'DVD Jon' Breaks Google Video Lock

WillemdeMoor writes "Yahoo News runs a story on Jon Johansen, aka DVD Jon, cracking Google's in-browser video player. Addict3d.org has some more details, including links to Johansen's patch (Win32 executable) and Jon's blog entry at nanocrew.net."

Comments

whaaaaa?

[Zone-MR]

"'DVD Jon' Breaks Google Video Lock

Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.

The patch, released on Johansen's 'So Sue Me' blog, effectively disables a modification Google made to the VideoLAN code to prevent users from playing videos that are not hosted on Google's servers."

ROFLMAO!?! Ahahahahaha :p ... Talk about a sensational news article :)

Jon made a modification to an OPEN SOURCE media player, removing a trivial protection, and Yahoo news posts a story about him cracking yet another protection mechanism, implying parallels with his past work. This news then spreads to Slashdot.

Awww, come on... I've made countless little mods to open-source apps in order to get them to behave the way I'd like. I've never gotten news coverage for adding "//" before an 'if(condition)' statment.

Re:whaaaaa?

[Anonymous Coward]

"I've made countless little mods to open-source apps in order to get them to behave the way I'd like. I've never gotten news coverage for adding "//" before an 'if(condition)' statment"

Hi, I'm from Yahoo News. Please tell us more about this "//".

Re:whaaaaa?

[djlowe]

Per the GPL, if he's making the changes only for his own use, and not for distribution, then he doesn't have to.

Re:whaaaaa?

[justforaday]

Hi, I'm from Yahoo News. Please tell us more about this "//".

This is slashdot gawdammit! You're looking for slashslash ...

Re:whaaaaa?

[Zone-MR]

A little-known hacker secret known as "//" or comment sequence is being used to illegally remove protections in computer software

"It's a nightmare for the industry, the // sequence is being used to defeat protections in hundreds of thousands of software programs, costing the industry trillions of dollars in lost revenue" said Robert Holleyman, president of the Washington-based Business Software Alliance (BSA).

While Linus Trovalds confirmed that the // sequence may be a powerful tool for removing protections, he downplayed the threat, stating that only software for which the code is freely availble can be cracked using the method.

Various anti-piracy groups are pressuring congress to pass an extention to the DMCA laws, which will effectively outlaw commenting out parts of computer code. Under the new law it will also be illegal to manufacture a computer keyboard with the forward slash '/' key.

Re:whaaaaa?

[Alphabet Pal]

I've never gotten news coverage for adding "//" before an 'if(condition)' statment.

Well, it's obvious that you "hackers" don't know what you're talking about. I tried using this so-called "hacker technique" to hack into a password protected website, but changing "iexplore.exe" to "//iexplore.exe" did nothing. I guess Microsoft has found a way to defeat this hacker exploit.

Re:whaaaaa?

[Momoru]

BAH!!! Yahoo News is not a News Agency, cripes it just grabs a feed from the freakin' AP and Reuters, I can't believe how many posts like yours have been modded up! Yahoo creates no more original news content then Google does, its just wire feeds...except in Yahoo's case they actually host the context. It doesn't even give precedence to stories based on their own politics, it shows stories in order of popularity, cripes.

Re:whaaaaa?

[ded_guy]

Clever hackers are now avoiding detection by using the nearly undetectable /* */ sequence instead.

Re:whaaaaa?

[aussie_a]

I hate that standard. I refuse to follow it.

Bill Gates, is that you?

You can skip the articles, not much content

[WebHostingGuy]

You can skip the articles they don't tell you much other than what is in the Slashdot Summary. However, the blog entry has the code part on it. Here are all the articles including code entry...

Story:

Ryan Naraine - PC Magazine Tue Jun 28,10:49 AM ET

Norwegian hacker Jon Lech Johansen has cracked the lock on Google's new in-browser video player.

Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.

The patch, released on Johansen's 'So Sue Me' blog, effectively disables a modification Google made to the VideoLAN code to prevent users from playing videos that are not hosted on Google's servers.

Johansen said the patch, which requires the .Net run-time framework, will remove Google's restriction and allow the playback of video files that aren't on the video.google.com server.

The 21-year-old hacker, who faced two trials in Norway in 2002 and 2003 for his role in the release of the
DeCSS decryption software, is a hero to many for his efforts to defeat DRM (digital rights management) mechanisms built into media player technology.

He has been involved in a public cat-and-mouse game with Apple Inc., releasing several tools to bypass the DRM software used to encrypt music sold on the iTunes Music Store. LINK TO: PyMusique Unlocks iTunes Copy Protection. Again. http://www.extremetech.com/article2/0,1558,1779526 ,00.asp

Johansen has also cracked Apple's AirPort Express's encryption and released a proof-of-concept program that allows
Linux users to play video encoded with Microsoft's proprietary WMV9 codec. The proof-of-concept is based on the VideoLan code.

Addict3d.org more details:

Jon Lech Johansen, "DVD Jon", took just one day to build a crack to allow you to play video on your website using Google's VLC-based player.

This means you can publish video that will play on your webpage and will work for anyone who has Google's player installed.

Johansen, also known as 'DVD Jon' for his work on decrypting DVD security codes, has created a patch for the Google Video Viewer--less than 24 hours after the search giant shipped the video playback plug-in, a tool based on the open-source VideoLAN media player.

Crack can be found here -

http://nanocrew.net/wp-content/GVVPatch.exe

http://nanocrew.net/?p=114

Blog Entry:

Google has released Google Video Viewer, a browser plugin based on VLC. Here's one of the features they've added:

+ // Google mods
+ const char* allowed_host = \"video.google.com\";
+ char * host_found = strstr(p_sys->url.psz_host, allowed_host);
+ if ((host_found == NULL) ||
+ ((host_found + strlen(allowed_host)) !=
+ (p_sys->url.psz_host + strlen(p_sys->url.psz_host)))) {
+ msg_Warn( p_access, \"invalid host, only video.google.com is allowed\" );
+ goto error;
+ }

This "feature" prevents you from playing videos that are not hosted on Google's servers. Download and run this patch I wrote to remove this restriction. Running the patch requires a .NET runtime.

Yeeeeah

[HyperChicken]

So, in other words, he modified the source code, which was being distributed. They didn't attempt to obfuscate that they didn't allow it from other hosts. They didn't entangle the code or anything. The code was wide open.

In other words, big friggin deal. All you had to do was grep the code of an error message and a little snipping of the code. Any fool could have done it. Or even screw that, it was domain-based. Setup an HTTP server, modify your hosts file to alias "video.google.com" (or whatever the domain was) to 127.0.0.1, and you're done. Or just modify VLC to know the MIME type "application/x-google-vlc-plugin" and you can play your heart away.

What "crack" will he do next? Take the VLC code to dump the file/stream you're playing, add it to Google's code, and create a Google Stream Ripper? Wow... how... amaz... ing. Or maybe add some awesome skins to the Google player? Yeah, that'd be great. Best part of all, he'll do it in 48 hours, while standing on his head, without sleeping, pizza, or coffee, and while playing the banjo!!!

It wasn't protected much, anyway

[mgv]

From the article, the only protection was limiting the allowable sources to video.google.com and adding a new mime type.

Not to undermine Jon, just noting why it took him 24 hours to break this - It was not designed to withstand much of an attack.

Nontheless, most users won't patch, so it will work anyway.

Michael

Another Windows only service.

[caluml]

Windows 2000 or later with latest updates installed; Firefox 1.0+ or IE 5.0+. DirectX 9.0c End-User Runtime.

Cmon Google.

Google and Windows

[aarku]

What's up with Google releasing all these Windows-only apps, anyways? Really, now.

Hold Your Horses

[taskforce]

Before everybody starts criticizing Jon... please remember that he's actually not publicising this as being a huge crack operation, it's the sites which are publicising his hack which are. He's just made a minor fix to a program, nowhere on his Blog does he say "OMGZ I HAX0R J00!" Infact he documents the exact way he did it to show that he didn't actually do anything complex.

Gah! It's not even useful for most!

[LincolnQ]

Quote:
This means you can publish video that will play on your webpage and will work for anyone who has Google's player installed.

That part is highly misleading! The people who want to view video on your website each individually need to download the patch! It's not very useful to content providers with this restriction.

How about users? Who would download this patch? Well, people who want to watch videos tagged with application/x-google-vlc-plugin that aren't from google. Not too many of these...

Re:True Colors

[mindstrm]

Or they will more intelligently do neither saying "Anyone can modify our open source client to do whatever they want, for whatever reason they want."

Do you really think google doens't understand open source?

Not much of a hack RTFA

[TheLoneCabbage]

all DVD Johny did was remove an if statement that checks is the URL is from google or not...

the upshot is you get a VLC plugin that can read some propriatary MS formats (thanx to google paying the bill for those software royalties)

it seems so easy that it's as if Google was just waiting for someone to come in and hack it.

goto considered harmful !!!

[scovetta]

+ // Google mods
+ const char* allowed_host = \"video.google.com\";
+ char * host_found = strstr(p_sys->url.psz_host, allowed_host);
+ if ((host_found == NULL) ||
+ ((host_found + strlen(allowed_host)) !=
+ (p_sys->url.psz_host + strlen(p_sys->url.psz_host)))) {
+ msg_Warn( p_access, \"invalid host, only video.google.com is allowed\" );
+ goto error;
+ }

I'm disappointed by Google's use of the 'goto' keyword. As was clearly described in this paper, the use of 'goto' leads to "swiss-cheesing" of the brain, the inability to think logically, and a plethora of other problems, leading eventually to brain-rot and inability to write code in anything but Perl.

I think we should all remember that just because Google is the pinnacle of success and is second only to (insert your diety here), Google too can make mistakes.

Re:goto considered harmful !!!

[grumbel]

### I'm disappointed by Google's use of the 'goto' keyword.

While goto is often better avoided, a call like "goto error;" is among the perfectly valid uses of goto, since it actually can make code more clear and logical then code without goto. Such use of goto is really no different then exceptions in C++, simply a way to get to the place that handles the error conditions without having to painfully drag error-variables through the code.

It's really disappointing

[Anonymous Coward]

If you check out the blog, you'll see that there's a nice goto at the end of the if statement.

Supposedly Google only hires top-coders, so what's up with that?

What a fabulous idea!

[Anonymous Coward]

Various anti-piracy groups are pressuring congress to pass an extention to the DMCA laws, which will effectively outlaw commenting out parts of computer code. Under the new law it will also be illegal to manufacture a computer keyboard with the forward slash '/' key.

What a fabulous idea! I'll get right on it!

Thanks,
Sen. Orrin Hatch

Re:What a fabulous idea!

[KDR_11k]

A statement issued by Microsoft Corp. insists that "We knew all along that the backslash (\) is far superior to the UNIX alternative. This proves again: Windows has a lower TCO than Linux or any other UNIX".

In related Yahoo! news...

[VeganBob]

"DVD Jon cracks MythTV to record video from a TV Tuner"

Re:Of course...

[Momoru]

Yahoo News is not a news agency, its just a feed from the Associated Press or Reuters. Yahoo hosts the content from the feeds, that is all.

In Defense...

[BioCS.Nerd]

In his defense though, it's the news source, Yahoo, sensationalizing his mods and not his own blog entry (i.e. he doesn't claim that this is some grand crack). His candor in his blog entry doesn't even hold up to the grandiose imagery of a scheming, brilliant hacker striking another blow against "the man" as painted by Yahoo. I actually feel sort of sorry for the guy given the magnitude of the patch being so inflated.

"Do No Evil"

[FreeUser]

Or they will more intelligently do neither saying "Anyone can modify our open source client to do whatever they want, for whatever reason they want."

Do you really think google doens't understand open source?

I think you make a very good point. This is perhaps more of an example of Google "doing no evil", creating a tool that, by default, for most casual users, promotes their video feed, while at the same time using a good free software project that allows those who want to, to bypass this setting.

If most people find the restriction onerous, they'll download a patched version (probably from websites that are also offering video). Social and market dynamics can take care of the rest. It seems a fairly reasonable position for Google to take ("we'll try this restriction, and if people really find it offensive, they'll modify the source and outcompete our offering, and we can write it off to experience and not try imposing these sorts of restrictions again. Either way, it probably won't affect our video feed business much.")

I doubt very much it is incompetence--google has much of the best talent around--nor is it a lack of understanding opensource/free software on the part of google, as they've been active in the community for many years.

Re:Source code?

[KillerBob]

http://code.google.com/patches.html

With that link, and a little knowhow, you, too, can crack the code and make your own Google Video viewer. The upshot is that you can compile it for Linux (Google has only released it for Windows). The downshot is that I'm surprised it took Jon so long to make the change. :)

It's not like it was hard to find... go to http://video.google.com/ click on "Install", and then click on "Get the source code". It's under "patches".

Re:Too many clicks and chunks there

[Eccles]

A single ampersand will do a bitwise AND with 0 -- which is always 0 -- so you can actually do it with just two added characters.

Does this make me a master hacker?

Re:Gone too far?

[dfghjk]

Who are "we all"? You think you're a member of some kind of team? Who's to say who's honorable and who are the good guys? This guy did something of interest to him and nothing more. His ideology is simply different than yours and, in his view, google did something sufficiently "evil" (in your words) to merit a response. He doesn't answer to you or to some imaginary "geek community".

Interesting

[Sheepdot]

Google RSS feeds:
Google releases Google Maps
Google releases Google Desktop Search
Google releases Google Web Accelerator
Google releases Google Video

Yahoo RSS feeds:
Are Google Maps an invasion of your privacy?
Is Google Desktop Search working *too* well?
All about your privacy and Google Web Accelerator: The secret agenda.
Google Video cracked within 24 hours. And privacy.

Re:Interesting to see....

[chrisd]

Here's reaction: It's not hacking, it's just compiling. We gave the world the patch for god's sake.

Matrix Revolutions is available

[chancycat]

Did anyone notice the entire Matrix Revolutions is available there in Google Video? Pretty cool. You might think it's just 30-second clips, but hit "Play whole video" and off it goes. Whole movie. Wondering if this is a special "show-off" case google snuck in, or a black-hat's upload?

see this link for the video