Slashdot Mirror

← Back to Stories (view on slashdot.org)

Johansen Cracks AirPort Express Encryption

Posted by michael on from the airport-express-sales-increase dept.

womby writes "DVD Jon has just announced that he cracked the encryption in Apple's AirPort Express. 'I've released JustePort, a tool which lets you stream MPEG4 Apple Lossless files to your AirPort Express. The stream is encrypted with AES and the AES key is encrypted with RSA.' No real details of the process employed in cracking the unit but newsworthy none the less."

18 of 459 comments (clear)

  1. Great News by Rura+Penthe · · Score: 5, Interesting

    This is great news. I want any application I own on any platform (OS X/Windows/Linux/Zeta!) to be capable of streaming to an Airport Express. I can't imagine that this would really upset Apple since you're still buying their hardware. It just lets you use the hardware with more applications. If iTunes is still the best and most elegant way, people will use that.

    Of course...Apple isn't always logical like that, and there may be some precedent set that would injure them in court some time later.

    1. Re:Great News by Rude+Turnip · · Score: 5, Interesting

      You can use an Airport Express and never buy anything from iTMS or purchase an iPod...just use your own MP3 collection. All three hardware products depend upon iTunes, but neither hardware item requires the other to use.

      To be honest, Apple's products become much more useful (and more desirable to purchase) when people come out with neat hacks like this. The only reason I spend big bucks in their music store is because the DRM has been broken through the Hymn project.

      --
      Bill Clinton: Pimp we can believe in. - The Shirt!!!
    2. Re:Great News by Kristoph · · Score: 5, Informative

      The hack in question does not permit you to stream to the AE unless you have access to the network on which the AE resides. If you did gain access to that network in some way you could still engage in the "abuse" you mention through iTunes without this hack.

      The point of the hack is to permit you to stream music from programs other than iTunes to an AE you have access to and not to hijack AE's.

      ]{

  2. Does anyone know Jon's doctor? by Anonymous Coward · · Score: 5, Funny

    I want to know if he really does have testicles made of brass.

  3. Re:huh, sounds solid... by interiot · · Score: 5, Insightful

    What's NOT solid is the whole concept of selling products which contain the encrypt and decrypt keys to customers, and thinking that they're never going to be able to recover those keys from the product you just put in their hands.

  4. This should be pretty cool by sith · · Score: 5, Interesting

    Since all he got was the public key, you can't actually decrypt streams that are being sent. What it means is that programs can now stream music to the AEx. This should be really cool, especially once something like AudioHiJack or Wiretap comes along that lets you redirect all your system audio to it. I'd love to be able to stream non-iTunes audio formats that way (real player radio stations and whatnot). Anyways, can't see how this hurts apple - more people have incentive to use the AEx, Apple doesn't have to support their use of it that way, and the protected music is still protected. Hizzah?

  5. From the Site... by Anonymous Coward · · Score: 5, Informative

    So sue me
    Jon Lech Johansen's blog
    Wed, 11 Aug 2004
    Reversing AirTunes

    I've released JustePort, a tool which lets you stream MPEG4 Apple Lossless files to your AirPort Express.

    The stream is encrypted with AES and the AES key is encrypted with RSA.

    AirPort Express RSA Public Key, Modulus:
    59dE8qLieItsH1WgjrcFRKj6eUWqi+bGLOX1HL3U 3GhC/j0Qg9 0u3sG/1CUtwC
    5vOYvfDmFI6oSFXi5ELabWJmT2dKHzBJKa3k 9ok+8t9ucRqMd6 DZHJ2YCCLlDR
    KSKv6kDqnw4UwPdpOMXziC/AMj3Z/lUVX1G7 WSHCAWKf1zNS1e Lvqr+boEjXuB
    OitnZ/bDzPHrTOZz0Dew0uowxf/+sG+NCK3e QJVxqcaJ/vEHKI Vd2M+5qL71yJ
    Q+87X6oV3eaYvt3zWZYD6z5vYTcrtij2VZ9Z mni/UAaHqn9Jds BWLUEpVviYnh
    imNVvYFZeCXg/IdTQ+x4IRdiXNv5hEew==
    Exponent: AQAB

    MD5(JustePort-0.1.tar.gz) = fe13e96751958c6e9d57cce0caa7b17b

    1. Re:From the Site... by SiliconEntity · · Score: 5, Interesting
      This RSA public key can also be expressed in hex as:
      000000 e7 d7 44 f2 a2 e2 78 8b 6c 1f 55 a0 8e b7 05 44
      000010 a8 fa 79 45 aa 8b e6 c6 2c e5 f5 1c bd d4 dc 68
      000020 42 fe 3d 10 83 dd 2e de c1 bf d4 25 2d c0 2e 6f
      000030 39 8b df 0e 61 48 ea 84 85 5e 2e 44 2d a6 d6 26
      000040 64 f6 74 a1 f3 04 92 9a de 4f 68 93 ef 2d f6 e7
      000050 11 a8 c7 7a 0d 91 c9 d9 80 82 2e 50 d1 29 22 af
      000060 ea 40 ea 9f 0e 14 c0 f7 69 38 c5 f3 88 2f c0 32
      000070 3d d9 fe 55 15 5f 51 bb 59 21 c2 01 62 9f d7 33
      000080 52 d5 e2 ef aa bf 9b a0 48 d7 b8 13 a2 b6 76 7f
      000090 6c 3c cf 1e b4 ce 67 3d 03 7b 0d 2e a3 0c 5f ff
      0000a0 eb 06 f8 d0 8a dd e4 09 57 1a 9c 68 9f ef 10 72
      0000b0 88 55 dd 8c fb 9a 8b ef 5c 89 43 ef 3b 5f aa 15
      0000c0 dd e6 98 be dd f3 59 96 03 eb 3e 6f 61 37 2b b6
      0000d0 28 f6 55 9f 59 9a 78 bf 50 06 87 aa 7f 49 76 c0
      0000e0 56 2d 41 29 56 f8 98 9e 18 a6 35 5b d8 15 97 82
      0000f0 5e 0f c8 75 34 3e c7 82 11 76 25 cd bf 98 44 7b
      a 2048 bit RSA public key. The exponent is hex 0x10001, which is decimal 65537, a very commonly used exponent for RSA encryption.

      The fact that he just published the public but not private parts of the key suggests that Apple's product merely wants to see its input data encrypted with this key. I.e. anything encrypted with this key, it will play.

      Normally a public key is just that, public, and available to anyone. It sounds like in this case Apple kept the key somewhat secret, and used knowledge of that public key as a form of authorization. Only Apple products knew the public key, so it would only play music from those products.

      Now that the public key is published, anyone could encrypt data using it and get Apple's device to play the music.

      Jon hasn't broken any encryption here. He has merely learned how to encrypt just like Apple does. It looks to me like the DMCA does not apply to this case.
    2. Re:From the Site... by codework · · Score: 5, Informative

      As someone else who has recovered the public key from iTunes, I can say He did break a form of encryption. The public keys are encryped in itunes albit it with a very simple rolling xor algo.

      There is actually table of 255 public keys encoded in itunes. This is just one of them.

  6. Re:What? by Anonymous Coward · · Score: 5, Informative

    DeCSS was indeed released by the group, MoRE, 4 years ago (MoRE had 3 members, you call that "large"?).

    However, as far as I can tell Johansen no longer has any connections with MoRE. All the software on his site is GPL'ed and copyrighted by himself. MoRE is not mentioned anywhere.

  7. Re:WTF? by PsychoSpunk · · Score: 5, Interesting

    This is a proverbial "last mile" problem: How do I get any sound to the Airport Express? The known elements are that the Airport Express plays Apple Lossless streamed from the client computer running iTunes. So the solution to the "last mile" is to figure out how to stream any Apple Lossless file to the Airport Express and not rely on a specific program. The conversion to Apple Lossless is left as an exercise for the reader, as they say.

    --
    ALL HAIL BRAK!!!
  8. Re:What does it means? by Kristoph · · Score: 5, Informative

    The point of the hack is to permit you to stream audio to an AE from a program other than iTunes.

    ]{

  9. He's not a big genius. by Anonymous Coward · · Score: 5, Interesting

    Maybe it appears that way to the layman, but to other programmers and computer scientists, he's just doing what comes naturally.

    Almost any good programmer can crack software. They just choose not to, or to keep quiet if they do. Jon is a skilled showman as well as a software cracker. Hey, he got his ass saved from jail by the EFF when all he was doing is fronting others code. Now he's pretty much bulletproof (he doesn't release compiled executables as that was the main DeCSS sticking point), it's only right that he should continue to champion fair use and stand against lazy attempts to be "DMCA compliant", by cracking pointless encryption schemes which only require a little reverse engineering to find the barely hidden key, not cryptanalysis.

    I think Jon's doing us a real service, which I appreciate. I don't worship his genius, as he's only doing something I've done myself, albeit on much more media-friendly targets. He could just be cracking Safedisc games in relative anonymity for the same amount of intellectual effort, but instead he's hounding high-profile DRM schemes, starting with the weakest (Apple). Worship him if you want.

  10. Re:What? by Anonymous Coward · · Score: 5, Informative

    It's worth mentioning that Johansen is a member of the open source VideoLAN project, which develops the libdvdcss library and VLC multimedia player.

    He reverse engineered FairPlay and added FairPlay support to VLC.

    Together with the fact that all his recent software has been licensed under the GPL this indicates that he no longer has anything to do with any "cracking" groups.

  11. Re:Too bad... by zokum · · Score: 5, Informative

    Yes, Norway is in fact the country implementing the EU-regulations the most (EU countries included) . We have a trade agreements etc with the EU, and we implement all the EU directives.

    We really should have joined EU a long time ago, and I find it absurd to not be in it. One can only hope. :-)

    If you want me to elaborate more, just reply, i can cite numerous examples, but I'd rather be on-topic to the post. But al in all, I agree with the grandparents post, it could smell trouble when the EU-DMCA comes into play....

    --
    Rest in peace Malin "looxn" Kristiansen. We miss you...
  12. I don't see the threat to DRM media here... by Lurch00 · · Score: 5, Interesting

    Can somebody explain to me how _this_ hack threatens the DRM protected content? AFAICT, itunes decrpyts the content, converts it to this lossless stream, reencrypts it to protect it in transit, and streams it to the AE. There's no threat to the DRM media here at all, since you have to have an unprotected source to start with.

    The real threat is that somebody will take this and figure out how to fake being an AE, then you essentially have iTunes doing the work of defeating its own DRM for you. This would have the advantage (from a piracy standpoint) of being fairly hard for Apple to fix via "bug fix updates", unless they built a way to upgrade the AE firmware the same way. That's something I can see people getting into a tizzy about, but for this particular hack I think the useful purposes far outweigh the piracy ones.

    Just a thought.

  13. Must be a new definition of "cracked" by DavyByrne · · Score: 5, Insightful

    Since when is using a publicly available public key to encrypt a stream of data from an application and send it to a device considered "cracking?" It seems to me that this is a good ol' hack (read: clever piece of software), just like DeCSS or the other thing he did with protected iTunes tracks.

    I wasn't surprised that the first source I saw report this called it a "crack," but had hoped by the time the story made it to /. the error would be corrected.

    By the way, you do a real disservice to people trying to fight the DMCA by calling things like this "cracks." Lawyers for the bad guys already think these sorts of hacks are actually illegal cracks. You're bolstering their opinion by conflating the two.

  14. Re:Why is Apple's encryption so weak? by mmusson · · Score: 5, Informative

    The strong encryption was not cracked. The implementation was cracked. No software-only based encryption is secure, period. The audio stream is encrypted with AES. AES is a symmetric key encryption sceme which means that both sides need the same key. The key needs to change over time or the encryption scheme can be cracked.

    This leaves the problem of how iTunes can tell the Airport the new key without everyone else listening and knowing the key also. Apple use RSA to secure the key transfer. RSA is a public key encryption system. This means there are two keys one public and one private. The private key is only known by the Airport. The public key is embedded in the iTunes software.

    When iTunes wants to send a new AES key to the Airport it uses the RSA public key to encrypt the AES key. This encrypted message can only be decryped with the private key that the Airport has which means the system is secure even though everyone hears the new key in encrypted form.

    The problem is that the RSA public key is embedded in the iTunes code. But that code needs to read in the key in order to use it and someone can reverse engineer this process to read the key themselves. This isn't necessaryily an easy thing to do but in a software only solution there is no way to stop it.

    --
    SYS 49152