Slashdot Mirror
Adobe Flaw Allows Full Movie Downloads For Free
webax writes with this excerpt from Reuters:
"[An Adobe security hole] exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience. 'It's a fundamental flaw in the Adobe design. This was designed stupidly,' said Bruce Schneier ... The flaw rests in Adobe's Flash video servers that are connected to the company's players installed in nearly all of the world's Web-connected computers. The software doesn't encrypt online content, but only orders sent to a video player such as start and stop play. To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players."
webax also notes that the article suggests DRM as a potential solution to the problem.
Eriouslysay.
Wow, so even Bruce Schneier is subject to the DRM double think now? What part of this is hard to understand? You have to give the viewer the key so it can decrypt the video stream and play it to the user.. if the user can see it, the user can record it. Game over. No amount of "encryption" can change the facts.
How we know is more important than what we know.
...at how fuckin dumb this all is. If you can see it, you can copy it, maybe it is more difficult, but not impossible. Do these idiots never ever learn?
sadly, axxo and fxg and their black market friends already figured out years ago how to get movies for free to most anyone willing to look for them. it brings the end of an industry in it's current form.
There are better models: allow people, if they choose, to take media without paying for it, but give them credit, additional access, and membership benefits when customers do sponsor/pay for the media they consume. It is really not that complicated... find something you can sell because you can no longer technically control the distribution of your product.
Major media producers cannot change the progression of technology with policy and lawsuits. They would be so much better off to adopt what tech can enable, and build effective business models around providing customers with real value when they do pay for media, instead of using fear and lawsuits to force them to pay when they don't have to.
Normally they overdo security, now they are lacking in basic security that protects legitimate content creators. The question is how long until they fix it.
Restrictions pitting a computer against its owner (and wasting time and energy to further a business model built on distrust) are always a problem, and the proof that some technologies can be inherently evil.
The free demo version of Replay Media Catcher allows anyone to watch 75 percent of anything recorded and 100 percent of YouTube videos. For $39, a user can watch everything recorded.
One Web site -- www.tvadfree.com -- explains step-by-step how to use the video stream catching software.
[snip]
Forrester analyst James McQuivey said he doesn't believe the video stream catching technology will entirely derail the advertising-supported business model used by the networks for online video.
"It's too complicated for most users," said McQuivey, noting that file-sharing services like BitTorrent already exist but only a small percentage of people use them.
See? He (whoever he is...) thinks piracy won't be a problem... it's too complicated to pirate stuff... people would rather pay... something like that anyway. And he's an analyst, so that makes it official, right?
Evolution is a state-sponsored, state-protected religion.
I just have to wonder what it's like to be in the shoes of the person that wrote the code that's flawed. Maybe i'm mistaken, but this seems like something that the coder did knowing that if anyone ever figured it out, it was game over for the DRM. Surely this person is now explaining why it is how it is to his supervisors, who are probably banging their heads against the wall thinking "OMG".
As we all love to repeat, DRM is folly, giving a man a locked box and the key, security through obscurity, mere obfuscation, inevitably cracked, etc. So, a story about yet another broken DRM system is hardly exciting.
What is amusing, in this case, is that we have a DRM system so broken that it includes a vulnerability of the kind that is theoretically fixable. Essentially, Amazon streams the first couple of minutes of whatever it is to you for free. To get more, you have to pay. However, thanks to this bug, Amazon doesn't actually stop streaming at two minutes, just sends a command to the player to stop playing. The video that you aren't supposed to see ends up, inadequately obfuscated, somewhere on your system.
That is the pathetic bit. It is ultimately impossible to control what another computer does; but it is merely a matter of good engineering to control what yours does. Server access control vs. DRM. Here, the system is so broken that Amazon's servers are essentially handing out video that they don't want copied to anybody who asks for it, at which time it is protected only by the usual doomed local DRM. Thanks to badly designed DRM, the system is less secure than that ever so early 90's "on payment, we email you a one time use link to a direct download" content protection scheme. Ha-ha.
You know what else allows full movie downloads for free?
THE INTERNET.
There are two kinds of people: 1) those who start arrays with one and 1) those who start them with zero.
Doesn't everybody know that all flash video is easily accessible? Most of the time it's just a case of dragging it out of the cache. Sometimes you need to jump through more hoops, but I thought it was common knowledge that you could download it all.
You have to re-encode it if you want to, say, burn it on dvd, but that's not too hard. I use winFF (yes, I use windows).
...at how fuckin dumb this all is. If you can copy it, they will try to stop you, maybe it is impossible, but they will still add DRM. Do these posters never learn?
Uh, the pirates were already uploading the full HD rips to Usenet days before the movies were even released. No pirate would want the shitty version Amazon is offering.
My other car is first.
There are two separate issues mentioned in the article.
1. HTTP and RTMP are not encrypted and thus it's trivial to record any video sent over these protocols. This is well-documented and I'd hardly consider it a flaw. Flash 9u3 has DRM (RTMPE+verification), but most Web sites don't bother to use it.
2. Apparently Amazon's movie store server will send the whole video whether the customer has purchased it or not. This is a bug, but it's Amazon's fault not Adobe's and Amazon should be able to fix it easily enough. Also, they're apparently not using all the DRM features available in Flash so their videos aren't as protected as they could be.
AFAIK Flash DRM hasn't been cracked yet because no one uses it. I'm not an advocate of DRM, but as a practical matter I find it works better when you actually turn it on.
In summary:
Amazon.com is staffed by idiots... They thought it would be safe to stream the ENTIRE MOVIE, to anyone, FOR FREE. The ONLY protection being that they send a command to the Flash Player to "pause" playback after 2 minutes for those that haven't paid to watch the whole thing. Cheap software and instructions have sprung up all over the web, and everybody knows Amazon.com is going to get a boot up the ass by the media companies, and fix this "security" issue any second now.
DRM is utterly redundant. They just need someone with 3-digit IQ in the company to teach them how to make a 2 minute excerpt clip that is free and publicly accessible, while keeping the full video password-protected.
This is about on-par with an Apache "security announcement" that even if you don't make a link to a document on your HTTP server, it's still accessible! The horror!
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
"Adobe Flaw Allows Full Movie Downloads For Free"
its not a flaw, its a feature!
-I only code in BASIC.-
What's the easiest and fastest way to take complete advantage of this?
I want links!
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
Actually I do have a bulletproof method of DRM that customers will accept. There's no patent - it's currently a trade secret. I could show them how it works without revealing the secret, and they could license it from me.
I only want $40m cash up front, and 10% of the back end.
I'm calling it MP[34]. Of course with licensing comes naming rights. I think "Plays For Now" is not yet taken.
Help stamp out iliturcy.
That was MP[34]XOR-B3
Sorry about that. MP[34] is already taken.
Help stamp out iliturcy.
Normally if you can play the video, you can capture it. So encryption/DRM is rather pointless. However, DRM can work (up to a point) if HDCP is used. The player has to be sure that the path from the internet to the display is full encrypted OR sealed. By doing the decryption in the video card, uncompressing it there, and re-encrypting it for HDCP over HDMI (audio, too ... so DVI won't work unless they want to give up the protection on the audio), you can be sure the video is safe all the way, as long as the content owner trusts the video card (it would have a player device key like a DVD player would, that can be revoked) and the video display device.
But there are still a couple analog holes. Internal electronics of the display could be tapped to get analog, which may have stair step levels that would allow determining original digital values. And then there is the camera on the screen method.
One big catch is, unlike the home TV market, few people have HDCP capable video cards and displays, and fewer still have it for HDMI that can support DRM audio through the video card. So deploying strong DRM for streaming video is not practical, yet.
now we need to go OSS in diesel cars
Amazon starts to stream the entire movie during the free preview -- even though it pauses the video on the Web browser after the first two minutes -- so that users can start watching the rest of the video right away once they pay.
However, even if a user doesn't pay, the stream still sends the movie to the video catching software, but not the browser.
So that's why my SQUID caches were getting so big :-)
now we need to go OSS in diesel cars
In encryption, person A wants to send something to person B without person C being able to read it. In DRM, person A wants to send something to person C who own computer B. It doesn't take an engineering degree to figure out, there's something wrong with DRM.
It's just like their instant delivery service, available for items that you've put on your wish list in advance. The way it works is that, when you put an item on your wish list, they ship it to you. Then, if you buy it, they give you the tracking number, you go to the shipper's site, and find that the item is on your porch, at which point you bring it inside and open it. If you don't buy it, eventually the shipper notices that it's been sitting on your porch for a while unclaimed and brings it back to Amazon.
I know you were gonna try it for research purposes... But apparently they fixed the hole. (At least at Amazon.)
In related news, researches have discovered that Gutenberg's printing press has similar flaws. By using modern technology such as photocopiers or cameras, or older technology such as monks and pens (or additional printing presses) criminals can create nearly identical copies of items printed with the press, depriving the original creators of the material of much needed compensation.
Gutenberg did not immediately return calls for comment, however it's theorized that he did not build in an encryption option to his printing press in order to boot comprehension speeds (Simple substitution ciphers were well established at the time of the creation of the printing press, and Gutenburg could have easily applied their techniques in the creation of his press, however it's not entire certain how effective it would have been at preventing piracy. (Somewhat (at most) effective DRM techniques were developed centuries later.))
On a related note, no doubt the maker of Replay Media Catcher, Applian, has seen a bump in both sales, and online warez activity. Their solution to combatting the latter?
http://www.applian.com/replay-media-catcher/crack.php
Umm, while researching the information in this article... *cough*... I discovered this. It shows up very highly on google.
In my opinion, this is a truly insightful move by Applian. It appeals to the vast majority of minor-league pirate types who really just don't want to pay for something (probably less appealing to the types of people who believe everything should be free)... people who are much less likely to value their privacy a highly as many of us here on Slashdot do. I say, bravo Applian.
I should say, it shows up very highly on google with specific searches... compare:
http://www.google.com/search?q=%22replay+media+catcher%22+crack
http://www.google.com/search?q=%22replay+media+catcher%22
Any site that try to protect their content with stupid tricks
Actually, what they did was trade-off stream security for the user experience - if the stream does pre-load, then the viewer can start viewing the movie much faster after they pay.
Its a good trick if most of your users do pay, as they get the video they pay for much faster (since it's already pre-loaded) than would be possible if the paid content was sent in a separate stream that did not start until after the payment was processed.
Mainly, this is an artifact of delivering video via http/progressive download vs. rtsp - you have a few options:
1. deliver one stream - tradeoff - geeks can view for free
2. deliver two streams - tradeoff - slow, annoying start up while you wait for the second stream to load enough to start playing
3. use rtsp - tradeoff - reduces the quality of the video to match minimum bandwidth between the server and the viewer
For really secure video, you'd use either RTSP or DRM (or both8-0), but they both have other problems with quality and user experience.
I guess a system designed by a video geek would probably lean towards providing the best quality viewing experience while making it possible for a geek to get the video for free:-).
Shh, don't tell the lawyers, or they'll try to ban the users.
'nuff said
So nobody though of or cared about the waste of bandwidth resulting from streaming into a void? Even if the content was intentionally being given away free, it seems stupid to continue streaming when the client is no longer watching.
only extra processor cycles at both ends... the content has exactly the same length of bytes, just got bits shifted in a weird and wonderful pattern according to the encryption algorithm and the keys
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Sooooo
well I "am going to steal that video/movie/song" you didn't asked me if I would but just in case you enforce that much restrictions on it that I couldn't ever stea..watch it.
you know what...your content doesn't really interest me. Your music is at best funny to listen two or three times (but from that moment it would have been broadcasted on many radios), movies finally are broadcasted on TV (yeah you have to wait a little bit but sincerely most of the movies aren't worth your time) and videos well many tv stations features "night long video clips" so bah you finally figure out that you could still watch a few of them.
I think that I see where you are coming :
"stay tuned for "Spider Monkey 4" -the absolutests bestest film ever made-but you'ain't going to see it because it's secured against the thief-"
The real problem would be for a fan who willingly wants to buy every material made on his beloved artist (or commercial product) who would be obligated to consume this stuff now like most of the people out there don't give a rat ass of that the world is saved.
"This was designed stupidly,' said Bruce Schneier"
It's an Adobe product. Saying it was designed stupidly is redundant.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
So that's why my SQUID caches were getting so big :-)
This must be already fixed. I just tried a South Park episode (I know, they're already available for free) and it stopped the download at 1.4MB of data.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Anybody know if exploiting this could be accomplished using VLC's stream capture tools? (I'm on a Mac) Not exactly sure if I could get the stream url in OSX from the flash player, but perhaps there is is a way in terminal? Excelsior!
Overall, this is a really misleading article and summary.
Adobe makes technology platforms. I assume this is using some derivative of Flash Media Server. FMS supports streaming media, and it also supports different kinds of optional and configurable encryption. Nothing is perfect and that goes double for software, but for the most part, Adobe's platforms are quite good.
Despite what you might think from the headlines, no part of this seems like a platform flaw.
I can only ASSUME that Adobe Consulting actually implemented the specific application for Amazon, and they screwed it up. Which I have to say I find much less concerning than if this is a platform problem.
The flaw seems to really be that whole movies are sent when just the beginning is supposed to be. This MIGHT be an FMS flaw, but it might also just be bad application design. I can't tell from here.
Then it says that the streams aren't encrypted. This might or might not have anything to do with the original problem, and in this kind of article it might or might not be true, since the first problem explains the issues. I would say that the streams for the preview plays SHOULDN'T be encrypted, if I correctly understand that anyone is allowed to watch those clips anyway.
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot