Hackers build back door into iTunes

A trio of independent programmers has released new software that allows people to tap into Apple Computer's iTunes music store and purchase songs free of any anticopying protections.

Joined by Jon Johansen, the Norwegian programmer responsible for distributing DVD-cracking code in late 1999, the programmers say their "PyMusique" software is a "fair" interface for iTunes, primarily aimed at allowing people who use the Linux operating system to purchase music from Apple's store.

But with a Windows version of the software also available, it's likely to trigger a legal response from Apple, which has closely guarded access to its online music store and has depended on its copy-protection software to gain rights to sell music online.

An Apple representative could not immediately be reached for comment.

The PyMusique release is the latest and most ambitious skirmish in a long-running battle between Apple and hackers intent on removing digital rights management from the company's songs. As the most popular online song store, Apple has helped prove that consumers will purchase copy-protected songs, but also has been a test case for whether that copy-protection can sustain attacks.

The PyMusique programmers say they have created the software so that it saves the song in the unprotected form initially used by Apple, before it is wrapped in a protective layer. Because it doesn't actually break through the copy protection, they've predicted in blog postings that the software is legal.

Apple's iTunes terms of service do seem to disallow any unauthorised access, however.

"You will not access the service by any means other than through software that is provided by Apple for accessing the service," the iTunes terms of service says.

A test of the PyMusique software showed that it did allow purchase of songs from iTunes, and that the songs were saved in the unprotected AAC digital music format, rather than in Apple's protected Fairplay format. Songs could not be downloaded without establishing an iTunes account and paying the ordinary price for the music.

Johansen said the work is specific to Apple's store, and would not be easily applied to other download stores such as those operated by Napster or Microsoft.

"I can't say whether it's possible without looking into it first," Johansen said in an e-mail. "The iTunes Music Store sells files in an open format -- AAC -- which is what makes it attractive."

Johansen said that two other programmers, Travis Watkins and Cody Brocious, had written the bulk of the software, while he had developed the Windows version.

Advertisement

Talkback 2 comments

    Thats the Danger of DRM techno ...Anonymous -- 21/03/05

    Thats the Danger of DRM technology. Crackers and hackers always find ways to exploit the code to access or just share protected content. There is not a DRM system that has not been cracked within months of widespread release. However DRM *encryption* offers the ability for computer viruses and malware to store content, and without the ability to decode the content, keep it hidden from antivirus scanners. Microsoft's Mediaplayer, Real's Realplayer, Apples' Quicktime, Adobe's PDF viewer and even Sun's Java have had remotely exploitable vulnerabilities, undoubtably there are more vulnerabilites yet underdiscovered and unpatched. DRM should stand for Denial of Rights Mechanism, like the right to be secure.

    Indeed. In fact, malware auth ...Anonymous -- 22/03/05

    Indeed. In fact, malware authors have already used Windows Media Audio DRM to automatically install spyware through a security hole in IE. Basically:

    You download a .WMA/WMV file. Media player tries to play it, but discovers that (because it's DRM restricted) you have to download a licence for it. It therefore pops open an embedded version of IE, and points it to the "licence" page specified in the file.

    This page, however, *actually* uses one of several IE exploits to automatically download and install spyware into you machine - see http://www.theregister.co.uk/2005/01/13/drm_trojan/ for more details.

    "Denial of Rights Mechanism" - love it. I always understood it to be "Digital Restriction Management"... <:-)

Add your opinion

Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Suzanne Tindal Sick of broken tender sites
    Some of the state governments desperately need to invest in more user-friendly tender sites so that looking for information on government tenders doesn't have to be a game of blind man's bluff.
  • Array Cyberwar: What is it good for?
    In this week's episode, Cyberwar. What is Australia's place in the world of digital warfare? What are the implications for the NBN?
  • Array Is wholesale-only backhaul just a pipedream?
    The potential acquisition of Pipe Networks by SP Telemedia has raised the question about whether vertically integrated backhaul providers will mean higher wholesale prices for ISP customers.
  • More blogs »

Tags

Back to top

Featured