Slashdot Mirror
Microsoft Windows Media Player Encryption Hacked
NubKnacker writes "Here we go again. The Register has the story about the encryption in Windows Media Player being hacked by DVD Jon. From the article: 'Jon Lech Johansen has reverse engineered a proprietary algorithm, which is used to wrap Media Player NSC files and ostensibly protect them from hackers sniffing for the media's source IP address, port or stream format. He has also made a decoder available." This has been pending for some time now. Do you see a reason to install Windows/WMP just to be able to view a webcast?"
Thanks DVD Jon. Keep the interoperbility clause of the DMCA alive!
Previous link Linus on /. is interesting.
Linus is a good guy, but in this instance I metamoderate him over the head with a rancid carp.A feeling of having made the same mistake before: Deja Foobar
Is there anything DVD Jon can't do?
I've hit Karma 50 and gotten a Score:5, Troll... I win!
You know, this only happens because Microsoft is the industry standard. Imagine a world where there are competitive OS and software markets, with no Internet Explorer phenomenon. You wouldn't get this, because developers would actually try to create secure programs. Instead, Microsoft takes programs that are more or less comparable, and incorporates them into it's products, thus killing any competition for that program! (Read: Excel and Lotus 1-2-3)
Not only "land of the free" but "land of the lawyers" who love a good old 1st amendment smackdown. Shihar 153932
http://nanocrew.net/software/nscdec.c
"VLC should have NSC support in the near future."
FTFA - "It's more likely that the purpose is to prevent competing media players from supporting the NSC format," he observed.
Exactly right... Why don't they just leave this kind of thing open for everyone to impliment with their own player and let the best player win? Argh!
"Do you see a reason to install Windows/WMP just to be able to view a webcast?"
Well sure!!!
But I've already installed Windows for its lovely properties of stability, speed, and beauty.
I can't say how much I love this guy.
Not because I will use his hack to play encrypted content, but just to show everyone that DRM is used to lock the users, not the data.
For us who don't want to install an entire OS just to be able to see a video, this is a great day.
Expect some Louisiana military relief effort units to be redeployed soon to Norway, for a Search-and-Destroy operation aimed at Jon!!!
If Microsoft, the MPAA, and other corporations don't want their systems hacked, they must make sure that there is a way to play the content on alternative systems easily. Vendor lock in is not acceptable and the people have spoken. Linux (and other non-MS OS) users should not be forced to run Windows to play DVDs or ASFs or whatever. That is all.
Liberal Ontarians and French Quebecers are draining Western Canada's wealth. Stop them now! Support Western separatism.
The utility translates it to this:
So you can grab the stream without using the MS program and netstat.
The utility is more like a utility like base64 decoders (this is not base64 though) than a circumventing tool.
Article from theregister.com
Norway's best known IT export, DVD Jon...
Awsome. I didnt know they were exporting those. I wonder how high they tax. I want one.
Is it really so ? Or have I missed something ?
Dimitris
Why? All encryption mechanisms (save quantum) can and will eventually be defeated. This has been known for quite some time. Why does this make it a sad day ?
Girl in the wild west: "DVD Jon, you're my hero!"
DVD Jon (disguised as the Lone Ranger): "Stay here, it's not over yet" (gets out revolver)
Man, I need to stop watching TV...
It doesn't make any difference which OS you watch it in nowadays, in this version Greedo still shoots first :(
liqbase
Personally, if I have to load MS products to view, read, hear, or use something, then I will never view, read, hear, or use that data... period!
If DVD John can crack it, then it wasn't secure in the first place. In my opinion, DVD-J is making the world more secure by showing people that their encryption sucks. Go John go...
Support NYCountryLawyer RIAA vs People
Maybe Linus is just bitter cause he doesn't have a low UID
[Fuck Beta]
o0t!
It's times like this when I wish there was a "+1, sarcastic" rating.
Then you should know that any encryption which can be broken like this is really not worth appreciating.
A correct headline would have been:
Proprietary encoding of Media Player Broadcast definition files successfully reverse engineered.
The problem is, no one really makes use of NSC files anyway. Most streaming media is still done as simulcast, not as multicast.
--- Eat my sig.
I think Microsoft should just hire DVD Jon and whoever else and have him write the algorithms and encryption. I know it's counterproductive, and I know he would probably oppose it, but throw enough money under there and most morals head out the door. DRM is coming, and if this guy is going to keep cracking them, you're gonna need someone better than him to write it, or get him so he'll be on their side.
Ah well, until then, what's the next one for him to hack? Can't be too far off now.
You can't know if that's true, unless you can prove P=NP.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Read that fourth paragraph carefully, mods!
Real Daleks don't climb stairs - they level the building.
I see the whole encryption scheme as a lesson in frustration.
Why even bother when someone is able to defeat it in less than 24hours?
The more you try to hold on to something the easier it is to let it slip away.
Can someone out there please give a clear and succinct explanation to this whole encryption scheme?
That's why I'm willing to use it. Looks a bit blocky, but compresses incredibly well - I have a wmv music video that's smaller than an mp3 of the song in question. Also, I've found it the easiest of the main video formats (windows media, real, and quicktime - ogg theora and dirac just aren't ready for primetime yet) to get working in linux - just dump the dlls in the right format and both xine and mplayer can play them flawlessly, even as streams from websites (just install gxine or kaffeine). Real is harder, at least if you don't want to use their OSS-only official client, and quicktime is an absolute nightmare. So I'm all in favour of requiring windows media player to view videos, because the alternatives are worse.
I am trolling
GOOD algorithms are a thing of beauty.
... not.
BAD algorithms are
Nobody whines over the disuse of the bubble sort. There are far better algorithms, as well as better algorithms that are just as simple. Why then should we treat encryption algorithms differently?
If anything, the destruction of a poor/weak algorithm is a good thing- it should (theoretically) cause something better to be created. Something better will inevitably be created anyway, but there's no sense in pretending a given algorithm is acceptable when it's apparently not too difficult to break.
MS is probably pissed that it happened, but they ought to be even more pissed that it was possible in the first place. Others have created encryption algorithms that have lasted far longer, and still others have created algorithms that stand to this day.
IMO you've committed the fallacy of division: since the whole has a given property, that each of the components has that property. Encryption algorithms are (good|appreciated|helpful|cool)... this does not mean that any given encryption algorithm (can|should) be described in the same way.
Of course it's true. No matter how strong the encryption the attacker (such as DVD-Jon) always has access to the decryption key. Once the key is retrieved from wherever it is stored in the player the encryption can easily be broken.
You can build a quantum computer... and then prove that QP=NP (where QP implies polynomial in time on a quantum computer). QP=NP is also an unsolved statement. One difference is that it seems to me to be more likely to be true than P=NP.
Ben Hocking
Need a professional organizer?
Or is this just for loading streams?
No. See the One Time Pad, which is mathematically impossible to break, even given infinite time and resources.
No! I've installed Windows Media--including the Windows Media SDK, WMP10, and the Windows Media Encoder--because it's a great encoder and is included in the price of a windows system. I prefer the sound of WMA-encoded files to MP3s at the same bitrate. And there are at least 50 music players on the market, like my Samsung, that I can just plug in to Windows and sync with Windows Media Player! No need to install any software (unlike those stupid Creative folks with their virus!). Just plug it in and it works.
Best Buy can have you arrested
Hey watch your back Jon! With so much power in the reverse engineering scene, one day someone might want to switch you off! Thank you for caring so well for our freedom.
Does anyone know where I can find a NSC file to try it out on?
I thought "quantum encryption" was One Time Pad using a quantum technique to ensure uncompromised pad distribution?
The FSF sends in a bodyguard team to care for DVD Jon's well being. It won't be long before assassination atempts against him by corporate minions begin.
-><- no
I believe that this might just be another example of micro$oft trying to wipe out the competition. Not only is it creating cheap programs that undercut the competition but makes special formats to force you to use them. This just highlights this fact. How simple can you get. write your link in a strange language so no-one else understands. The truly secure systems pay top hackers and crackers (yep, they really do employ DVD-J) to break into their software / servers etc etc and monitor how it is done. Cunningly enough they then use this to make it even more secure. Lets assume this is now on the net that microsoft will patch WMP with a different encryption in ooo... 2 weeks and get you to download it as "a vital security update for WMP".
I think people are missing the point when they say he should work for microsoft..
He's making information FREE for the world. Now you want him to get a job to make proprietary formats more secure?
I find it hard to believe that anyone would welcome opression..
Thinking back to years ago when the corporate powers-that-be had a teenager arrested for merely figuring out CSS, I wonder if those corporate bureaucrats realize that they were creating a monster?
I mean, if they had just left the kid alone, his curiousity might have waned and today he might be a stodgy coder writing finance apps.
Instead, they pissed him off, highlighted the system's corruption and injustice, and created a monster.
I only use it to watch something internal to my house network. My firewall (IPCop) is configured to block everything that WMP uses port-wise in and out, and can only open links to stuff on my LAN as I have a media server that does produce Windows media from one device (Beyond TV3).
Knowing both Micro$oft's history, and the fact that much of Windows is still akin to swiss cheeze, I don't want to risk it. My kids are predominantly using Winamp and I even shudder with it sometimes.
Cheers
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
I think the more level-headed response to piracy is what multi-billion dollar companies like Oracle and IBM have taken -- they let you download and install FULL versions of their flagship software packages, if only you agree to pay them when YOU earn money from their software. These are the companies that pioneered much of the software that runs major IT companies that power the Internet. If they've realized that encryption is a lost cause and that trust and incentives are the only workable solution, then why are the numbskull media execs not learning a lesson from them?!
If users feel a level of trust, I believe media companies will come out ahead. Yes, some amount of piracy will continue, but that's true even today. However, I think if it were easier to get, play and buy media electronically, they'd actually see a dramatic rise in sales, rather than more piracy.
In a purely platonic way of course.
The way to a man's heart is through the left ventricle
I totally agree. While I didn't fully agree with the iTunes hack (didn't achieve anything that couldn't already be done, and broke quite a reasonable service), this is definitely a good thing, like DeCSS. Breaking a service which either enforces price-fixing or having to use a particular OS is ethical, and certainly good work.
And no, I'm not an Apple fanboy (I hate those bastards!), before you ask.
Don't forget the option of doing nothing. Any moves they'd make in response to this embarrassment, whether moves involving lawyers or redesigning, will attract media attention which would be bad for business because of investor perception of the company changing the company's worth in addition to alerting not just more hackers but the Kazaa crowd entirely that there's nothing to worry about anymore regarding wmv (other than malware bugs, of course).
If I were MS in this situation, I'd sweep this news under the rug and pretend nothing happened. They're too late to go back to the drawing board, too much has been invested, and their reputation to other companies they courted into secure media format cooperations would dive even deeper.
"For those of us who truly appreciate encryption on a higher intellectual level"
:-)
consider my name... ah come on, it's a joke.. laugh okay ?
Not impossible to break if you get ahold of the pad..Also if you ever read the book "Cryptonomicon" you will see it is possible to break one time padsa based on human error. Basically if the human operator creating the one time pad must do it day in and day out, sometimes they will slip and then, poof you get someone whos a insanely brilliant man who breaks it. Yes i do understand that this book is Fiction but it could happen. Nothing is impossible..remember that
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
Ontario doesn't get any transfer payments, it infact pays the most out by far. Us ontarians are being robbed more than anyone else, while Quebec sits pretty wallowing in funds it doesn't deserve according to the formula. And recently it's been publisized in the media that our economy can't handle this practice much longer, so fuck you thinking your the ones being drained dry. And also fuck you for having a religiously entangled conservative party, I can vote for the ontario conservatives free of the fear of helping religious extremists (like Kline and co for example). IANAL(liberal)
This is another great example that DRM has failed and should give the rest to any plans of using DRM that might be still being evaluated. DRM has failed to gain any consumer acceptance and simply does not work.
I suppose that it is possible to genetically engineer pigs with wings too. Doesn't mean it's useful to call pigs flying "possible" in a serious conversation.
There is nothing mystical about correctly using a one time pad: use a random key, don't reuse keys. The one time pad is dead simple, it's just not very practical.
Analogies don't equal equalities, they are merely somewhat analogous.
... That he couldn't take a few minutes to put some comments into his code! =)
As for those who feel it is a dark day for encryption please elaborate a bit more. Is it bad because someone cracked it or is it bad because it was crackable without resorting to using a cluster of supercomputers in parallel? Are there other reasons I'm missing? Thanks!
Sure that web-site has content.. But so does a garbage can!
Being a non-broadbander from far far east I was forced to do so on regular basis. The streaming is no-option for me so I am forced to hack the stream server and get to the downloadable content. I can do it for cbsnew.com, comedycentral.com, foxnews.com, cnn.com, msnbc.com and bunch of other servers. Some have their content even very well indexed and sorted by date in the database behind, so someone can pick the track without even looking.. (once u get in) just change the date or increment the story ID and forward it to the download queue. Instant TV and replayable, very nice.
(just kidding of course)
what i am saying is that is possible and it did happen during world war 2. By the parent calling this impossible he was wrong
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
Last night I decided to check out the MTV VMAs because I saw a commercial on MTV that said you can watch online, on demand, in total control.
Well I fired up FireFox on my Linux desktop and went to http://overdrive.mtv.com/ and low and behold it said: "We're sorry, you're running a Unix system.".
Well, ok, let me go over to the wifey's XP desktop and fire up FireFox. Low and behold it says you must be using IE.
Well unfortunately IE has never worked properly on my wife's computer. So I'm basically SOL as far as MTV is concerned. Oh well.
What would help me would be a plug-in for FireFox that sends a custom post/get header thingy that let's me tell the web server that I'm on a Windows OS running IE (even though it's FireFox on Linux). I know Opera let's you say you're IE but it doesn't let you change your O.S.
What DMCA?
Because, thank God, American "justice" is of no consequence in my country (Norway) - so DVD-Jon will be free to continue.
Of course, for you US citizens it's another matter, but then again you get what you pay/vote for.
Come on, people. What his program does is just:
- read some hexadecimal data
- read some base64-encoded data (though with the character set [0-9A-Za-z{}])
- have an exploitable overflow, because converting a UTF-16 buffer into a UTF-8 buffer of the same size is VERY dangerous
Please, please, for the sake of all cryptographers, don't call it an encryption! Mind you, I'm glad that VLC will have NSC support. But it's not as if it was designed to be a strong protection in the first place -- MS just wanted to avoid copy-paste. This is nothing like DeCSS.
The universe has a finite amount of energy, and hence computation. It should be possible to use a key length sufficiently long that brute-forcing it would require more energy than actually exists. (OK, should quantum computers prove feasable they would still be able to do it.)
Of course, you can always break encryption by some other method, e.g. let someone with the key decode the data and then steal it.
You're mistaken - we don't use Case Law in Norway. Our legal tradition is Scandinavian/continental civil law - where precedents are very weak arguments as opposed to the US/UK Common Law system.
Being founding members of NATO - Norway could then ask every other member of NATO to defend it! The British would have a perfect opportunity revoke that silly "indepedence"! :)
Well, yes, but that's not a flaw in the encryption, that's a flaw in the idea of DRM.
Current encryption technology was never meant to be used this way.
What you are saying is like saying "All screwdrivers that are used as cold chisels will break eventually." Well, duh.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
As I understand it, he's more the "release" guy.
Especially now, because he can grab headlines by humiliating the DRM makers every time he releases something.
N.B. That's not to say that he hasn't got anything to do with the coding/reversing of these schemes, just that these things are reversed by more than just him working alone.
At least, that's how I understood the story.
I, for one, welcome our new oppresive Microsoft employee of the month DVD Jon overlord.
Editors: Please take note of the proper definitions of hack and crack.
Help us build a better map!
I can not believe that people are still trying to broadcast streaming media via proprietary and "locked" technology. I, for one, will use this new decrypter to view any streaming broacasts that use this technology. I'd like to also rant a little on Quiktime who now bundles iTunes.. if you are not using a windows 98/me you are forced to install iTunes just to view a .mov file.. That's BS..
I now use Quiktime alternative and Media Player classic which may be download alone, or bundled with the kazza lite mega codec pack.
Reality is in the mind of the beholder - me 1996
Can someone out there please give a clear and succinct explanation to this whole encryption scheme?
Sure. The gist of it is that you put your video file on a web server. Then you put what is basically an INI file on a webserver as well. People download the INI (renamed to an NSC extension), their media player fires up, reads the INI, finds the location of the media file, and starts downloading and playing it.
But then anybody could load and parse that INI and get your media file. So they obfuscated the INI file by changing the important bits of it to be what looks like nonsense.
This obfuscation works by shifting all the text into it's hexadecimal equivalent, performing some fairly minor math to shift those numbers into some other numbers, and then spitting out the hex as text. Couple other bits are added on to the beginning though... it uses a couple of different encoding types, and a length field to tell you how much data there is, but that's the gist of it.
It's not actually "encryption" because there's no actual key used. It's about as much encryption as ROT13 is, it's just a little more complicated than that.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
In reply to Linux's David Miller:
Bryan Cantrill on comp.sys.sun.hardware
OT
/. yet..........
3 531991/
but why is this news not on
Massachusetts Eyes Open Office Standards
http://www.internetnews.com/ent-news/article.php/
..until proven guilty :)
That's exactly what quantum encryption does, and it solves the problem of key distribution that is the serious weakness of the one time pad.
"Sorry....I got more and more pissed off as I was typing that, which I'm sure you can see by the tone......"
No need to apologize. You are completely right.
Last time I tried to view a movie or listen to sound on it, the piece of garbage launched my web browser and redirected me to some site saying that there were the maximum users allowed to view the file(?) WTF?!?! I immediately ditched WiMP and vowed to never d/l a .wmv / .wma. WiMp is as useless as those formats, so why would I want anything to do with it?
http://slashdot.org/comments.pl?sid=160890&cid=134 67785
Will you join the class action suit against billybob2001 for damages to computer keyboards and screens?