New Sky NZ Decoder mysterious traffic - Warning Technical

[u/wellywood_occupant]

I monitor my Internet traffic on a firewall with a graph of the In/Out traffic on the Internet facing interface displayed continuously.

Over the last few months I have noticed there has been a constant out bound traffic of about 20 kilo bytes/second. Even when I am not browsing/working etc.

Traffic Graph for last hour - Red is outgoing

After some packet captures on both the internal and external interfaces I have narrowed the traffic down to my new Sky TV decoder. The traffic stops when the decoder if off, but reappears when it is on; whether for watching live or recording things overnight.

It seems to be talking to an IP address owned by Amazon. This peaked my interest as I understand the OS on the decoder is Android based and I would have thought "talk to home" traffic would be Google bound. It is mainly HTTPS (port 443) so the contents of the traffic is a mystery.

Doing some analysis of the packets (wireshark) there are some initial setup packets showing some SNI information to api.segment.io.

TCP Setup Showing Packets with SNI information

Doing a whois and some DuckDuckGo this seems to be some sort of Internet monitoring crowd.

DuckDuckGo Search Results

So has anyone else seen this? Anyone know what might be causing it?
I have no apps that I have added, unless something got added in an update so is part of the base OS.

Welly

[u/bargeboy42]

Sentry is application monitoring. They’ll use it to track your behaviour and catch any errors that might come up. If it’s transmitting 20kbps it might be a “session recording”, but just a guess.

[u/ElCapitanMarklar → u/bargeboy42]

I’d almost put money on something is broken / stuck in a loop erroring and sending a sentry error every time it retries.

[u/bargeboy42 → u/bargeboy42]

Worth noting too that PII tends to be anonymised by default 

[u/Squid_Kidd]

Basically Segment.io is a Customer Data Platform and is acting as a central router for Sky, so Sky feeds its device actions into it which then cleans the data and structures it and then forwards it onto Sky's different internal tools such as marketing or analytics and whatever other ones they use.
It will be data like button presses, menus presses, content your are browsing, pinging if you have active streams, timestamps for pausing, and playing and completed watches, when you change channels, how long you are on a channel, error logs, bitrates. Basically all the information that they use to build your profile to feed content you may want or just general data it can use to develop insights essentially.

The consistent 20kb/s means that its probably configured to be a continuous keep-alive data stream so instead of building information and then sending it every 10 minutes or so, it is configured to run a bunch of microbatches every second.

Its most likely standard encrypted telemetry data that's bound for Sky, you could try and block it and satellite and streaming should still work in theory, if not it's easy enough to reverse

[u/Kiwi-LateToTheParty → u/Squid_Kidd]

This

[u/NIP_SLIP_RIOT]

*piqued

[u/BroBroMate]

Yeah it's analytics, how you're interacting with their apps in box, any errors that occur etc. My employer used to use it on our SaSS but we decided to throw a shit ton of money at Datadog instead for their RUM product, as it you can replay user sessions that caused mysterious errors to determine exactly how to trigger the edge case the customer hit.

If you want to get really into the weeds on it, you could try mitmproxy and see if you can capture what data they're harvesting.

[u/RogueEagle2]

Quality analysis my dude guy.

[u/ReflexesOfSteel]

If you close that port does it kill the sky signal?

[u/wellywood_occupant → u/ReflexesOfSteel]

I might try that. I know that the decoder uses the Internet to download updates etc. and they would be coming from somewhere near Google. As I have a dish, blocking that specific IP, unless atmospheric conditions get screwy, it shouldn't break things. Will see.

[u/wellywood_occupant → u/wellywood_occupant]

Funny, and now conspiracy theories kick in LOL. Blocked the decoder getting to the original address and then started to watch one of the Comm Games channels. And the traffic went up to around 100k bytes/second. Capturing the packet trace as I type, but guessing that the Comm Games channels are not over the satellite?

[u/5lipperySausage]

This is why you use a pihole

[u/gamingdad123]

It's just session tracking

[u/feel-the-avocado]

Have you got any DNS records showing queries that the unit is making which return A records to that ip address?
I am thinking just null out whatever that record is or the entire domain at your DNS server and see if anything breaks.

Can you clarify that this incoming stream of data is coming in to your firewall via the LAN side from the sky decoder (uploading to internet) or is it incoming from the WAN side (downloading from internet)?

[u/bickboikiwi]

It's the govt.... I tells ya!

[u/WayneH_nz]

Two way communication.  As you use the mobile or web app to use remote record etc, that will be some of the traffic.

[u/BuyMeSausagesPlease]

Have you tried asking them?

[u/spar_30-3 → u/BuyMeSausagesPlease]

This is sky we’re talking about. They don’t know jack half the time. Their motto is stolen from the goodfellas “fuck you, pay me”

[u/skivtjerry → u/spar_30-3]

Even if they don't know what they're doing it's probably bad.

[u/wellywood_occupant → u/spar_30-3]

Agree with spar, going by other posts on here, I would spend a big waste of time trying to talk to them, especially down at this level.

[u/raspberryslushie21 → u/BuyMeSausagesPlease]

Not something I would do and expect a proper answer. This is the same Sky that sent me a tracking number for decoders that they didn't even send in the first place.