Many ISPs in Bulgaria are offering IPTV to their customers in addition to internet services. Usually IPTV is delivered with a set-top box device (STB) which is connected to the ISP network and the user's TV. The security model of this solution relies on the assumption that only STBs can decrypt and play IPTV content.
I took the challenge to prove this assumption is wrong with the IPTV offering from a big telecom in Sofia. In this talk I will explain how I reverse engineered the STB firmware and figured out how video streams are encrypted. At the end, I was able to decrypt and play IPTV streams with my own programs running on a PC.