5

I really hope this question isn't off-topic...

Background

The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or otherwise (open to the public, but should not be redistributed according to some license or another).

For example, a video on Youtube may be open to the public (for viewing), but should not be redistributed. A video on PBS may share the same regulations on the content of the site, but they're secured in very different manners.

I haven't been able to work this out with Adobe Flash, but with HTML5 there seems to be a pretty straightforward way to get the actual media content when no obfuscation is in place.

Edit: For clarification, I'm asking in the context of the average user who could likely follow the below method I give for downloading a video from PBS, but who would find it near impossible to download a video from Youtube.

Edit 2: Youtube breaks up the media content for performance in streaming video; this can also be considered a 'security' mechanism, because a user would have to write software to get all of the pieces and put them together (software exists for this purpose), which makes it difficult for people to gain direct access to the media in question. However, they also use validation mechanisms in the query string for the GET request (see below in Method); these validation mechanisms are the core concern for the question.

Method

I'll take Youtube (HTML5) and PBS (JW Player 6.11.4920) as an example to walk through what I'm talking about.

La Famiglia on PBS's website:

1.) Disable Adobe Flash (chrome:plugins -> Adobe Flash -> disable, for example)

  • This forces JW Player to fall back to HTML5

2.) Open Developer Tools -> look at the Network tab

3.) Start playing the video

4.) Notice video/mp4 in the Type column:

source

5.) The request URL is the direct link to the media that is downloadable. Voilà.

Clearly this is insecure. If this were copyrighted content, a person could easily download it and redistribute via torrents, file upload sites, etc. Not great! With Adobe Flash-only media players, this type of method seems impossible to do, but that may just be my lack of investigative skills.

Let's take a look at Haddaway - What Is Love on Youtube:

1.) Youtube is HTML5 now, great, skip a few steps and go directly to Developer Tools

2.) Look for some video format. Found some!:

Youtube media source

3.) Obfuscation, on a high level


As we can see, some sites implement some form of media access control to prevent unauthorized access. In Youtube's case, it may be for efficiency but by the look of their request URL format:

https://r1---sn-hxgpu-a5oe.googlevideo.com/videoplayback?upn=_t-wCQzh3Ww&signature=A298625B841D2DD1A8A8BBCFAEE5FE80F9F8ED45.4AF128179F70E92385145290FEF6B1843D3E4047&itag=243&keepalive=yes&lmt=1414207260185348&key=yt5&pl=16&id=o-AFRnZLaRZX9g_lgGGgfcjzbUFLOu-PFx0EGukit2Z358&mime=video%2Fwebm&mm=31&ipbits=0&requiressl=yes&ip=148.61.167.67&ms=au&gir=yes&mt=1424731661&dur=241.040&initcwndbps=3913750&expire=1424753375&sver=3&fexp=3300103%2C3300103%2C3300130%2C3300130%2C3300137%2C3300137%2C3300161%2C3300161%2C3310704%2C3310704%2C3311902%2C3311902%2C3312210%2C3312210%2C905657%2C907263%2C924628%2C927622%2C931378%2C934954%2C9406486%2C9406573%2C9406921%2C943917%2C947225%2C947240%2C948124%2C948703%2C952302%2C952605%2C952612%2C952901%2C954815%2C955301%2C957201%2C957906%2C959701%2C961403&mv=m&sparams=clen%2Cdur%2Cgir%2Cid%2Cinitcwndbps%2Cip%2Cipbits%2Citag%2Ckeepalive%2Clmt%2Cmime%2Cmm%2Cms%2Cmv%2Cpl%2Crequiressl%2Csource%2Cupn%2Cexpire&clen=8105881&source=youtube&cpn=S4VP0TLZXAoVAKuj&alr=yes&ratebypass=yes&c=WEB&cver=html5&range=7240268-8105880

It seems that they're restricting access in a lot of ways. The process to actually retrieve the video (from Youtube) requires reverse-engineering (example) the constructed URL (request URL), downloading each chunk and building the data incrementally. Google seems to be doing a good job for the casual user, but a developer can reverse engineer the request URL and create 'Youtube downloaders', as are very common nowadays.

Questions

Is there a specific name for the method that Youtube is using (fragmentation + access control via querystring parameters)?

Are there widely-used/named methods for 'obfuscating' media in this fashion?

Is it even (technically) possible to fully prevent unauthorized media access? My guess is no, so long as someone is willing to spend the time to reverse-engineer the necessary metadata.

  • Are you asking about preventing a legitimate/authorized user who can view the video from downloading/saving it, or preventing unauthorized access - e.g., the user must be logged in, etc. – Eric G Feb 23 '15 at 23:42
  • @EricG The first - an average Joe could follow the instructions I gave for PBS. Saving Youtube videos locally requires reverse-engineering their interface, which is not something an average person could do. So the question is, what methods are providers using to make it difficult or impossible for the average person. I also added a clarification segment near the top of my question for the context of who the access control methods are intended for :) – Chris Cirefice Feb 23 '15 at 23:48
  • An average Joe can still take someone else's program that downloads the media. How are you viewing the ones that develop these programs, in the context of your question? – Rob W Feb 24 '15 at 0:00
  • Why would the average Joe even bother when they could stream it from the browser or download the torrent a more advanced user uploaded? – David Houde Feb 24 '15 at 1:03
  • @RobW The developers of the applications that reverse-engineer what is required to rebuild the correct GET requests should be considered non-casual users; they are the people that break access controls (such as Youtube's) in order to make it easy for the average user to obtain 'unofficial' copies of the media in question. In this context, the question becomes how are providers protecting their media from developers who could reverse-engineer access control methods? Are there standard methods providers (e.g., Youtube) use to defend said media from these 'thieves'? – Chris Cirefice Feb 24 '15 at 2:51
3

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests.

Because of this parsing, it becomes difficult to create a script/program that consistently can place all of these pieces together.

I took a screen grab and highlighted some points:

Firebug Capture of Youtube Traffic

Notice the multiple GET requests to *.googlevideo.com.

If you actually look at the response you will see a url that returns a snip of the .mp4 file. (below is what will happen if you merely go to the response url)

enter image description here

You can look in your browser's cache to find the actual snippet and conceptually piece them all together. (below is a capture of the cache file itself)

enter image description here

Now, I do not know if you must still further decrypt the file itself (one you have pieced all these cache's).

I am led to believe no, because the video is obviously playing client-side. I just need to confirm this...

  • Thanks for the answer. I guess I didn't really make it understood that I understand the multiple requests (there is a screenshot in the question). I know what Google does, I'm wondering if there is a name for the 'obfuscation' scheme they're using (fragmentation + access control via query string parameters), and if there are industry-standard methods of implementing similar systems. For example, is fragmentation of the media before delivery and validation via query string a standard method? Or did Google just invent their own media access control system? – Chris Cirefice Feb 24 '15 at 2:59
  • I would imagine the multiple requests is for performance and switching between networks etc versus security – Eric G Feb 24 '15 at 3:23
  • @ChrisCirefice, as Eric said, Google does this more for performance than security. Back in the day (2008), the videos were entirely loaded via one non-encoded uri (thus enabling anyone knowing how to read a bit of source code to download them). This method was horrible for networks because it meant that even if you watch only a small portion of the video, the entire video is loaded. I cant remember the term off hand, but I believe Google did pioneer this concept in regards to web-streaming. – Matthew Peters Feb 24 '15 at 13:03
  • @MatthewPeters I figured that it was more for performance than securing their content from being downloaded by any average user, but the validation in the query string is more of what I'm referring to in my question. If a file was only broken up into pieces and served via multiple GET requests (without access control), even I could write a simple program to get all the pieces and assemble them. However, the security mechanism they have in place forces a person to reverse engineer Google's request URL in order to make valid requests; this is the core of the question :) (also see my 2nd edit). – Chris Cirefice Feb 24 '15 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.