3

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to display their transparency reports and financial companies display data via massive time-delayed queries to prevent scraping. Recently, I encountered a new method, this time implemented as a pseudo-DRM:

Question: How does myfont.com hide the font from the browser? Can it be defeated?

Research: Consider the page for the font Modern Brush. It showcases a webfont for sale. Under Chrome's developer tools there are several fonts listed:

enter image description here

but none of the fonts look like the font used on screen. The fonts are clearly loaded however, since there is an editable div:

<div contenteditable="true" spellcheck="false" 
  class="text headline" 
  data-font="Modern Brush" 
  style="font-family: 'Modern Brush';">
            The Wonder of Webfonts
</div>

and a corresponding CSS style:

enter image description here

Close votes: I think that understanding this particular technique falls under the purview of SE Information Security. Additionally, please note that this question asks for information on circumventing a DRM (even if the intent is pedagogic). These reasons may constitute a reason for closing. If so, please advise in the comments.

closed as off-topic by schroeder, Steve, Xander, RoraΖ, Scott Pack Feb 1 '15 at 2:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Steve, Xander, RoraΖ, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure why you're having trouble. I was able to grab a copy in TrueType format with just a little poking around using wget. I was also able to get Embedded OpenType and WOFF2 files, but I don't have the ability to verify that those files actually have the correct font. – Mark Jan 30 '15 at 8:53
  • Wonder whether other resources can be hidden like that. I mean, what if you can hide a malicious JS like that? Or exploited image. Oh, there may even be ttf-exploit hidden like that in the wild – НЛО Jan 30 '15 at 11:58
  • @НЛО I think that is an interesting point and maybe grounds for an additional question. If you do ask it, can you provide a comment here linking them? – Hooked Jan 30 '15 at 18:07
2

The font files are loaded via CSS using code similar to this:

@font-face {
  font-family: 'Modern Brush';
  font-weight: normal;
  font-style: normal;
  src: url('/url-here/') format('woff');
}

I'm not convinced they have tried to hide this at all. The woff font file loaded shows up under the fonts tab in FireBug ok. The preview fails though as it doesn't factor in the URL parameters Key-Pair-Id, Policy and Signature which obviously make a difference, and presumably therefore these are components of their DRM implementation.

  • You mean FireBug right? – Hooked Jan 30 '15 at 18:08
  • Are the key-pair-id items tied to a browser specific instance? Another commenter mentioned that you could simply wget this url, but I had problems grabbing the src url from the command line. – Hooked Jan 30 '15 at 18:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.