Slashdot Mirror
MS DRM Version 2 - Cracked
As the title says: Microsoft Digital Rights Management Version 2 has been cracked. The Register has the story, including a link to a downloadable zip file which contains source code, explanation and a small DOS utility. Grab it while you can. You can also read the explanation directly here, and you can also find it with Google.
in the immortal words of someone who's name escapes me:
"Information wants to be free."
There's a lot of bored but bright minds out there, and putting mountains up in their way just BEGS them to be climbed. As the old adage goes, Why do people climb mountains? well, there's actually 2 reasons, 1) because they're there.. 2) they're in the way of where you're trying to go..
*yawn* nice try MS, better luck next time eh?
What I don't get is why not use some proven technologies to get this done right? secure key-based encryption, rotating key servers, etc?
A Microsoft security hole?
Anonymous M$ exec1: We're hacked? Again?
M$ techie: No, we're not hacked. The MDRM v2 is hacked. We... (is interrupted)
Anonymous M$ exec2: We're hacked! Didn't the hacker read our last bulletin on that? It's wrong to post exploits we don't know about. It's almost against the law! Or rather, it should be!
Anonymous M$ exec1:Good idea. I'll give our lawyers a call! I'm sure its in the DCMA somewhere. Thats why we invented it, remember?
/Smuffe
When are MS, Sony and others going to learn that any sort of system like this will be broken? They should take a tip from the gaming industry.
I was excited to get a sony mp3 player as a gift last year. Until I realized that it used a proprietary format, atrac3. It will only allow me to load a particular piece of music 4 times. I've even loaded the music I make on it, but I am still subjected to this limitation. HELLO, it's my music, I made it,I own the copyright.
Digital Rights Management is there only to help support the massive amount of proffit that the recording industry is used to making. Well, I have a message for these people: The days of the $20 CD are long gone. Charge a fair amount of money for your product, and people will buy it. If you continue sticking it to the customer, they will break your systems and get it for free. Evolve or die. It's that simple.
http://www.assasins.net
Here's a mirror to the .zip file. Hope it helps.
This is the place where you write something that will make you seem like a complete idiot.
the following: is fair use a birth right or simply a result of the sale
contract?
If it's the latter, there's nothing we can do but informing people and
refusing to buy products with fscked up sale contracts (limiting fair use).
Maybe fair use is nothing more than a tradition and something we've grown
used to. And not "right", by all means. Is the limitation in copyright
(which it is) written in the books of law?
PPINZ you ask? Philosophy Paper In The Zip. Pretty good read, if you ask me. An Excerpt- Making a copy of an item doesn't in any way remove that item from the original possessor, so "theft" is clearly an inaccurate terminology. However, the publishers' insistence on using that word, and the public's acceptance of it, means that a much more negative light is cast on an action that, while wrong, is nowhere near the severity of a true "theft." After reading this I feel I owe the world an apology. Dear World. I am profoundly sorry for 'stealing' all that music. I am not a selfish person, but apparently I am an ignorant one. Here, all this time I thought I was copying all that music, not moving it. And to think, all those songs I have on my hard drive are no longer held by the publishers and radio stations. I was beginning to wonder if the worlds tastes were suddenly changing, as all I heard were boy bands and implanted teenage girls on the radio. Now, I come to find, that I am the reason for this trend. All the good songs are on my hard drive, and this is all the publishers had left. They even went to the extent of "manufacturing" artists to compensate for all those I have stolen from them. For this as well, I apologize. I know this music sucks, and nobody should have to listen to it, but in my ignorance I thought the old standbys would remain, even if I downloaded them. And to think of the moral implications of downloading the music of deceased artists. Never again will these songs be heard! I will be burning all of these songs to CDR and mailing them to the RIAA, so that we may have the beautiful music of our culture again. Sorry O-town, I have a feeling you'll be the first to go.
I apparently forgot that sig != uptime...
>I hate to say it, but it's illegal according to the DCMA, to reverse engineer and distribute the code. But,
>since I don't give a fuck about the DCMA, I'll be downloading too.
In the US, yes... the Reg resides in the UK and the EU "Council Directive 91/250/EEC of 14 May 1991 on the legal protection of computer programs" states the following:
Article 6 Decompilation
1. The authorization of the rightholder shall not be required where reproduction of the code and translation of its form within the meaning of Article 4 (a) and (b) are indispensable to obtain the information necessary to achieve the interoperability of an independently created computer program with other programs...
By putting it on its own server Reg is pretty much trolling Microsofts legal department. Way to go!
JK
No it's not. That's the whole point - US copyright does not create property rights. The actions of the copyright holders in shifting the terminology of the debate to the language of property rights means they've already almost won. After all, who agrees with stealing? But if they don't own it (and they don't - you paid for it), it ain't stealing...
So, I encourage, nay I *challenge* each and every one of you who would boycott MS or the RIAA to pick up a local newspaper and see what's going on in y our town this weekend. Chances are, there's a band or two actually worth checking out, and hey, it's not like you're going to meet chicks sitting behind your monitor.
Chicks, take this as a warning: stay home this weekend.
Yours Sincerely, Michael.
You have a good point about the suggestion to grab the DRM cracking utilities, though I disagree with your sentiments that violating MicroSoft's copyright is somehow justifiable. Microsoft's engineers worked hard to create an effective system for helping large corporations control their copyrights and here some anonymous hacker has broken all of their hard work and rendered the fruits of their money and efforts worthless, all in a single package that you can download here. Slashdotters, you should be ashamed that you are being encouraged to download this file and HeUnique should be ashamed for suggesting that people grab this file.
Cries of "fair use" do not render valid laws and copyrights obsolete. Just because DRM is easily circumvented is no excuse to ignore Microsoft's intellectual property.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
As Thomas Jefferson said, "The price of Copy Protection Schemes is eternal vigilence and endless lawsuits."
Regards,
Slak
This kid we had interning with us for a few months. Said using MS Visual C++'s built in RSA encyrption schemes was "too hard" so he thought he could go and write "something better" in 3 hours. :)
I'm just gonna stick with Windows 98 First Edition for now hehehehe
In case of fire, do not use elevator. Use water!
The notion that "information wants to be free" is a rather interesting case study of anthropomorphism gone horribly wrong. Information doesn't want anything. Truth, the facts, raw data, none of them want anything. They're just sentences, numbers, claims, opinions, ideas. Unless you're willing to extend the definition of a meme to the extreme, they're hardly capable of even Darwinian ambition.
But people often want information -- want it to be free, or secure, or copyrighted, or burned, or locked away for the greater good. People want the latest news, the biased studies, the most accurate statistics. They want each other's secrets, their inventions, their inspirations, their dirty laundry . They want to be the first in the know, the winner in the argument, the smartest in the class. They want to be told what to think, to make others think like themselves, and to be the first with a new idea.
People in the Western world are conditioned to believe that with a little applied brain power, they can be anything they want. So they insist that information should be free, despite omnipresent evidence to the contrary. They ignore the fact that library books cost ten cents per day late, that a reliable Internet connection costs fifteen dollars a month, and that university tuition costs four thousand dollars a year.
Knowledge is power. The right kind of information is all that's needed to upend governments, bankrupt companies, exile citizens, and execute prisoners. It can turn a housewife into a millionaire, a CEO into an inmate, and a celebrity into a punch line. A poor man will kill for money, but a rich man will kill for secrecy. The patent office is filled with millions upon millions of facts which are worth anywhere from pennies to princedoms to the right people.
Information doesn't want to be anything. Information just is, which makes it an asset, which makes it vulnerable to the economic laws of supply and demand. So if your information is about Linux, it's probably worth nothing at all, save your reputation as a programmer. But if your information is about, say, Microsoft Office... in that case, it's worth whatever Bill Gates can get you to pay.
The thing is that before a peice of software can be used, music be listened to, etc it MUST be decrypted. You can have all the stong crypto you like, it has to be in an unencrypted format before it's usable. Ok well this means that all the components necessary to decrypt it and make it usable must be included. You can mess around and obfuscate all you like, in the end your software still has to be able to decrypt the program so it can be run, and that means the hackers can trace through your code and find out what you are doing and how to do it themselves.
.exe and gives it to you. The only difference between it and the real SafeDisc is that SafeDisc unwraps the program to memory and runs ut each time, these crackers unwrap it and write it to disc, so you can use it whenever you like without copyprotection.
This is how all the SafeDisc unwrappers and the like work. They get all their info from the very files SafeDisc uses, extracts the necessary info, and then unwraps the
The reason why encryption is normally secure is it assumes two trusted parites. If I send something encrypted to you, it is assumed that you have the necessary means to decrypt it and that is what I want you to do. For example suppose you and I regularly encrypt our stuff with a semetric encryption algroithm like Blowfish. We both have a key that we use to talk to eachother. We both know this key, but nobody else does. In that way we can lock the data so that only we are able to unlock it. Well this only works because I WANT you to be able to decrypt the data. Well with copy protection the idea is they DON'T want you to be able to see the data, so they encrypt it. Problem is, your processor needs it decrypted. That means they HAVE to give you the key to decrypt it. They can hide it and obfuscate it, but it has to be there, otherwise it doesn't do any good. Well, that means you can find it, and use it to unlock the data they sent you.
I don't consider the pathetic fallacy (describing a phenomenon as if the objects involved were humans acting it out) to be a fallacy at all, but a useful metaphorical device.
"Water seeks its level." - no, sufficient quantities of water tend to be arranged by the force of gravity over time such that its open surface is roughly equidistant from the center of gravity
"Opposite electrical charges are attracted to each other." - no, there is a force on any two objects of opposite electrical charge each toward the other
"Information wants to be free." - no, it is difficult for one party to limit the distribution of information to only those parties it approves of
The common quotes are shorter and more digestable, literal truth is not relevant compared to effective communication.
On the other hand, the literal expressions are more likely to be left alone by those who don't understand them.
Read it all - Microsoft used SHA-1, Eliptical Curve Encryption, a bastardized version of Base64 encoding, and I think even the kitchen sink to try and keep this from being reversed. They encrypted the comms between DLLs (!) to prevent anyone from being able to get anything from the calls going back and forth must have added a ton of overhead with all of this encryption. They even move the location of the key pairs on each machine that this junk is installed upon in order to prevent the keys from being easily extracted. Kripes, Microsoft went so far as to build in the capability to REVOKE the keys if they were ever published - this hack must be killing them :-)
:-)
All of that would've worked except that the code that actually USES the keys has to know where they're located and THAT code's location is static (lol). The author simply used THAT code to pull the keys for the decryption - I love it. I'll bet some poor schmuck MSFT techie is smacking his head going "Dammit!" right about now.
I'm not sure how Microsoft could've stopped this - obviously their bulletproof EULA didn't work (lol). At some point in the code something has to know how to pull the needed keys and I cannot imagine how they would've been able to shift the code that does the calling in every copy of Windows - something has to be static somewhere or at least the code to find the location does
Since Microsoft used code to detect debuggers I have to wonder how he did this - hacked the debugger too? Hack the code to stop the detection of the debugger? Or decompile the code in some fashion and step through it? (shiver)
If this was the creation of a single individual or even a team it's damned impressive! I hope that The Reg gets it's wish for some sort of an interview granted and that this person or team of persons releases more insightful cracks. This was pretty sweet IMO, my hat's off to this effort!
Build it, Drive it, Improve it! Hybridz.org
Zone Alarm just told me that Windows Media Player is tring to ping my default gateway.
Now WHY would it want to do that? Is it part of a security scheme?
If it tell ZoneAlarm to not allow Internet access to WMP, am I in violation of DMCA? Is ZoneAlarm a circumvention tool?
Really? Consider this:
Suppose I produce $50,000 worth of code in a year. My employer hands me a fat check. After taxes and living expenses, I have about $10,000.
Scenario 1: I purchase 588 compact discs (at $17 each, for $10,000) of RIAA-approved content.
- Some artists get $600 to spend on tax, living expenses, guitars, and syntheziers.
- The music seller gets about $2500 or so. He buys food with it.
- A CD pressing factory gets about $1000. They buy fancy chemicals and mastering equipment with it.
- Hilary Rosen and her friends get about $4100 to spend on hookers and booze Congresscritters, to pass more laws to restrict my freedom.
Scenario 2: I download the music "for free".Now... explain to me again why paying $17 per CD is good for overall economic growth?
Is there a Scientology Microsoft connection? Their tactics seem awful similar sometimes.
Believe it or not, yes there is! Take a look at this e-mail I got. Fell free to check the sources:
<old Inbox digging>
>> Well, personally I did stay away from Windows 2000 not because of product
>> activation keys, but because I do not and will not support dangerous
>> organizations like Scientology, and cannot entrust a system which
>> includes their Diskeeper disk maintenance software with any sensitive data.
>>
> WHAAAAAT???? Scientology makes software included in Windows?????
Yes, they do, unfortunately.
> Where did you get that information from?
Well, this has been in the technical press in Europe for months in 1999 and 2000 and it was part of a boycott campaign against Windows 2000 for this very reason. These are not rumours, but proven facts.
Major parts of the disk maintenance software in Microsofts Windows 2000 are written by Executive Software, a software company led by and heavily influenced by very "high" Scientologists. They even talk (or talked - I havent visited them recently) about this on their web-site.
Offical German government and church authorities asked Microsoft to remove this code or open it up so that it could be checked for possibly included malware, but Microsoft refused to do this and just said they could not understand the problem and that this would be a form of religious discrimination...
Meanwhile Microsoft has published patch instructions (at least here in Germany) how to remove this component from Windows 2000, but I am afraid I can no longer trust them.
PS. If you speak German, I suggest to check ct magazine at www.heise.de. They have backlogs of all their articles available, and you should be able to find the issue discussed in all details and with names, dates, and cites in there. Otherwise, a search engine like www.google.com might help to point you to similar info in English.
</old Inbox digging>