Breaking Google's DRM

An anonymous reader writes "Google's new Google Print service (that lets you see scanned pages from printed books) has a pile of advanced browser-disabling DRM in it ('Pages displaying your content have print, cut, copy, and save functionality disabled in order to protect your content.'). This works with JavaScript turned off, even in Free Software browsers. Seth Schoen has posted preliminary notes on some breaks to the DRM (beyond just automating a screenshotting process), including a proposal for a circumventing proxy that would fetch Google Print pages and strip out the DRM. A full exploration of the html obfuscation and DRM employed by Google would be very interesting; certainly the ability for a remote attacker to disable critical browser features like save, right-click, copy and cut against the user's wishes is a major security vulnerability in Moz/Firefox and should be fixed ASAP."

Comments

That explains those mysterious hirings

[waynegoode]

Knowing how to develop stuff like this is not a skill everyone has. This might explain why Google recently hired some browser-type software developers (as discussed on Slashdot).

Re:That explains those mysterious hirings

[Gentoo Fan]

Google is not god.

Correct, Google is much more useful.

Re:That explains those mysterious hirings

[Sqwubbsy]

Google is not god.

Blasphemer!

Re:That explains those mysterious hirings

[Karma Farmer]

The haven't even added the half dozen extra spoilers. The complete DRM can be boiled down to eight lines of very, very simple HTML, including the CSS you've hinted at above:

<style type="text/css" media="print"> .hidden { display:none; }
</style>
<div class="hidden">
<div style='background-image:url("http://print.google.c om/pageimage.gif")'>
<img src="clear.gif" width=575 height=752>
</div>
</div>

It's a cool technique. But I can'timagine how hundreds of people on slashdot can look at this without more than half a dozen knowing how it's done.

Security issue?

[radish]

certainly the ability for a remote attacker to disable critical browser features like save, right-click, copy and cut against the user's wishes is a major security vulnerability in Moz/Firefox and should be fixed ASAP

While I agree it would be nice to fix this from a convenience point of view, and a "it's my computer - it'll do what I want" point of view, how is this a security risk? How do I get a trojan, or lose files, because of an inability to copy & paste on a particular page?

Re:Security issue?

[Rude Turnip]

"...how is this a security risk?"

A part of your security is having control over your computer. Your security has been compromised when you lose that control.

Re:Security issue?

[lukewarmfusion]

No kidding... you may not like having those features disabled, but calling them a "security vulnerability" is like shouting "terrorist" because you don't like what someone else says.

There are plenty of sites that go to great lengths to turn off functionality like copy, back button, print, etc. When a major corporation does it, suddenly it's a risk?

Google can only offer that information because they can employ DRM.

Re:Security issue?

[EvilSS]

A denial of what service? Your inaliable right to Copy-Paste-Repeate? Your God given right to duplicate copyrighted works?

Even though most of /. may not like it, Google has to protect the copyright of the books in its search, or not offer them at all.

Take your pick:
Google offers book searching with DRM
Google does not offer book searching

Re:Security issue?

[rackhamh]

Your computer is a physical piece of hardware. Unless somebody has locked the case and/or tied your hands behind your back, you retain full control over it... including the decision of which software to install, and which services you choose to use.

If Google Print doesn't offer the save/print/whatever functionality you desire, then don't use it.

There, you just exercised your control over your computer.

Re:Security issue?

[arose]

Copyright isn't a god given right either. People tend to foerget that...

Re:Security issue?

[Feanturi]

That definition's too broad though. Is crippleware of any sort then, a security risk? That doesn't make sense. Though, we're talking about a full app here that already saves other things fine but just not this particular content. So what? How is that a loss of 'control'? I still have control over *my* system, just not the ability to manipulate *someone else's* material.

Re:Security issue?

[earthforce_1]

>Your computer is a physical piece of hardware. Unless somebody has locked the case > and/or tied your hands behind your back, you retain full control over it...
> including the decision of which software to install, and which services you
> choose to use.

Unfortunately, that is the idea behind "trusted" computing. You no longer have full control over your own machine, you can only run applications "trusted" by those controlling the DRM. As soon as you run an untrusted app, you cannot run a trusted application. Typically, in this case the trusted app would be a DRM compliant browser. Attempt to fire up mozilla or anything that can otherwise image the data (even from a screenshot) and the it will not be allowed to run, or if it does the trusted apps will immediately shut down. At least in theory, that is how it is supposed to work.

Of course, nothing would stop you from capturing the screen from a camera on a second PC synchronized to the frame rate. It just makes things awkward.

Re:Security issue?

[cduffy]

This is distinctly unlike crippleware, unless that crippleware were to (for instance) disable some OS-level functionality until it's paid for.

Web content shouldn't be able to affect browser functionality without the user's consent, just the same as an application shouldn't be able to disable a part of the OS.

Finally, and I've said this elsewhere: It's not "someone else's" material in the sense that they have complete and total ownership; it's "someone else's" material in the sense that they own copyright over it. Copyright is, by intent, limited: It controls reproduction, public performance, and several other actions, and no more. It also have a number of execeptions where reproduction and so forth can be permitted (for instance, exerpting for a review).

Pretending that ownership of the exclusive right to reproduce (and some other actions as well) is equivalent to complete and total control is a modern myth -- but if folks folks don't fight for that distinction, we may well lose it; and in that case, it's the public as a whole that misses out.

Re:Security issue?

[Plutor]

I'd like to see something like this, for instance, in Firefox's security settings near the Javascript permission settings:

Block sites from:
[X] Disabling right-click context menus


In Firefox:
* "Edit" -> "Preferences"
* Select "Web Features"
* Click the "Advanced" button next to "Enable JavaScript"
* Uncheck "Disable or replace context menus"
(This was bug 86193, checked into the code in March. It's in 1.0PR)

As for single-window mode, there are plenty of extensions. Try the one called "Tabbrowser Extensions", for instance.

Re:Security issue?

[radish]

You have complete control. Don't go to that site. See? Easy. No one is forcing you to use this service. If you choose to use it, you are subject to certain rules, one of which is - no copy & paste. Don't like the rules? Don't use the service.

Counter Example 1: Many popular games won't run without the CD in the drive. In other words, if you try to start the app without the CD, it will not do what you want (it will exit). Did you just lose control of your computer? Is your security at risk? Of course not.

Counter Example 2: Hard drives have firmware built into them. It is this firmware, not any software on the machine itself, which controls exactly where on the disk data is written. If this firmware fails, data can be lost. This firmware is in ROM, on the drive itself. When you save a file you are trusting it to do the right thing, whatsmore, there's no way you can actually tell what it is doing, or affect what it does. Have you lost control? Is your security compromised?

It's doomed.

[gowen]

Facts :

i) To display the books, they've got to send that information to the browser, on your machine.
ii) Once its displayable on your machine, there is *absolutely* no way they can stop a determined person from printing it.
iii) If its going to work on Open-Souce browsers, the DRM must be fairly transparent.
iv) If it works on Open Source browsers, someone cleverer than me will modify that browser so that it works as the user intends, rather than the sender. Their only protection is the DMCA, which may stop a US coder from writing/distributing the hacked app, but the rest of us will be laughing.

Frankly, if Google were as smart as they're hyped to be, they'd know this.

So?

[lxs]

Messing with our browsers and DRM

Does this mean that Google is now officially an Evil Company(TM)?

Article Text

[Anonymous Coward]

Google DRM

To further protect your book content, printing and image copying functions are disabled on all Google Print content pages.

Similarly:

We've put a number of measures in place to prevent the downloading, copying, or printing of your content [...] Pages displaying your content have print, cut, copy, and save functionality disabled in order to protect your content.

I'm surprised at how much effort Google went to here. I would have expected my browser not to be vulnerable to having any of its "functionality disabled", yet, with a recent Firefox, I found that I couldn't

1. print the page to a PostScript file,
2. right-click on the page at all,
3. save the page to disk (the image would somehow not be downloaded at all),
4. view the precious image in Page Info/Media (although I could see which image it was),
5. save the precious image in Page Info/Media,
6. find the precious image in the DOM Inspector (which seemed like the really heavy artillery), although the DOM Inspector did let me see its URL as part of an uninterpreted style definition, and seem to reveal the trick: defining a style called ".theimg", with the definition

{ background-image:url("http://print.google.com/long url with cryptographic signature"); background-repeat:no-repeat; background-position:center left; background-color:white; }

and then invoking that style inside a tag:



So I tried turning off JavaScript, and I found that I was essentially no better off: right-clicking caused a copy of cleardot.gif, not the .theimg background, to be saved to disk. For some reason, Save Page As.../Web Page (complete) still declined to download the background image at all, even in the absence of JavaScript, as if perhaps the CSS parser in the display logic in Firefox is smarter than the CSS parser in the Save Page As... code.

The two ways I've found so far that work to capture images from Google Print are a screen capture (I used xwd, which of course worked perfectly) and looking in the on-disk cache (ls -lrt .mozilla/firefox/default.*/Cache/[0-9A-F]*). I'm still puzzled about why Page Info and the DOM Inspector won't actually reveal the image referenced in the .theimg style or allow it to be saved.

If you wanted to write a proxy that would make Google Print pages capable of being saved to disk, you would presumably want to match

background-image:url("http://print.google.com/\( [^ "]+\)")

(although you'd need to be careful to match only the one in the definition of ".theimg", because it looks like there may at least one other background-image:url) and then replace



I haven't tried this because it felt like too much work relative to the previous two methods.

Contrary to what I expected, Google Print does not seem to check referer, so it seems to be possible merely to extract the URL from the definition of .theimg, and then to load it directly. Perhaps that will change in the future.

Google must have hired some experts on html image protection or html obfuscation. To be sure, there are lots of other tricks in Google Print that I had never seen before. It is hard to think that the author of that HTML obfuscation was not the subject of Richard Stallman's accidental haiku. It is amusing to think that Mr. Bad's "other" DeCSS might at last be used for some kind of circumvention (although I doubt it, because presumably Google Print simply won't work at all with the CSS removed).

Re:First, how go I get to Google Print

[deicide]

Seacrh for "economic development".

gerv talks about this

[glob]

gerv, a mozilla developer, has a few blog entries that talk about how the print service tries to stop you from getting to the jpeg's, and how to bypass that.

Google Print, And Clue Barriers
Google Print Hacking Ideas

Re:Getting stuff for free?

[ImaLamer]

this just looks like breaking DRM to get stuff for free.

You are 100% right.

It isn't about "security" or even "fair use" it's about the ability to cut and paste, save and print someone else's content without their permissions.

I could understand if you owned the books but you don't. Sounds like a good way to bite the hand that feeds you.

If you are really concerned with Google messing with your browser... don't go to any Google domain, ever. Add an entry in your HOSTS file for google, froogle, gmail, gbrowser and whatever else you'd like.

It's a free service, free in the sense that you are free not to use it.

very easy to break...

[AmigaAvenger]

Guess I just broke it...

First, turn off javascript. then turn on image dimensions. right click on the dimensions for the main image, and click view background image.

http://print.google.com/print?id=ULQSG0Zs7vcC&pg=3 &img=1&q=mastering+digital+photography&sig=gv2nFpt Ef0dj7Gzb8eZ4U8UdtUo

is the URL that is used, and surprisingly it is linkable from outside, it doesn't appear to check IP's, browsers, or anything else. (deep link away!)

Re:here we go again.

[dykofone]

And I say let the revolution begin!

The BPAA (Book Publishers Association of America) has destroyed literature by stifling innovation and branding it's own pop authors that it force feeds to the masses. Why, I can't go outside without being forced to read the latest chart topper.

And really, why should I be forced to pay $20 for a whole book when only a few chapters in it are any good, and I could just download those from google or have a friend make me a copy.

Re:Getting stuff for free?

[Anonymous Luddite]

If someone's only business model is to put some crap on a website, charge a bunch of money for access, and hope to sit back and watch the cash roll in, I think they will be in for a rude wakeup call.

You're absolutely right.

If that worked, the internet would be full of pornography in a heartbeat.

Oh. Wait a minu.. ..nevermind