5 ms·

Post author here! I wanted to make it clear that the original technique for breaking Spotify DRM is not mine - it was developed by Wang et al. in their excellen

by moyix 12y ago

Post author here! I wanted to make it clear that the original technique for breaking Spotify DRM is not mine - it was developed by Wang et al. in their excellent paper, Steal This Movie: Automatically Bypassing DRM Protection in Streaming Media Services. I just thought it would be a nice showcase of PANDA's capabilities. In particular, we can avoid the crazy optimizations in that paper because we can operate on a replayed execution rather than doing it live.

rational-future 12y ago
Hello OP! Can you give a short not so technical description of this attack please?
- gcv 12y ago
  Not the OP here, but briefly, the technique uses a little statistical cleverness and the ability to examine a running program to help identify which part of the Spotify program produces the unencrypted bytes of the track it is playing. It then taps into that part of the program, and copies these bytes to a file. That file then contains playable audio. (This data must be unencrypted in order to meaningfully feed the digital-to-analog converter of the playback computer.)
- AlyssaRowan 12y ago
  - Runs it in a virtual machine/emulator (QEMU). - Records (with PANDA) every instruction run and every piece of data read or written by that virtual machine for half a minute while it's playing audio. (!) - Analyses that recording and uses some very clever statistics to identify functions that read chunks of data that looks encrypted, and write chunks of data that looks compressed (yes, you can tell the difference, compression is imperfect). - Out pops one likely candidate, which sure enough is the decrypter.
  - moyix 12y ago
    Small correction: the magic of record-replay is that you don't have to record every piece of data read/written, only the non-deterministic events (interrupts, accesses to devices, and a couple instructions like `rdtsc`). This lets the overhead during recording stay low, while still getting all the benefits of a full execution trace. This is why we're able to store the Spotify trace [1] in only 263.1 MB. [1] http://www.rrshare.org/detail/28/ http://www.rrshare.org/detail/28/
thrownaway2424 12y ago
Hello, author. I read your whole post and still didn't know what PANDA might be. Please add a description or a link.
- rememberlenny 12y ago
  His other post explains it: http://moyix.blogspot.com/2013/09/announcing-panda-platform-for.html http://moyix.blogspot.com/2013/09/announcing-panda-platform-...
  - test_account_1 12y ago
    Thanks, saved me time for searching.
msane 12y ago
On the subject of cracking streaming music DRMs, a realization I have been sitting on for a while about what people can do with it... Considering the common wisdom that: - storage will get exponentially cheaper - data transfer speeds will get higher It makes me think that eventually there will be illicit torrents of all the worlds music, plus the index, plus the metadata, and plus the interface/app for browsing it. In other words, people would not only pirate individual songs or movies, they would download their own complete copies of Spotify / Netflix. It isn't feasible now but it could be sometime in the next 5-15 years, depending bandwidth speeds. I'm not sure how many people see this coming or take it seriously but I wonder what the effect could be and what the remedy attempts would be.
- null_ptr 12y ago
  You can see the remedy attempts already * push for cloud storage over local storage * push for locked down devices over general purpose computers * push for DRM on the open web * big ISP companies fighting against net neutrality
  - msane 12y ago
    I very much agree. I hope that, capitalism, ironically enough for DRM, is the probably always the solution to overstepped DRM remedies. Regardless of the issue of piracy, which I am not advocating. For instance there will always be a market for custom computing and "PCs", and so non-locked PCs will (hopefully) always exist in a capitalist environment. That market I think ultimately circumvents any attempt at ubiquitous control of hardware. The same thing is at play with software. And hypothetical new methods of connectivity may be able to circumvent many attempts at central control of the net.
    - userbinator 12y ago
      For instance there will always be a market for custom computing and "PCs", and so non-locked PCs will (hopefully) always exist in a capitalist environment. Unfortunately, that market is slowly becoming the minority, and because those "more free" devices may have limitations that make them incompatible with a lot of proprietary content (which is the majority) and circumventing those limitations could be illegal and difficult, there will be fewer users of them. Reminds me of this https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html and the old saying "If you outlaw freedom, only outlaws will have freedom."
AlyssaRowan 12y ago
That's a lovely piece of work. Congratulations. It's always fascinating to me how far the tools of the trade have come on since my heyday. They surpassed my own custom tools of yore a little while back, and things like this were things I could obviously never do at the time - nowhere near enough storage, for a start, but I also didn't know about the compressed/encrypted distinction (that would have saved me a lot of time!). That you can do it in such an automated fashion now, where I just paged through the disassembly and hexdumps until I saw something that leaped out at me, is stunning. I'd coded a few helper routines, and my debugger was completely stealth and I could rewind a couple thousand instructions (the secret of my success! <g>), but never anything like that back then. Perhaps I should look into this PANDA.

by moyix 12y ago

rational-future 12y ago

Hello OP! Can you give a short not so technical description of this attack please?

gcv 12y ago
Not the OP here, but briefly, the technique uses a little statistical cleverness and the ability to examine a running program to help identify which part of the Spotify program produces the unencrypted bytes of the track it is playing. It then taps into that part of the program, and copies these bytes to a file. That file then contains playable audio. (This data must be unencrypted in order to meaningfully feed the digital-to-analog converter of the playback computer.)
AlyssaRowan 12y ago
- Runs it in a virtual machine/emulator (QEMU). - Records (with PANDA) every instruction run and every piece of data read or written by that virtual machine for half a minute while it's playing audio. (!) - Analyses that recording and uses some very clever statistics to identify functions that read chunks of data that looks encrypted, and write chunks of data that looks compressed (yes, you can tell the difference, compression is imperfect). - Out pops one likely candidate, which sure enough is the decrypter.
- moyix 12y ago
  Small correction: the magic of record-replay is that you don't have to record every piece of data read/written, only the non-deterministic events (interrupts, accesses to devices, and a couple instructions like `rdtsc`). This lets the overhead during recording stay low, while still getting all the benefits of a full execution trace. This is why we're able to store the Spotify trace [1] in only 263.1 MB. [1] http://www.rrshare.org/detail/28/ http://www.rrshare.org/detail/28/

thrownaway2424 12y ago

Hello, author. I read your whole post and still didn't know what PANDA might be. Please add a description or a link.

rememberlenny 12y ago
His other post explains it: http://moyix.blogspot.com/2013/09/announcing-panda-platform-for.html http://moyix.blogspot.com/2013/09/announcing-panda-platform-...
- test_account_1 12y ago
  Thanks, saved me time for searching.

msane 12y ago

On the subject of cracking streaming music DRMs, a realization I have been sitting on for a while about what people can do with it... Considering the common wisdom that: - storage will get exponentially cheaper - data transfer speeds will get higher It makes me think that eventually there will be illicit torrents of all the worlds music, plus the index, plus the metadata, and plus the interface/app for browsing it. In other words, people would not only pirate individual songs or movies, they would download their own complete copies of Spotify / Netflix. It isn't feasible now but it could be sometime in the next 5-15 years, depending bandwidth speeds. I'm not sure how many people see this coming or take it seriously but I wonder what the effect could be and what the remedy attempts would be.

null_ptr 12y ago
You can see the remedy attempts already * push for cloud storage over local storage * push for locked down devices over general purpose computers * push for DRM on the open web * big ISP companies fighting against net neutrality
- msane 12y ago
  I very much agree. I hope that, capitalism, ironically enough for DRM, is the probably always the solution to overstepped DRM remedies. Regardless of the issue of piracy, which I am not advocating. For instance there will always be a market for custom computing and "PCs", and so non-locked PCs will (hopefully) always exist in a capitalist environment. That market I think ultimately circumvents any attempt at ubiquitous control of hardware. The same thing is at play with software. And hypothetical new methods of connectivity may be able to circumvent many attempts at central control of the net.
  - userbinator 12y ago
    For instance there will always be a market for custom computing and "PCs", and so non-locked PCs will (hopefully) always exist in a capitalist environment. Unfortunately, that market is slowly becoming the minority, and because those "more free" devices may have limitations that make them incompatible with a lot of proprietary content (which is the majority) and circumventing those limitations could be illegal and difficult, there will be fewer users of them. Reminds me of this https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html and the old saying "If you outlaw freedom, only outlaws will have freedom."

AlyssaRowan 12y ago

That's a lovely piece of work. Congratulations. It's always fascinating to me how far the tools of the trade have come on since my heyday. They surpassed my own custom tools of yore a little while back, and things like this were things I could obviously never do at the time - nowhere near enough storage, for a start, but I also didn't know about the compressed/encrypted distinction (that would have saved me a lot of time!). That you can do it in such an automated fashion now, where I just paged through the disassembly and hexdumps until I saw something that leaped out at me, is stunning. I'd coded a few helper routines, and my debugger was completely stealth and I could rewind a couple thousand instructions (the secret of my success! <g>), but never anything like that back then. Perhaps I should look into this PANDA.