Vancouver-based geolocation piracy pro GeoComply has added a suite of updates to its GeoGuard database to capitalize not just on the increased VPN (virtual private network) trends seen during the pandemic – but also the evolved behaviors of the pirates that use them.
GeoComply is likely a new name to many Faultline readers, so before getting stuck into the updates, the company’s Director of Global Sales, James Clark, explained that its stripes were earned from success in online gambling, protecting companies by accurately locating players’ whereabouts, which has proved particularly useful in the unique US market where the legality of gambling varies from State to State. On the back of this success, GeoComply saw an opportunity ripe for the taking in the media market, launching its GeoGuard database of IP addresses and location techniques to the market about five years ago – and it didn’t take long for GeoGuard to sign up big names like Amazon Prime Video and BBC.
A quick search of the term ‘geopiracy’ will bring up very different results to what GeoComply specializes in, which is about targeting service providers that can’t afford a dedicated VPN detection team, but also about preaching a message that IP address analysis alone isn’t enough to tackle geopiracy anymore as it evolves.
Geopiracy is apparently becoming an increasingly recognized term, according to Clark, as the lazy elision of geolocation and piracy into a single marketable term.
“There are loads of techniques, but people saw geolocation as a burden. The industry has now woken up to the knowledge that pirates will do anything to not be detected – and more often than not these pirates implement location-based techniques. Geo IP data can drill down to the postcode level, but even that can be quite inaccurate with VPN detection,” Clark explained.
“We track 250 spoofing techniques and hundreds of millions of IP addresses every day – and pirates are getting smarter to the extent they are trying to spoof us,” continued Clark.
That said, proxy over VPN is the first of four updates released into the GeoGuard database this week, claiming to be the only tool out there capable of identifying attempts by premium VPN providers to target high-value video streaming services using proxy over VPN techniques. These can be especially hard to detect when users are double-spoofing services under cover of darkness, unless you have this feature. Clark referenced recent tests with an unnamed major OTT video provider that showed it was blocking just 1% of attacks before deploying the GeoGuard add-on, at which point it managed to block 87% of attacks.
CDN integrations have also been added to GeoGuard, including Akamai and AWS CloudFront. Clark stressed the ease of integration, “Literally you can flick a switch and it’s done, it’s so easy to integrate.”
Third up is a residential IP update – which Clark described as a “headline-grabbing update” due to its direct effect on end users, so it was only apt that it was used in the headline for this piece. A problem with free VPNs is that most people don’t read the Ts and Cs, so often end up downloading other malicious apps that hijack domestic IP addresses for resale to premium VPN providers. The alarming part of this IP hijacking is that VPN users inadvertently end up surrendering chunks of bandwidth as high as 10% in some cases, which is a huge concern for the wider industry.
With this revelation about VPN vampires sucking bandwidth from home internet connections, Faultline is perplexed as to why internet service providers aren’t shouting about this activity from the rooftops to discourage VPN usage. Firms like GeoComply should certainly be doing more to drive that message as an effective and cheap mudslinging tool.
Finally, GeoGuard now comes with IPv6 detection to combat VPN providers adding IPv6 ranges that allow users to spoof locations – something that has been bubbling around for a while, according to Clark, but is really gaining traction now, particularly on mobile devices. IPv6 streams are more complex and therefore harder to understand, and also more expensive which means IPv6 is used for premium attacks, so adding support allows OTT broadcasters to remain fully compliant with contractual obligations and business rules without blocking out legitimate users (as happened to Faultline during one of our recent webinars).
The fundamental point here, Clark explained, is around accuracy. It’s about knowing who to block, but also who not to block – therefore keeping false positives down to a minimum.
“IP has been the source of geopiracy checks forever. When attacks evolve, we will need more data points beyond IP, so we’re looking at GPS, cellular, WiFi,” he added.
Interestingly, Clark envisions the media industry eventually catching up with what he described as GeoComply’s “hyper-accurate detection technology” – although he simply chuckled and shrugged when probed when that might happen. GeoComply certainly looks to have a significant head start, and it’s intriguing to observe a company shifting so effectively from online gambling into media and entertainment.
When GeoGuard was launched five years ago, the company cited one in four internet users implementing VPNs to mask location. Today, that has risen to 31%, of which 50% are using VPNs to access premium content.
Coming back to the idea of an absence of in-house VPN detection teams, Clark isn’t aware of any business doing in-house what GeoComply can do. He admitted that while it’s feasibly possible for media companies to bring these techniques in-house, it would require significant investment if your pockets are deep enough. As pockets go, they don’t come much deeper than Amazon’s, and GeoComply has already claimed that scalp.