legal IPTV services supply video content as part of a TV licence, one-time purchase, or paid subscription, whereas free alternatives usually incorporate advertisements. While IPTV services each have many different genres of video content, users often need to subscribe to multiple services to view the specific films and TV programmes they want to watch. Due to the limited effort, convenience, and monetary costs of these legal IPTV services, many users instead choose to use copyright-infringing IPTV technologies to view video content illegally. A report by Sandvine estimates that \"roughly 6% of all households in North Americacurrently have a Kodi device configured to access unlicensed files and streams\" [6]. This implies that many IPTV users are willing to risk compromising their home network by installing potentially infected software to access unlicensed video content in addition to possible legal action for copyright infringement. One of the reasons why infringing IPTV users are willing to risk legal action or exposure to malware and scams is that illegal IPTV services are usually either free or have low monetary costs in comparison to legal IPTV services [7]. Additionally, applications and various software for accessing infringing content can be installed from unofficial software and application stores on physical set-top boxes, which appeals to users due to its ease of use, facilitating a \"wide range of illicit content being available in one place, without the need for multiple subscriptions\" [8]. Because of the lower perceived costs, these users are willing to accept the risks of trusting and potentially disclosing credit card or personal information to illicit content providers who cannot be trusted and who could be frauds. The addition of the malware threat to this criminal environment adds another dimension to criminal activities, creating a poly-criminal environment. This was observed in the technical report on the online investigation of IP crime [9], which found that in many cases, the financial gain in one criminal activity supports the other, thus creating a vicious many-folded criminal ecosystem. Another importance in illuminating the malware ecosystem behind illegal IPTV is that it will challenge the judicial process behind the illegal IPTV ecosystem by stressing the fact that the severity of crime increases once the malware is added into the mix. Our research found that currently, there are insufficient forensic investigation studies and actionable intelligence collections available to effectively identify the risks and threats of malware from using illegal IPTV technologies [10]. This is in part due to an inadequate number of studies and malware analyses that have assessed the likelihood and severity of malware threats in the illegal IPTV ecosystem.