iTunes 4.5 Authentication Cracked
fooishbar writes "Yesterday, Apple released iTunes 4.5, which deliberately broke the 4.2 authentication scheme, which had been successfully reverse-engineered. However, crazney has been at it again, and within 24 hours of downloading iTunes 4.5, has broken the new scheme, and added more features to this library along the way. If you want to incorporate iTMS support in your program, give libopendaap a go!" Reader ScottGant submits this story about the Pepsi/iTunes promotion: "News.com has this story about Pepsi's iTunes promotion give-away. The promotion,
which is slated to end this Friday, was to have given away 100 million
tracks through Apple's iTunes
music site. But according to Apple on Wednesday, only about 5 million
free songs have been redeemed."
That's way less than they anticipated. Only 5 million out of 100 knocked me flat. Since iTunes serves a pretty specific market, I guess that says a lot. Especially since the tracks are free. The question on my mind: how many of those 100 million winners actually reached folks? TFA mentioned something about distribution problems.
:P), but I have to wonder.
Also, about the new authentication crack: I am curious how this will impact their deal to offer free weekly songs, I'm assuming it's some sort of deal with the record industry. Today is a fairly uninspiring Avril Lavigne track (but free! I got it anyway!
Auto-reply to ACs: "Truly, you have a dizzying intellect."
The idea that Apple is "breaking" or "crippling" this part of iTunes is misleading. It wasn't a feature that Apple provided to begin with, and any hacks to break the DRM scheme will be thwarted by Apple eventually.
If you don't like this, you shouldn't use iTunes at all and don't buy their music because this is something they need to sell music online. Last I checked, you can just buy the CD at the store that contains no DRM at all.
SIG:Slashdot: indymedia for nerds.
I'm hardly surprised by the results. Personally, I don't drink Pepsi usually (though it's not a religious thing, no matter what people think). But I'll drink a Sierra Mist, which is included in the contest.
So when My Lovely Wife (MLF) would go to the store, she knew to look for Sierra Mist with the label. For about the last 5 months she's looked, and every so often I'd take a peek.
Nothing. Nada. I've talked to other people in the San Diego/Southern California area. Nothing. I was on a business trip to Chicago - didn't see any out there (though maybe someone who lives there might have had more luck).
I don't know if it's that Pepsi had a lot of "warehouse" Pepsi to sell that just never got to the market, or if they only shipped it to certain areas. But whatever the reason, I have not seen one iTunes Pepsi cap - and those friends I have who have seen them in their area mention that it's not 1/3 that one, but typically more like 1/10 (though perhaps they were victims of the "Bottle Tilt Trick" in their area from ambitious music buyers).
I'd like to hear that Pepsi extends the contest for another 6 months in the hopes that the labeled bottles will eventually reach stores, but I'm not holding my breath.
52 Weeks, 52 Religions with John Hummel
my main problem with 4.5 is that it no longer allowed sharing with other itunes running boxen on my home network - the one machine i had updated to 4.5 ( my parents imac) couldn't accesss my music on the g5. it seems like a fairly annoying thing that wouldn't be particularly hard to not break for no particular reason. while i personally think theres no reason to break apple's authentication or other security features in itunes (the current permisions are more than enough for me, and i have less than 20 pruchased tracks, and only 2 machines i play em on), its nice to know that work arounds do exist.
Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
I live in NYC and have seen exactly 1 bodega with iTMS Pepsi bottles.
Maybe someone forgot to ship these things to places where people actually would use them?
I hope apple didnt invest too much time/money in this new fixed drm. Will these media pimps ever learn?
This isn't about DRM, it is about access to the music store, sharing, etc. outside of the iTunes application.
And despite the poster's assertion, there's no real reason to think the authentication scheme was intended to break compatibility; as most developers know, sometimes you need to make changes for other reasons that force a break in compatibility. If this WERE about DRM, I'd say it was likely, but I see no reason to think this separate change was deliberate. It may have been, but no one's given any reason to think it.
That's because for a "free" song you had to give them your credit card number.
No, you didn't. I got two free, no credit card required.
I've worked for marketing companies that created similar promotions for their clients. Promotions like this are created with the full knowledge that the vast majority of winning caps will be tossed. 5% is actually a pretty strong number considering the L.A. Lakers caps they had in L.A. were only redeemed at a rate of 1.2 % (You got $10 off at Foot Locker) Have you noticed that 90% of the time McDonalds announces "We're giving away a million dollars!" that you never hear about anybody winning the prize?
Vonal Declosion
So... 95 million valid codes left, where's the code generator? :-)
I dunno what iTunes *YOU* were using, but I never had to give my credit card # and I'm on free song #9 and counting...
Viva La Revolucion! Buy a Mac!
I wonder what the typical redemption rate is for the Pepsi, Coke and other softdrink give aways. I know for paper coupons the redemption rate is about 2 percent. Granted alot of those coupons go straight into the trash. However, when people print coupons from the web only 20 percent are redeemed. And if someone is going to print them, you would think they would use them.
My point, is the Pepsi-iTunes rate of 5 percent unexpected?
Their new strategy seems to be fixed, and it's a strict policy of lip service. If they make sure:
- The De-Fairplay utilities don't have public development sites, and instead are forced to be these little files passed around on USENET and P2P and slashdot like they're some sort of contraband, well out of the public eye
- The way things work change just *SLIGHTLY* with every minor release of iTunes, causing all the De-Fairplay utilities to have to be updated with every minor release
Then, well. The slashdotters get to keep their de-Fairplay utilities and use them as much as they want; and from the RIAA's perspective, Apple's "doing something" about piracy, because there's no longer a publically visible way to crack Fairplay, and so they don't revoke Apple's license to sell music. Everybody wins! Except our civil liberties.
This is about authentication with the itunes music store, not removing the playfair drm protection.
.002 and .004
.m4a files which show no protection, and play fine in VLC, and itunes.
Fairplay still works without any changes. A "friend" did the following last night:
1. Using an old version of itunes on a pc, purchased a new song from the music store.
2. Launched VLC on the PC, and found it had no problem playing it. Checked c:\documents and settings\[username]\application data\drms and there was a new file: XXXXXXXX.005, in addition to the other two files that were already there. They had extensions
3. Upgraded itunes on the PC to 4.5. Bought another song. It shows fairplay v2 when you look at it's info.
4. VLC can also play this one. No new file in the drms directory was created.
5. Copied both songs.m4p and the key files from drms to the mac running the latest itunes. Put the keys in ~/.drms
6. Ran playfair (v 0.5.0) against the two songs. They decoded into
7. Just to double check, bought a third song using itunes on the mac. Ran playfair against it (still using the keys from the PC) and it decoded and plays fine.
My conclusion is that as long as you have the keys, you can still use playfair. My friend gets the keys from the PC running VLC. I don't know if other techniques may have been broken by the new itunes.
I don't have any problem with the ethics of removing the protection. I don't-- I mean, *wouldn't* use it to illegally share the music. It's just nice to have clean files in case Apple quits developing itunes for the PC, or some other unlikely scenario.
I found a link to this on Ben&Jerry's site after reading the news.com article. Pledge to vote in the next election and you get a free iTunes download with 24-48 hours.
Get 'em while they're hot--er, or before they melt?
Ii might have something to do with the inconvenience of downloading and installing iTunes, creating an account (which includes entering a credit card number), and then finally entering the code and picking a song.
But I think more importantly, the vast majority of people simply don't know much about iTunes (or don't even know what it IS). I dug a lot of "one free song" bottle caps out of the wastebaskets in our office because people didn't have a clue what they were...however, once I showed them how to redeem them, their reaction was usually something like "I can get any song I want?!? COOL!". This leads me to believe that Apple still has a ways to go in terms of public interest and awareness of the online music store scene...which is actually an exciting opportunity for them.
Except you didn't have to give them a credit card to get the songs. I didn't have to put in any credit card informtaion until i actually bought a track -- after i had downloaded 18 free iTunes songs. So yes, they were actually free. You only needed to give them an email addy to create the account (or at least I did, but i used the account i'd had with apple for 2 years, so they already had my email).
Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
Given the classic assumptions on "mail-in rebates" that only 10% of the people actually bother if the amount is less than $100...5% is actually amazingly high for something that has a very narrow audience given the number of people who by Pepsi (i.e., lots of people that bought winners didn't care about iTunes).
My wife and I would go out of our way to get the Pepsies with the promotion. We won quite a few times.
It wasn't a bad promotion, but many times we had to go out of our way to even find the Pepsies with the offer. They were hard to find.
"Music is everybody's possession. It's only publishers who think that people own it." - John Lennon.
Wow. That's fascinating. I never realized the Great Wall of China ended in Japan.
In the end, though, if this stays a technology arms race, Apple will lose. Why? Because most of the smart people in the world don't work for Apple. (That's also true even for Microsoft, incidentally.)
Apple will have to take another tack if they want to preserve the integrity of the iTunes DRM. What that'll be, I dunno, but I hope they don't resort to suing their customers.
Be who you are...and be it in style!
And cracking the authentication scheme is considered ... good? I love iTunes and the iTMS. If Apple pulls out of the market because it tires of people breaking their rules out of a overblown sense of entitlement, we'll all be worse off.
This week's schedule
You mean you missed the big honking Pepsi logo right in the middle of the iTunes home page that said "Redeem your free song here"?
"Music is everybody's possession. It's only publishers who think that people own it." - John Lennon.
If a person still needs a account to login to iTMS with this bit of reverse engineered method, the Authentication hasn't been cracked!!!
Authentication cracked means that you cand take an encrypted password and retreive the plain text for and already existing account.
All this guy seems to be able to do is figure out where and how iTunes sends its login information, so he can put it in his own application.
they want a credit card for you to retrieve your free itunes aac, and since this was a promotion geared towards teens, how are they supposed to get thier free music?
.5% went thru with it.
i had a couple caps but i didnt feel like signing up. great promotion there. only
Ok, you're a clever guy. We get the message.
But is your ego helping those of us who would like the RIAA to see the light and start being more open in their approach to digital music?
Read the EFF's Fair Use FAQ
What the planet of Hell do you need a workaround for? Just upgrade the other machines! iTunes is *DUM, DUM, DUMDUM* FREE (as in beer)! Is it really so hard to upgrade a free program?
Boobies never hurt anyone. - Sherry Glaser.
So, as far as I am concerned, they've fucked themselves on this one.
Other people's comments aside (about the CC field as optional for a signup), why would you say they fucked themselves?
They got the PR associated with giving away $100M worth of stuff. They only had to pay out $5M (less, since this certainly doesn't cost them as much as it would cost an actual customer). And you say they fucked themselves?
More like they fucked us. At least they used lube, but still... "Distribution problems" my ass. For anyone who considers every aspect of this as anything but well thought out and perfectly coordinated, I have a bridge to sell you...
It's a great day! We found a new way to screw over the one company who actually found a way to provide what everyone said they wanted: convenient, electronic distribution of music at a fair price.
But wait, that's not really what they wanted. What they really want is stores with no cash registers and libraries of thousands of pieces of music representing the creative efforts of generations of people while valuing those libraries at zero.
Oh, and they also want to complain about greed.
Business isn't willing to pay for products, innovation and careers, so we get brands, mortgage commercials and layoffs.
Alright, so all I have to say about this is, don't make a Windows version of the hack Please !! If we all agree not to port the code to windows, then all the script kiddies will be waiting for a DRM breaker that naver comes, and they might BUY some CDS. I dunno I think that what is happening with File sharing is criminal. If I go to a US court I will just pull out the legal papers from my home Countre Canda, and try to prove that online file sharing is PERFECTLY FINE. It only got a slight drop when everybody was doing it, now with this suing shit happenting, everyone is back in the red. So what the hell is the problem? It's not illegal, it's fine, and content proveders. WE know you need money.. I will all works itself out, lets just stop the madness. Please?
Here's a thought for you who didn't find a Pepsi Bottle with a yellow cap: TRY ANOTHER STORE. Just becaue 9/10 stores in my immediate area don't sell Sobe's Love Bus Brew, ndoesn't mean I won't travel somewhere that does.
To those who couldn't find where to insert your code on iTunes. USE YOUR EYES. It was right there on the front page: "PEPSI iTUNES GIVEAWAY." With a Pepsi logo with headphones on it. Click on it, insert your code, then it says ONE FREE SONG in the upper right hand corner. Find a song, click DONWLOAD, and it downloads it free.
To those complaining about having to use a credit card: How else are you going to pay for the songs you download? Food stamps?!
And about the DRM. c'mon people. Apple has to play the game of the law and the game of the recording industry in order to sell these things. But you tell me. How many other service let you KEEP the rights to the songs you bought, allowing them to be burned with the only restriction: Can only burn the same PLAYLIST 7 times to CD....Hell, Add or subtract a song from that playlist and you have a whole new playlist ready to burn.
People...just have no sense of reason. This is the BEST legal download service available on the market. Plus, the software is free, and is THE BEST jukebox software, on ANY platform.
Even WINBLOWS users are stating that "opinion." Should be more like fact if you compare all the others.
was to have given away 100 million tracks through Apple's iTunes music site. But according to Apple on Wednesday, only about 5 million free songs have been redeemed."
So iTunes is a failure.
Let's close it up. Unplug the servers and shut down the site.
They haven't sold enough Macs either, so let's close that down too. Can't make a dime unless they're the #1 record-setting, fastest-growing business in the history of civilization.
Business isn't willing to pay for products, innovation and careers, so we get brands, mortgage commercials and layoffs.
"I don't know why they bother trying to up the security. There is no way to secure media content that is compatible with mass distribution."
It's the "a little goes a long way" paradigm. There's not a car lock that will stop a sophisticated thief who wants your car, but it stops 90% of the punters. Same with locks on doors and copy protection on computer games and gaming consoles. There are likely professional car thieves who also wonder out loud why the car manufacturers don't just give up because it's a losing battle, etc., but it's not going to happen, either.
"They need to work on their business model, because this piecemeal anti-cracking stuff is a joke."
Apple has sold 70 million songs in their first year, and the iTMS is the most wildly successful of any of the legitimate download services, by a wide margin. I think their business model suits them just fine. Remember, Slashdot readers != the general populace. The little annoyances of playing cat-and-mouse with the "all music must be free" crowd is just one part of doing business and is similar to the fraud and theft issues that many other retailers deal with.
Sitting in my day care, the art is decopainted.
For better or for worse, DRM is a battle that content providers will lose
No they won't.
Don't be surprised when Apple suddenly becomes one of the biggest supporters of "trusted" computing, and introduces a palladium technology of their own. And all the Mac zealots who were busy telling us before why Apple DRM was good, while Microsoft DRM was bad, will come back to tell us why Mac Palladium is good.
I'm not saying the coders here are doing something wrong because they are pushing Apple in that direction: if we self censor ourselves to appease the DRM monglers, then we are where they wants us anyways. Apple picked sides in this battle, and for all the bullshit their fans are feeding us about "nice" DRM, the side they chose leads only one way. Goodbye user controlled computer. Welcome Palladium controlled user.
Itunes maybe drm but they consistently have the most generous terms and usage limits. They also are reasonably priced. They put out a good product at a fair price...and they dont charge subscriptions. They are also the only paid song program for Mac users.
Itunes is a good thing , and if you hack their songs without paying you are a thief. It is not like Kazaa where you might say there is no victim, Itunes is based on selling its product,and if Itunes fails mac users are screwed.
If there is someday an Itunes for Linux are you going to hack that until it dies too?
End of February? You were lucky -- I was working in Anaheim since January 2004, and we didn't see any yellow iTunes caps until the third week of March, which was right before the promotion ended.
I'm still getting yellow caps now; it's a good thing Apple is still letting me redeem them (at least through tomorrow), because I've already cashed in 7 or 8, and could reap a few more between now and the end of work tomorrow.
--R.J.
Electric-Escape.net
Perhaps you don't understand: libopendaap isn't about hacking iTunes. libopendaap is about other programs "talking daap" with other programs (and specifically iTunes). It's about interoperability; interoperability is perfectly legal.
The authentication doesn't just prevent DRM-removal. It also cripples iTunes' ability to connect to non-iTunes music shares.
I have my entire music library--which, incidentally, is 100% legal and paid for--on a Linux server running daapd. iTunes 4.5 broke iTunes so I could no longer pay my legally purchased music on my Macintosh.
Fortunately, the maintainer of daapd worked out the fix about as quickly as the maintainer of libopendaap did, and I've been able to upgrade iTunes after all.
Make no mistake, Apple's screwing around does have a negative impact on their customers, even the ones who haven't infringed copyright.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Places like etree have long lists of bands (over 1k listed on etree) that are cool with trading (mostly live shows). There's some great legally free music downloads out there, start checking them out.
"And a voice was screaming: 'Holy Jesus! What are these goddamn animals?'" - HST
A lot of people seem to be up in arms over this, so let me clear it up somewhat: when the Pepsi promo was started, there was an option in the account settings to choose "none" for your credit card. However, in the last week, that option was disabled, and new accounts now require a valid credit card to be entered in order to be created. So both sides of the argument are correct.
An interesting side note: my account had the "none" option selected, so even though that's no longer an option, my account has been unaffected! Meaning, unless Apple figures it out, I can keep my account open without entering any credit card information. I intend to do all my future purchases via iTunes Gift Certificates. ^_^
Thanks a million. Push Start to replay.
So let me get this straight...
(1) I spend 99c downloading a song
(2) I spend the next X hours of my life writing or downloading an Apple DRM decoder
(3) I end up with a non-DRM song and a 99c credit card bill
I can see why this is easier than just performing step 1 and quitting. I mean, since I have 6 computers I need to play the song on, or I want to burn 8 of the identical CD, or I have no life.
I only came here to do two things; kick some ass, and drink some beer...looks like we're almost out of beer.
Ok, now that's just plain silly. These are FREE songs we're talking about. So they didn't have a specific tune you wanted. What was keeping you from downloading a track from someone you never heard of? (The previews are there for a reason.)
You could have discovered something new that you really liked, without any risk of wasting money. Be a little more adventurous...
Does it make you happy you're so strange?
>I guess the bottle availablity has more to do with your local distributor than Pepsi.
Exactly. The marketing agency I work for currently has Pepsi as a client. One of the biggest hassles in getting promotions going is dealing with the bottlers and distributors. If the bottlers still have items in stock waiting to be sent out, then it's even tougher to get the new bottles out.
iTunes on Windows is slow
I believe that it was a poor design choice on Apple's part, but iTunes performance degrades quickly in the presence of shoddy video drivers. This may have been your problem. Also, if you disable SoundCheck (or just let it finish running) performance improves dramatically. SoundCheck determines the volumes of your music files and has iTunes compensate for bad rips, etc.
iTunes on Windows is slow
FairPlay is the DRM system used on files from the iTMS. iTunes could care less what you do with any of your files that were acquired elsewhere. It will even let you stream audio across your network with almost zero setup.
Winamp 2.95 is fast, convenient, and smart.
It sure is better than the 3.x version, but it has zero library management functions. It takes no time to search for a song in my library in iTunes. If I want to hear a song, I can begin to type any part of its name or its artist's name or even the album name and the song list updates live with each keystroke. It often takes just one or two characters to bring the song you want into the window. That is the one feature that sets iTunes apart from Winamp for me. I really liked Winamp and Macamp but I hated trying to find a particular song. I had to use filesystem searches, but that's not good enough.
You might want to take a second look at iTunes after you update your video drivers. Since you want it to be light weight, turn off all of the music store and sound enhancement features (turn off SoundCheck!). Then you will have an awesome music library management program. I think that if you have a significant music library that you will appreciate the search feature so much that it will eclipse iTunes other shortcomings.
It would seem that Pepsi did indeed screw up big time with the distribution. It's a shame the caps were only around for about a month, I would have gotten many more free songs if they didn't disappear so fast.