China Academy of Information and Communications Technology: 80% of Internet TV systems have the problem of illegally collecting and sharing user data – yqqlm

IT House June 17 news, the “OTT Terminal Data Security and Personal Information Protection Research Report (2022)” released today by the China Academy of Information and Communications Technology and the Telecom Terminal Industry Association shows that,There are 1.083 billion Internet TV users in my country, and 80% of TV systems have the problem of illegal collection and sharing of user data.

IT Home understands that,OTT is the abbreviation of “OverTheTop”, which refers to providing various application services to users through the Internet beyond the operator. OTT terminals generally refer to Internet TV in China. According to the 2021 National Radio and Television Industry Statistical Bulletin of the State Administration of Radio and Television, by the end of 2021, there will be 1.083 billion Internet TV users, 7.1 billion annual Internet video paying users, 1.5 billion Internet audio annual paying users, and short video uploading users. Over 700 million yuan, and the OTT integration service business revenue was 7.802 billion yuan, a year-on-year increase of 9.73%.

The “Research Report” pointed out that with the rapid development of the OTT terminal industry, it also brought many security problems, such as untimely patching of vulnerabilities, unauthorized control of control modules, tampering of voice control content, excessive requests for permissions from application software/SDK, and access to user data. Illegal collection and sharing, direct collection and sharing of MAC, etc. cannot change the device identification, etc.

Especially in terms of data security and personal information security,There are a lot of phenomena of forced authorization, excessive claims, and collection of personal information beyond the scope of apps and third-party SDKs on Internet TV; In terms of traffic fraud, the proportion of false and cheating traffic in the OTT field is relatively high, which squeezes the advertising market budget and threatens the safety of home users; in terms of content, content piracy and infringement, secondary creation, transportation and other soft piracy are prominent, affecting the development of the video payment market; In terms of security, screencasting is more convenient, but there is also the risk of leaking user privacy.

In terms of Internet TV security detection and analysis, the “Research Report” pointed out that the security evaluation of a variety of Internet TV products, including 66 items in 6 aspects, showed that 75% of the tested TV operating systems had known security vulnerabilities; 80% There are debugging interface protection problems; application installation and voice control modules generally have security risks; 60% of the pre-installed apps have the problem of illegally collecting user information such as shared MAC addresses;80% of TV systems have built-in SDKs and pre-installed applications that share sensitive user data with third parties without the user’s consent;App privacy policies generally have problems such as incomplete content display.

According to the “Research Report”, in recent years, my country’s Internet TV security management actions have been frequent. At the regulatory level, the “Data Security Law” and “Personal Information Protection Law” and related regulations and departmental rules have been promulgated in China to clarify the management requirements for data security and personal information protection; in terms of industry self-discipline, the China Electronic Video Industry Association took the lead in promulgating the “Smart TV Startup”. Advertising Service Specifications”, China Internet Audio-Visual Program Service Association and Internet TV Working Committee released industry specifications such as “Internet TV Application Store (Application) Management Specifications”; in terms of industrial ecology, TV terminals cooperate with Internet companies’ security teams across industries to jointly build security Ecosystem; In terms of testing and certification, enterprises actively participate in the TAG traffic anti-fraud certification project to help the Chinese market eliminate the risk of traffic fraud.

The “Research Report” recommends strengthening industry management and improving the supervision of the whole chain; accelerating the formulation of technical standards to solve the pain points and difficulties of the industry; using privacy computing technology to give full play to the value of data elements; promoting safety testing and certification, and strengthening platform audit and management; User privacy protection awareness and other aspects are multi-pronged and coordinated development.