Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING"

https://plus.google.com/101700526665328331501/posts/Yk71MgkvAXx

by asherlangton • 14 years ago

720 254 14 years ago

plus.google.com

pav3l3• 14 years ago

Can someone explain how he got a hold of the decrypted .mov files that he compared the encrypted ones with? It's not very clear to me from the post, and I'm not familiar with Leaping Brain.

Either way.. wow... XOR encryption with just such a short repeating string! I bet it wouldn't be too hard to decrypt it even without the original file, since the file signature alone would probably be longer than the string. DISCLAIMER: I'm just speculating, I don't know the .mov specs.

tedreed• 14 years ago

"Well, since they load the file from a Python script, it's easy to make a copy of the "decrypted" file before it's reverted."

He edited their Python script to make a copy.

doorty• 14 years ago

The player decrypts the file before it is played and then encrypts again when it is finished, so if you grab the file while it is being used by the player then it will be decrypted.

srdev• 14 years ago

The "proprietary player" was just a Python script that made a temporary decrypted the video and ran VLC against it. So he just changed the Python script to keep around a decrypted copy rather than re-encrypt it away.

NickPollard• 14 years ago

From what he says, it sounds like the app is really a standard movie player, plus their 'encrypter', plus a python script that does the following:

> calls 'decrypt movie_file' to create 'decrypted_movie_file' > calls 'play decrypted_movie_file' > calls 'delete decrypted_movie_file'

He just made a copy of the python script that calls their own decryption module but removed the delete line.

pav3l3• 14 years ago

I don't even know what's worse - their "proprietary encryption algorithm" or the fact that they used Python for a critical piece of distributed software that you don't want to be reverse-engineered!

tshtf• 14 years ago

He just performed a bitwise XOR of the plaintext and ciphertext stream to obtain the key.

From the post:

By comparing the binary files, I discovered the "proprietary video encryption" algorithm: for the first 15kB, each 1kB block has its initial bytes xor'd with the string "RANDOM_STRING".

See:

https://en.wikipedia.org/wiki/XOR_cipher

mikeash• 14 years ago

Looking briefly at the .mov file format[1], it appears that any such file is guaranteed to have exactly the same bytes 4-11 (atom identifier and major brand identifier), is almost guaranteed to lead with three zero bytes (first four bytes are the length of the first atom, which is likely to be small), and will probably have the same bytes 12-15 (minor version number). If you know it's a .mov file, then you can extract "RAN" and "OM_STRIN" trivially, and the rest is easily guessable from there. In fact, since the first three bytes are probably zero, "RAN" will be right there in the file, ready for pondering.

[1] https://developer.apple.com/library/mac/#documentation/Quick...

asherlangton5• 14 years ago

The wrapper script is GPL'd, so I copied it here:

http://dl.dropbox.com/u/15447644/brainplayer_py.txt

My modifications are on lines 553-556. The compiled app "fixes" the .mov file just long enough for it to be loaded into the player. If you have Leaping Brain's player installed (often branded with the content owner's name), the .mov files are in a hidden .media folder. On my Mac, they were in $HOME/Library/Application Support/LeapingBrain/catalog/$VIDEONAME/.media

pav3l3• 14 years ago

Thanks for sharing! Hope you won't get in trouble for your post.

0x0• 14 years ago

Reusing one-time-pad keys means you can often very easily recover the plaintext simply by XOR'ing the two encrypted files, since it effectively takes the key out of the picture, see for example http://www.cryptosmith.com/archives/70 (where the key is literally taken out of the picture)

mturmon2• 14 years ago

From http://leapingbrain.com/:

"Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security."

Near-ridiculous security seems about right.

STRML• 14 years ago

The whole thing is a marketing "worst-of". They consistently advertise their products as "unique, brilliant, revolutionary", "magical, user-friendly, powerful", and "your only option".

The real laugh-out-loud moment is this tagline (http://leapingbrain.com/mod-machine/overview/):

"Forget crappy streaming systems and primitive, unprotected loose movie file downloads that make your products seem like a joke."

ohashi• 14 years ago

I bet there is a better way to securely share files.

Aardwolf• 14 years ago

I'm actually wondering if the whole leaping brain website is just filled with sarcasm on purpose?

I mean, even for the US, the superlatives seem a bit overdone.

bitwize• 14 years ago

"Forget crappy streaming systems and primitive, unprotected loose movie file downloads that make your products seem like a joke."

That reminds me of a psychic hotline from the 90s which produced an infomercial featuring Billy Dee Williams and an obviously scripted and professionally shot series of vignettes purportedly about a young woman documenting her experiences with the hotline.

Their very next infomercial opened with these words: "Tired of psychic informercials with phony testimonials and has-been celebrities?"

theorique• 14 years ago

Near-ridiculous security seems about right.

Not just near ridiculous, it is truly ridiculous!

toyg• 14 years ago

I am awed by the chutzpah of whoever is behind Leaping Brain, selling snake oil to clueless media people.

This is why I'll never be rich: I am utterly unable to sell crappy non-solutions to people with more money than knowledge.

dmix• 14 years ago

> I am utterly unable to sell crappy non-solutions to people with more money than knowledge.

This is why us engineers quietly keep the world running.

lutze• 14 years ago

It's easy to laugh at stuff like this, right up until they get the contract to secure your online banking...

jtheory• 14 years ago

My suspicion is that they wrote the "secure" DRM first -- probably actually encrypting the video files -- and realized that it was way too slow to decrypt before playing the file, and for whatever reason couldn't figure out streaming it to the player during decryption.

So they hacked together something that was acceptably fast, figuring they'd solve this technical difficulty for the next release, and that was that....

It's also unfortunately possible that (until now, at least) only the developer(s) knew about this shortcut, if their internal dynamic is sufficiently poor.

Tloewald• 14 years ago

I think you're giving them way too much credit.

dubya• 14 years ago

I prefer to believe this was the minimum viable product for the DRM market.

georgemcbay2• 14 years ago

While this is a particularly terrible DRM system for videos and I'm sure there are some really pissed off people at media companies who are learning this the hard way, in practice this is really no worse than any other video DRM system out there when it comes to stopping piracy.

HDCP is cracked, the genie is out of the bottle and there's no practical way to put it back in without causing a consumer uproar. All you can do technically is try to prevent super casual pirating of digital content, because the tech savvy can't be stopped by any practical solution. (Of course, even if HDCP wasn't cracked the analog loophole would still render DRM on any non-interactive content mostly useless).

So ultimately this stupid system (even now that it is 'cracked') is still about as effective as any other when it comes to stopping that super casual pirating.

acqq• 14 years ago

Exactly. It's not much safer if it's encrypted with AES compared to what they did, as long as you give the user all the keys. If the keys are RANDOM_STRING or 0x2ebfgh... also doesn't matter.

Karunamon• 14 years ago

Me either, but then I remember who implements and requires these restriction schemes, and my morality somehow becomes a lot more flexible...

noonespecial6• 14 years ago

All DRM is a non-solution really. Some are just non-er than others.

Its like the first law of "info-dynamics": 'If you can watch it, you can copy it'.

Anyone actually paying for a DRM scheme feels to me to be of the same caliber as someone investing in a perpetual motion machine. They're determined to get ripped off throwing good money after bad. Why try any harder than you have to to accept their money?

beering• 14 years ago

Do you really think that all DRM users are idiots who believe in perfect DRM security?

Gosh, people who buy locks must be stupid, because anybody with a crowbar can simply pry the door out of its frame.

DRM deters people from copying content willy-nilly. You might argue about the quantitative results, but it does something, and as long as it has more value than it costs, people will pay for DRM.

brian_cloutier4• 14 years ago

> All DRM is a non-solution really.

I know that by now it's tradition to say this, but can we please stop?

It seems to be that a law of life is 'everything dies'. Is medicine therefore useless? Are all the people who spend money for nothing but delaying the inevitable getting ripped off?

We all admit perfect security is impossible. Yes, you're right! Controlling the spread of information is a very hard problem. Yes, you're right! It would be very nice if the things I want to watch and listen to were made freely available by their creators.

But no, you're wrong. DRM has a purpose, and it can be successful even without perfectly achieving its goals. People tend to avoid effort, and if you can make pirating content more difficult than obtaining it legitimately, most people will obtain it legitimately.

There is no fundamental reason why information deserves to be free, it's just easier to copy than physical things.

aufreak3• 14 years ago

You can say the same thing about strong public key cryptography as well - "if you can read it, you can copy it" - but that doesn't say anything about the encryption technology itself.

In the case of DRM, we are not in general interested in the received material being secret to us whereas in the use of traditional public key cryptography we are. The incentives are not aligned in the case of DRM, no matter what technology is used.

sigkill3• 14 years ago

I don't know why this is a hard concept for people to understand.

DRM is basically the equivalent of Schroedinger's box. You want the content decryptable so that it can be consumed, yet you don't want it to be copied. The problem is, decrypted content does not discriminate use cases. If it's clear-content, it shall do as the handler of the content wishes to do.

Possibly the only method I can think of would be PKI enabled hardware. I've not thought completely on it enough to proclaim it practical or otherwise, but I had an idea that the player somehow has onboard memory to store public keys that are required for a disc to play.

xtracto2• 14 years ago

By the same logic, a door with a lock is a non-solution to protect your flat. Nevertheless I do not see people getting angry about other people installing those in their homes.

blinkingled• 14 years ago

> whoever is behind Leaping Brain

http://leapingbrain.com/about/ - all of them seem to be proudly listed there. Gotta watch the page for disappearances :)

beedogs• 14 years ago

Having a conscience sucks sometimes.

jim-greer• 14 years ago

I wish it were "clueless media people". It's actually clueless sign language teachers, clueless yoga instructors, etc. They're ripping off small businesses, not big media.

http://leapingbrain.com/clients/

jcromartie3• 14 years ago

If these guys could amass a big client list with their broken DRM and a crappy, clunky, and ugly site, app, and online store, then there is surely a market for a DRM-free video platform.

iandanforth• 14 years ago

Could someone (OP?) provide more of the steps that might have gone (went) into discovering it was an XOR operation and the original string? Seems like an impressive intuitive leap to me!

alxbrun• 14 years ago

He said it was decoded by a Python script.. so easy to understand from the script I guess.

jlgreco• 14 years ago

After recovering the original file, he "compared the binary files". Likely this means he popped them both up in a hex editor and noticed the difference. XORing by a string is a very common very very trivial thing to do, so it would be pretty high on your list of things to notice.

ben0x539• 14 years ago

Maybe OP just xor'd the files with each other and the result was the RANDOM_STRING string followed by a pile of \0 bytes, repeat.

Edit: To clarify, I meant the encrypted and temporarily-decrypted-by-the-wrapper-script versions of the same .mov file.

tptacek7• 14 years ago

The XOR of two ciphertexts under P XOR K isn't K (you have to know a plaintext to make that trick work, which, granted, you likely would here). The solution that doesn't require a known plaintext is comparably simple.

tptacek7• 14 years ago

It's so easy to solve repeating-key XOR for the key that the solution is a practical way to detect the scheme; you wouldn't even necessarily bother trying to detect it, you'd just run the "solver" (even calling it a solver sort of dignifies it a bit too much).

tekromancr• 14 years ago

Is the solver just (cyphertext XOR plaintext)?

ahh• 14 years ago

So that's generally true--Babbage's solution to the Vigenere was one of my favorite things to learn in basic crypto--but amusingly I'm not sure it would be easy in this case!

In particular, while I don't know the .mov file format backwards, the last step (after lossy encoding) is probably a lossless encoder, either LZ-type or some sort of entropy coder. This means that the plaintext is going to be a very good approximation of IID coinflips; in other words, a one-time pad _key_.

"Decoding" the repeated-key XOR also decodes the one-time-pad encryption of the repeated-key interpreted as plaintext. This is, well, hard.

(mov may have enough frame structure/boilerplate that this doesn't apply; I don't know.)

asherlangton5• 14 years ago

Once I had both versions of the files, I looked at them in a hex editor. Since there were some null bytes at the beginning of the video file, it wasn't hard to guess the string they were using. I'm not going to post the file themselves (for obvious reasons), but here's the first 16 bytes of the unencrypted and encrypted files (in hex and ascii, from xxd). Unencrypted:

0000000: 0000 0020 6674 7970 7174 2020 2005 0300 ... ftypqt ...

Encrypted:

0000000: 5241 4e64 2939 2623 2526 696e 6705 0300 RANd)9&#%&ing...

asdfaoeu• 14 years ago

Someone want to explain why this is less secure than other DRM methods?

lotyrin2• 14 years ago

Precisely. They've gone to an effort which should invoke the DMCA (as ridiculous as that is) and they have a bullet point somewhere on a power point they can show to content creators that says DRM.

Those are the practical uses of any DRM technology one might ever devise.

Sure, you could throw in more than 5 seconds of security-through-obscurity, but why bother?

rdl4• 14 years ago

There actually are DRM schemes which were too hard to break -- DIVX from Paul Kocher (distinct from DivX), for instance.

tptacek7• 14 years ago

You might try asking Slysoft, which has to continually release new betas of AnyDVD HD as Macrovision randomly decides to break their software with updates of BD+.

Or, you could ask all the people who used to make 6 figures dealing H-cards for DirecTV, but can't anymore.

NateLawson7• 14 years ago

Additionally, I don't know of any other major system that has gone 4 years without an open-source hack. Since 2008, the only BD+ rippers are commercial.

Also, credit should be due to the designers of Cinavia as it has succeeded with the least secure design possible. It's a watermark in the compressed stream that is checked by the _player_, which mutes the audio if it is present. All you have to do is patch the player to ignore the mark or play it with VLC and it is "bypassed".

However, even the commercial rippers have not yet stripped off this watermark and all bypasses other than playing in VLC have been partial (e.g., needed an old PS3 firmware).

DanBC• 14 years ago

We use simplifications when we teach things (eg crypto) to people.

When people learn about cryptography they learn that one time pads (OTP) are the only mathematically provable secure cryptography. Everything else is thought to be secure, but we don't know.

Then they learn why OTPs are not used more often. (You need a pad as large as the text you want to encrypt; the pad must be really random; you must never reuse the pads; you have to get the pads to the person doing the encrypting and decrypting.)

And then they learn a bit more and one of the simplifications they learn is to XOR a bit of text with a string; they encrypt plaintext with a key. This is not a real crypto system, it's just a silly little demonstration.

But a disturbing number of people seem to stop there and say something like "Let's use XOR and a secret key and it's a bit like a OTP so super secure!!" but they forget that you must have a pad as large as the plain text.

So their crypto system is really very very weak.

Other DRM systems have been broken, but usually by smart people working hard with advanced techniques.

I could have broken this system.

The other thing that's bad about it is that it is ridiculously easy to intercept the decrypted files and copy those.

So they've sold a system to small un-clueful content distributors and they've used hyperbole to do so.

And the law prevents us from telling those content distributors because we're not allowed to circumvent a technical copyright protection method.

hosay123• 14 years ago

You cannot simultaneously crow "hurr, DRM is broken!" and act all smug about this discovery. Perhaps the original developer, like you, understood this, and did the absolute bare minimum necessary to fulfil commercial obligations, all the while making it easier for people like himself (i.e. you) to get what they want, and making a few bucks from the old and dying media industry all at the same time.

Given the evidence (complex integration with a non-standard set of open source libs, complex industry area in general), I'd say it's almost certainly an insult to imagine the developer could not have made your life harder if he'd chosen to.

Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been.

"No good deed goes unpunished"

asherlangton5• 14 years ago

You're right, actually. I'm glad it's broken, because it's a lot easier for me to watch the videos I purchased without the DRM. I was just struck by the audacity of their marketing claims.

mietek• 14 years ago

Way to miss the point. It's just as broken as any other DRM!

andrewcooke• 14 years ago

i think you can be stronger than that. it's clearly written to show to the "discoverer" that it's only a gesture. i would have thought anyone with an ounce of compassion and empathy would have smiled and kept quiet.

broadcasting this, and likely harming the developer, for internet points, is a pretty poor move.

charonn03• 14 years ago

The developer(s) created a product that didn't do even 10% of what was advertised and now must face the consequences. Why is that bad? Their professional reputation should suffer if the quality of their work is poor.

zera_holladay• 14 years ago

That's a huge assumption.

Anyone with a few years of experience in the software field has heard the following: I'll pay you N dollars to X but you have to finish by unrealistic Y. I'm the sole provider of a household of 4, so in this kind of circumstances I'll agree to minimum features or specific features plus additional features if time allows. I'll make it very clear that the client can't have their cake and eat it too. Sometimes it's merely a matter of economics, so don't go hanging anyone yet.

kstenerud2• 14 years ago

Applying Occam's Razor, it is far more likely that incompetence is in play here, rather than a well organized conspiracy to weaken the DRM peddled by a virtually unknown company, thus Doing Their Part to bring easily decryptable media to the internet proletariat (and it would've worked, too, if it weren't for those meddling kids!)

codeulike3• 14 years ago

You misunderstand. LeapingBrain dont need the DRM to be good, they just need to persuade the media industry (filmmakers) that they have DRM. Why bother to do more than that?

RobAley• 14 years ago

As a developer, it's your reputation to protect. If you choose to do substandard work, for whatever reason (be it for the money or for glory), you know the risk you take to your reputation.

If you're really doing it for moral reasons, you won't keep quiet and make a buck while doing it. If you're opposed to drugs, you don't become a drug dealer and make loads of money selling lower quality drugs.

AmirS2• 14 years ago

Agreed.

Looks like they know they cannot offer a video platform without providing DRM, because the media industry demands it, and they also know that trying to implement unbreakable DRM is futile. Therefore, they just need to implement the minimum needed to convince the media suppliers that their content is really DRM'd.

codeulike3• 14 years ago

Yeah I think this is it. LeapingBrain has to show the media industry that they have DRM, but they don't actually need the DRM to be good or effective. Its just something they have to do. Why faff about putting lots of effort into it?

i0exception• 14 years ago

Anyone who has taken Computer Security 101 would know that security through obscurity is not the smartest thing to do. Calling it "near-ridiculous level of security." is downright blasphemy.

asherlangton5• 14 years ago

Or just (unintentional) truth in marketing...

4ngle• 14 years ago

Not to mention, a foolhardy challenge to break it.

damian20003• 14 years ago

I wouldn't even call it security through obscurity. I'd call it dumb as rocks security.

marssaxman• 14 years ago

Blasphemy? Sounds like nothing more than the simple truth. If anything, they're being too humble. It literally is a ridiculous level of security, for here we all are ridiculing it.

shmerl• 14 years ago

The only mistake in that was the word "near". It's purely ridiculous, since that method has nothing to do with security honestly saying.

esrauch2• 14 years ago

Except that these videos are playing on your local machine. With the most advanced DRM mechanism possible it is nearly as trivial to simply record the video output.

There is no reason to spend developer time making a complex mechanism that is no more secure than a simple xor.

coin• 14 years ago

Recording the output is not the same as extracting the DRM-free stream

marshray2• 14 years ago

This is apparently why the DMCA anti-circumvention provisions only apply to bypassing "effective copy protection" systems.

Of course, if a copy protection system was "effective" it wouldn't need a law prohibiting its circumvention. Conversely, if a copy protection system is circumventable, it's not effective.

gizmo6862• 14 years ago

Unfourtuantly, the term "effective" is highly ambiguos. One could argue that any system that works against non-programmers is effective, as most of the market is a non-programmer.

nitrogen• 14 years ago

The term "effective" is defined in the DMCA:

1201(a)(3)(B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.

So, even trivial measures like the broadcast flag or SCMS[0] are covered by the DMCA's anti-circumvention provisions. Similar laws in other countries have similar definitions.

[0] https://en.wikipedia.org/wiki/Serial_Copy_Management_System

eli• 14 years ago

IANAL, but I'm pretty sure you are misreading that. A technology that "effectively controls access" means that it has the effect of controlling access. It's not a qualitative statement on how well it works.

alexkus3• 14 years ago

Since it uses [L]GPL software then this comes in to play:-

https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited

" Does GPLv3 prohibit DRM?

    It does not; you can use code released under GPLv3 to develop any kind of DRM technology you like. However, if you do this, section 3 says that the system will not count as an effective technological “protection” measure, which means that if someone breaks the DRM, he will be free to distribute his software too, unhindered by the DMCA and similar laws.

    As usual, the GNU GPL does not restrict what people do in software, it just stops them from restricting others.
"

joezydeco• 14 years ago

How do we know this wasn't a non-english speaking subcontractor that took the spec too literally?

mahmud• 14 years ago

What the hell? That implies someone who can't implement security themselves was tasked with the design of said security. Actually, that sounds about right ..

Eliezer2• 14 years ago

Maybe there's a scheme here to prevent good DRM by flooding the market with highly inflated impressive-sounding claims attached to laughable security. The Old Media crowd won't be able to solve the Design Paradox (http://www.paulgraham.com/gh.html) well enough to tell who's lying, good designs won't be able to charge more than laughable competition, and the DRM field will slowly die.

corwinstephen• 14 years ago

That's gotta be one of the most genius conspiracy theories I ever heard.

oconnore• 14 years ago

"Just a few bytes of brilliance"

Actually, 13 of them.

damian20003• 14 years ago

Has anyone pointed out that "BrainsTrust" (in the UK at least) is mostly used sarcastically to mean a stupid/idiotic person. So I think you are onto something here.

dllthomas3• 14 years ago

http://en.wikipedia.org/wiki/Brain_Trust

calpaterson• 14 years ago

FWIW I'm a UK resident and have never heard it used sarcastically.

robk• 14 years ago

In the US it is often used with a positive connotation.

jes5199• 14 years ago

but shouldn't that have happened by now? DRM has been shockingly pathetic since at least the 1990s, maybe longer.

oofabz• 14 years ago

DRM before 1990 typically involved non-standard floppy disk formats that a home computer could not duplicate. You can read about one such scheme here:

http://dmweb.free.fr/?q=node/210

KateLawson• 14 years ago

Though there is no organized conspiracy, this is actually not far from the truth, especially in some areas of content protection. Companies that don't have the in-house technical expertise (music labels), working from an unprotected distribution system (audio CD) are at a particular disadvantage.

At the other end of the spectrum, you have satellite TV. In this area, a lot of money invested and full control of the playback platform have resulted in some strong systems. But still, it took a long time and a lot of cracks of intermediate systems for this industry to become the success story it is today.

Disclaimer: I worked for a company involved in the above.

jdietrich• 14 years ago

Of course, in the case of satellite TV, you have big companies doing an awful lot of "research" into each others' crypto systems - NDS Group's alleged reverse engineering of OnDigital is the obvious example.

minikites2• 14 years ago

Remember DirecTV's war on smart card hackers?

http://www.securityfocus.com/news/143

--------

But DirecTV reacted to that wrinkle over a year ago, by taking advantage of their ability to remotely reprogram the set top satellite receivers, as well as the cards. The company sent a few specific bytes of data to all the H cards, while simultaneously reprogramming the satellite receivers to reject cards that didn't reflect the change. This forced hackers to update the cards manually with the new data, or to make the cards writable again.

--------

rjzzleep2• 14 years ago

that sounds like all the consulting the big names provide to _yourfavoritegovernmentagencyhere_ in _yourengineeringprojectofchoice_ .

i used to think they did it on purpose, but now i'm starting to think they're just stupid and they actually think they're doing a good job.

A friend of mine sent me a research study on security standards for healthcare and they did suggestions on what to do. it boiled down to this: in essence all they were saying was use decade old crypto that everyone else already uses, we're just stuck in the past, but i'll make it sound like i just invented something new.

i wish i could find the link.

gizmo6862• 14 years ago

In fairness, decade old crypto is still perfectly good, with the added benefit of being field tested. Now, if we can only get people to use it properly (as in make crypto libraries that do not require a degree in crypto to use properly).

JulianMorrison• 14 years ago

Probably not so much stupid, as ignorant pressure from above, apathy from below, and Marketing off in la-la land selling fantasies. "Lets build something that compiles and ship it, fuck them if it doesn't do as advertised, how will they know?" thinks the programmer.

jacquesm• 14 years ago

There is ample evidence that this is already happening.

What's impressive is how long silly schemes (this one in particular) stay afloat!

jwr• 14 years ago

I have this theory that some DRM schemes were intentionally sabotaged by engineers (DVD CSS comes to mind) to be weaker than they could be, for moral reasons.

px43• 14 years ago

This is what they call this a 1024 bit Vernam Cypher in the movie "Swordfish".

danso• 14 years ago

Ha, so the key really was "RANDOM_STRING", in the literal sense...was that just the programmer giving up, or was that pseudocode that was missed during shipping?

Eliezer2• 14 years ago

What string could possibly be more random than the one which says "RANDOM_STRING"?

msg• 14 years ago

"RANDOM_STRING" implies a suspiciously structural byte alignment.

"RANDOM_BITS"

pwg• 14 years ago

http://dilbert.com/strips/comic/2001-10-25/

MBCook• 14 years ago

I don't know about random, but "SECURE" would have been more secure.

RickHull• 14 years ago

Obligatory XKCD: http://xkcd.com/221/

ataggart• 14 years ago

Judging by the headline, it sounded like they tried to implement a one-time pad, but had only heard of them by rough description.

jacques_chester• 14 years ago

That was my thought too.

In theory, OTPs are nigh uncrackable.

In practice, they suck.

1. The XOR text needs to be as long as the plaintext.

2. The XOR text needs to be truly random.

3. You have to distribute the XOR test somehow. Remember all those spy novels where they burn the codebooks? Yeah.

derleth• 14 years ago

> In theory, OTPs are nigh uncrackable.

One-time pads are mathematically proven to be uncrackable if used correctly. This is because, for any given cryptext, every possible plaintext of the same length is equally probable.

Using a one-time pad correctly means only using a given pad once, the 'pad' being the key material. If you ever reuse the same key, you are no longer using a one-time pad and the above proof no longer applies.

And if your pad is 13 bytes which you keep reusing over and over again, you're a bleeding idiot.

cbsmith• 14 years ago

It very much depends on the use case. If I was a CIA director having an affair with a biographer, an OTP would seem quite helpful. During our liaisons, we could exchange thumb drives with several GB of randomly generated data from any of a number of reasonably random entropy sources (hardware PRNG works pretty well by itself, but you can throw in EGD and other sources for greater confidence) with some software whitening and the occasional bit of chaff plaintext for good measure. At each exchange destroy any previous pads (and yes, one would have to go to some lengths to ensure destruction without interception, but tossing them in to an incinerator would probably work pretty well).

Now I have a means to communicate over the internet while apart from my paramour without any concerns about the content of the messages being decoded while in transit (compromises at the source or destination are obviously still in play).

Not every crypto problem involves establishing a secure connection party selected ad-hoc without a higher-bandwidth secure channel.

billsix• 14 years ago

One time pad requires the key to be as big as the plaintext. This looks like a weak variant of the Vigenere cipher.

damian20003• 14 years ago

There's two software engineers and a product architect listed on the about page - http://leapingbrain.com/about/

It might be a good idea to remove their names, to protect their reputation. ;-)

mahmoudimus• 14 years ago

I did a lot of reverse engineering back in the day - you'd be surprised how many "virtually uncrackable" DRM protections used by companies like Adobe (at the time - Macromedia) that were just stupid XORs of magic strings.

Ahh..the good old days of SoftICE and w32disassm.

Oh man, the worst was the md5 of some salt + whatever you put in.

If you ever want to see some gems of misuse of cryptography for DRM management, let me know - email's in my profile.

Some examples: Using RSA 1024 bit keys, with exponent of 3...

pbsd3• 14 years ago

e=3 is fine, so long as you remember to pad...

NateLawson7• 14 years ago

It's not that simple. There are other attacks against e=3, and you have to prevent them all.

javajosh• 14 years ago

This should be lauded just as much for being a solid little piece of citizen, even activist, journalism. The specific issues about DRM are important, but I think the greater willingness to really look into things and publish the results should be encouraged.

stcredzero5• 14 years ago

Breaking repeated XOR with a string is a variant of the Vignere cipher or the Vernam cipher, depending on how you think of it. Either way, breaking it is a freshman cryptography exercise.

mopatches• 14 years ago

The Vernam cipher is actually quite strong when used correctly - the key needs to be as long as the input; it's never repeated :)

http://en.wikipedia.org/wiki/Gilbert_Vernam#The_Vernam_ciphe...

samuellevy• 14 years ago

Tomorrow on HN: "Legislation passed to embed DRM chips into people's heads, which automatically shut down visual input if un-authorized content is detected playing in their vicinity. Three strikes policy before permanent blindness."

photorized• 14 years ago

The business goal behind most of these "protection" methods is to make unauthorized (unpaid) copying/sharing inconvenient. That's it. There are no commercially feasible methods to protect video or audio content against "a determined hacker", but that's not what these barriers are for. You can make fun of these laughable encryption methods all you want, but they serve their purpose by providing the desired purchase to piracy ratio.

The problem is marketing folks getting carried away when describing these "technology solutions" to the content owner, because that's what they (as well as VCs) want to hear.

Disclaimer: cofounded a video CDN+DRM provider more than a decade ago, developed many content protection methods over the years.

tlrobinson2• 14 years ago

"It turned out the actual player, launched from their compiled app, was a Python wrapper around some VLC libraries"

Isn't VLC licensed under the GPL? Or at least was until very recently? http://www.jbkempf.com/blog/post/2012/How-to-properly-relice...

Is/was Leaping Brain violating the license?

EDIT: the wrapper script is apparently released under the GPL too: http://news.ycombinator.com/item?id=4834834

alexkus3• 14 years ago

> Is/was Leaping Brain violating the license?

No, I can't see how they are.

Here's one GPL FAQ that's vaguely relevant:-

https://www.gnu.org/licenses/gpl-faq.html#CompanyGPLCostsMon...

But this question is very relevant:-

https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited

" Does GPLv3 prohibit DRM?

    It does not; you can use code released under GPLv3 to develop any kind of DRM technology you like. However, if you do this, section 3 says that the system will not count as an effective technological “protection” measure, which means that if someone breaks the DRM, he will be free to distribute his software too, unhindered by the DMCA and similar laws.

    As usual, the GNU GPL does not restrict what people do in software, it just stops them from restricting others.
"

tlrobinson2• 14 years ago

I didn't mean DRM violated the GPL, I thought that they may not have been complying with the GPL by not releasing their code that used libvlc, but it appears they are.

leoedin• 14 years ago

Just a heads up, but I think (assuming it's not somebody else on the page) the formatting of your GPL quote means that it doesn't break automatically, making the comment page very wide (at least in IE9).

anonymous• 14 years ago

facepalm Come on, people!

First rule of weak DRM, you do not talk when you find weak DRM.

Second rule of weak DRM, you DO NOT talk when you find weak DRM.

Third rule of weak DRM, upload to pastebin, then walk away.

billpg• 14 years ago

That's not the second rule, but the first rule repeated.

How am I supposed to take weak DRM seriously when it has a third rule but no second rule?

Tomis02• 14 years ago

You need to learn your cultural references young man. Go watch Fight Club and report back with your results.

pilif• 14 years ago

This could very well be a simple bug where it's supopsed to XOR with some really random string generated on the server, but some replacement of a template string isn't happening which is why it XORs with RANDOM_STRING.

Of course this is only marginally better and should really have been caught, but there's a huge difference between saying that XORing 12 bytes with RANDOM_STRING is kick-ass DRM and actually having a kick-ass DRM infrastructure that then doesn't work right because of a bug.

If this was any really random looking string, I would be more inclined to assume that this was intentional. By the string being this token, I would guess it's a bug somewhere.

Remember. If RANDOM_STRING was truly random, unique per file and account and only transmitted from the server before playing, then this would be as good an encryption as any.

jhuckestein• 14 years ago

That wouldn't be better. Intercepting the decoded movie is trivial either way. Finding the encryption scheme was just a fun exercise and discovering the random string (even if it isn't "RANDOM_STRING") once you have the decrypted copy is trivial as well.

harshpotatoes• 14 years ago

My understanding is that when using the xor cipher, even if the key is truely random, the file could still be trivially completely decrypted for a repeating key. It seems like a rather unwieldy cipher if you need to download a key which is nearly the same size as the video file.

yk• 14 years ago

This is roughly the level of programming I expect from DRM software. After all, the content needs to be in unencrypted format at some point to view it.[1] Therefore there are two kinds of programmers working on DRM, idiots and liars. One kind does not understand the futility of their efforts, the other kind wagers that there superiors do not understand the futility of their efforts.

[1] Assuming a general computation device, not a dedicated hardware player.

shocks• 14 years ago

"All aspects of the platform feature a near-ridiculous level of security."

Well... They weren't lying...

nnq• 14 years ago

...I find it extremely funny when people use the word "virtually" to mean "practically" or "nearly" or "almost" and they turn out to be wrong but are excused by the fact that they added the magic word "virtually" :) ...and conversely, if someone uses the word when talking to me, I label everything the person says afterwards as 99% weasel words...

Syssiphus• 14 years ago

Hm, anybody remember Dmitry Slyarov? http://en.wikipedia.org/wiki/Dmitry_Sklyarov

As far as I recall the Adobe PDF encryption was also just some XOR with a simple passphrase. Got him into serious trouble.

And WTH is 'virtually uncrackable'?

seanhandley• 14 years ago

XOR isn't insecure per se. What I'd like to know is how this "random string" is created in the first place

SideburnsOfDoom• 14 years ago

It looks like the phrase "RANDOM_STRING" should be taken quite literally. That is the random string. Perhaps some code was supposed to substitute in something else, and it failed quietly.

cafard• 14 years ago

Back in the 1990s, the revolutionary organization Sendero Luminoso was naive enough to believe in WordPerfect's encryption. This was a grave mistake, for that encryption (for 4.2 and 5.1 at least) was a simple XOR of the password against the text--and in 5.1 you had 10 or so bytes of known text to compare against in the header. The decryption of the files was not the only thing that worked against Sendero Luminoso, but it must have hurt them.

sigkill3• 14 years ago

To be fair, when I read the title I thought that if the string is truly random then it's actually a very good technique. This is the core operating principle behind the one-time pad which is provably secure.

Now that I read the article twice, I literally got a panic attack when I realized that it wasn't a random string that they were xor'ing their data with, but a string called "RANDOM_STRING". Although it sounds bad, one must realize that this is not security by obscurity since the key has been leaked, and nobody guarantees encryption against a leaked key.

Dylan16807• 14 years ago

'very good technique' The important part of a one time pad isn't the xor, it's the length. This does not even begin to resemble a one time pad. It's an xor cipher.

sigkill3• 14 years ago

Yeah exactly. I cannot convey the utter disappointment I had when I realized that it was "RANDOM_STRINGRANDOM_STRINGRANDOM_STRING...." that they were XOR'ing with.

ballfrog• 14 years ago

From their website:

Fort Knox-level security.

Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security.

jcromartie3• 14 years ago

You know what's absolutely terrifying? This guy could conceivably go to jail for this. Looks like he has kids, presumably a wife... hoping it goes well for him.

radarsat1• 14 years ago

I would like to propose that DRM is not intended to be uncrackable. It's easy to convince yourself that DRM is flawed, because fundamentally it is a flawed tool. Companies know this, they're not stupid. However, DRM is actually not a technical tool to prevent piracy. Rather, DRM is a legal tool to provide stronger legal arguments that theft has occurred.

I'm not saying this is right, necessarily, but I think companies know full well that their DRM scheme will be broken, so it's not really worth investing in an "uncrackable" and costly solution. Instead, the role that DRM play is purely legal -- when the company does decide to go after someone for piracy, the DRM scheme, no matter how simple, provides them with the ability to say that the accused person "broke a lock," rather than simply walking in through an unlocked door. "Entering" vs. "breaking and entering." It's nothing but legal leverage, and effective at that role even if it's not a very strong lock.

Of course, to have this argument hold, a company would never be able to admit that they purposefully implemented weak security -- this would be akin to admitting that their door was unlocked afterall, and would weaken their legal argument. Therefore, there remains a niche in the market for solutions that look secure even if they fundamentally aren't. It's all about lip service.

talmand2• 14 years ago

In the US, the DMCA more or less makes it illegal to reverse-engineer DRM regardless of how easy it is to crack.

The DRM could be as simple as the code being "A" to bypass the DRM and if you do so, you have broken the law. Even providing that "A" to someone else would be illegal, look at all the silliness over the dvd copy protection fiasco. Therefore, they don't even have to pretend that the DRM is strong, just saying it's there is probably enough.

It's one reason printer cartridges have chips that communicate to the printer. Reverse-engineering that to provide third-party cartridges is illegal. Well, it used to be, I'm not sure over current policy as the DMCA has a back door for exceptions.

For PC games, the DRM is often employed to prevent piracy for the first two or three weeks because typically that's the highest level of sales. After that point it is usually cracked but sales often have dipped anyway. In some cases the DRM is removed in a patch at some point, often because the DRM causes problems for people who paid for the game, which kills long-term sales. Ubisoft recently changed their policies on having a seriously strict DRM to one that is more flexible; many thinking because it hurt their sales and that it was useless anyway.

No one thinks of DRM as a long term solution since it is only a matter of time before someone cracks it.

stevewillows• 14 years ago

Anyone can make a bump key, but breaking into people's houses is still a crime :)

loup-vaillant• 14 years ago

The obligatory xkcd: http://xkcd.com/221/

jiggy20113• 14 years ago

Question: Can anybody name a DRM scheme that hasn't been cracked?

asherlangton5• 14 years ago

The CEO of Leaping Brain (or someone pretending to be him) has now joined the Google Plus thread, implying that the "DRM" was intended as satire...

etsimm• 14 years ago

I find it curious that (after 242) there are no comments here ranting about ir/responsible disclosure. Is this simply indicative of the readership's unanimous hatred of all things DRM - or is there perhaps a threshold of ineptitude beyond which we feel ethically free to fully disclose vulnerabilities?

Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING"

Related Stories