Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I visit YouTube, my browser accesses the website and begins to play whatever video I select. By its very nature, this involves YouTube sending the content of the video to my computer. Not only this, but my computer clearly caches the audio/video information which is being sent, as demonstrated by the fact that I can move backward in a video without reloading the entire thing or the bits after it.

Based on this, how does YouTube (or any other media sharing/streaming site) possibly prevent the theft of their content? I look in my browser cache, and I don't see a fully downloaded video, so clearly there's at least some obfuscation going on. Does the site instruct the browser to only cache the data for a short period of time? Does it somehow scramble the information in transit? Obviously whatever security measures they do use aren't perfect, as evidenced by sites which facilitate actual, direct download of content. But I'd like to understand how they can possibly attempt to prevent it in the first place.

share|improve this question
    
I wasn't quite sure how to phrase what I was asking in the question title, so if anyone else has a better idea, please suggest. –  Jeff Gohlke May 17 '13 at 0:00
    
It doesn't do it very effectively if anything. See the youtube-dl tool for Linux. –  Luc Jul 2 '13 at 20:49
    
I don't think preventing automatic piracy will ever be possible. They can make it difficult for the script kiddies but in the end it's a bunch of 1's and 0's. If it's running on a machine where you have admin you can get it one way or another and if you can get it you can automate the getting. –  Four_0h_Three Jul 2 '13 at 21:06
add comment

2 Answers

up vote 6 down vote accepted

The relevant practice you're describing is leeching and the immediate connotation is inappropriately as harsh as the term "junk bond".

Your conceptual description is accurate but YouTube's content is leechable, sites like HuLu, even CSpan go to greater lengths to protect their content by instructing your browser to cache the content in your systems RAM instead of the disk even overriding your browsers preferences. Other measures such as storing the content in an encrypted manner that requires a rapidly expiring cookie for deciphering along with layers of redirection on the server side that strives to isolate your system from directly accessing the content which is being proxied from internal media servers to the web server, then you.

YouTube employs those measures for the premium content like day pass $9 movies but the never ending competition between the content providers and the labeled pirates keeps prevents the topic from becoming stale.

Whether you can access the actual source FLV, MP4, etc files or have to rely on sniffing the content with a purpose built packet sniifer (even VLc and RealPlayer has mechanisms to record the stream as analogous as a VCR), isolating content from unapproved capture is impossible.

I love the wording of your question because it has all of the hallmarks of a SecPro with more of a traditional background in law enforcement, policy auditing and it seems like the earnest curiosity of someone on the quest to learn more and that is becoming rarer in this profession.

If you google for "leeching tools" you'll get a Chicago thick phonebook of results and just starting with FlashGot or FlashVideoDownloader as FireFox add on's will demonstrate the semi obfuscated URL's. If you hate FireFox and prefer IE, you can use the ANT Downloader, it's FF and IE compatible.

My own experiences, I've found Firefox addon's more capable for this leeching in its depth and breadth of choices, while Chrome seems to be lacking especially when trying to leech video from YouTube or any other site in the google family.

share|improve this answer
    
off-top: mind pointing to the U-tube 'premium content' ? Really curious, never seen such ... thx –  Yuri May 17 '13 at 9:18
    
@Yuri - Its prompted on YouTube.com –  Ramhound May 17 '13 at 14:16
add comment

Well, first you have to define the word 'theft' in this case.

All the content I've seen so far on YouTube is for free anyway. The only protection there I know of is preventing users from recording video streams for off-line viewing or viewing not via your flash-enabled browser or manipulating the stream.

Against this they use RTMPE/RTMPS streaming protocol (e.g. Al-Jazeera live stream) which involves SSL/RC4 encryption of the stream, so you can't intercept it to record and also you can't mangle it (e.g., if it contains ads you cannot strip them off) So, on YouTube the protections are tamper-proof, rather than theft-proof.

In general, though, the technology called DRM is used that usually involves some proprietary DRM-aware desktop player (e.g., Windows Media Player) and server-side software working with such a player. This way the player makes sure that you paid for the content you are trying to access and makes it very hard to circumvent (no cache, encrypted chunks of stream, recorded ID of the user, etc.). The Hulu desktop player is another example.

share|improve this answer
    
Google just annouced paid YouTube channels recently. UFC is one of those channels. –  Ramhound May 17 '13 at 14:16
    
ok, thanks, just checked it out –  Yuri May 17 '13 at 14:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.