Slashdot Mirror
Adobe's ADEPT DRM Broken
An anonymous reader writes "I love cabbages has reverse-engineered Adobe's ADEPT DRM (e-book protection). On February 18, I love cabbages released code that decrypts EPUB e-books protected with ADEPT and followed that up on February 25, with code that decrypts PDF e-books protected with ADEPT. On March 4, I love cabbages was given a DMCA take down notice. And there's plenty of evidence he got it right. DS:TNG (Dmitry Sklyarov: The Next Generation)?"
DRM is like trying to make water not wet.
The MS "no sue/patent deal" with Novell/Xandros is like the Pope blessing a Jewish wedding
It's rather comical that so many people out there are trying to break DRM and band themselves as allies of the open source movement in some way. The thing is, the legal framework, the right of the copyright holder to issue a license, is the same for software with DRM as it is without. If we have a legal system where copying images, songs and books is tolerated, then we also have a legal system where taking GPL code and subverting it will be tolerated as well.
This is my sig.
The tools are not on the site anymore...
But now what you're really here for - the PDF decryption tool: REMOVED. (And if you don't already have it, the key-retrieval tool: REMOVED.)
Edit: Links to tools removed due to DMCA complaint from Adobe.
This is not the next Dmitri, if anything, it may turn in to the new DeCSS as Adobe is trying to stop the tool(s) from spreading, which tends to have the opposite effect.
I really wonder if it hadn't been better for Adobe not to say anything, now they are giving it publicity it wouldn't have had otherwise.
09f9 1102 9d74 e35b d841 56c5 6356 88c0
Google cache.
Google's cache of the blog has a working link.
There is of course, Google Cache ...
Or, you can just get it from pastebin:
http://pastebin.com/f1cb3663c
and
http://pastebin.com/f26972321
XenoPhage
Technological Musings
That DRM was broken close to 10 years ago or so by this guy http://en.wikipedia.org/wiki/Elcomsoft
I dont think they changed the encryption, just the way they encrypted it. My guess is that
the tools created by Dmitri and the rest still work today....I may be wrong.
Who cares about Adobe's e-book drm? I want someone to break Audible's DRM!
from TFA:
> Any guesses as to why only the PDF decryption tool and not the EPUB tool?
Probably because no-one's even heard of EPUB but practically everyone has heard of PDF files...
>But now what youâ(TM)re really here for â" the PDF decryption tool: http://pastebin.com/f1cb3663c. (And >if you don't already have it, the key-retrieval tool: http://pastebin.com/f26972321.)
From the original article without having the links broken by law. /. will have to do the same now?
I wonder is
You can always call it back from google cache...as I did.
http://74.125.47.132/search?q=cache:aoDTe7wI6s4J:i-u2665-cabbages.blogspot.com/2009/02/circumventing-adobe-adept-drm-for-pdf.html+http://i-u2665-cabbages.blogspot.com/2009/02/circumventing-adobe-adept-drm-for-pdf.html&hl=en&ct=clnk&cd=1&gl=ca
The thing is, the legal framework, the right of the copyright holder to issue a license, is the same for software with DRM as it is without.
As I understand it, the purpose of copyright is to secure for creators a limited time monopoly on the rights necessary for selling the creation, in return for them eventually enriching the cultural (and, in the case of software, technological) commons.
Some kinds of DRM prevent or obstruct use of the work in such a way that when the work enters the public domain, it doesn't enrich the commons in practice. It's like being given a car wreck that's in really bad shape: sure you can sell it as scrap metal, but it's worth so little that you're better off ignoring it.
For this reason, I think one can argue that DRM (with certain properties) goes against the spirit and purpose of copyright law, and the argument doesn't apply to GPL'ed software.
Using the DMCA to censor him just inconveniences him a bit while he finds a way to post it from a country without such a law (or effective enforcement thereof). Isn't this less despicable than using the DCMA to charge him with the criminal act of providing tools to break access controls?
I hope we don't have another replay of the Skylarov fiasco.
Disclaimer: Don't take this comment as indicating that I think the DMCA is a good law.
I would think that it would be trivial to just record the output of your speakers/mp3 player/etc., no? You could even record multiple times and develop sophisticated algorithms to remove the analog noise and improve resolution.
And while we're at it, I'm fairly sure that someone could write software which would OCR the output of a camcorder recording the screen of Adobe's ebook reader application while the down arrow key was held down with a small weight or clamp. Doesn't matter how many updates they make to their software in this case.
DRM is silly and insulting to the customer, especially in low-bandwidth cases like this.
How does one other than COMMIE find time to waste like that?
Get job. Get girlfriend. Get boyfriend!
First, a take-down is a sure way to have this kind of thing spread far and wide. Thanks to this article I have the code now. Better, in about half an hour I'll understand the crack.
Second, there is some DRM-encumbered PDF content that I was thinking of buying, but have not because it was protected. I'm seriously considering buying it now, removing the protection, and (a) using it on a device that it would not otherwise have worked on, and (b) backing up the content, so I'll still be able to use it decades hence.
One German mirror and one extra American mirror
PDF decryption tool: http://pastebin.com/f1cb3663c
http://nopaste.info/8ad6b71874.html
http://paste2.org/p/161270
key-retrieval tool: http://pastebin.com/f26972321
http://nopaste.info/8b62e63436.html
http://paste2.org/p/161271
If you know of any other foreign pastebins,
mirror and post in this thread.
They have a responsibility to their shareholders to do everything they can to protect a) their investment in creating the DRM in the first place, and b) the value of their licensed software and agreements with publishers.
Well, they have a responsibility to their shareholders to deliver a good return on investment.
You can try doing that in multiple ways. One of them is fighting a losing battle tooth and nail, another is coming up with a business model that works well in the environment it'll execute in.
I'm not saying Adobe is at one extreme and should move to the other. But you have to wonder whether fighting the DRM war is ultimately good or bad for business. If it's bad, not fighting it is their shareholder responsibility.
What these "rights holders" are saying is this:
1) We like copyright.
2) Mostly
3) What we don't like about copyright is the following:
a) You can sell it to someone else. We really don't like that.
b) You can use it in the way that you want, and I can't control it
c) You can use it forever. I really don't like that
4) So I like copyright, but I want it to be constraining than copyright
5) So I'll lock it in DRM and then you can't actually do those things in #3 above that I really dislike
6) And then as a rights holder, I get to control how you use the work.
7) Which copyright doesn't really allow
I mean, I *get* why people want to ignore #3. It's just that the law is not on their side. So they created technical hurdles to fair use and doctrine of first sale. And then they claim a copyright violation (much as you're doing) to justify the taking of rights.
That's the argument in a nutshell.
Like I said, I don't think they should have gone down this path in the first place. PDFs were not a prime candidate for working DRM in the first place. But if they simply abandon it, then they open themselves up to lawsuits from the publishers who had been using the DRM and would be left high and dry. The harder a fight Adobe puts up now, the less they stand to lose in court. And since I strongly suspect that the people handling the cease-and-desist stuff are staff lawyers who get paid either way, I doubt it costs them anything extra to fight tools like this at this stage.
Copyrights are like patents in software/hardware. They prevent you from improving upon a certain work and they effectively lock the competition
Actually that's completely upside down.
Patents, in theory, are a deal between an inventor and society. For a limited, government enforced monopoly the inventor must document and register his invention with the patent office. Others can look at those patents and build upon them as long they either license the patent, wait until it's expired or build upon it in a way that the patent is not violated.
Now, this is the theory of course which doesn't seem to be very much related to nowadays reality.
However, patents where certainly not invented to hinder innovation, actually - due its documentation requirements - quite the opposite.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
Unless he stole Adobe code, the DMCA takedown notice was probably illegal. Giving people the right to read what they bought is not a violation of copyright that DMCA takedowns are meant to refer to..
Free Software: Like love, it grows best when given away.
The thing is, the legal framework, the right of the copyright holder to issue a license, is the same for software with DRM as it is without.
As I understand it, the purpose of copyright is to secure for creators a limited time monopoly on the rights necessary for selling the creation, in return for them eventually enriching the cultural (and, in the case of software, technological) commons.
Some kinds of DRM prevent or obstruct use of the work in such a way that when the work enters the public domain, it doesn't enrich the commons in practice. It's like being given a car wreck that's in really bad shape: sure you can sell it as scrap metal, but it's worth so little that you're better off ignoring it.
For this reason, I think one can argue that DRM (with certain properties) goes against the spirit and purpose of copyright law, and the argument doesn't apply to GPL'ed software.
The problem with this argument is that its an assumed, implied agreement that the works will enrich the cultural commons - its not anything laid out in law as copyright law does not handle what happens to the work after copyright law ceases to apply.
Or in other words, its not the copyright holders responsibility to ensure that you have access to the works after copyright expires - and indeed, neither should it be.
You could argue this violates the DMCA with respect to technological protection measures.
But DMCA notices use a different part of the DMCA, which allows takedowns for actual copyright violations. IANAL, but I don't think that you can combine the two and use a DMCA notice to take down something that doesn't violate copyright but does violate the other part of the DMCA.
"They have a responsibility to their shareholders..." Dude, I'm not ragging on you at all... but haven't you guys heard this a whole helluva lot more these days? Corporatism = Fascism.
I completely agree with what you said, except as much as I dislike the recording industry and their tactics? I think their quest to find "unbreakable DRM" has more rationality behind it than you give them credit for.
The problem in their scenario is, they count on making their money via a high volume of music sales. (So to use one of your analogies, it's as though their business is costume jewelry sales. No individual piece would seem to be worth spending much money to protect, from a customer's perspective. Yet from their point of view, anything less than "unbreakable DRM" is like leaving their entire inventory sitting out on a table where anyone can walk by and help themselves to as many free pieces as they'd like to take.) DRM that's easily defeated by some free utility or music player plug-in is about as useful to the music industry as taping those pieces of costume jewelery down to the table with scotch tape.....
And really, that's why DRM is a hopeless endeavor. People implementing it WANT it to be like a safe, with thick walls that take hours to cut open, and a combination lock you'll stand no chance of randomly guessing the combination to. Yet it's not, because unlike a safe, once the first person goes through the effort to crack it open, they can transfer that ability to everyone else with VERY little effort. (Imagine a situation where magically, a cutting torch that cut through the wall of one safe could cut through ALL future safes instantly, after the effort was made on the first one. That's what DRM is like.)
As a somewhat random aside, I believe that most software is not directly copyrightable, as it is a derivative work of the source code. If the source code isn't copyrighted, then how can the compiled source code be copyrightable?
The source code can't be copyrighted, as doing so would require the publishing of the source, and that would reveal all kinds of secrets. Since the secrets are obfuscated in the compiled code, they are safe to publish (until they get reverse engineered, such as this example). But is compiled code copyrightable? I don;'t think so!
Da comrade, we get good job for mother russia, make many bullets. Crush capitalist pigdogs under might of Sasha!
Happy Stalin Day to you too.
As of right now, GP is 0 and parent is +5.
Troll and Flamebait do not mean "we disagree with your argument". What exactly was it about the GP that was said in a trollish or flamebaiting manner other than mirroring, with only the briefest emphasis, a phrase that was part of the (highly modded!) comment he replied to?
Parent wasn't all that insightful either. GP's argument would hold for physical goods just as much as copyable goods. Copyright isn't involved.
We really need to stop abusing the moderation system as a way to suppress dissent.
As the agents of adobe state in i love's blog "that content in your blog...allegedly infringes upon the copyrights of others." Of course, its what's missing that is most interesting in the take-down notice; acknowledgment of the vulnerability, as though forcing i love... to remove the post makes the problem go away. When will they learn?
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Does he/she really love cabbages?
Mada mada dane.
Found it via a simple Google search for 'ADEPT PDF decryption'...
http://pastebin.com/f26972321
http://pastebin.com/f1cb3663c
Get mad at the author for caving and making it easier for the next author to justify caving. Adobe is not to blame.
That's a distortion and a half. I cannot copy a song on iTunes, and I redistribute GPL code, unless I comply with either license. It's really simple actually. If you can invent for yourself a new kind of right that lets you make and distribute unlimited copies of a song, then certainly someone else can invent for themselves the right to redistribute GPL code in proprietary products. Either you agree that the copyright holder has a right to control distribution, that is, you believe in copyrights, or you don't.
It's really very simple, and what you are offering, instead, is that people must comply with YOUR copyrights, that is, the GPL, but you don't have to comply with THEIRS.
That's bullshit.
This is my sig.
Reverse-engineered does not mean broken. The guy broke it by reverse engineering it. DRM is broken enough already to need sensationalist summaries like this one.
Recording the output is trivial, as you say. However, audiobooks can be 30 hours long and are broken up into 3, 4, even 5 pieces. The "analog-hole" approach is not practical under these circumstances.
I assume that they're broken up so that the maximum length of each piece isn't cumbersome; your reply indicates that the pieces are usually less than 6 hours long; most people sleep at least 5 hours/night which would only mean 1 hour of computer deprivation assuming only one computer in the house to do this.
But to get to the real point: your reply shows why DRM actually does work, even if it is breakable. It just has to make breaking it enough work that enough people are willing to pay for the luxury of not having to break it (i.e., buy multiple copies of the same content). Of course, the downside is that it will sometimes scare away other customers, like me. But as long as people like me are in the minority, companies will continue to try to use DRM to pad revenues.
All of these companies who develop corporate American malware (a.k.a. DRM) are worse than terrorists. They are working to eliminate consumer rights and they want to chain users to the products of their brethren. Because of corporate American malware, I can only read e-books on Windows. Because of corporate American malware, I can only listen to purchased Itunes music on Windows or Mac.
The cabbage guys who cracked the corporate American malware are heroes in my opinion.
>What the recording industry provides is not infinitely valuable, so DRM needn't be infinitely strong.
While it is true that the content is not infinitely valuable, the cost of having your DRM broken means the content becomes infinitely INvaluable. So DRM needs to be very strong because once it's broken, your product is worthless. As in, no one will be willing to pay money for it.
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
>Without copyright, people might not make money out of it. But nobody says
>people are supposed to make money for everything they do. Making money is not a right.
Making money may not be a right, but it is one hell of a motivator. Perhaps the greatest motivator ever devised. Take away the motivation, and you will have a lot less of it.
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
As I recall it, the DMCA forbids circumventing an "effective technical measure" that restricts access to copyrighted material. Now, while I personally can't be bothered to crack anyone's DRM, I DO see an interesting hole in the DMCA here: Specifically, it only protects "effective" technical measures.
What defines the meaning of "effective" as used here? I strongly suspect that it HAS no well-defined meaning until tested in court. Moreover, the question of effectiveness is NOT AT ALL STRAIGHTFORWARD in legal terms. Consider a few examples:
1) ROT13 encryption of a text document would stop 80% of Americans from reading it, mostly because they couldn't be bothered; the other 20% would waltz right through it without breaking stride. ROT13 is trivially solvable by a 5-year-old, so it's likely that no one can be bothered to publish tools to crack it. Is stopping 80% of Americans "effective" if a 5-year-old can break it?
2) Most forms of DRM, such as CSS encoding of DVDs, can probably stop, say, 99% of Americans from breaking the DRM *on their own*. HOWEVER, the other 1% tend to publish their exploits on the Internet, and some folks even provide user-friendly toolsets for this, so that in effect, at least 50% of Americans can easily break the DRM using widely-available tools provided by the others. Is a DRM that ultimately stops only 50% of Americans "effective" when anyone who bothers to download the right tool can crack it?
Now, it's obvious that CSS is a more secure algorithm per se than ROT13. ROT13 cannot conceivably be viewed as "effective" content protection, but (in my admittedly crude back-of-envelope analysis) it stops more folks than CSS, which IS considered "effective" content protection.
In the presence of a global Internet, neither of the two methods can stop the majority of Americans from getting at the content behind them; thus, the primary barrier to access is the user's indifference. Does this not imply that there is no such thing as an "effective technical measure" once anyone has broken it and published a cracking tool (even if that tool is illegal)?
Alternatively, the circumvention provision of the DMCA must be critically dependent on a rather tortured and artificial reading of the term "effective." Moreover, it's clear that technological progress can render DRM schemes ineffective, which is obviously a one-way street.
Methinks a good attorney could drive a truckload of decrypted DVDs through this provision.
DRM is failed. DRM will never work. We don't need anymore analogies. DRM is flawed because of the core principle of '
memory'. DRM is a function that tries to prevent the use of memory when the object containing DRM depends on 'memory'.
"Remove the 'memory' aspect of the product and it is secured by DRM 100%, but remove the 'memory' aspect of the product renders the product 100% useless." - By Neruos
But now what youâ(TM)re really here for â" the PDF decryption tool: REMOVED. (And if you don't already have it, the key-retrieval tool: REMOVED.) ...
Edit: Links to tools removed due to DMCA complaint from Adobe.
and then the cache updated... Owell. I found copies elsewhere but they're source (python files) Would be nice if someone could post a binary or other readymade app for the novices
I work for the Department of Redundancy Department.
Note that even laws like the DMCA talk about copy protection, rather than DRM.
That's not entirely correct. While they refer to them as copyright protection devices, the actual definition of infringement in USC 17.12.01 is:
No person shall circumvent a technological measure that effectively controls access to a work protected under this title.
So according to the law copyright protection devices control access to the work not just copying of the work. Another reason that it is a bad law.
Get it into your thick skull already; copyright cannot stop you from using what you bought the way you want it. It only stops you from copying what you bought and giving it to others.
You are mistaken, and the above is incorrect.
When you "buy" a song, a photo, or software, what you are really doing is purchasing a license to use a copy of the item. The license almost always has restrictions. You can NOT do "anything you want" with your copy. For instance:
1) When you buy a song, you can't then play that song at your restaurant. This is a commercial airing of the song, and you have to pay royalties for this use. This is outside of the license you were granted for your personal use of the song. It doesn't matter how you purchased your copy - bought a CD or downloaded it from iTunes. Ditto for buying a DVD of a movie then showing the movie at your business.
2) When someone takes a photo of you at an event (e.g. sporting event, graduation, office xmas party) and you buy a print or a jpeg, you can't give your copy (no "copying" taking place) to someone else to use for commercial purposes. The photographer still owns the copyright on the image, and your copy is for your personal enjoyment only and is not licensed for commercial use. (Such commercial use usually involves making additional copies and the "copying" becomes the issue, but even if no additional copies are made, the commercial use is outside the license granted with the personal purchase of the photo.)
3) When you buy software, you can use it on one computer, and a backup computer. You can't install it on every computer in your home or office *unless* the seller explicitly gives you this right.
You do have the "right of first purchase" to use your copy for personal use or to sell it to someone else (as is the case with a music CD or video DVD). But your rights are limited, even for your own personal use.
Now, it is fair to argue that copyright laws have been extended (many times) in the past 100 years in ways that amount to a "taking" from the public domain, and that they are overdue for changes. As someone who benefits from copyright laws (I'm a photographer), I'm not in favor of their extended reach today, and back proposals to rein-in copyright. But until the laws are changed, this is the state of copyright law in the US today.
You may also find these cites helpful:
Copyright Myths
Brief Intro to Copyright
"I'd much rather be mistaken as a lesbian by a bigot than be mistaken as a bigot by a lesbian."
same with congress and the Micky mouse law
How can extending the copyright term of content that was already created possibly enrich the public domain? No, it hampers it because it prevents people from humoring it and creating derivatives, but that doesn't keep the RIAA and MPAA, and as a result congress, from telling people it does enrich us.
Hey, why is Digital Editions at Adobe 404'd? In response to this? I wanted to get a book. :(
If you want to allow others to build on your work and force them to allow you to build on theirs you use GPL.
Without a license like GPL, your customers are not allowed to build on your work and re-distribute.
If you receive source someone else provided to you under GPL (i.e linux), the fact that you can modify and re-distribute it is a favor to you from them. If you then distribute changes, your contributions benifit everyone, especially the origional authors.
GPL is best used for tools that are not your key products, i.e don't work on Apache if you make webserver software - only if you use it a lot.
*I'm not a GPL expert, just a user*
but we are talking about DRM, which controls use, not distribution.
Well that's the point, isn't it. As a practical matter, the only use DRM really seeks to prohibit is duplication and perhaps alteration and duplication, and these two items are in fact the very same items that the GPL addresses through licensing.
You have leaped from a discussion about DRM's incompatibility with copyright to a rant defending copyright itself. Have a coffee, re-read the comments about then get back to us.
I have read the comments and I think the argument that says there is a distinction between DRM and the GPL is disingenuous. As I've said, your argument of "use" glosses over the simple fact that the most reasonable "use" of hacking DRM is, in fact, to distribute DRM'd works, thus violating the right of the copyright holder.
If you want to be against intellectual property, and say that there's no copyrights, that's fine, but be consistent, and accept that the open source movement is essentially public domain, and tolerate the commercialization of Linux just as much as you would expect the creator of a song, say, Metallica, to tolerate your copying of their works.
This is my sig.
Now there is a pack of pricks that should be laid on a water bed full of petrol with free cigarettes... They own MM because MM couldn't afford any more time in court. Why that wasn't stopped as being a monopoly is amazing. They invent a plugin format for image editors and once everyone is using it the encrypt the format so it only works with their products. If ever there was software that should be cracked it's theirs!
When you "buy" a song, a photo, or software, what you are really doing is purchasing a license to use a copy of the item.
No. When you acquire a copyrighted work, there's no license involved, and you can do anything you want with it, except for those things that are specifically restricted by copyright law. Your own source, the "Brief Intro to Copyright," says: "If you create something, and it fits the definition of a creative work, you get to control who can make copies of it and how they make copies." As the source says, the issue here is copying (and also public display), not mere use.
Your first example is of public display or performance, something specifically restricted by copyright.
Your second example is incorrect - if I own a copy of a photograph and I can make some commercial use of it without copying or publically distributing it, I don't need the permission of the copyright holder to do so (I can't think offhand of a way you could use an image commercially that didn't involve copying or publically displaying it; but if there are any such ways, they are permitted by copyright law).
Your third example is contentious. Software companies claim that using a program involves copying it, and so using it requires a license. But even if that's true, the license is only required because you are copying the software.
its not anything laid out in law as copyright law does not handle what happens to the work after copyright law ceases to apply.
Uuuuhhmmm.... It will fall out of copyright, thereby enriching the cultural commons? There's not really much else it can do, unless it hasn't been distributed at all.
Or in other words, its not the copyright holders responsibility to ensure that you have access to the works after copyright expires - and indeed, neither should it be.
No, it shouldn't. But I should be able to undertake the effort to make that legal copy after the copyright expires, if I so choose.
DRM prevents this, or at least makes it a significant burden for most people.
"City hall" in German is "Rathaus" Kinda explains a few things......
It's not stealing!
It's COPYRIGHT INFRINGEMENT, you FUCK!!
>Because no one buys DVDs now that CSS is trivial to bypass.
I know I don't.
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.