Adobe Flaw Allows Full Movie Downloads For Free

webax writes with this excerpt from Reuters: "[An Adobe security hole] exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience. 'It's a fundamental flaw in the Adobe design. This was designed stupidly,' said Bruce Schneier ... The flaw rests in Adobe's Flash video servers that are connected to the company's players installed in nearly all of the world's Web-connected computers. The software doesn't encrypt online content, but only orders sent to a video player such as start and stop play. To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players." webax also notes that the article suggests DRM as a potential solution to the problem.

Ixnay ehtay olehay iscussionday

Eriouslysay.

Doublethink

Wow, so even Bruce Schneier is subject to the DRM double think now? What part of this is hard to understand? You have to give the viewer the key so it can decrypt the video stream and play it to the user.. if the user can see it, the user can record it. Game over. No amount of "encryption" can change the facts.

Re:Doublethink

Schneier didn't write the article. He is only quoted briefly.

Re:Doublethink

From TFA:

To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players." webax also notes that the article suggests DRM as a potential solution to the problem.

Whoa. Just...whoa. Friday night cognitive dissonance too much to handle!

Re:Doublethink

Well, there are many points to the article, but one of them is that someone can watch the movie for free because Adobe's server software is set up to continue streaming the movies after showing the free "clip". That, indeed, is "stupid", it relies upon trusted client software. DRM is one solution to this problem, but another is not to stream content to people's PCs they haven't paid for.

Re:Doublethink

yea, i think Adobe did the smart/sensible thing by leaving the stream unencrypted to boost download speeds. performance and speed are major considerations for streaming media.

like you said, you ultimately have to give the user access to the unencrypted data so that they can view the content. so if they had done what the author suggests they should have done, then they would have just ended up with a streaming technology that's slower & wastes more bandwidth, and the DRM scheme still would have been easily bypassed by hackers.

it's pointless to apply DRM to web content, as it is with offline content. it's always amusing to see website developers try to prevent visitors from saving images from the site--which is especially annoying when they use JavaScript to disable right-clicking, as if that'll stop anyone from saving an image to disc when it's already on their hard drive. these petty tactics simply insult visitors to the site and create a major annoyance for anyone who simply wants to access a command from the context menu. but i guess driving visitors away and decreasing the traffic to your site would reduce the chance of people steeling your precious lossy, lo-res jpeg images.

Re:Doublethink

The dumb part here is that they send the whole movie to your computer even if you're just watching the free two-minute preview. The two-minute restriction is only enforced in the flash applet. Now, no amount of DRM can stop a paying customer from copying the movie, but a smartly designed system could certainly make the customer pay for the movie before giving the whole movie to them.

Re:Doublethink

The dumb part here is that they send the whole movie to your computer even if you're just watching the free two-minute preview. The two-minute restriction is only enforced in the flash applet.

Web programming 101.
Children, repeat after me: When you program for the web, NEVER, EVER trust the client.

Re:Doublethink

Now, no amount of DRM can stop a paying customer from copying the movie, but a smartly designed system could certainly make the customer pay for the movie before giving the whole movie to them.

Having the preview show you a preview length clip is not a "smartly designed system" it is basic common sense.

Any site that try to protect their content with stupid tricks instead of creating separate content for the preview honestly deserve what comes their way.

I guess content providers have to make a decision as to which is cheaper &/or better:
1. Licensing DRM
2. Buying extra hard drives to store preview clips instead of streaming from the full movie/audio/whatever

Ming boggles...

...at how fuckin dumb this all is. If you can see it, you can copy it, maybe it is more difficult, but not impossible. Do these idiots never ever learn?

Re:Ming boggles...

He's also Merciless!

Do these idiots never learn?

Actually I do have a bulletproof method of DRM that customers will accept. There's no patent - it's currently a trade secret. I could show them how it works without revealing the secret, and they could license it from me.

I only want $40m cash up front, and 10% of the back end.

I'm calling it MP[34]. Of course with licensing comes naming rights. I think "Plays For Now" is not yet taken.

in case you hadn't noticed

sadly, axxo and fxg and their black market friends already figured out years ago how to get movies for free to most anyone willing to look for them. it brings the end of an industry in it's current form.

There are better models: allow people, if they choose, to take media without paying for it, but give them credit, additional access, and membership benefits when customers do sponsor/pay for the media they consume. It is really not that complicated... find something you can sell because you can no longer technically control the distribution of your product.

Major media producers cannot change the progression of technology with policy and lawsuits. They would be so much better off to adopt what tech can enable, and build effective business models around providing customers with real value when they do pay for media, instead of using fear and lawsuits to force them to pay when they don't have to.

DRM can't be a solution

the article suggests DRM as a potential solution to the problem

Restrictions pitting a computer against its owner (and wasting time and energy to further a business model built on distrust) are always a problem [wikipedia.org], and the proof that some technologies can be inherently evil.

Impressive(ly pathetic).

As we all love to repeat, DRM is folly, giving a man a locked box and the key, security through obscurity, mere obfuscation, inevitably cracked, etc. So, a story about yet another broken DRM system is hardly exciting.

What is amusing, in this case, is that we have a DRM system so broken that it includes a vulnerability of the kind that is theoretically fixable. Essentially, Amazon streams the first couple of minutes of whatever it is to you for free. To get more, you have to pay. However, thanks to this bug, Amazon doesn't actually stop streaming at two minutes, just sends a command to the player to stop playing. The video that you aren't supposed to see ends up, inadequately obfuscated, somewhere on your system.

That is the pathetic bit. It is ultimately impossible to control what another computer does; but it is merely a matter of good engineering to control what yours does. Server access control vs. DRM. Here, the system is so broken that Amazon's servers are essentially handing out video that they don't want copied to anybody who asks for it, at which time it is protected only by the usual doomed local DRM. Thanks to badly designed DRM, the system is less secure than that ever so early 90's "on payment, we email you a one time use link to a direct download" content protection scheme. Ha-ha.

The internet enables free downloads. Seriously.

You know what else allows full movie downloads for free?

THE INTERNET.

   

This is new?

Doesn't everybody know that all flash video is easily accessible? Most of the time it's just a case of dragging it out of the cache. Sometimes you need to jump through more hoops, but I thought it was common knowledge that you could download it all.

You have to re-encode it if you want to, say, burn it on dvd, but that's not too hard. I use winFF (yes, I use windows).

From the article:

The problem exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience.

Uh, the pirates were already uploading the full HD rips to Usenet days before the movies were even released. No pirate would want the shitty version Amazon is offering.

Re:From the article:

Exactly. This flaw, no matter whose fault, isn't going to make more pirated copies appear, or even more people to become pirates. Anyone that wants to pirate the films, isn't waiting for some security flaw in Amazon/Adobe software to allow them to do so.

Not really a flaw

There are two separate issues mentioned in the article.

1. HTTP and RTMP are not encrypted and thus it's trivial to record any video sent over these protocols. This is well-documented and I'd hardly consider it a flaw. Flash 9u3 has DRM (RTMPE+verification), but most Web sites don't bother to use it.

2. Apparently Amazon's movie store server will send the whole video whether the customer has purchased it or not. This is a bug, but it's Amazon's fault not Adobe's and Amazon should be able to fix it easily enough. Also, they're apparently not using all the DRM features available in Flash so their videos aren't as protected as they could be.

AFAIK Flash DRM hasn't been cracked yet because no one uses it. I'm not an advocate of DRM, but as a practical matter I find it works better when you actually turn it on.

Summary of "news" story...

In summary:

Amazon.com is staffed by idiots... They thought it would be safe to stream the ENTIRE MOVIE, to anyone, FOR FREE. The ONLY protection being that they send a command to the Flash Player to "pause" playback after 2 minutes for those that haven't paid to watch the whole thing. Cheap software and instructions have sprung up all over the web, and everybody knows Amazon.com is going to get a boot up the ass by the media companies, and fix this "security" issue any second now.

DRM is utterly redundant. They just need someone with 3-digit IQ in the company to teach them how to make a 2 minute excerpt clip that is free and publicly accessible, while keeping the full video password-protected.

This is about on-par with an Apache "security announcement" that even if you don't make a link to a document on your HTTP server, it's still accessible! The horror!

flaw?

"Adobe Flaw Allows Full Movie Downloads For Free"

its not a flaw, its a feature!

It's like 0-day shipping

It's just like their instant delivery service, available for items that you've put on your wish list in advance. The way it works is that, when you put an item on your wish list, they ship it to you. Then, if you buy it, they give you the tracking number, you go to the shipper's site, and find that the item is on your porch, at which point you bring it inside and open it. If you don't buy it, eventually the shipper notices that it's been sitting on your porch for a while unclaimed and brings it back to Amazon.

In related news ...

In related news, researches have discovered that Gutenberg's printing press [wikipedia.org] has similar flaws. By using modern technology such as photocopiers or cameras, or older technology such as monks and pens (or additional printing presses) criminals can create nearly identical copies of items printed with the press, depriving the original creators of the material of much needed compensation.

Gutenberg did not immediately return calls for comment, however it's theorized that he did not build in an encryption option to his printing press in order to boot comprehension speeds (Simple substitution ciphers [wikipedia.org] were well established at the time of the creation of the printing press, and Gutenburg could have easily applied their techniques in the creation of his press, however it's not entire certain how effective it would have been at preventing piracy. (Somewhat (at most) effective DRM techniques were developed centuries later.))

Re:Switcheroo

Typically, DRM related security bugs get fixed markedly faster than do security bugs that threaten the security of the computer the software is installed on. Just to remind you who the customer is, and who the consumer is, y'know.