search

ant-media / Ant-Media-Server

Ant Media Server is a live streaming engine software that provides adaptive, ultra low latency streaming by using WebRTC technology with ~0.5 seconds latency. Ant Media Server is auto-scalable and it can run on-premise or on-cloud.
https://antmedia.io
Other
4.24k stars 621 forks source link

URGENT - WE GOT HACKED #6659

Open IVEN2024 opened 4 days ago

IVEN2024 commented 4 days ago

we are using latest enterprise version on ubuto 22.4 , and because both the m3u8 or the webrtc link accually have the streaming key so people just used the streaming key to stream back , m3u8 or the webrtc player should not have the streaming key at all , ???!!!!!! explain to me please

lastpeony commented 3 days ago

Which security feature are you utilizing?

Read https://antmedia.io/docs/category/stream-security/ again carefully please

IVEN2024 commented 3 days ago

no no this is not the security we need , above , the stream key is always everywhere , in webrtc player , in the name of the .m3u8 file etc. this is not good at all

lastpeony commented 2 days ago

After you receive the one time token for example, you should consume it by passing it to .play() function or if you are using ant media server web player pass it to web players constructor.

Do not store it. Also you dont need to pass the tokens through url parameter. Webhook play authorization can be also used.

IVEN2024 commented 2 days ago

why its hard to explain something so simple , if you have a live stream , share with me your ebmedded that you copy from AMS , then i will show you what is the problem , in any link you share i will have your streaming key , cause the m3u8 have the streaming key , the webrtc player have the streaming key , why you dont want to understand is has nothing to do with tokens ??!!

lastpeony commented 2 days ago

what do you mean by streaming key? there is stream id and tokens in ant media server. there is no stream key.

IVEN2024 commented 2 days ago

how you stream ??

rahul78275 commented 2 days ago

Hello @IVEN2024

Thank you for raising the security concern, I can understand your frustration at this time. I am sure AMS have solution of it. Just help @lastpeony to understand your issue. If you are an enterprise user you can create a ticket, may be provide a video recording of the issue in the ticket that can be reproducible, also do follow the issue raising template like below.

Short description

Brief description of what happened

Environment

  • Operating system and version:
  • Java version:
  • Ant Media Server version:
  • Browser name and version:

Steps to reproduce

Expected behavior

Put as much detail here as possible

Actual behavior

Put as much detail here as possible

Logs

Place logs on pastebin or elsewhere and put links here

Ask your questions on Ant Media Github Discussions

IVEN2024 commented 2 days ago

its on both , when you copy the publish url to put it on the streaming software , you will have a stream key , for example https://yourdomain.com/stream1/stream2222 the stream222 is the stream key that streaming software will use to make you broadcast the live stream , this key is found public everywhere , in the webrtc player , on the m3u8 filename , so ?!!!!