Beating the Pirates: A Custom Content-Protection Protocol for a Closed Video Platform
Secure Video LMS · Axoten Innovations · Role: Solutions Architect & founding engineer
The setup
Late 2020. Covid, curfew, classrooms shut. Sri Lanka’s massive private-tuition industry — the machine that preps students for the A/L exams — had nowhere to go. An institute came to us with an order: build them a Learning Management System, fast.
We shipped the first release in weeks: courses, lessons, attendance, payments, and video streaming. For video we made the pragmatic call — embed a third-party host. It offloaded our bandwidth, saved months of work, and got students learning again.
Within days, full lessons were circulating in Telegram groups.
That kicked off an eight-month cat-and-mouse game that ended with me writing a custom streaming protocol from scratch — and it’s the piece of work I’m proudest of.
flowchart LR A["Third-party embed"] -->|links scraped| B["Native apps"] B -->|packet sniffing| C["Custom protocol"] C -->|holds| D["~95% blocked"] style C fill:#4a9eff,stroke:#4a9eff,color:#fff style D fill:#1f7a3d,stroke:#1f7a3d,color:#fff
Round 1 — the easy leak
The first attack needed no skill at all. Open the browser network tab, copy the video URL, feed it to a free downloader. Done. Because the video lived on a third party, we had zero visibility and zero control — no traces, no logs, nothing to even detect.
The fix had to be fast, not perfect. We moved playback off the open web and into apps — porting the LMS into mobile and desktop clients to make link-extraction harder. It bought us time. It also cost us: mobile in-app video playback in 2021 was fragile. And it only bought us time. The pirates came back with packet sniffing: same result, extract the real link, download with an external tool. We’d raised the bar; we hadn’t cleared the field.
Round 2 — the decision everyone else would’ve skipped
The team was ready to give up. The only “real” answer was industry-standard DRM — and the institute rejected it on cost. Their logic was sharp, too: “Netflix has DRM and new releases are pirated the day they drop. Why pay a fortune for something that doesn’t even stop the pros?”
They were right. And that’s where I found the insight the whole project turned on:
Every protection we’d tried failed for the same reason — the technology was common. There are entire online communities dedicated to breaking exactly these standard formats. But our system wasn’t Netflix. It was a closed, whitelisted platform — only enrolled students could ever touch it. So why fight on the pirates’ home turf with tools they’ve already mastered?
If the audience is closed, the protocol doesn’t have to be standard. So I built a custom one.
I took the challenge solo and designed a proprietary content-protection scheme — a heavily customized streaming protocol — enforced consistently across every client platform. I can’t share the mechanism, and that’s exactly the point: there was nothing on the internet to copy-paste an attack from. The global piracy community had no incentive to reverse-engineer it — cracking a niche protocol used only by Sri Lankan A/L students earns them nothing. The economics of the attack collapsed.
They still tried. They went after the encryption keys and failed. The system held.
The honest limit
No protection is absolute, and I won’t pretend otherwise. The scheme defeats every off-the-shelf tool and casual attack — but a determined specialist with deep low-level skills eventually found a theoretical edge (exactly one person did, a university researcher — it takes that level of effort). That’s the ceiling of this approach, and I know precisely where it sits.
So rather than chase an unwinnable 100%, we treated the last sliver as a different problem and layered on deterrence-and-detection strategies — at a high level: digital watermarking, steganographic tracing, and analytics-driven monitoring. The philosophy shifted from “make it impossible” to “make it pointless, and make offenders traceable.”
The result: ~95% of unauthorized downloads and screen recordings eliminated — and the remaining fraction pushed into effort no ordinary user would ever attempt.
Where it landed
- Became the flagship product of Axoten, now maintained by a full team.
- Runs on iOS, Android, and Windows, with built-in live streaming.
- Serves roughly 500–1,000 TB of video bandwidth per month.
- Scaled to 20,000+ users and 5,000–10,000 concurrent viewers.
- The custom protocol still holds today, years later. I stay on as Technical Consultant.
Why I keep this one close
I built this in the pre-ChatGPT era. No AI pair-programmer, no Stack Overflow answer waiting — some of the questions I hit had no answers at all. Reading the media-codec internals felt like reading quantum physics. It was just me and the compiler, night after night, until it worked.
A curfew order for a stopgap LMS turned into a custom streaming protocol that outlived every attack thrown at it. That’s the work I point to when someone asks what I can do with a hard problem and no map.