iTunes store 'hole' open again
A new version of PyMusique, 0.3, was released today which circumvented the block that Apple put in place on Monday. PyMusique simply allows users to become iTunes music customers without needing Apple's Mac and Windows-only iTunes client software, expanding Apple's customer base. So a PyMusique user can setup an account and pay for music - but not 'steal' songs for free. Because Apple only applies DRM at the client, it has the happy bonus that music won't be encumbered by DRM and the ever-decreasing freedom that Apple permits. The application runs on any computer that runs Python and a few libraries, including the Gtk and crypto modules.
Our intent was not to circument (sic) copy protection, and if Apple did DRM on the server, we would leave it in place!" wrote Cody Brocious, one of the PyMusique developers.
It's a sign that while Apple remains ahead of the activists, the anti-DRM developers are now only hours behind. Meanwhile, music sites that allow users to listen to, or buy music without DRM such as BetterPropaganda or Bleep can spend more resources improving their sites, rather than penalizing their users. ®
Source
----
Update 1: iTunes hack disabled by Apple
Apple Computer has closed a security hole that allowed an underground program to tap into its iTunes Music Store and purchase songs stripped of antipiracy protections.
The PyMusique software, created by a trio of independent programmers online, emerged last week as a copy protection-free back door into the popular iTunes store. One of the creators was Jon Johansen, the Norwegian programmer responsible for releasing DVD-copying software in 1999.
Apple released a statement Monday saying the problem had been fixed, and that some iTunes customers would need to upgrade their software.
"The security hole in the iTunes Music Store which was recently exploited has been closed, and as a consequence the iTunes Music Store will now sell music only to customers using iTunes version 4.7," the company said in a statement.
Like all other digital music companies, Apple has been dealing continually with hackers intent on finding ways around the antipiracy protections that are added to songs as they are sold online. The company has upgraded its iTunes software several times to block unauthorized programs' access.
Johansen has been one of the most persistent of those programmers, releasing several tools that have helped others tap into the inner workings of the iTunes software, and even remove the copy protections.
PyMusique itself was the creation of several different programmers, including 17-year-old Pennsylvania high school student Cody Brocious, who last week said he was simply trying to create a way for Linux-based computers to use the iTunes store.
A test of PyMusique on Monday morning showed that it was still able to preview songs in the iTunes music store, but no longer able to purchase music.
An Apple spokeswoman declined to comment on whether the company is considering legal action on the issue.
Only about 15 percent of iTunes users would be affected by the need to upgrade to the latest version of the software, the company said in its statement.
Source
----
Original report: Hackers build back door into iTunes
A trio of independent programmers has released new software that allows people to tap into Apple Computer's iTunes music store and purchase songs free of any anticopying protections.
Joined by Jon Johansen, the Norwegian programmer responsible for distributing DVD-cracking code in late 1999, the programmers say their "PyMusique" software is a "fair" interface for iTunes, primarily aimed at allowing people who use the Linux operating system to purchase music from Apple's store.
But with a Windows version of the software also available, it's likely to trigger a legal response from Apple, which has closely guarded access to its online music store and has depended on its copy-protection software to gain rights to sell music online.
In an interview late Friday, one of the program's creators, 17-year-old Pennsylvania high school student Cody Brocious, said the ability to save songs without copy protection was essentially an accident derived from the way Apple's system downloads songs. He said the software wasn't intended to harm Apple.
"The intent of the project was to be able to purchase files from the iTunes Music Store," Brocious said. "I believe very firmly that the project is ethical and does nothing but good for the community at large."
Apple representatives had no immediate comment on the software.
The PyMusique release is the latest and most ambitious skirmish in a long-running battle between Apple and hackers intent on removing digital-rights management from the company's songs. As the most popular online music store, Apple has helped prove that consumers will purchase copy-protected songs but also has been a test case for whether that copy-protection can sustain attacks.
The release draws from the work of a handful of scattered programmers over the past year who have successively identified how different pieces of the iTunes software works.
Brocious said he started his project after hearing of another programmer's work creating a Web-based interface to the iTunes store.
He and other programmers found that the iTunes store downloads songs wrapped in encryption, but that music purchasers are given the key to unlock that encryption when they buy a song. Ordinarily, the iTunes software would then rewrap the song in Apple's FairPlay digital rights management software, he says--but with their Linux version, that separate step didn't turn out to be necessary.
The result was a song that had been paid for and downloaded, but lacked the copy protections Apple's store ordinarily provides.
Brocious, who has left his most recent development on the software to another programmer, said he hasn't been contacted by Apple and hasn't talked to a lawyer. Because PyMusique doesn't actually break through Apple's copy protection, the programmers have predicted in previous blog postings that the software is legal.
Apple's iTunes terms of service do seem to disallow any unauthorized access, however.
"You will not access the service by any means other than through software that is provided by Apple for accessing the service," the iTunes terms of service says.
Annette Hurst, a San Francisco copyright attorney, said the software appeared to cross legal lines. The Digital Millennium Copyright Act, or DMCA, bars software that "avoids" or "bypasses" antipiracy mechanisms, she said.
"Those are pretty broad words," she said. "I would be very concerned about this if I were their lawyer.
A test of the PyMusique software showed that it did allow the purchase of songs from iTunes, and that the songs were saved in the unprotected AAC digital music format rather than in Apple's protected Fairplay format. Songs could not be downloaded without establishing an iTunes account and paying the ordinary price for the music.
Apple's rights-management software already allows iTunes customers to burn the songs they buy to CDs, which can themselves be ripped into unprotected MP3 files.
Johansen said the work is specific to Apple's store, and would not be easily applied to other download stores such as those operated by Napster and Microsoft.
"I can't say whether it's possible without looking into it first," Johansen said in an e-mail. "The iTunes Music Store sells files in a open format--AAC--which is what makes it attractive."
Johansen said that two other programmers, Travis Watkins and Brocious, had done much of the work on the Linux software, while he had developed the Windows version.
The Norwegian programmer has been a constant thorn in the side of the entertainment industry for more than half a decade, as the most public face among programmers testing the power of rights-management protections.
As a teenager in 1999, he worked with other still-anonymous programmers to create and release software called DeCSS, which allowed Linux-based computers to play DVDs, but that could also be used to copy the movies. That action led to years of legal battles in which Hollywood studios and their allies sued Web sites and software makers trying to keep the DeCSS code offline and off store shelves.
That legal strategy was successful; judges in the United States ruled that the code was illegal to distribute or sell. Nevertheless, DVD-ripping programs remain widely available online.
Johansen himself was prosecuted in Norway as a result of his work on DeCSS, but was ultimately acquitted.
The programmer has since turned his attention to Apple's iTunes store, studying the interior workings of the software and coming up with tools that can help strip the copy protection off purchased songs. The PyMusique release is related, but not directly dependent on his earlier work, Johansen said.
By John Borland
Staff Writer, CNET News.com
This post has been edited by Mavol: 24 March 2005 - 01:22 PM
Like
This topic is locked
facebook
twitter
featured news feed
Help
Register Now!