Slashdot Mirror


Felten Follower Examines Crippled Music Disks

D4C5CE writes "Following in the footsteps of his famous professor, in his paper "Evaluating New Copy-Prevention Techniques for Audio CDs" (yes, that's pure PS), which is one of many interesting contributions to the 2002 ACM Workshop on Digital Rights Management, Princeton student Alex Halderman takes apart (bit by bit, literally) the "tricks on tracks" employed by the music industry to frustrate fair use."

24 of 160 comments (clear)

  1. Role of OS! by krazyninja · · Score: 5, Interesting

    I think examining the strength/weaknesses of algorithms without regard to the surroundings is not a good idea. With Windows providing most of the drivers in signed form, and refusing to accept unsigned drivers, it could be difficult to apply the "breaking" methods defined, in the mainstream operating systems. Ofcourse, in other OS's this shouldnot be a problem.

    --
    "Do something man. Right now."
    1. Re:Role of OS! by krazyninja · · Score: 5, Insightful
      Windows' "driver signing" is only a way to guarantee that a particular driver is verified

      Yah..But how long before that "option" is removed from the screen, and instead an "error" is indicated? From the way the DMCA has been brought upon, I dont see far.

      --
      "Do something man. Right now."
    2. Re:Role of OS! by Zocalo · · Score: 5, Insightful
      Yah..But how long before that "option" is removed from the screen, and instead an "error" is indicated? From the way the DMCA has been brought upon, I dont see far.

      I'd tend to disagree. Microsoft does at least appear to have gained a clue about security recently, and if they refuse to allow unsigned drivers outright they are opening an ugly can of worms. It takes time to get that WHQL certification that marks a driver as signed, so consider what would happen in the scenario of an exploit being found in a WHQL driver and made public immediately.

      The driver vendor might be able to issue a patch almost immediately, but would then have to submit it for WHQL approval before it can be installed. Even with somekind of "fasttrack emergency approval" mechanism for this situation, that's not going to happen overnight. Now imagine the outcry from those who do have a security clue if they are left vulnerable because Microsoft decided it was in their best interests not to allow them to install the patch because it was unsigned.

      The security services have the definition right; a "trusted box" is one that has the capability to break your security policy. Think about it - your firewall is "trusted" right? Yet if it breaks and starts allowing all packets through, what just happened to security. Now, tell me again Microsoft, "Palladium" is "trusted computing" and this is a good thing? ;)

      --
      UNIX? They're not even circumcised! Savages!
    3. Re:Role of OS! by BeBoxer · · Score: 5, Insightful

      I'd tend to disagree. Microsoft does at least appear to have gained a clue about security recently, and if they refuse to allow unsigned drivers outright they are opening an ugly can of worms. It takes time to get that WHQL certification that marks a driver as signed, so consider what would happen in the scenario of an exploit being found in a WHQL driver and made public immediately.

      Microsoft(tm)'s Palladium scheme will require signed drivers. There is simply no way to try to enforce that level of security while still allowing end users to insert arbitrary code into the kernel. Not with any standard definition of "driver" and "kernel".

      Most likely they will "compromise". You'll be able to load unsigned drivers, but when you reboot to load the drivers Palladium will detect that the OS is no longer in a "secure" state and any software that relies on the "trust" Palladium gives will be disabled. So no running WMP. And even though Microsoft(tm) has claimed that they won't use Palladium for software licensing somebody will. It's just too juicy for software publishers to resist. So you can expect that software to break. And since guarding against virii and such is one of the trumpeted reasons for Palladium, you can expect your AV software to have a fit. Who knows what it's failure mode will be. Should it not allow anything, since it can't really trust it's own binary, or it's AV database? Or should it allow everything for the same reason? Either failure mode is quite unpleasant. Or should it continue as if nothing had changed?

      Now imagine the outcry from those who do have a security clue if they are left vulnerable because Microsoft decided it was in their best interests not to allow them to install the patch because it was unsigned.

      Anybody with a security clue should realize that Palladium is about creating a new level of security user which is higher than "Administrator" and which only Microsoft(tm) has access to. No more. No less. It's about taking root access away from the user and giving it to Microsoft(tm). Any security administrator who willfully gives up final control of their box to the OS vendor gets exactly what they deserve. What's remarkable is how many "administrators" are going to be dumb enough to do exactly that.

      Palladium is designed to make the PC an attractive platform to media conglomerates for online content. A platform which will allow Microsoft(tm) to collect a toll on that delivery. It has nothing to do with increasing security for end users. Media companies don't trust their cusomters, nor do they trust their PCs. Microsoft(tm), by assuming control of the users computer, will be able to assure the media companies that their customers PC's can be trusted, even though the customers themselves can't be.

  2. Long trip... by mseeger · · Score: 5, Funny
    Hi,

    I hope he knows such trips to conferences may last longer than expected. Instead of bodyguards he should be guarded by lawyers.

    Yours, Martin

  3. Postscript Viewer by enneff · · Score: 5, Informative

    For those that don't have a Postscript viewer and run Windows, check out RoPS - small, fast and effective.

  4. This guy rocks! by Anonymous Coward · · Score: 5, Funny

    Is it just me, or does he have a picture of Natalie Portman in his photo collection?

    Her name is Julie?

    Copy-protection bashing and Natalie Portman... A hero to us all. I salute you!

  5. Actually, by Anonymous Coward · · Score: 5, Funny

    they prefer the term "Music Discs with Disabilities"

    1. Re:Actually, by more+fool+you · · Score: 5, Funny

      or even useability-challenged

  6. Re:Damn PS by Pathwalker · · Score: 5, Informative

    here is a PDF version for those people stuck on systems with only an acrobat viewer.

    It looks like he used a bitmap font, so the conversion looks a little ugly, but it is readable. I'll try to replace it with a better conversion in a half hour or so, as soon as I match the font he used.

  7. 'Frustrate fair use' by Anonymous Coward · · Score: 5, Insightful

    Exactly. There is no way that an audio cd can be made copy-protected, and remain reasonably compatible with redbook CD players. It was never built in to the spec, and there is no way to shoe-horn it in to the spec now.

  8. Which way will hardware producers go? by eddy · · Score: 5, Interesting

    As the paper points out, these schemes rely on "bugs" and "mis-features" in reader firmware, and it suggests that CDDA copy prevention won't last since "[...]Hardware and Software adaption is an inevitable and natural extension of improved design and bug fixing".

    The question is if the hardware manufacturers will begin competing for customers by providing the very best fireware in their drives, or if they will join hands with the RIAA and the snake-oil salesmen. So far I see no decisive move in either direction.

    Some drives can 'clone' protections just fine or need only better software on the computer side, but on the other hand there's a whole class of typical hardware -- like the Toshiba in this case -- which has been b0rken for so long that I really think the manufacturer is playing nice with the copy-protection industry.

    Maybe what we really need is drives with a more capable RAW reading interface, then all errors could be emulated and/or corrected as necessary on the side we control, the computer.

    --
    Belief is the currency of delusion.
  9. Let's be fair here... by goldspider · · Score: 5, Insightful
    Princeton student Alex Halderman takes apart (bit by bit, literally) the "tricks on tracks" employed by the music industry to frustrate fair use."

    ...as if the music industry's actions has nothing whatsoever to do with frustrating music pirates.

    Let's be fair here. We all know that recent copy protection schemes do in fact (at the very least) interfere with fair use, but we can't forget/deliberately ignore the underlying goal of the music industry for the sake of sensationalism, however faulty their methods are.

    --
    "Ask not what your country can do for you." --John F. Kennedy
    1. Re:Let's be fair here... by Chriscypher · · Score: 5, Interesting

      It amazing me that the same battles seem to be fought as computers infiltrate each new market. In the early 80's, personal computer software publishers did everything in their power to copy protect floppy disks, writing on half tracks, out-of-range tracks, and using other floppy format tricks.

      This created a new industry of commercial disk copy utilities, such as Copy2Mac, etc etc which enabled any floppy disk to be duplicated. For years it was an arms race of new protection schemes vs. copy utilities.

      If I remember correctly (I was pretty young then), lawsuits were filed against copy utility publishers, which lost, the courts holding that making a personal copy for backup purposes fell under fair use doctrine.

      I am sure there are plenty of prior cases which would overthrow the DMCA if a test case would only come to court.

      This software copy protection war resulted in:
      A) Common use of copy utilities by end users
      B) Eventual resignation by the industry against protecting media: not worth the cost or user inconvience.
      C) Introduction of hardware dongles for high-ticket software.
      D) The serial number 'protection' method in common use today for software.

      So here we are with music publishers revisiting the same war, and I believe they too will ultimately lose. I believe their actions are the result of old school inertia within the industry, and that ultimately, their business model will necessarily change.

      --
      "You have liberated me from thought."
  10. errr, what's ps? by Anonymous Coward · · Score: 5, Funny

    it doesn't have an icon on my windows xp system. Do I use notepad :(

  11. OT Re:Fair use? by expro · · Score: 5, Insightful
    The record companies have had more than ample opportunity to express their committment, both verbally and in deeds, to preserving what used to be the normal use of purchased media and fair uses of media by their customers. They have made it clear that they are trying to stamp out exactly that by opposing it and never saying otherwise.

    Whatever games they and you (and for all we know you are they) play to pretend otherwise, their goal is to squeeze more and more money out of those who legally purchase their works, thinking that as long as the market may be able to bear more, it is their duty to extract more by further restriction of rights, whatever that means to their customers.

    This is also very obvious from your / their push to extend copyright perpetually, extracting more and more, not from the copyright violators, but from those who abide by the laws.

    While you / they feel it is your right to push it to the edge to squeeze every last drop from the paying public who have suported you thus far, claiming you / they are just trying to make pirates pay their fair share. The fact kicking those who have been buying dozens or hundreds of new titles every a year does not make us more loyal, and will eventually lead to changes more fundamental than what you / they complain about today.

    We know your industry hates discussion of fair use. If they ever showed any signs of actually caring about preserving the rights of the customer, they might have a legitimate sympathizer or two among the paying public. An approach that exhibited any evenhandedness, restoring some of what they have driven so hard to take away, would shock their opponents. There are any number of forms this could take technologically.

  12. I don't understand why they try... by Kjella · · Score: 5, Insightful

    ...because this only pisses off their existing customers. I've yet to see one CD protection that hasn't been bit-exact ripped by someone (which is all it takes).

    If they can't play it in the devices they have will they
    a) Call it a defective cd? Most likely.

    b) When they find out it's defective by design, will they

    1) Continue to buy defective CDs?
    2) Get a normal CD(-R) from friends or mp3 from internet?

    We get more and more DVD/CD/MP3/kitchen sink consumer players. Break compatibility with those, and the MPAA will have only themselves to thank when the customers abandon them (Who the hell pays $20-25/CD anyway, that's the usual full price here in Norway...)

    Kjella

    --
    Live today, because you never know what tomorrow brings
    1. Re:I don't understand why they try... by BeBoxer · · Score: 5, Insightful

      We get more and more DVD/CD/MP3/kitchen sink consumer players. Break compatibility with those, and the MPAA will have only themselves to thank when the customers abandon them

      That's what I find amazing. These CD's work only in plain audio CD players. But as the incremental cost of adding MP3 playback drops to almost nothing, more and more players are including that functionality. Quite a few portables play MP3s. At least a dozen car CD decks play them. All DVD players. All computers of course. I've even seen boom boxes that play them.

      And these new discs, by trashing the TOC with stupid multisession tricks, are going to have problems in a growing class of players. It's like the media conglomerates want me to go pirate their music. With their endless campaign to reduce both the quality of the music as well as the compatability and usefulness of the disc itself, combined with what seems to be endless price hikes and settlements with the FCC for price fixing. Ugh. The music industry survives despite the executives running it, not because of them.

  13. So what is a "pirate"? by fmaxwell · · Score: 5, Insightful

    There is no scheme yet devised that will significantly hamper true music pirates. And by that term, I mean people who create and redistribute bootleg CDs for profit. Any of those folks will just take an audio CD player and capture the music via the SPDIF output.

    The music industry wants to convince the world that anyone who records a CD to their hard disc is a "pirate." They want consumers to believe that making a backup copy in case of damage is piracy. They want people to believe that creating a "mix CD" of your favorite songs is piracy. They want the public to believe that the guy who copies a CD so he can have one in his car and one at home is a pirate. In short, they are waging a campaign to equate simple copying with piracy.

    In their ideal world, if you wanted a copy of a CD for the car and one for the home, you would have to purchase two of them. If you wanted a "mix CD" with numerous hits, you would choose from their canned compilations. If you damaged the CD while moving it from player to player, you would have to purchase a new one (since you would not have a backup). This is not about piracy. It's about making you pay multiple times for the same music.

    1. Re:So what is a "pirate"? by fmaxwell · · Score: 5, Insightful

      Would this nearly as much of an issue without the likes of Napster and P2P contributing to the proliferation of illegal music distribution (whatever you want to call it, I'm talking about the illegal stuff)?

      I think so. I believe that Napster and other P2P networks were simply an excuse. There is little evidence to suggest that Napster et al. were costing the record companies a lot in sales. In fact, there were some pretty reputable studies and polls done that showed that exposure to new music on Napster caused people to buy more CDs. It's one thing to download a song or two by an artist to see if you like their stuff, but it is quite another to risk $15 or more on a CD that you've never heard.

      Want to know what the largest network is that distributes copyrighted music? FM radio. Back in high school when I wanted one song by a band and could not afford and/or justify buying their whole album, I'd just record it off the air on cassette. My friends did the same thing. We also made cassettes of LPs (yeah, I know that I'm old).

      I think that the RIAA just saw this as an opportunity to push crippled CDs on to the public.

  14. It also costs $, while GhostScript is free by Slashamatic · · Score: 5, Interesting

    Perhaps it is a sledgehammer to crack a nut but I would rather use GhostScript. Both variants (AFPL and GPL) are esentially and totally free, respectively which I prefer. For such an article, is a commercial (and overpriced)viewer really appropriate?

  15. Re:Just semantics? by 3141 · · Score: 5, Insightful

    1. I'd have a hard time saying that the industry's intent is to destroy fair use. Where's the profit in that?

    Fair use is largely concerned with being able to copy a work. The problem that I and many like me see is that it can't even be properly argued that there IS any profit in it. The point is not profit but control, with the idea that in some time in the future this can be leveraged to make profit. It's the same reason Disney are so scared to let "Steamboat Willie" fall out of copyright. You think they're going to many a fortune on that any time soon?

    2. I have little doubt that the problems that are occurring are because they're trying to -comply- with spec, not obliterate it -- namely, the problems some have noted with copy-protected compact discs are because the industry is trying to protect its content while remaining compatible with an obsolete standard.

    I have to wonder if you're not just having a laugh with this one. Altering a specification, for whatever reason, is quite the opposite to complying with it. The proper method of adding functionality to a specification is to create a new one. Compare how PNG could not support animation, so a new specification was made, MNG, that could. Also compare how no-one uses MNG, because they are quite happy with PNGs and animated gifs. This is how you determine whether a standard is obsolete or not, and the same logic applies to the CD. If everyone is happy with it, it isn't obsolete... or will you be listening to sounds with a frequency out of the (44100/2) = 22050Hz that CD supports?

    3. I have little doubt that when the next generation of media arrives, with effective digital rights management built in, that it will have the capability to deliver content and permit fair use...

    The two are the antithesis of each other. When the day comes that I can't copy a CD to play on another stereo, or just to make a backup, I've lost all pretence of having fair use capabilities in the CD.

    4. ...while preventing the sort of rampant piracy that is driving small record chains out of business.

    Examples, please. I have yet to see any examples that have evidence of piracy harming small record chains, while I have seen some that suggest it helps by providing wider exposure. "Piracy" has been bandied around so long as the cause of all commercial suffering that people are beginning to believe it, even using it for an excuse for failure.

    5. I think that the free market will probably be the best way to determine how importantly fair use should factor in to these new designs.

    Spot on correct! So when are we going to repeal the DMCA and throw out the SSSCA/CBDTPA? Let's let the free market (including all the fair-use supporting consumers) decide whether crippled content delivery will fly or not.

  16. A chance to get ahead of the curve by seanellis · · Score: 5, Interesting

    Looks like we can get ahead of the game here, by ensuring that we have our "Free Alex" flyers and placards printed out in advance.

    Seriously, the amount of information in this paper is similar to that which got Dmitry Sklyarov detained under the Downloaded Music Criminalization Act (DMCA). It even gives information as to which programs and hardware are most effective at bypassing these copy-restriction technologies.

    It's well worth a read to see how these technolgies only work due to buggy or fragile implementations of the standard.

  17. What about home audio CD recorders? by dpbsmith · · Score: 5, Interesting

    I continue to feel that attention should be paid to how these things interact with home audio CD recorders, and not just because I happen to own one.

    Under the Audio Home Recording Act of 1992, blank media for home audio CD recorders includes a fee which is distributed to publishers and artists in exchange for the right to copy the CD. Home audio recorders are restricted from writing to ordinary blank CD-R media; the media must have the encoding that identifies them as a "Music CD-R" thus verifying that the fee has been paid, and they also incorporate a "serial copy control system" which makes it difficult for people to create huge numbers of copies by making copies for three friends who each make copies for three friends, etc.

    Copy-protection schemes have to corrupt the data enough to prevent access by standard computer software. HOWEVER, they must not corrupt it so much that home audio CD recorders fail, or they are (probably) violating the AHRA.

    In practice, Universal Music evaded answering any questions I asked them about this issue; however, when I sent them a copy of "The Fast and the Furious" which my home audio CD recorder refused to copy, they sent me a replacement which did! I believe their strategy is "avoid public discussion by taking care of any individuals who complain, on a case-by-case basis."