Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem

Recent developments have led to the emergence of illegal streaming services that are difficult to detect because they are offered only to those who have purchased specific set-top boxes. Even when such infringements are identified, the hardware-based nature of the service makes tracking extremely challenging. This paper focuses on analyzing the services provided through one such device, EVPAD. Upon installation, as of January 19, 2025, EVPAD allows users to watch real-time broadcasts of 1,260 channels from 18 countries and access 24,934 VoD contents, including Netflix and Disney Plus, as well as locally produced broadcasts. Through reverse engineering and detailed analysis, we identified 131,175 unique users and 78 servers dedicated to providing illegal streaming services over the course of two months. Beyond copyright infringement, EVPAD devices distributed worldwide could be misused by operators for cyberattacks. This paper proposes two blocking strategies based on EVPAD's service characteristics to curb copyright infringement and track key service nodes to dismantle illegal services and prevent potential cyber threats.