Analysis of the MediaMax CD3 copy-prevention system [LWN.net]

John A. Halderman has analyzed the "CD3" copy protection system for audio CDs and posted his results. It seems that this technology works by loading a special driver via the Windows autorun feature; the driver interferes with read operations, thus thwarting copy attempts. But only if the driver is actually loaded. "MediaMax's protections are ineffective because the driver program can easily be disabled or, depending on the system configuration, it might never be installed to begin with. As a result, audio content is vulnerable to copying in virtually 100% of deployed systems.... Computers running Linux or Mac OS 9 can't run the MediaMax software at all, so they can always copy the recording." Sometimes the lack of Linux support is a good thing.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 15:32 UTC (Mon) by Soruk (guest, #2722) [Link] (1 responses)

First we had a system that rendered marker pens illegal under the DMCA.

Does this therefore render shift keys illegal under the same Act?!

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 16:56 UTC (Mon) by rknop (guest, #66) [Link]

Dunno, but Joe Halderman is going down. After exposing the internals of this copy protection scheme, expect the FBI to descend on him and throw him in jail.

-Rob

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 15:37 UTC (Mon) by DaleQ (subscriber, #4004) [Link] (2 responses)

I think that the funniest thing is that most of the windows cd-recording software packages I've installed have a prompt like;

"Auto-insert notification should be turned off to prevent errors during recording. Turn off auto-insert notification?" [YES] [No]

Therefore, even the target audience of this protection scheme is not prevented from copying CDs.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 15:51 UTC (Mon) by xorbe (guest, #3165) [Link] (1 responses)

Auto-insert notification is not the same thing as the Auto-run feature.

You want to leave the first on, and the second off (for general usage).
Of course, Windows only exposes the setting for the first!

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 16:44 UTC (Mon) by DaleQ (subscriber, #4004) [Link]

True.

However, if auto-insert notification is turned off, the auto-run is not executed.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 17:00 UTC (Mon) by welinder (guest, #4699) [Link]

Pathetic.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 17:11 UTC (Mon) by libra (guest, #2515) [Link]

I just realized that this copy protection scheme just does not render unlegal to disable autorun, it also renders unlegal to own any other operating system than Windows.
Damn, they finally got us!

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 17:50 UTC (Mon) by edlenz (guest, #12021) [Link] (1 responses)

Good Joke, I think we should be fast and release a Linux version as soon as possible :0)

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 19:35 UTC (Mon) by rmini (subscriber, #4991) [Link]

It'll be an even bigger joke when it asks you to run a program off of the CD as root. :)

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 19:53 UTC (Mon) by lacostej (guest, #2760) [Link]

I haven't tried the latest version, but vmware recommends you to disable autorun in order for your Guest OSes to run OK.
In one way, VMWare also becomes a copy-protection circumventing mecanism :)

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 20:26 UTC (Mon) by jdossey (guest, #15798) [Link] (4 responses)

This just gives the Recording Industry another reason to abandon traditional CD's in favor of a new version that only contains encrypted DRM material. It will probably involve Microsoft and only be usable on Windows-enabled hardware.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 6, 2003 21:56 UTC (Mon) by iabervon (subscriber, #722) [Link] (3 responses)

Given that no such format is available for any audio devices I know of, that would be tantamount to getting out of the music distribution business. While I would support that move, I somehow doubt they'd be interested in it.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 7, 2003 12:00 UTC (Tue) by nowster (subscriber, #67) [Link] (2 responses)

DVD-Audio has some form of copy-protection (not CSS). It's not copy protection – it's extraction protection, and wouldn't prevent determined counterfeiters from making a bitwise copy.

DVD audio (Analysis of the MediaMax CD3 copy-prevention system)

Posted Oct 7, 2003 13:49 UTC (Tue) by eru (subscriber, #2753) [Link] (1 responses)

Interesting. If I understood the description there correctly, each DVD Audio player model has a private key, used for getting the actual audio encryption key from a block on the disk. The player key can be revoked, which I believe means that a player with a revoked key continues to be able to play old recordings, but not ones produced after the revocation.

But this means that revoking one player key leaves all users with the particular player model with an obsolete device (unless each individual player has a private key, but the text only talks about models, not individual decoder instances). Hard to see how this revocation could be applied to any popular player model without creating a monumental PR disaster for the entire DVD Audio format.

Anyway, thanks for warning. That is one home entertainment format I am never going to buy. I don't want such potential logic bombs in my living room!

DVD audio (Analysis of the MediaMax CD3 copy-prevention system)

Posted Oct 9, 2003 17:41 UTC (Thu) by cwitty (guest, #4600) [Link]

While the actual cipher is not CSS, eru's problem with DVD Audio is almost exactly the same thing that could happen with DVD video. Every DVD has multiple copies of the decryption key, each encrypted with a player-specific key; this is so that DVD makers can revoke player keys by no longer providing corresponding decryption keys. (The only difference is that DVD Audio, according to the article, changes player-specific keys every three months; I don't know if the same is true of DVD video.)

And again, with DVD video, they couldn't "revoke" any popular players without a monumental PR disaster.

Legal implications?

Posted Oct 6, 2003 22:24 UTC (Mon) by Pnin (guest, #15173) [Link]

What are the legal implications of this? After all, the
user does not expect an audio CD to install software, and
he certainly does not wish that it does. Is there a warning
or disclaimer on the CD cover? Isn't that dangerously
close to a criminal offense, "data alteration" or whatever
your local legislation calls it?

More on the legal aspect of the problem...

Posted Oct 7, 2003 6:35 UTC (Tue) by libra (guest, #2515) [Link] (1 responses)

I've just had an idea, if someone creates a DRM system that uses a secret key, and then chose the text of the DMCA as the secret key wouldn't that render the DMCA unlegal in regard of the DMCA?

To be more constructive it just proves the following to my opinion :
A DRM mechanism can only be used in conjunction with DMCA to prevent use of something that :
- was not existing BEFORE the DRM mechanism has been put in use : to prevent use of DRM + DMCA as a way to forbid previously existing and legal things.
- is ONLY intended to circumvent the DRM mechanism
- is not preventing fair usage of protected material as specified by other laws

In case something would be created after a DRM mechanism was revealed and could be used to circumvent that DRM, but also to gain fair use of DRM protected material in a way that nothing else would permit under some conditions, then it should be admited that as long as no other technical solution to achieve the same goal in the same context has been released under the same conditions the would be circumvention system shall remain legal.

This application of simple common sense would just give choice to some organizations to :
a) allow use of certain programs to read DVDs and some music under Linux
or
b) provide a program freely that would allow to do the same thing with same quality under same conditions

The difference between hackers and judges...

Posted Oct 7, 2003 6:58 UTC (Tue) by raph (guest, #326) [Link]

...is that hackers come up with these kinds of games and think they're clever, but judges are not amused.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 7, 2003 21:35 UTC (Tue) by ccchips (subscriber, #3222) [Link] (1 responses)

Go to news.com and look at the article there.

After you read it, tell me there aren't millions of sycophants on this planet, and that they're not all crowding around the Web at this time.

If anyone ever sells me a CD that I can't use as I wish, I will return it, unopened. If that's not possible (because some nitwit tricked me into thinking it was a pure CD,) I will throw it in the trash, and notify the seller that I will never do business with them again.

I am very disappointed in people right now. First, they engaged in rampant, illegal music distribution, then the victims dragged people like me into their fight.

BTW, that thing about buying and then returning CD's is only if I ever do buy another CD. At this point, the idea makes me sick. I've decided to go somewhere else for music, places where this crap doesn't apply, and where these stupid laws and copy-protect schemes aren't necessary.

I'm tired of being treated like a gullet, and being condescended to by ass-kissing investment reporters.

Analysis of the MediaMax CD3 copy-prevention system

Posted Oct 9, 2003 15:16 UTC (Thu) by Max.Hyre (subscriber, #1054) [Link]

Said article lives at http://news.com.com/2100-1025_3-5087875.html (It took me a couple minutes to find it, anyway.)