13 ms·
Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING"
- pav3l 14y agoCan someone explain how he got a hold of the decrypted .mov files that he compared the encrypted ones with? It's not very clear to me from the post, and I'm not familiar with Leaping Brain. Either way.. wow... XOR encryption with just such a short repeating string! I bet it wouldn't be too hard to decrypt it even without the original file, since the file signature alone would probably be longer than the string. DISCLAIMER: I'm just speculating, I don't know the .mov specs.
- tedreed 14y ago"Well, since they load the file from a Python script, it's easy to make a copy of the "decrypted" file before it's reverted." He edited their Python script to make a copy.
- doorty 14y agoThe player decrypts the file before it is played and then encrypts again when it is finished, so if you grab the file while it is being used by the player then it will be decrypted.
- srdev 14y agoThe "proprietary player" was just a Python script that made a temporary decrypted the video and ran VLC against it. So he just changed the Python script to keep around a decrypted copy rather than re-encrypt it away.
- NickPollard 14y agoFrom what he says, it sounds like the app is really a standard movie player, plus their 'encrypter', plus a python script that does the following: > calls 'decrypt movie_file' to create 'decrypted_movie_file' > calls 'play decrypted_movie_file' > calls 'delete decrypted_movie_file' He just made a copy of the python script that calls their own decryption module but removed the delete line.
- pav3l 14y agoI don't even know what's worse - their "proprietary encryption algorithm" or the fact that they used Python for a critical piece of distributed software that you don't want to be reverse-engineered!
- tvdw 14y agoFor the record, distributing Python scripts doesn't have to mean distributing the source: it's possible to just execute the compiled .pyc files, which are harder to crack than (for example) Java's .class files. Also, since xor is just a CPU instruction, you won't immediately notice it in the decompiled script (if you get that far). With all the overhead that decompilers tend to produce, it's really easy to miss.
- revelation 14y agoYou should really take a look at one of these .pyc files. They are very very verbose to the point that they even contain local variable names and the python code can be trivially decompiled from the bytecode. Literally the only thing that goes missing from .py to .pyc is comments.
- jrockway 14y agoThat's what an assembly dump looks like to an experienced reverse engineer. Writing something in a "compiled language" because it's more secure is like XOR-ing your video with RANDOM_STRING and calling it DRM. (Not that any DRM scheme can ever work, ever, but hey. At least some try to try.)
- tshtf 14y agoHe just performed a bitwise XOR of the plaintext and ciphertext stream to obtain the key. From the post: By comparing the binary files, I discovered the "proprietary video encryption" algorithm: for the first 15kB, each 1kB block has its initial bytes xor'd with the string "RANDOM_STRING". See: https://en.wikipedia.org/wiki/XOR_cipher https://en.wikipedia.org/wiki/XOR_cipher
- mikeash 14y agoLooking briefly at the .mov file format[1], it appears that any such file is guaranteed to have exactly the same bytes 4-11 (atom identifier and major brand identifier), is almost guaranteed to lead with three zero bytes (first four bytes are the length of the first atom, which is likely to be small), and will probably have the same bytes 12-15 (minor version number). If you know it's a .mov file, then you can extract "RAN" and "OM_STRIN" trivially, and the rest is easily guessable from there. In fact, since the first three bytes are probably zero, "RAN" will be right there in the file, ready for pondering. [1] https://developer.apple.com/library/mac/#documentation/QuickTime/QTFF/QTFFChap1/qtff1.html#//apple_ref/doc/uid/TP40000939-CH203-BBCGDDDF https://developer.apple.com/library/mac/#documentation/Quick...
- asherlangton 14y agoThe wrapper script is GPL'd, so I copied it here: http://dl.dropbox.com/u/15447644/brainplayer_py.txt http://dl.dropbox.com/u/15447644/brainplayer_py.txt My modifications are on lines 553-556. The compiled app "fixes" the .mov file just long enough for it to be loaded into the player. If you have Leaping Brain's player installed (often branded with the content owner's name), the .mov files are in a hidden .media folder. On my Mac, they were in $HOME/Library/Application Support/LeapingBrain/catalog/$VIDEONAME/.media
- pav3l 14y agoThanks for sharing! Hope you won't get in trouble for your post.
- nacs 14y agoNot sure how he could get in any trouble from it due to the license at the very top of the file he linked: "# BrainPlayer is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License I'm sure Leapfrog hated to put that GPL license on there but were likely forced to due to the VLC components they're using that are GPL/LGPL.
- alexkus 14y agoAnd, as per https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited the DMCA cannot be applied to this software.
- 0x0 14y agoReusing one-time-pad keys means you can often very easily recover the plaintext simply by XOR'ing the two encrypted files, since it effectively takes the key out of the picture, see for example http://www.cryptosmith.com/archives/70 http://www.cryptosmith.com/archives/70 (where the key is literally taken out of the picture)
- mturmon 14y agoFrom http://leapingbrain.com/ http://leapingbrain.com/: "Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security." Near-ridiculous security seems about right.
- STRML 14y agoThe whole thing is a marketing "worst-of". They consistently advertise their products as "unique, brilliant, revolutionary", "magical, user-friendly, powerful", and "your only option". The real laugh-out-loud moment is this tagline (http://leapingbrain.com/mod-machine/overview/ http://leapingbrain.com/mod-machine/overview/): "Forget crappy streaming systems and primitive, unprotected loose movie file downloads that make your products seem like a joke."
- ohashi 14y agoI bet there is a better way to securely share files.
- Aardwolf 14y agoI'm actually wondering if the whole leaping brain website is just filled with sarcasm on purpose? I mean, even for the US, the superlatives seem a bit overdone.
- jcromartie 14y agoI didn't realize this was a US company because of the awful website copy. The content is just appallingly bad, and seems more like something fit for a web squatter or an eastern-European warez site.
- mturmon 14y agoI think you're right. Their word choice about security ("ridiculous" security) seems to be a wink-wink-nudge-nudge touch. In other words, it looks knowingly negligent, and I wonder if that could have legal consequences?
- toyg 14y agoI am awed by the chutzpah of whoever is behind Leaping Brain, selling snake oil to clueless media people. This is why I'll never be rich: I am utterly unable to sell crappy non-solutions to people with more money than knowledge.
- dmix 14y ago> I am utterly unable to sell crappy non-solutions to people with more money than knowledge. This is why us engineers quietly keep the world running.
- lutze 14y agoIt's easy to laugh at stuff like this, right up until they get the contract to secure your online banking...
- jtheory 14y agoMy suspicion is that they wrote the "secure" DRM first -- probably actually encrypting the video files -- and realized that it was way too slow to decrypt before playing the file, and for whatever reason couldn't figure out streaming it to the player during decryption. So they hacked together something that was acceptably fast, figuring they'd solve this technical difficulty for the next release, and that was that.... It's also unfortunately possible that (until now, at least) only the developer(s) knew about this shortcut, if their internal dynamic is sufficiently poor.
- georgemcbay 14y agoWhile this is a particularly terrible DRM system for videos and I'm sure there are some really pissed off people at media companies who are learning this the hard way, in practice this is really no worse than any other video DRM system out there when it comes to stopping piracy. HDCP is cracked, the genie is out of the bottle and there's no practical way to put it back in without causing a consumer uproar. All you can do technically is try to prevent super casual pirating of digital content, because the tech savvy can't be stopped by any practical solution. (Of course, even if HDCP wasn't cracked the analog loophole would still render DRM on any non-interactive content mostly useless). So ultimately this stupid system (even now that it is 'cracked') is still about as effective as any other when it comes to stopping that super casual pirating.
- iandanforth 14y agoCould someone (OP?) provide more of the steps that might have gone (went) into discovering it was an XOR operation and the original string? Seems like an impressive intuitive leap to me!
- alxbrun 14y agoHe said it was decoded by a Python script.. so easy to understand from the script I guess.
- jlgreco 14y agoAfter recovering the original file, he "compared the binary files". Likely this means he popped them both up in a hex editor and noticed the difference. XORing by a string is a very common very very trivial thing to do, so it would be pretty high on your list of things to notice.
- ben0x539 14y agoMaybe OP just xor'd the files with each other and the result was the RANDOM_STRING string followed by a pile of \0 bytes, repeat. Edit: To clarify, I meant the encrypted and temporarily-decrypted-by-the-wrapper-script versions of the same .mov file.
- tptacek 14y agoThe XOR of two ciphertexts under P XOR K isn't K (you have to know a plaintext to make that trick work, which, granted, you likely would here). The solution that doesn't require a known plaintext is comparably simple.
- sold 14y agoAs the post says, he gained access to both decrypted and encrypted version. Then (p XOR k) XOR p = k.
- tptacek 14y agoIt's so easy to solve repeating-key XOR for the key that the solution is a practical way to detect the scheme; you wouldn't even necessarily bother trying to detect it, you'd just run the "solver" (even calling it a solver sort of dignifies it a bit too much).
- asdfaoeu 14y agoSomeone want to explain why this is less secure than other DRM methods?
- lotyrin 14y agoPrecisely. They've gone to an effort which should invoke the DMCA (as ridiculous as that is) and they have a bullet point somewhere on a power point they can show to content creators that says DRM. Those are the practical uses of any DRM technology one might ever devise. Sure, you could throw in more than 5 seconds of security-through-obscurity, but why bother?
- rdl 14y agoThere actually are DRM schemes which were too hard to break -- DIVX from Paul Kocher (distinct from DivX), for instance.
- lotyrin 14y agoI'm not saying it's impossible, merely saying that the technical strength of a DRM system is often not one of the primary goals.
- rdl 14y agoIndeed, and Divx was actually a commercial failure, partially due to how annoyingly complex their rights management was (but mainly because their partner was dying). DRM (and similar tech) works pretty well in specific cases, like printer-ink DRM. I actually think ERM was a great idea, but sadly failed to DLP and other solutions (basically blacklist vs. whitelist of permitted activities). Where it fails is software, particularly "media content", on commodity players, fully in possession long-term of end users, who are otherwise hostile, with no real costs to a failed break attempt.
- tptacek 14y agoPrinter ink: another CRI success story.
- hosay123 14y agoYou cannot simultaneously crow "hurr, DRM is broken!" and act all smug about this discovery. Perhaps the original developer, like you, understood this, and did the absolute bare minimum necessary to fulfil commercial obligations, all the while making it easier for people like himself (i.e. you) to get what they want, and making a few bucks from the old and dying media industry all at the same time. Given the evidence (complex integration with a non-standard set of open source libs, complex industry area in general), I'd say it's almost certainly an insult to imagine the developer could not have made your life harder if he'd chosen to. Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been. "No good deed goes unpunished"
- asherlangton 14y agoYou're right, actually. I'm glad it's broken, because it's a lot easier for me to watch the videos I purchased without the DRM. I was just struck by the audacity of their marketing claims.
- mietek 14y agoWay to miss the point. It's just as broken as any other DRM!
- andrewcooke 14y agoi think you can be stronger than that. it's clearly written to show to the "discoverer" that it's only a gesture. i would have thought anyone with an ounce of compassion and empathy would have smiled and kept quiet. broadcasting this, and likely harming the developer, for internet points, is a pretty poor move.
- charonn0 14y agoPlease, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been. The developer(s) created a product that didn't do even 10% of what was advertised and now must face the consequences. Why is that bad? Their professional reputation should suffer if the quality of their work is poor.
- i0exception 14y agoAnyone who has taken Computer Security 101 would know that security through obscurity is not the smartest thing to do. Calling it "near-ridiculous level of security." is downright blasphemy.
- asherlangton 14y agoOr just (unintentional) truth in marketing...
- 4ngle 14y agoNot to mention, a foolhardy challenge to break it.
- damian2000 14y agoI wouldn't even call it security through obscurity. I'd call it dumb as rocks security.
- marssaxman 14y agoBlasphemy? Sounds like nothing more than the simple truth. If anything, they're being too humble. It literally is a ridiculous level of security, for here we all are ridiculing it.
- shmerl 14y agoThe only mistake in that was the word "near". It's purely ridiculous, since that method has nothing to do with security honestly saying.
- esrauch 14y agoExcept that these videos are playing on your local machine. With the most advanced DRM mechanism possible it is nearly as trivial to simply record the video output. There is no reason to spend developer time making a complex mechanism that is no more secure than a simple xor.
- coin 14y agoRecording the output is not the same as extracting the DRM-free stream
- px43 14y agoThis is what they call this a 1024 bit Vernam Cypher in the movie "Swordfish".
- marshray 14y agoThis is apparently why the DMCA anti-circumvention provisions only apply to bypassing "effective copy protection" systems. Of course, if a copy protection system was "effective" it wouldn't need a law prohibiting its circumvention. Conversely, if a copy protection system is circumventable, it's not effective.
- gizmo686 14y agoUnfourtuantly, the term "effective" is highly ambiguos. One could argue that any system that works against non-programmers is effective, as most of the market is a non-programmer.
- nitrogen 14y agoThe term "effective" is defined in the DMCA: 1201(a)(3)(B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. So, even trivial measures like the broadcast flag or SCMS[0] are covered by the DMCA's anti-circumvention provisions. Similar laws in other countries have similar definitions. [0] https://en.wikipedia.org/wiki/Serial_Copy_Management_System https://en.wikipedia.org/wiki/Serial_Copy_Management_System
- eli 14y agoIANAL, but I'm pretty sure you are misreading that. A technology that "effectively controls access" means that it has the effect of controlling access. It's not a qualitative statement on how well it works.
- alexkus 14y agoSince it uses [L]GPL software then this comes in to play:- https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited " Does GPLv3 prohibit DRM? It does not; you can use code released under GPLv3 to develop any kind of DRM technology you like. However, if you do this, section 3 says that the system will not count as an effective technological “protection” measure, which means that if someone breaks the DRM, he will be free to distribute his software too, unhindered by the DMCA and similar laws. As usual, the GNU GPL does not restrict what people do in software, it just stops them from restricting others. "
- joezydeco 14y agoHow do we know this wasn't a non-english speaking subcontractor that took the spec too literally?
- mahmud 14y agoWhat the hell? That implies someone who can't implement security themselves was tasked with the design of said security. Actually, that sounds about right ..
- Eliezer 14y agoMaybe there's a scheme here to prevent good DRM by flooding the market with highly inflated impressive-sounding claims attached to laughable security. The Old Media crowd won't be able to solve the Design Paradox (http://www.paulgraham.com/gh.html http://www.paulgraham.com/gh.html) well enough to tell who's lying, good designs won't be able to charge more than laughable competition, and the DRM field will slowly die.
- corwinstephen 14y agoThat's gotta be one of the most genius conspiracy theories I ever heard.
- oconnore 14y ago"Just a few bytes of brilliance" Actually, 13 of them.
- damian2000 14y agoHas anyone pointed out that "BrainsTrust" (in the UK at least) is mostly used sarcastically to mean a stupid/idiotic person. So I think you are onto something here.
- dllthomas 14y agohttp://en.wikipedia.org/wiki/Brain_Trust http://en.wikipedia.org/wiki/Brain_Trust
- Jimmie 14y agohttp://www.urbandictionary.com/define.php?term=Brain%20Trust http://www.urbandictionary.com/define.php?term=Brain%20Trust
- dllthomas 14y agoYes, not saying it's never used ironically - I agree that that is probably most common - just pointing out that it originated as a serious label for anyone unfamiliar with the history.
- danso 14y agoHa, so the key really was "RANDOM_STRING", in the literal sense...was that just the programmer giving up, or was that pseudocode that was missed during shipping?
- Eliezer 14y agoWhat string could possibly be more random than the one which says "RANDOM_STRING"?
- RickHull 14y agoObligatory XKCD: http://xkcd.com/221/ http://xkcd.com/221/
- msg 14y ago"RANDOM_STRING" implies a suspiciously structural byte alignment. "RANDOM_BITS"
- pwg 14y agohttp://dilbert.com/strips/comic/2001-10-25/ http://dilbert.com/strips/comic/2001-10-25/
- chimeracoder 14y agoRelated: https://bbs.archlinux.org/viewtopic.php?id=66969 https://bbs.archlinux.org/viewtopic.php?id=66969 You can even show your support: http://www.zazzle.com/14_is_not_a_random_number_tshirts-235047239743529386 http://www.zazzle.com/14_is_not_a_random_number_tshirts-2350... Or, for those who disagree: http://www.zazzle.com/14_is_a_random_number_t_shirts-235046315951603929 http://www.zazzle.com/14_is_a_random_number_t_shirts-2350463...
- ahelwer 14y agoThe script was amazing.
- MBCook 14y ago
- ataggart 14y agoJudging by the headline, it sounded like they tried to implement a one-time pad, but had only heard of them by rough description.
- jacques_chester 14y agoThat was my thought too. In theory, OTPs are nigh uncrackable. In practice, they suck. 1. The XOR text needs to be as long as the plaintext. 2. The XOR text needs to be truly random. 3. You have to distribute the XOR test somehow. Remember all those spy novels where they burn the codebooks? Yeah.
- derleth 14y ago> In theory, OTPs are nigh uncrackable. One-time pads are mathematically proven to be uncrackable if used correctly. This is because, for any given cryptext, every possible plaintext of the same length is equally probable. Using a one-time pad correctly means only using a given pad once, the 'pad' being the key material. If you ever reuse the same key, you are no longer using a one-time pad and the above proof no longer applies. And if your pad is 13 bytes which you keep reusing over and over again, you're a bleeding idiot.
- cbsmith 14y agoIt very much depends on the use case. If I was a CIA director having an affair with a biographer, an OTP would seem quite helpful. During our liaisons, we could exchange thumb drives with several GB of randomly generated data from any of a number of reasonably random entropy sources (hardware PRNG works pretty well by itself, but you can throw in EGD and other sources for greater confidence) with some software whitening and the occasional bit of chaff plaintext for good measure. At each exchange destroy any previous pads (and yes, one would have to go to some lengths to ensure destruction without interception, but tossing them in to an incinerator would probably work pretty well). Now I have a means to communicate over the internet while apart from my paramour without any concerns about the content of the messages being decoded while in transit (compromises at the source or destination are obviously still in play). Not every crypto problem involves establishing a secure connection party selected ad-hoc without a higher-bandwidth secure channel.
- damian2000 14y agoThere's two software engineers and a product architect listed on the about page - http://leapingbrain.com/about/ http://leapingbrain.com/about/ It might be a good idea to remove their names, to protect their reputation. ;-)
- mahmoudimus 14y agoI did a lot of reverse engineering back in the day - you'd be surprised how many "virtually uncrackable" DRM protections used by companies like Adobe (at the time - Macromedia) that were just stupid XORs of magic strings. Ahh..the good old days of SoftICE and w32disassm. Oh man, the worst was the md5 of some salt + whatever you put in. If you ever want to see some gems of misuse of cryptography for DRM management, let me know - email's in my profile. Some examples: Using RSA 1024 bit keys, with exponent of 3...
- pbsd 14y agoe=3 is fine, so long as you remember to pad...
- NateLawson 14y agoIt's not that simple. There are other attacks against e=3, and you have to prevent them all.
- pbsd 14y agoWhat kind of attacks remain when using proper padding (e.g. OAEP)?
- B-Con 14y agoBeing who he is, it would be interesting to hear him elaborate.
- NateLawson 14y agoThe original commenter said, "using RSA 1024 bit keys with exponent of 3" was a flaw in DRM systems he or she had reviewed. Your response was "e=3 is fine, so long as you remember to pad" and then "what kind of attacks remain when using proper padding (e.g. OAEP)?" I feel a bit queasy any time I read "just do this" as a solution to crypto flaws[1]. Such answers assume way too much about the system the proposed fix applies to and make it sound trivial to secure. They also leave out all the steps behind what things "just pad" means (e.g., receiver must verify the padding and sender must properly generate). When a developer hears "just pad", they think "append a string of zeros" when implementing a sender or "skip" when writing a receiver because that's what it means in other contexts. In particular, your response assumed the DRM system in question: * Was performing RSA encryption of a message, not signing or verification * Used a public exponent e=3, not a private exponent d=3 Assuming the reader knows enough about RSA and cryptography to know what "just pad" implies, it may still be insufficient to solve the problem. For example, if the commenter meant d=3, "just pad" wouldn't fix Wiener's attack. http://en.wikipedia.org/wiki/Wiener%27s_Attack http://en.wikipedia.org/wiki/Wiener%27s_Attack Or, in the cases of RSA used for purposes other than message encryption, the suggestion of OAEP does not apply. Consider the attacks against the TMN secret sharing protocol and Franklin/Reiter verifiable signature sharing scheme (sections 5.1 and 5.2 of this paper). http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.33.6527 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.33.6... The F/R scheme involves RSA encryption of signatures. But signatures must be the full modulus size (no padding possible) unless you use a larger RSA key for encryption than for signing. So again, OAEP would not fix this flaw. Remember that the commenter was mentioning DRM, so jumping to the conclusion that they were using RSA for straightforward message encryption and with e=3 was not warranted. There are lots of applications for RSA in DRM (verifying a signature on a license key, calculations under homomorphic encryption, etc.) For many scenarios, "just pad" would not solve the problem, even with the generous assumption that the reader knows exactly what that means and applies it correctly. [1] I'm not picking on you here. The most astounding of these kinds of errors was when Colin Percival (who I highly respect) said "use AES-CTR mode + HMAC" and then later found he had made a fatal flaw in his own implementation of exactly that. http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html http://www.daemonology.net/blog/2009-06-11-cryptographic-rig... http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-...
- javajosh 14y agoThis should be lauded just as much for being a solid little piece of citizen, even activist, journalism. The specific issues about DRM are important, but I think the greater willingness to really look into things and publish the results should be encouraged.
- stcredzero 14y agoBreaking repeated XOR with a string is a variant of the Vignere cipher or the Vernam cipher, depending on how you think of it. Either way, breaking it is a freshman cryptography exercise.
- mopatches 14y agoThe Vernam cipher is actually quite strong when used correctly - the key needs to be as long as the input; it's never repeated :) http://en.wikipedia.org/wiki/Gilbert_Vernam#The_Vernam_cipher http://en.wikipedia.org/wiki/Gilbert_Vernam#The_Vernam_ciphe...
- samuellevy 14y agoTomorrow on HN: "Legislation passed to embed DRM chips into people's heads, which automatically shut down visual input if un-authorized content is detected playing in their vicinity. Three strikes policy before permanent blindness."
- photorized 14y agoThe business goal behind most of these "protection" methods is to make unauthorized (unpaid) copying/sharing inconvenient. That's it. There are no commercially feasible methods to protect video or audio content against "a determined hacker", but that's not what these barriers are for. You can make fun of these laughable encryption methods all you want, but they serve their purpose by providing the desired purchase to piracy ratio. The problem is marketing folks getting carried away when describing these "technology solutions" to the content owner, because that's what they (as well as VCs) want to hear. Disclaimer: cofounded a video CDN+DRM provider more than a decade ago, developed many content protection methods over the years.
- tlrobinson 14y ago"It turned out the actual player, launched from their compiled app, was a Python wrapper around some VLC libraries" Isn't VLC licensed under the GPL? Or at least was until very recently? http://www.jbkempf.com/blog/post/2012/How-to-properly-relicense-a-large-open-source-project http://www.jbkempf.com/blog/post/2012/How-to-properly-relice... Is/was Leaping Brain violating the license? EDIT: the wrapper script is apparently released under the GPL too: http://news.ycombinator.com/item?id=4834834 http://news.ycombinator.com/item?id=4834834
- alexkus 14y ago> Is/was Leaping Brain violating the license? No, I can't see how they are. Here's one GPL FAQ that's vaguely relevant:- https://www.gnu.org/licenses/gpl-faq.html#CompanyGPLCostsMoney https://www.gnu.org/licenses/gpl-faq.html#CompanyGPLCostsMon... But this question is very relevant:- https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited " Does GPLv3 prohibit DRM? It does not; you can use code released under GPLv3 to develop any kind of DRM technology you like. However, if you do this, section 3 says that the system will not count as an effective technological “protection” measure, which means that if someone breaks the DRM, he will be free to distribute his software too, unhindered by the DMCA and similar laws. As usual, the GNU GPL does not restrict what people do in software, it just stops them from restricting others. "
- tlrobinson 14y agoI didn't mean DRM violated the GPL, I thought that they may not have been complying with the GPL by not releasing their code that used libvlc, but it appears they are.
- leoedin 14y agoJust a heads up, but I think (assuming it's not somebody else on the page) the formatting of your GPL quote means that it doesn't break automatically, making the comment page very wide (at least in IE9).
- anonymous 14y agofacepalm Come on, people! First rule of weak DRM, you do not talk when you find weak DRM. Second rule of weak DRM, you DO NOT talk when you find weak DRM. Third rule of weak DRM, upload to pastebin, then walk away.
- pilif 14y agoThis could very well be a simple bug where it's supopsed to XOR with some really random string generated on the server, but some replacement of a template string isn't happening which is why it XORs with RANDOM_STRING. Of course this is only marginally better and should really have been caught, but there's a huge difference between saying that XORing 12 bytes with RANDOM_STRING is kick-ass DRM and actually having a kick-ass DRM infrastructure that then doesn't work right because of a bug. If this was any really random looking string, I would be more inclined to assume that this was intentional. By the string being this token, I would guess it's a bug somewhere. Remember. If RANDOM_STRING was truly random, unique per file and account and only transmitted from the server before playing, then this would be as good an encryption as any.
- jhuckestein 14y agoThat wouldn't be better. Intercepting the decoded movie is trivial either way. Finding the encryption scheme was just a fun exercise and discovering the random string (even if it isn't "RANDOM_STRING") once you have the decrypted copy is trivial as well.
- harshpotatoes 14y agoMy understanding is that when using the xor cipher, even if the key is truely random, the file could still be trivially completely decrypted for a repeating key. It seems like a rather unwieldy cipher if you need to download a key which is nearly the same size as the video file.
- deleted 14y ago[deleted]
- jayzalowitz 14y agohttp://xkcd.com/221/ http://xkcd.com/221/
- yk 14y agoThis is roughly the level of programming I expect from DRM software. After all, the content needs to be in unencrypted format at some point to view it.[1] Therefore there are two kinds of programmers working on DRM, idiots and liars. One kind does not understand the futility of their efforts, the other kind wagers that there superiors do not understand the futility of their efforts. [1] Assuming a general computation device, not a dedicated hardware player.
- shocks 14y ago"All aspects of the platform feature a near-ridiculous level of security." Well... They weren't lying...
- nnq 14y ago...I find it extremely funny when people use the word "virtually" to mean "practically" or "nearly" or "almost" and they turn out to be wrong but are excused by the fact that they added the magic word "virtually" :) ...and conversely, if someone uses the word when talking to me, I label everything the person says afterwards as 99% weasel words...
- Syssiphus 14y agoHm, anybody remember Dmitry Slyarov? http://en.wikipedia.org/wiki/Dmitry_Sklyarov http://en.wikipedia.org/wiki/Dmitry_Sklyarov As far as I recall the Adobe PDF encryption was also just some XOR with a simple passphrase. Got him into serious trouble. And WTH is 'virtually uncrackable'?
- seanhandley 14y agoXOR isn't insecure per se. What I'd like to know is how this "random string" is created in the first place
- SideburnsOfDoom 14y agoIt looks like the phrase "RANDOM_STRING" should be taken quite literally. That is the random string. Perhaps some code was supposed to substitute in something else, and it failed quietly.
- cafard 14y agoBack in the 1990s, the revolutionary organization Sendero Luminoso was naive enough to believe in WordPerfect's encryption. This was a grave mistake, for that encryption (for 4.2 and 5.1 at least) was a simple XOR of the password against the text--and in 5.1 you had 10 or so bytes of known text to compare against in the header. The decryption of the files was not the only thing that worked against Sendero Luminoso, but it must have hurt them.
- sigkill 14y agoTo be fair, when I read the title I thought that if the string is truly random then it's actually a very good technique. This is the core operating principle behind the one-time pad which is provably secure. Now that I read the article twice, I literally got a panic attack when I realized that it wasn't a random string that they were xor'ing their data with, but a string called "RANDOM_STRING". Although it sounds bad, one must realize that this is not security by obscurity since the key has been leaked, and nobody guarantees encryption against a leaked key.
- Dylan16807 14y ago'very good technique' The important part of a one time pad isn't the xor, it's the length. This does not even begin to resemble a one time pad. It's an xor cipher.
- sigkill 14y agoYeah exactly. I cannot convey the utter disappointment I had when I realized that it was "RANDOM_STRINGRANDOM_STRINGRANDOM_STRING...." that they were XOR'ing with.
- ballfrog 14y agoFrom their website: Fort Knox-level security. Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security.
- jcromartie 14y agoYou know what's absolutely terrifying? This guy could conceivably go to jail for this. Looks like he has kids, presumably a wife... hoping it goes well for him.
- radarsat1 14y agoI would like to propose that DRM is not intended to be uncrackable. It's easy to convince yourself that DRM is flawed, because fundamentally it is a flawed tool. Companies know this, they're not stupid. However, DRM is actually not a technical tool to prevent piracy. Rather, DRM is a legal tool to provide stronger legal arguments that theft has occurred. I'm not saying this is right, necessarily, but I think companies know full well that their DRM scheme will be broken, so it's not really worth investing in an "uncrackable" and costly solution. Instead, the role that DRM play is purely legal -- when the company does decide to go after someone for piracy, the DRM scheme, no matter how simple, provides them with the ability to say that the accused person "broke a lock," rather than simply walking in through an unlocked door. "Entering" vs. "breaking and entering." It's nothing but legal leverage, and effective at that role even if it's not a very strong lock. Of course, to have this argument hold, a company would never be able to admit that they purposefully implemented weak security -- this would be akin to admitting that their door was unlocked afterall, and would weaken their legal argument. Therefore, there remains a niche in the market for solutions that look secure even if they fundamentally aren't. It's all about lip service.
- talmand 14y agoIn the US, the DMCA more or less makes it illegal to reverse-engineer DRM regardless of how easy it is to crack. The DRM could be as simple as the code being "A" to bypass the DRM and if you do so, you have broken the law. Even providing that "A" to someone else would be illegal, look at all the silliness over the dvd copy protection fiasco. Therefore, they don't even have to pretend that the DRM is strong, just saying it's there is probably enough. It's one reason printer cartridges have chips that communicate to the printer. Reverse-engineering that to provide third-party cartridges is illegal. Well, it used to be, I'm not sure over current policy as the DMCA has a back door for exceptions. For PC games, the DRM is often employed to prevent piracy for the first two or three weeks because typically that's the highest level of sales. After that point it is usually cracked but sales often have dipped anyway. In some cases the DRM is removed in a patch at some point, often because the DRM causes problems for people who paid for the game, which kills long-term sales. Ubisoft recently changed their policies on having a seriously strict DRM to one that is more flexible; many thinking because it hurt their sales and that it was useless anyway. No one thinks of DRM as a long term solution since it is only a matter of time before someone cracks it.
- loup-vaillant 14y agoThe obligatory xkcd: http://xkcd.com/221/ http://xkcd.com/221/
- jiggy2011 14y agoQuestion: Can anybody name a DRM scheme that hasn't been cracked?
- asherlangton 14y agoThe CEO of Leaping Brain (or someone pretending to be him) has now joined the Google Plus thread, implying that the "DRM" was intended as satire...
- etsimm 14y agoI find it curious that (after 242) there are no comments here ranting about ir/responsible disclosure. Is this simply indicative of the readership's unanimous hatred of all things DRM - or is there perhaps a threshold of ineptitude beyond which we feel ethically free to fully disclose vulnerabilities?