Slashdot Mirror
'DVD Jon' Breaks Google Video Lock
WillemdeMoor writes "Yahoo News runs a story on Jon Johansen, aka DVD Jon, cracking Google's in-browser video player. Addict3d.org has some more details, including links to Johansen's patch (Win32 executable) and Jon's blog entry at nanocrew.net."
"'DVD Jon' Breaks Google Video Lock
:p ... Talk about a sensational news article :)
Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.
The patch, released on Johansen's 'So Sue Me' blog, effectively disables a modification Google made to the VideoLAN code to prevent users from playing videos that are not hosted on Google's servers."
ROFLMAO!?! Ahahahahaha
Jon made a modification to an OPEN SOURCE media player, removing a trivial protection, and Yahoo news posts a story about him cracking yet another protection mechanism, implying parallels with his past work. This news then spreads to Slashdot.
Awww, come on... I've made countless little mods to open-source apps in order to get them to behave the way I'd like. I've never gotten news coverage for adding "//" before an 'if(condition)' statment.
..Google's reaction. Up till now, most folk have been singing the praises of the nice, friendly, cuddly search engine company. Will this change anything? I personally doubt it.
You can skip the articles they don't tell you much other than what is in the Slashdot Summary. However, the blog entry has the code part on it. Here are all the articles including code entry...
.Net run-time framework, will remove Google's restriction and allow the playback of video files that aren't on the video.google.com server.
6 ,00.asp
// Google mods
.NET runtime.
Story:
Ryan Naraine - PC Magazine Tue Jun 28,10:49 AM ET
Norwegian hacker Jon Lech Johansen has cracked the lock on Google's new in-browser video player.
Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.
The patch, released on Johansen's 'So Sue Me' blog, effectively disables a modification Google made to the VideoLAN code to prevent users from playing videos that are not hosted on Google's servers.
Johansen said the patch, which requires the
The 21-year-old hacker, who faced two trials in Norway in 2002 and 2003 for his role in the release of the
DeCSS decryption software, is a hero to many for his efforts to defeat DRM (digital rights management) mechanisms built into media player technology.
He has been involved in a public cat-and-mouse game with Apple Inc., releasing several tools to bypass the DRM software used to encrypt music sold on the iTunes Music Store. LINK TO: PyMusique Unlocks iTunes Copy Protection. Again. http://www.extremetech.com/article2/0,1558,177952
Johansen has also cracked Apple's AirPort Express's encryption and released a proof-of-concept program that allows
Linux users to play video encoded with Microsoft's proprietary WMV9 codec. The proof-of-concept is based on the VideoLan code.
Addict3d.org more details:
Jon Lech Johansen, "DVD Jon", took just one day to build a crack to allow you to play video on your website using Google's VLC-based player.
This means you can publish video that will play on your webpage and will work for anyone who has Google's player installed.
Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.
Crack can be found here -
http://nanocrew.net/wp-content/GVVPatch.exe
http://nanocrew.net/?p=114
Blog Entry:
Google has released Google Video Viewer, a browser plugin based on VLC. Here's one of the features they've added:
+
+ const char* allowed_host = \"video.google.com\";
+ char * host_found = strstr(p_sys->url.psz_host, allowed_host);
+ if ((host_found == NULL) ||
+ ((host_found + strlen(allowed_host)) !=
+ (p_sys->url.psz_host + strlen(p_sys->url.psz_host)))) {
+ msg_Warn( p_access, \"invalid host, only video.google.com is allowed\" );
+ goto error;
+ }
This "feature" prevents you from playing videos that are not hosted on Google's servers. Download and run this patch I wrote to remove this restriction. Running the patch requires a
Quality Hosting e3 Servers
So, in other words, he modified the source code, which was being distributed. They didn't attempt to obfuscate that they didn't allow it from other hosts. They didn't entangle the code or anything. The code was wide open.
In other words, big friggin deal. All you had to do was grep the code of an error message and a little snipping of the code. Any fool could have done it. Or even screw that, it was domain-based. Setup an HTTP server, modify your hosts file to alias "video.google.com" (or whatever the domain was) to 127.0.0.1, and you're done. Or just modify VLC to know the MIME type "application/x-google-vlc-plugin" and you can play your heart away.
What "crack" will he do next? Take the VLC code to dump the file/stream you're playing, add it to Google's code, and create a Google Stream Ripper? Wow... how... amaz... ing. Or maybe add some awesome skins to the Google player? Yeah, that'd be great. Best part of all, he'll do it in 48 hours, while standing on his head, without sleeping, pizza, or coffee, and while playing the banjo!!!
Free of Flash! Free of Flash!
Ironically, there is nothing on Google News concerning it.
Anyone else notice that Yahoo Search looks and acts EXACTLY like Google's? (That's probably redudant...)
I am just waiting for Revenge of the Sith to hit Google Video.
From the article, the only protection was limiting the allowable sources to video.google.com and adding a new mime type.
Not to undermine Jon, just noting why it took him 24 hours to break this - It was not designed to withstand much of an attack.
Nontheless, most users won't patch, so it will work anyway.
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
Cmon Google.
Get your own free personal location tracker
... heard 'round the world!
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
What's up with Google releasing all these Windows-only apps, anyways? Really, now.
It's a good thing he didn't try to tangle with Macrovision. As lightning-uk almost found out, it's hard to code when you're fingers are broken and your eyes have swollen shut from contusions.
Is it just my observation, or are there way too many stupid people in the world?
Before everybody starts criticizing Jon... please remember that he's actually not publicising this as being a huge crack operation, it's the sites which are publicising his hack which are. He's just made a minor fix to a program, nowhere on his Blog does he say "OMGZ I HAX0R J00!" Infact he documents the exact way he did it to show that he didn't actually do anything complex.
My 3D Texturing Skinning work (under construction)
I'm no geek and really do not understand .NET clearly. I am still running Windows98 SP2. Does this fact mean that I cannot utilise his patch since Windows98 is just too old to even have a .NET runtime?
Now we see what Googles true colors are.
Will they say "hey thanx for the tip? Want a job?" or will they go all RIAA on little johny?
Stay tuned for the next exciting episode of as my stomach turns!
I would rather be ashes than dust!
Quote:
This means you can publish video that will play on your webpage and will work for anyone who has Google's player installed.
That part is highly misleading! The people who want to view video on your website each individually need to download the patch! It's not very useful to content providers with this restriction.
How about users? Who would download this patch? Well, people who want to watch videos tagged with application/x-google-vlc-plugin that aren't from google. Not too many of these...
And Videolan is backporting Jon's work so it can play google streams, and non-google streams.
So it seems, in the end, everyone will get a browser plugin that can play google video streams.
The wonders of open source.
Now, if only google had chosen Ogg Theora instead of patent encumbered MPEG4.
Of course, you'll need to be locked into .NET to do so.
Yay.
Uhh, good sir, could you please put the shackles back on? My ankles are getting cold. Thank you.
Quantum materiae materietur marmota monax si marmota monax materiam possit materiari?
I'm disappointed. It has been, what, 2 days? It took Jon 2 days to crack another DRM?
People are getting lazy ya know... I thought Jon should have cracked it in 3-4 hours.... That boy needs to stop smoking so much....
PS: Mod me Funny +5 / Informative +5
Of course Yahoo News is running an article on how something Google made got hacked.
Acts 17:28, "For in Him we live, and move, and have our being."
all DVD Johny did was remove an if statement that checks is the URL is from google or not...
the upshot is you get a VLC plugin that can read some propriatary MS formats (thanx to google paying the bill for those software royalties)
it seems so easy that it's as if Google was just waiting for someone to come in and hack it.
I would rather be ashes than dust!
Damn, tone it down its 9am. Let me guess, your a little bitter because you ended up being a database geek instead of an elite haxor?
I think we should all remember that just because Google is the pinnacle of success and is second only to (insert your diety here), Google too can make mistakes.
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
If you check out the blog, you'll see that there's a nice goto at the end of the if statement.
Supposedly Google only hires top-coders, so what's up with that?
Various anti-piracy groups are pressuring congress to pass an extention to the DMCA laws, which will effectively outlaw commenting out parts of computer code. Under the new law it will also be illegal to manufacture a computer keyboard with the forward slash '/' key.
What a fabulous idea! I'll get right on it!
Thanks,
Sen. Orrin Hatch
"DVD Jon cracks MythTV to record video from a TV Tuner"
Being funny is my sig nature.
Is this more or less what he did?
// if(!running_on_google())
Before:
if(!running_on_google())
After:
Hope it's not "DVD Jon breaks leg"
I think we all like Jon when he was meddling with "evil" companies. How do we feel now that he is locking horns with the geeks' uncontested favorite company? I'm all for raising a little hell when the intents of a company are less than honorable, but leave the good guys alone. Not to say Google can do not evil, just that they haven't yet.
Does the Google video viewer even run on your Win98 system? The system requirements say that it requires "Windows 2000 or later with latest updates installed".
A real hacker would do something like this:
(3 added characters)or at the very least:
(4 added characters)Currency converter with free form text entry of conversion amounts and currencies
In his defense though, it's the news source, Yahoo, sensationalizing his mods and not his own blog entry (i.e. he doesn't claim that this is some grand crack). His candor in his blog entry doesn't even hold up to the grandiose imagery of a scheming, brilliant hacker striking another blow against "the man" as painted by Yahoo. I actually feel sort of sorry for the guy given the magnitude of the patch being so inflated.
This little known hacker tool is responsible for cracking Google's video player. See how it could affect your computer's security, tonight at 11!
Or they will more intelligently do neither saying "Anyone can modify our open source client to do whatever they want, for whatever reason they want."
Do you really think google doens't understand open source?
I think you make a very good point. This is perhaps more of an example of Google "doing no evil", creating a tool that, by default, for most casual users, promotes their video feed, while at the same time using a good free software project that allows those who want to, to bypass this setting.
If most people find the restriction onerous, they'll download a patched version (probably from websites that are also offering video). Social and market dynamics can take care of the rest. It seems a fairly reasonable position for Google to take ("we'll try this restriction, and if people really find it offensive, they'll modify the source and outcompete our offering, and we can write it off to experience and not try imposing these sorts of restrictions again. Either way, it probably won't affect our video feed business much.")
I doubt very much it is incompetence--google has much of the best talent around--nor is it a lack of understanding opensource/free software on the part of google, as they've been active in the community for many years.
The Future of Human Evolution: Autonomy
I get the impression from the name "DVD Jon" that this guy is really good at perhaps hacking code for the use of some media device. So why is adding "//" to impressive? Surely he has done better in the past.
"DVD Jon" breaks wind, Yahoo! news is there!
jon could turn his attention to the m$ drm
we'd all be glad
hate that format and hate not being able to
convert it into ex.xvid
especially pw protected wmv's
"Video is currently not available" is appearing on every video clip I can find on video.google.com
Coincidence?
Google RSS feeds:
Google releases Google Maps
Google releases Google Desktop Search
Google releases Google Web Accelerator
Google releases Google Video
Yahoo RSS feeds:
Are Google Maps an invasion of your privacy?
Is Google Desktop Search working *too* well?
All about your privacy and Google Web Accelerator: The secret agenda.
Google Video cracked within 24 hours. And privacy.
but I'm too busy trying to stifle my laughter at the multi-layered irony of this legend taking, what, all of five minutes to break this. On top of it being for Windows. On top of it being based on VLC which is OSS. On top of that being yet again done by Google (why is the new demigod of the OSS world Google when Google is so relentlessly Windows-centric?). On top of what he did being trivial for most coders and more so for him. On top of the insane volume of squaking about it.
Want DRM? Write a closed souce undocumented codec from the ground up and closed source apps to play things recorded with it. Want to skate by on the cheap and use existing well known standards and even be so insane as to use OSS? Well...
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
"Google no longer following 'don't be evil' mantra" headlines?
I wonder if Jon would be as motivated in demonstrating how easy it is to crack trivial industry DRM if he hadn't been persecuted for his legit work as a kid. It's a good thing they didn't send him to Guantanamo, or this country would be in more trouble than Hollywood.
--
make install -not war
To this Jon replied
Kinda makes sense why we need a hack anyway.
Anyone else notice that Yahoo Search looks and acts EXACTLY like Google's? (That's probably redudant...)
;)
Y-ah-oo? What's a Y-ah-oo? Oh Search! I know what search is. You mean Google.
Yes, it is redundant to say google looks exactly like google
Use OSS and Release source code? It looked like Google is just asking people to mod their software.
In US, you can easily buy enough major firearms to wipe out your neighbourhood but a few little fireworks are banned.
Seriously, does Jon have to do it all? If some states AG gets a burr under his saddle about something like this, they can again incarcerate him and cost him a boatload of sheckles to get clear of it.
My point is, why does it always have to be 'DVD Jon' that does it, the more contributions by others the merrier the party.
And this comment from a 70 year old who really ought to be more of an 'establishment' type.
Realisticly, both patent and copyright has been expanded to protect the guilty until even I can see the falacy of it and its deleterious effects on society and the needless stifling of technological progress.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
99.35% setiathome rank, not too shabby for a WV hillbilly
Oh! Did Google release a RSS news feed ?
Distribute some content.
Modify an open-source player to view it.
But add restrictions. Distribute the source, too (per GPL).
Accuse anybody who modifies the source AFTER you have added your restrictions of DMCA violations.
Demand that all further development of the project stop as it's in violation of DMCA.
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
A lot of people posting sound a lot like all of the Bushites that seem to lose all ability to reason whenever their beloved president does something they don't agree with.
First, they ignore it like it doesn't exist.
Then they try to explain it away or dismiss it as minimal.
Then they attack those pointing out the error.
Then they just go insane and spontaneously combust.
Currency converter with free form text entry of conversion amounts and currencies
8 6132416392876567415754
http://coinmill.com/convert/USD_GBP.html?amount=7
7.8613241639288E+23 United States Dollars
are worth
4.34 Pounds Sterling
now i can afford that Fortune 500 company that's been bugging me with crap products. Lol!
Do unto MS as MS does unto you.
:)
Embrace and Extend them.
I8-D
DVD Jon is the front man for a large group of hackers and crackers. If they come up with something clever, it usually gets released under his name since he's well-known and willing to be the lightning rod.
In this case, this is a 5-minute hack he just did because he was curious (or perhaps as a mild frown at Google). There was nothing hard or sinister about this one (despite the "news" sites spinning this as if it were similar to the past exploits DVD Jon is known for, which it really is not)
please submit your goto-less version of the TCP input routine in the BSD IP stack.
//g"
:o)
"s/goto
Note that you didn't specify that the code had to work afterwards.
Jon: Sons of Slashdot. I am DVD Jon.
Slashdotters: DVD Jon is seven feet tall!
Joh: Yes, I've heard. Kills men by the hundreds! And if he were here, he'd consume the MPAA with fire balls from his eyes and bolts of lightning from his arse! I am DVD Jon! And I see a whole army of my countrymen, here in defiance of tyranny. You've come to fight as free men, and free men you are. What will you do with that freedom? Will you fight?
A little offtopic, but who gets to decide these things, to prevent clashes? What's their purpose anyway?
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
So... What would the steps be, then, to turn this into the default browser video player plugin for IE, FF, or Opera?
Not everyone is familiar with slash fiction, so I'm afraid that joke probably went over a lot of people's heads. Very high 'Dennis Miller' quotient. For the uninitiated, slash fiction is fan fiction of a pornographic nature, usually homosexual, almost always written by bored housewives (from what I hear.) Things like "Kirk/Spock", "Han/Luke", or "CmdrTaco/Hemos". Thus the slash.
Did anyone notice the entire Matrix Revolutions is available there in Google Video? Pretty cool. You might think it's just 30-second clips, but hit "Play whole video" and off it goes. Whole movie. Wondering if this is a special "show-off" case google snuck in, or a black-hat's upload?
see this link for the video
Evan - needs to hit preview before submitting
+ // Google mods
+ const char* allowed_host = "video.google.com";
+ char * host_found = strstr(p_sys->url.psz_host, allowed_host);
+ if ((host_found == NULL) ||
+ ((host_found + strlen(allowed_host)) !=
+ (p_sys->url.psz_host + strlen(p_sys->url.psz_host)))) {
+ msg_Warn( p_access, "invalid host, only video.google.com is allowed" );
+ goto error;
+ }
+
That's the official part of the google modification (thanks to the guy who pointed to line 389). Now, where was DVD Jon's patch to compare?
I'm surprised people are already trying to do things with the player. I can't even get the thing to run. It just hangs Firefox. I'm on a stock machine that meets all the system requirements.
This is one time I regret having tabbed browsing, as now I lose my context in several places rather than just the instance that the Google player hosed.
Hope it's not "DVD Jon breaks leg"
The news story coming is:
"'DVD Jon' breaks both kneecaps in freak 'accident'"
Of course, it's because Windows is the operating system that allows a developer to sneak "features" into the OS.
Ask any malware writer!
Good programmers know goto is harmful - great programmers know when it's not.
Actually, even there I'm exaggerating a bit. Even fairly average programmers can usually be taught when goto is acceptable and when it's not. Anyway, the goto statement in C is much more limited, and much safer than the wide-open, global-scale thermonuclear goto that Wirth originally wrote about.
Highwayman: I know you Wizards have rules against using your powers on civilians, so you don't scare me. Just hand over the money, er...ri-deep?
Ridcully: (blowing on his finger and staring at the new-made frog) It's more of a guideline than a rule, actually.
Suprisingly, there is no mention of this anywhere on Google News. Hmm...
Here's the C# source for DVD John's GVPatch.Exe
. txt
http://www.geocities.com/vishalmishra/GVVPatch.cs
yahoo gets its news from feeds (not crawled, but regular feeds), and puts the data up as they get it. this is the authoritative answer, i have worked on this site, all your conjecture is BS.
Ive seen the patch before on a torrent site http://www.bogaa.org/ I think its briliant! Hope they crack the msn webcam codec to so we Geeks can use it on our linux boxes
Nice bookmarklet. :)
If you don't want to install google's special player just download VLC zip version and then click "Open File", copy and paste the link and the video plays. No muss and no extra software/MIME types needed.
If you wanna get rich, you know that payback is a bitch
Done! You don't even need VLC: the http://video.google.com/ pages contains code like this:
You can simply copy the string (the one that starts with http...), use your favourite language to unquote it (e.g. urllib.unquote() in Python or unescape() in JS) and download the file or play it online with any media player! (mplayer under Linux is perfectly fine!)
Yeah! ;-)
P.S.: a greasemonkey script that do the above automagically, anyone?
There's a hidden treasure in Python 3.x: __prepare__()
No: you can see the videos under any OS and any (good) media player!
You don't even need VLC: the http://video.google.com/ [google.com] pages contains code like this:
You can simply copy the string (the one that starts with http...), use your favourite language to unquote it (e.g. urllib.unquote() in Python or unescape() in JS) and download the file or play it online with any media player! (mplayer under Linux is perfectly fine!)
P.S.: a greasemonkey script that do the above automagically, anyone?
There's a hidden treasure in Python 3.x: __prepare__()
here's a greasemonkey script that'll let you use any player you want on google video.
Um, the entire collection of the Travel Channel's Great Hotels?
The O'Reilly Factor?
The Tony Danza Show?
C-SPAN Book TV?
Is this stuff being provded by the TV studios?
What is the deal with Google Videos?
Where is all the content coming from?
I did all kinds of searches. Got many results. Zero of them were playable videos.
At what point did you think it was? Pressing a keystroke in the editor?
I hate it when jackasses always have to throw in their ignorant comments.
Das Keyboard
negative mods are bad, but the parent doesn't seem to get (or just chose to ignore) the joke
pseudo-mod: "-0: too serious"
Microsoft is the Marquis de Sade of the technology world.
This is an insult. The Marquis de Sade was an aristocrat and a significant writer. How can you compare him with some commercial company?
That's nothing guys. In Soviet Russia // removes you!
Can you imagine a Beowulf cluster of that? A huge cluster of Soviet //'s running night and day for the sole purpose of removing you... scares the beejeezes out of me!
All the chatter here seems to point to a plain vanilla VLC as being incapable of viewing Google video. So is Google doing us any service by making a proprietary bastard plugin out of a perfectly good Open Source viewer? Google must have sorted the licensing ramifications of .Net & GPL, but it smells off to me...
Whaaat?
then
Yeeaah!
And said all that remains to be done by the user is click:
Oh Kaaay
Get your Unix fortune now!
Google releasing video.google.com: lots-of-servers
DVD Jon "breaks" google video: dirty-patch, 10$
Average user installing patch: 20$
Some geek releasing virus with patch: PRICELESS!
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
10 company releases software
20 hacker modifies software
30 hacker releases modified software
40 software works better
50 company attacks hacker
60 post to slashdot
70 goto 10