Slashdot Mirror
'DVD Jon' Breaks Google Video Lock
WillemdeMoor writes "Yahoo News runs a story on Jon Johansen, aka DVD Jon, cracking Google's in-browser video player. Addict3d.org has some more details, including links to Johansen's patch (Win32 executable) and Jon's blog entry at nanocrew.net."
"'DVD Jon' Breaks Google Video Lock
:p ... Talk about a sensational news article :)
Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.
The patch, released on Johansen's 'So Sue Me' blog, effectively disables a modification Google made to the VideoLAN code to prevent users from playing videos that are not hosted on Google's servers."
ROFLMAO!?! Ahahahahaha
Jon made a modification to an OPEN SOURCE media player, removing a trivial protection, and Yahoo news posts a story about him cracking yet another protection mechanism, implying parallels with his past work. This news then spreads to Slashdot.
Awww, come on... I've made countless little mods to open-source apps in order to get them to behave the way I'd like. I've never gotten news coverage for adding "//" before an 'if(condition)' statment.
So, in other words, he modified the source code, which was being distributed. They didn't attempt to obfuscate that they didn't allow it from other hosts. They didn't entangle the code or anything. The code was wide open.
In other words, big friggin deal. All you had to do was grep the code of an error message and a little snipping of the code. Any fool could have done it. Or even screw that, it was domain-based. Setup an HTTP server, modify your hosts file to alias "video.google.com" (or whatever the domain was) to 127.0.0.1, and you're done. Or just modify VLC to know the MIME type "application/x-google-vlc-plugin" and you can play your heart away.
What "crack" will he do next? Take the VLC code to dump the file/stream you're playing, add it to Google's code, and create a Google Stream Ripper? Wow... how... amaz... ing. Or maybe add some awesome skins to the Google player? Yeah, that'd be great. Best part of all, he'll do it in 48 hours, while standing on his head, without sleeping, pizza, or coffee, and while playing the banjo!!!
Free of Flash! Free of Flash!
From the article, the only protection was limiting the allowable sources to video.google.com and adding a new mime type.
Not to undermine Jon, just noting why it took him 24 hours to break this - It was not designed to withstand much of an attack.
Nontheless, most users won't patch, so it will work anyway.
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
Before everybody starts criticizing Jon... please remember that he's actually not publicising this as being a huge crack operation, it's the sites which are publicising his hack which are. He's just made a minor fix to a program, nowhere on his Blog does he say "OMGZ I HAX0R J00!" Infact he documents the exact way he did it to show that he didn't actually do anything complex.
My 3D Texturing Skinning work (under construction)
Or they will more intelligently do neither saying "Anyone can modify our open source client to do whatever they want, for whatever reason they want."
Do you really think google doens't understand open source?
Of course, you'll need to be locked into .NET to do so.
Yay.
Uhh, good sir, could you please put the shackles back on? My ankles are getting cold. Thank you.
Quantum materiae materietur marmota monax si marmota monax materiam possit materiari?
Of course Yahoo News is running an article on how something Google made got hacked.
Acts 17:28, "For in Him we live, and move, and have our being."
all DVD Johny did was remove an if statement that checks is the URL is from google or not...
the upshot is you get a VLC plugin that can read some propriatary MS formats (thanx to google paying the bill for those software royalties)
it seems so easy that it's as if Google was just waiting for someone to come in and hack it.
I would rather be ashes than dust!
Or they will more intelligently do neither saying "Anyone can modify our open source client to do whatever they want, for whatever reason they want."
Do you really think google doens't understand open source?
I think you make a very good point. This is perhaps more of an example of Google "doing no evil", creating a tool that, by default, for most casual users, promotes their video feed, while at the same time using a good free software project that allows those who want to, to bypass this setting.
If most people find the restriction onerous, they'll download a patched version (probably from websites that are also offering video). Social and market dynamics can take care of the rest. It seems a fairly reasonable position for Google to take ("we'll try this restriction, and if people really find it offensive, they'll modify the source and outcompete our offering, and we can write it off to experience and not try imposing these sorts of restrictions again. Either way, it probably won't affect our video feed business much.")
I doubt very much it is incompetence--google has much of the best talent around--nor is it a lack of understanding opensource/free software on the part of google, as they've been active in the community for many years.
The Future of Human Evolution: Autonomy
According to this,
+ const char* allowed_host = \"video.google.com\";
+ char * host_found = strstr(p_sys->url.psz_host, allowed_host);
Wouldn't it be possible to have a subdomain structure like:
video.google.com.whateverdomain.com
And then be able to use Google Video on your own site, without applying the patch at all?
My <1000 UID is with a hot chick
depends on the native indenting style
if the code was
if ( conditional )
{
do();
some();
stuff();
}
then a slash slash could be used to activate the code every time
//if ( conditional )
{
do();
some();
stuff();
}
A single ampersand will do a bitwise AND with 0 -- which is always 0 -- so you can actually do it with just two added characters.
Does this make me a master hacker?
Ooh, a sarcasm detector. Oh, that's a real useful invention.
Who are "we all"? You think you're a member of some kind of team? Who's to say who's honorable and who are the good guys? This guy did something of interest to him and nothing more. His ideology is simply different than yours and, in his view, google did something sufficiently "evil" (in your words) to merit a response. He doesn't answer to you or to some imaginary "geek community".
### I'm disappointed by Google's use of the 'goto' keyword.
While goto is often better avoided, a call like "goto error;" is among the perfectly valid uses of goto, since it actually can make code more clear and logical then code without goto. Such use of goto is really no different then exceptions in C++, simply a way to get to the place that handles the error conditions without having to painfully drag error-variables through the code.
No. Read the second clause of the IF statement.
No, I've seen those people. They are on ego trips. They think they know everything about everything and because they saw someone mention that "goto is evil" on teh Intarweb they think no one should use it. They are morans.
goto is an extremely useful tool. It shouldn't be abused but is useful nonetheless (exception handling in plain C code is one example).
Chris, are you making that statement as a representative of Google? If so you might want to be careful given what happened to Mark Jen. I'm sure you as the Open Source director agree with this hack, but perhaps the people in the Google Video dept that planned on making some money with this idea don't quite feel the same way?
> Such use of goto is really no different then
> exceptions in C++
>
Using goto is a great way to create memory leaks. C++ exceptions guarantee that all objects going out of scope have their destructors invoked to allow resource deallocation.