Slashdot Mirror
Microsoft Windows Media Player Encryption Hacked
NubKnacker writes "Here we go again. The Register has the story about the encryption in Windows Media Player being hacked by DVD Jon. From the article: 'Jon Lech Johansen has reverse engineered a proprietary algorithm, which is used to wrap Media Player NSC files and ostensibly protect them from hackers sniffing for the media's source IP address, port or stream format. He has also made a decoder available." This has been pending for some time now. Do you see a reason to install Windows/WMP just to be able to view a webcast?"
Thanks DVD Jon. Keep the interoperbility clause of the DMCA alive!
Previous link Linus on /. is interesting.
Linus is a good guy, but in this instance I metamoderate him over the head with a rancid carp.A feeling of having made the same mistake before: Deja Foobar
You know, this only happens because Microsoft is the industry standard. Imagine a world where there are competitive OS and software markets, with no Internet Explorer phenomenon. You wouldn't get this, because developers would actually try to create secure programs. Instead, Microsoft takes programs that are more or less comparable, and incorporates them into it's products, thus killing any competition for that program! (Read: Excel and Lotus 1-2-3)
Not only "land of the free" but "land of the lawyers" who love a good old 1st amendment smackdown. Shihar 153932
http://nanocrew.net/software/nscdec.c
"VLC should have NSC support in the near future."
FTFA - "It's more likely that the purpose is to prevent competing media players from supporting the NSC format," he observed.
Exactly right... Why don't they just leave this kind of thing open for everyone to impliment with their own player and let the best player win? Argh!
"Do you see a reason to install Windows/WMP just to be able to view a webcast?"
Well sure!!!
But I've already installed Windows for its lovely properties of stability, speed, and beauty.
... get a job from any reputable company, unfortunately. Someone as resourceful as Jon, if given an opportunity, could be priceless.
For us who don't want to install an entire OS just to be able to see a video, this is a great day.
Expect some Louisiana military relief effort units to be redeployed soon to Norway, for a Search-and-Destroy operation aimed at Jon!!!
If Microsoft, the MPAA, and other corporations don't want their systems hacked, they must make sure that there is a way to play the content on alternative systems easily. Vendor lock in is not acceptable and the people have spoken. Linux (and other non-MS OS) users should not be forced to run Windows to play DVDs or ASFs or whatever. That is all.
Liberal Ontarians and French Quebecers are draining Western Canada's wealth. Stop them now! Support Western separatism.
The utility translates it to this:
So you can grab the stream without using the MS program and netstat.
The utility is more like a utility like base64 decoders (this is not base64 though) than a circumventing tool.
Article from theregister.com
Norway's best known IT export, DVD Jon...
Awsome. I didnt know they were exporting those. I wonder how high they tax. I want one.
Is it really so ? Or have I missed something ?
Dimitris
Why? All encryption mechanisms (save quantum) can and will eventually be defeated. This has been known for quite some time. Why does this make it a sad day ?
Girl in the wild west: "DVD Jon, you're my hero!"
DVD Jon (disguised as the Lone Ranger): "Stay here, it's not over yet" (gets out revolver)
Man, I need to stop watching TV...
It doesn't make any difference which OS you watch it in nowadays, in this version Greedo still shoots first :(
liqbase
I'm sure that when he's old enough to sign a contract he'll have job offers. Maybe not from Microsoft but from some small company who wants to become the next Microsoft.
I've hit Karma 50 and gotten a Score:5, Troll... I win!
Personally, if I have to load MS products to view, read, hear, or use something, then I will never view, read, hear, or use that data... period!
If DVD John can crack it, then it wasn't secure in the first place. In my opinion, DVD-J is making the world more secure by showing people that their encryption sucks. Go John go...
Support NYCountryLawyer RIAA vs People
Maybe Linus is just bitter cause he doesn't have a low UID
[Fuck Beta]
o0t!
It's times like this when I wish there was a "+1, sarcastic" rating.
Then you should know that any encryption which can be broken like this is really not worth appreciating.
A correct headline would have been:
Proprietary encoding of Media Player Broadcast definition files successfully reverse engineered.
The problem is, no one really makes use of NSC files anyway. Most streaming media is still done as simulcast, not as multicast.
--- Eat my sig.
I think Microsoft should just hire DVD Jon and whoever else and have him write the algorithms and encryption. I know it's counterproductive, and I know he would probably oppose it, but throw enough money under there and most morals head out the door. DRM is coming, and if this guy is going to keep cracking them, you're gonna need someone better than him to write it, or get him so he'll be on their side.
Ah well, until then, what's the next one for him to hack? Can't be too far off now.
You can't know if that's true, unless you can prove P=NP.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
According to his wikipedia page, he's currently 22 years old.
http://en.wikipedia.org/wiki/Jon_Johansen
Read that fourth paragraph carefully, mods!
Real Daleks don't climb stairs - they level the building.
I see the whole encryption scheme as a lesson in frustration.
Why even bother when someone is able to defeat it in less than 24hours?
The more you try to hold on to something the easier it is to let it slip away.
Can someone out there please give a clear and succinct explanation to this whole encryption scheme?
That's why I'm willing to use it. Looks a bit blocky, but compresses incredibly well - I have a wmv music video that's smaller than an mp3 of the song in question. Also, I've found it the easiest of the main video formats (windows media, real, and quicktime - ogg theora and dirac just aren't ready for primetime yet) to get working in linux - just dump the dlls in the right format and both xine and mplayer can play them flawlessly, even as streams from websites (just install gxine or kaffeine). Real is harder, at least if you don't want to use their OSS-only official client, and quicktime is an absolute nightmare. So I'm all in favour of requiring windows media player to view videos, because the alternatives are worse.
I am trolling
You can build a quantum computer... and then prove that QP=NP (where QP implies polynomial in time on a quantum computer). QP=NP is also an unsolved statement. One difference is that it seems to me to be more likely to be true than P=NP.
Ben Hocking
Need a professional organizer?
Or is this just for loading streams?
No. See the One Time Pad, which is mathematically impossible to break, even given infinite time and resources.
No! I've installed Windows Media--including the Windows Media SDK, WMP10, and the Windows Media Encoder--because it's a great encoder and is included in the price of a windows system. I prefer the sound of WMA-encoded files to MP3s at the same bitrate. And there are at least 50 music players on the market, like my Samsung, that I can just plug in to Windows and sync with Windows Media Player! No need to install any software (unlike those stupid Creative folks with their virus!). Just plug it in and it works.
Best Buy can have you arrested
Does anyone know where I can find a NSC file to try it out on?
I thought "quantum encryption" was One Time Pad using a quantum technique to ensure uncompromised pad distribution?
The FSF sends in a bodyguard team to care for DVD Jon's well being. It won't be long before assassination atempts against him by corporate minions begin.
-><- no
...And living with mom and dad in true geek style!
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Thinking back to years ago when the corporate powers-that-be had a teenager arrested for merely figuring out CSS, I wonder if those corporate bureaucrats realize that they were creating a monster?
I mean, if they had just left the kid alone, his curiousity might have waned and today he might be a stodgy coder writing finance apps.
Instead, they pissed him off, highlighted the system's corruption and injustice, and created a monster.
I only use it to watch something internal to my house network. My firewall (IPCop) is configured to block everything that WMP uses port-wise in and out, and can only open links to stuff on my LAN as I have a media server that does produce Windows media from one device (Beyond TV3).
Knowing both Micro$oft's history, and the fact that much of Windows is still akin to swiss cheeze, I don't want to risk it. My kids are predominantly using Winamp and I even shudder with it sometimes.
Cheers
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
I think the more level-headed response to piracy is what multi-billion dollar companies like Oracle and IBM have taken -- they let you download and install FULL versions of their flagship software packages, if only you agree to pay them when YOU earn money from their software. These are the companies that pioneered much of the software that runs major IT companies that power the Internet. If they've realized that encryption is a lost cause and that trust and incentives are the only workable solution, then why are the numbskull media execs not learning a lesson from them?!
If users feel a level of trust, I believe media companies will come out ahead. Yes, some amount of piracy will continue, but that's true even today. However, I think if it were easier to get, play and buy media electronically, they'd actually see a dramatic rise in sales, rather than more piracy.
In a purely platonic way of course.
The way to a man's heart is through the left ventricle
Prove the Church-Turing Hypothesis.
"Anyone who attempts to generate random numbers by deterministic means is living in a state of sin." -- John von Neumann
I totally agree. While I didn't fully agree with the iTunes hack (didn't achieve anything that couldn't already be done, and broke quite a reasonable service), this is definitely a good thing, like DeCSS. Breaking a service which either enforces price-fixing or having to use a particular OS is ethical, and certainly good work.
And no, I'm not an Apple fanboy (I hate those bastards!), before you ask.
Don't forget the option of doing nothing. Any moves they'd make in response to this embarrassment, whether moves involving lawyers or redesigning, will attract media attention which would be bad for business because of investor perception of the company changing the company's worth in addition to alerting not just more hackers but the Kazaa crowd entirely that there's nothing to worry about anymore regarding wmv (other than malware bugs, of course).
If I were MS in this situation, I'd sweep this news under the rug and pretend nothing happened. They're too late to go back to the drawing board, too much has been invested, and their reputation to other companies they courted into secure media format cooperations would dive even deeper.
"For those of us who truly appreciate encryption on a higher intellectual level"
:-)
consider my name... ah come on, it's a joke.. laugh okay ?
Not impossible to break if you get ahold of the pad..Also if you ever read the book "Cryptonomicon" you will see it is possible to break one time padsa based on human error. Basically if the human operator creating the one time pad must do it day in and day out, sometimes they will slip and then, poof you get someone whos a insanely brilliant man who breaks it. Yes i do understand that this book is Fiction but it could happen. Nothing is impossible..remember that
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
Ontario doesn't get any transfer payments, it infact pays the most out by far. Us ontarians are being robbed more than anyone else, while Quebec sits pretty wallowing in funds it doesn't deserve according to the formula. And recently it's been publisized in the media that our economy can't handle this practice much longer, so fuck you thinking your the ones being drained dry. And also fuck you for having a religiously entangled conservative party, I can vote for the ontario conservatives free of the fear of helping religious extremists (like Kline and co for example). IANAL(liberal)
I suppose that it is possible to genetically engineer pigs with wings too. Doesn't mean it's useful to call pigs flying "possible" in a serious conversation.
There is nothing mystical about correctly using a one time pad: use a random key, don't reuse keys. The one time pad is dead simple, it's just not very practical.
Analogies don't equal equalities, they are merely somewhat analogous.
... That he couldn't take a few minutes to put some comments into his code! =)
As for those who feel it is a dark day for encryption please elaborate a bit more. Is it bad because someone cracked it or is it bad because it was crackable without resorting to using a cluster of supercomputers in parallel? Are there other reasons I'm missing? Thanks!
Sure that web-site has content.. But so does a garbage can!
Being a non-broadbander from far far east I was forced to do so on regular basis. The streaming is no-option for me so I am forced to hack the stream server and get to the downloadable content. I can do it for cbsnew.com, comedycentral.com, foxnews.com, cnn.com, msnbc.com and bunch of other servers. Some have their content even very well indexed and sorted by date in the database behind, so someone can pick the track without even looking.. (once u get in) just change the date or increment the story ID and forward it to the download queue. Instant TV and replayable, very nice.
(just kidding of course)
That's a negatory good buddy. According to your link, he's currently 21, ready to celebrate the completion of his 22nd year in mid-November.
what i am saying is that is possible and it did happen during world war 2. By the parent calling this impossible he was wrong
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
What DMCA?
Because, thank God, American "justice" is of no consequence in my country (Norway) - so DVD-Jon will be free to continue.
Of course, for you US citizens it's another matter, but then again you get what you pay/vote for.
You're mistaken - we don't use Case Law in Norway. Our legal tradition is Scandinavian/continental civil law - where precedents are very weak arguments as opposed to the US/UK Common Law system.
User Agent Switcher. Do a search for that at the mozilla.org website to pull up the .xpi installer.
But be forewarned that most sites that say they require IE do so because they use ActiveX (such as to use THEIR player) and will not work with any other browser.
Just "gittin-r-done," day after day.
http://prefbar.mozdev.org/
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
I had it in my head he was still 16. I guess that was a few years ago.
I've hit Karma 50 and gotten a Score:5, Troll... I win!
Well unfortunately IE has never worked properly on my wife's computer. So I'm basically SOL as far as MTV is concerned. Oh well.
I wouldnt call it unfortunate, more like a bonus feature.
I'm not sure where it is, but I'm *sure* such a thing does exist. I found it before, when I used to regularly use firefox. It's a toolbar, most likely avaliable on the firefox extensions page, somthing about spoofing browser identification.
I don't know where it is, because I usually use Safari or Konqueror (depending on whether I'm in OS X on my powerbook or linux on my desktop), and this funcationality is native to both.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Well, yes, but that's not a flaw in the encryption, that's a flaw in the idea of DRM.
Current encryption technology was never meant to be used this way.
What you are saying is like saying "All screwdrivers that are used as cold chisels will break eventually." Well, duh.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Sweet!! Thanks!
Thanks as well. Couldn't find one that did this, now thanks to the /. crowd I have two to choose from :-)
I, for one, welcome our new oppresive Microsoft employee of the month DVD Jon overlord.
Editors: Please take note of the proper definitions of hack and crack.
Help us build a better map!
I can not believe that people are still trying to broadcast streaming media via proprietary and "locked" technology. I, for one, will use this new decrypter to view any streaming broacasts that use this technology. I'd like to also rant a little on Quiktime who now bundles iTunes.. if you are not using a windows 98/me you are forced to install iTunes just to view a .mov file.. That's BS..
I now use Quiktime alternative and Media Player classic which may be download alone, or bundled with the kazza lite mega codec pack.
Reality is in the mind of the beholder - me 1996
Can someone out there please give a clear and succinct explanation to this whole encryption scheme?
Sure. The gist of it is that you put your video file on a web server. Then you put what is basically an INI file on a webserver as well. People download the INI (renamed to an NSC extension), their media player fires up, reads the INI, finds the location of the media file, and starts downloading and playing it.
But then anybody could load and parse that INI and get your media file. So they obfuscated the INI file by changing the important bits of it to be what looks like nonsense.
This obfuscation works by shifting all the text into it's hexadecimal equivalent, performing some fairly minor math to shift those numbers into some other numbers, and then spitting out the hex as text. Couple other bits are added on to the beginning though... it uses a couple of different encoding types, and a length field to tell you how much data there is, but that's the gist of it.
It's not actually "encryption" because there's no actual key used. It's about as much encryption as ROT13 is, it's just a little more complicated than that.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
That's exactly what quantum encryption does, and it solves the problem of key distribution that is the serious weakness of the one time pad.
Is this what you're thinking of?
Slashdot requires you to wait longer between hitting 'reply' and submitting a comment.