Saturday, October 31, 2020

TorrentFreak's Latest News

 

'Deciphering' YouTube's Rolling Cypher in Your Browser is a Piece of Cake
Ernesto Van der Sar, 30 Oct 10:02 PM

youtube cipher rollingDownloading audio and video from YouTube is generally not allowed, as the video service clearly states in its terms of service.

Despite this restriction, there are numerous 'stream-ripping' tools available on the web that do just that.

These tools have legal uses but they are also a thorn in the side of music industry outfits, who see them as a major piracy threat. That was illustrated once again last week when an RIAA takedown notice wiped youtube-dl off GitHub.

The Rolling cipher

According to the RIAA, youtube-dl violates the DMCA's anti-circumvention provisions because it bypasses YouTube's 'rolling cipher' technical protection measure. That sounds rather complicated, but publicly little is known about how it works.

To find out more we reached out to YouTube, which didn't respond to our inquiry. However, we did find out more about the 'rolling cipher' in a judgment from a German court in Hamburg. This 2017 verdict was explicitly mentioned in the RIAA's takedown request to GitHub.

At the Hamburg court, copyright holders argued that YouTube's 'rolling cipher' is an effective technological protection measure under EU law. It's so complex that average users can't decipher it.

"In the case of the video at issue, the user would have to filter out the 22 encoded URLs from a total of 72,338 characters, then find the 'S variable' of each URL, decipher it – using the respectively valid, because changing key – and then the newly generated URL use to get the video," their argument was.

In the 2017 verdict, the court went along with this assessment ruling that encryption by the so-called "S variable" or "rolling cipher" is a technical measure within the meaning of Germany's Copyright Act.

DIY Downloading From YouTube

At TorrentFreak, we have relatively little knowledge about encryption, so it would be impossible for us to bypass this 'rolling cipher,' one would think. However, after a few Google searches, we learned that pretty much every browser can do this by default.

Once you know the trick it takes only 20 seconds or so to download the audio or video from any YouTube clip, using only a browser and no dedicated ripping tools.

Our 'deciphering' quest started in Chrome but works in Firefox and other browsers as well. Because we don't want any trouble, we used Dubioza Kolektiv's Pirate Bay song as the test video. When that was loaded up, we opened Chrome's devtools inspector, and navigated to the 'network' tab.

The devtools inspector shows you what requests are made by a page. When we filter for the keyword 'audio', several URLs appear, all pointing to chopped up audio streams from the YouTube video.

devtools

Without any encryption knowledge, we opened one of these streams in a separate browser tab. As expected, this didn't immediately bring up the full audio with the Pirate Bay song. That requires the extra step of removing the last part of the URL, which starts with "range=".

When that's done the audio clip shows up in full and it can be played just fine. In fact, Chrome even offers the option to download it.

download cipher

While we didn't dare to go that far, we heard that it indeed saves just fine. And when the 'weba' extension is renamed to MP3, it will play offline too.

Downloading From YouTube is Easy

So there we have it. In just a few clicks and keystrokes we managed to bypass YouTube's copyright protection using a browser. We didn't see any rolling cipher in the process and anyone can do it.

That brings us back to the RIAA's takedown request and the cited court verdict, which said that "an average user is not able to access the video info file, let alone decipher it." Either we are geniuses or the court's statement is wrong, at least for the present situation.

The above is the simple conclusion, but there's more to it, which gets a bit technical.

But Where's the Encryption?

After talking to several experts we learned that YouTube uses different 'signatures' for video URLs. Most have a fixed "sig" parameter, but there are also others that use an "s" parameter. In the latter cases, the player's JavaScript is called with this "s" parameter which varies (or 'rolls').

That parameter shuffling is likely what rightsholders refer to with a 'rolling cipher.' However, this doesn't involve any real encryption and youtube-dl doesn't use it, as it simply executes the JavaScript code with a JavaScript interpreter, much like a browser does.

Over the past weeks, dozens of experts have chimed in about the legality or illegality of tools such as youtube-dl. We are not going to add to this, as these questions are ultimately up to a court to decide.

Stream-Rippers are Not Needed

What our little quest shows, however, is that there doesn't appear to be any encryption to stop average users from downloading files in a browser. Anyone can download audio and video from YouTube without a dedicated stream-ripping tool.

That leads us to the final question, which we will leave unanswered. Or perhaps it answers itself. If youtube-dl is violating the DMCA because it allows people to download audio from YouTube, should browsers such as Chrome be outlawed as well?

From: TF, for the latest news on copyright battles, piracy and more.

Ololo.to Shuts Down After Being Targeted By ACE Anti-Piracy Coalition
Andy Maxwell, 30 Oct 11:00 AM

Streaming KeyBack in 2018, streaming search engine Alluc announced that it would be closing down.

Considering the site's length of service, an impressive 13 years, a sizeable gap was left in the market for some kind of replacement.

While there are plenty of indexing sites around, dedicated search engines have proven less easy to find in the current climate.

The Rise of the Ololo Streaming Video Search Engine

On April 1, 2018, a new streaming video search engine appeared. Named Ololo and located at Ololo.to, the site gave users the ability to search for the latest movies and TV shows.

By crawling some of the largest video hosting platforms on the planet, including the now-defunct Openload, Streamango, Rapidvideo and Verystream, for example, the site became a hit with users.

Ololo

"With ololo you can search hundreds of websites at one place and you can also use ololo as an alluc alternative. Help us spread the word and tell your friends who are looking for alluc alternatives," the site previously announced.

One Year Ago: Ololo Takes a Big Hit

Exactly a year ago, the unlicensed video streaming market received a huge blow when Openload, a massive file-hosting platform generating more traffic than legal services such as Hulu or HBO Go, was suddenly shut down along with stablemates Streamango, Streamcherry, and Verystream.

All had been shuttered after coming under pressure from global anti-piracy coalition Alliance for Creativity and Entertainment, which required their operators to pay a "significant" damages award. The action had a serious knock-on effect for Ololo too, which previously crawled the platforms looking for content.

"Goodbye openload, streamango, verystream. This is gonna hurt us for a long time," the site reported at the time.

Recovering and Moving On – For a While

During the months to follow, Ololo added support for even more sites including Viduplayer.com, mystream.to, upstream.to, videobin.co, prostream.to, onlystream.tv, and many more. As recently as May this year, Ololo began offering support for other platforms including streamtape.com and oogly.io.

As a result and from a standing start a little over two years earlier, the site was generating significant traffic, pulling in an estimated two million visitors per month**, many of whom commented on the quality of the platform and the results produced. However, trouble lay ahead.

At some point, the site's Twitter account was suspended for violating the platform's rules. The nature of the violation isn't known but the account, which was supposed to be used to notify users of outages, would've come in handy.

Without warning from the site's operator/s, Ololo suddenly went down in the past few days leaving the following message: "ololo says goodbye! The ololo search engine has been discontinued."

Ololo goodbye

While many of the site's users felt the closure was a complete surprise, recent history reveals that the search engine had some problems. It isn't clear whether these were the direct cause of the site shutting down but in the scheme of things, it's likely they played a part.

Pressure from Hollywood – Blocking

Earlier this month we reported how group of major Hollywood studios, Netflix, and other movie companies had obtained a new pirate site-blocking injunction in Australia.

The injunction targeted 78 domains, requiring that the majority of ISPs in Australia block them moving forward. On the list was Ololo, with the applicants in the case stating that the search engine's "primary purpose or effect" was to infringe or facilitate the infringement of copyright.

While a blocking order in Australia wouldn't have affected the site's traffic too much, another more significant event was on the horizon. After successfully shuttering Openload and colleagues a year ago, the Alliance for Creativity and Entertainment (ACE) was on the heels of Ololo too.

Pressure from Dozens of Companies – DMCA Subpoena

This month, ACE obtained a DMCA subpoena compelling the Tonic domain registry, the operator of Ololo's .to domain, to hand over information on many sites, including Ololo.

As a result, Tonic was ordered to disclose the identities, including names, physical addresses, IP addresses, telephone numbers, e-mail addresses, payment information, account updates and account histories of the people operating the sites, Ololo.to included.

Again, it is not clear whether the blocking, subpoena, or the prospect of being unmasked caused the shutdown of Ololo but the timing of the site's closure raises plenty of questions. However, with the platform now consigned to history, perhaps it will be allowed to just fade away.

Update: **A statement sent to TF by Ololo indicates that contrary to SimilarWeb stats, Ololo only received "6,000 to 8,000 visitors daily." The site supplied additional information as follows;

"We never made a single cent from this website, although there was one popup to cover server costs it was not enough. With such small traffic we had to pay this site from our pockets," the statement reads.

"With that being said, closing ololo was in our minds many times before. The recent Australian block and now ACE taking actions were the final signals for us to shut down this site for good.

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company

Thursday, October 29, 2020

TorrentFreak's Latest News

 

Alleged KickassTorrents Operator is Now Officially a Fugitive
Ernesto Van der Sar, 28 Oct 09:15 PM

kickasstorrentsAt the start of 2016, KickassTorrents was the most popular torrent site on the Internet.

With millions of daily visitors, it had even surpassed the mighty Pirate Bay. A few months later, however, the site was gone.

The site's quick demise was the result of a criminal investigation by the FBI. This resulted in three indictments, with alleged operator Artem Vaulin being the main target.

Vaulin, who was born in Ukraine, was arrested at a Polish airport and later transferred to a local prison. The outstanding extradition request from the United States accused him of being the mastermind behind KickassTorrents, which 'shared' over $1 billion in copyrighted content.

The US immediately requested extradition, a process that turned out to take years. While awaiting the outcome, Vaulin was released on bail on the condition that he could not leave Poland. That promise was kept until a few weeks ago, when the defendant suddenly disappeared from the radar.

Vaulin Jumps Bail

United States Attorney John R. Lausch Jr. recently informed the federal court in Illinois that their suspect had jumped bail and gone 'missing.'

"According to information recently received from the Polish Ministry of Justice, defendant Artem Vaulin has left Poland in violation of his release conditions, and his current whereabouts are unknown," Lausch wrote.

This status update came as a surprise to nearly everyone involved, including Vaulin's legal team in the US which informed us that they intended to withdraw from the case.

Defense Lawyers Withdraw

This is indeed what happened. Last week, Vaulin's attorneys Theodore Poulos, Ira Rothken, Jared Smith, and Valentin Gurvits, asked the federal court to grant their withdrawal.

"Because Defendant Vaulin appears to have intentionally violated the conditions of release and became a fugitive, undersigned counsel are no longer amenable to representing Defendant Vaulin and wish to withdraw as his counsel," they wrote.

Fugitive Calendar

This request was granted by the court which also decided to put the case on the fugitive calendar last Wednesday. This basically means that the case will remain inactive until the defendant is apprehended again. If that happens at all.

fugitive calendar

This may very well mean that the KickassTorrents case is dead. After the case was put on the fugitive calendar, United States Attorney John R. Lausch Jr submitted a new status report, indicating that it doesn't anticipate the need for any further status hearings unless the defendants are located.

Other Defendants Never Arrested

In addition to Vaulin there are two other defendants, Oleksandr Radostin and Ievgen Kutsenko, who have never been apprehended and remain at large. This was confirmed by the United States Attorney as well.

"The remaining defendants in this case have not been arrested, and the government is not aware of any attorneys who represent them. The government will apprise the Court if the remaining defendants are arrested," Lausch wrote.

It is worth noting that Vaulin previously offered to surrender to the US voluntarily under the right conditions. His legal team discussed this option with the US Government but, based on the lack of action afterwards, both parties were unable to reach an agreement.

From: TF, for the latest news on copyright battles, piracy and more.

Sender of False DMCA Takedown Notices Ordered to Pay £370K in Damages
Andy Maxwell, 28 Oct 10:29 AM

Court DamagesEvery day millions of DMCA takedown notices are sent to major online platforms including Google, YouTube, Facebook and Twitter.

The aim is to remove content that infringes third-party copyrights and the majority succeed in that goal. However, some people see the takedown provisions of the DMCA either as a tool for censorship or one to be abused in order to seize an advantage over a competitor or rival.

There are remedies available under the law that allow senders of malicious DMCA takedown notices to be financially punished but such conclusions are extremely rare. This week, however, a court ordered one abusive notice sender to pay what appears to be the most significant amount on record.

Defendant Sent Abusive DMCA Takedown Notices

In December 2019, The California Beach Co., LLC, (CBC) filed a complaint in a California court alleging that Han Xian Du, an individual living in China, had filed multiple multiple DMCA complaints with various online platforms complaining that CBC's content infringed copyright.

CBC is the exclusive distributor of a kids' playpen and sells its product through various outlets and via the Internet. Han Xian Du, on the other hand, used a distributor to sell "knockoff" variants of the playpen in the United States. According to the complaint, the defendant sent multiple DMCA takedown notices to Facebook and Instagram, demanding that CBC content should be taken down.

Online platforms have a tendency to quickly remove allegedly infringing content and in this case it was no different. Instagram responded by removing CBC's posts while Facebook disabled CBC's account in its entirety. Neither of the platforms responded to appeals to have the content reinstated.

On Christmas Day, 2019, things escalated when CBC's product page on Amazon was also removed following a fraudulent DMCA takedown notice, bringing the company's sales on the platform to a swift halt.

Complaint Sought Injunction and Damages

As per the complaint, in order to file copyright takedown notices with each of the online platforms, the defendant had to sign a declaration that the content to be removed violated his copyrights. Knowing that these declarations were fraudulent, the defendant made deliberate misrepresentations under the DMCA.

"Any person who knowingly materially misrepresents under this section that material or activity is infringing shall be liable for any damages, including costs and attorneys' fees, incurred by the alleged infringer, by any copyright owner or copyright owner's authorized licensee," the relevant section reads.

According to CBC, the company believed it could lose $100,000 every week its accounts were down and was already incurring "crippling loss of consumer goodwill". Demanding a permanent injunction to prevent the ongoing violations of the DMCA's takedown provisions, the company also sought an extensive damages award.

Court Issues Injunction and Grants Damages For Abuse of the DMCA

On January 8, 2020, the court handed down a temporary restraining order to prevent the violations, noting that Du was "temporarily not permitted to file any further takedown notices with Facebook, Instagram, or any other service provider's website as to CBC's online content or product line."

On January 24, 2020, the injunction was made permanent but despite repeated attempts to contact him, Du failed to plead his case before the court. The case was therefore dealt with in his absence and predictably went in favor of CBC.

"By virtue of his decision not to defend and to default in this matter, Defendant has admitted liability on Plaintiffs' claims," the order handed down this week by Judge Yvonne Gonzalez Rogers reads.

"[T]he Court finds that based on the Declarations and evidence in the record that CBC has suffered damages resulting from the conduct of Defendant in the amount of $369,849.12, which includes $316,991.00 in lost profits damages, $51,474.00 in reasonable attorneys' fees, and $1,384.12 in recoverable costs."

A Rare Decision Awarding Damages Under 17 U.S.C. § 512

Whether CBC will see any of this award remains to be seen but the outcome in favor of the plaintiff is important. To our knowledge, this is the highest damages award ever handed down in a case based on abusive DMCA takedown notices and is extremely rare.

In March 2015, Automattic, the company behind the popular WordPress blogging platform, won a similar case against a man who abused the DMCA to censor an article published by student journalist Oliver Hotham.

Hotham wrote an article about "Straight Pride UK" which included a comment he received from the organization's press officer Nick Steiner. However, Steiner didn't like the article so sent WordPress a takedown notice claiming that it infringed his copyrights.

Automattic stood by the journalist and went to court, demanding a damages award for Steiner's abuse of the DMCA. The blogging platform and Hotham emerged the winners, with an award of roughly $25,000 in damages and attorneys fees, again via default judgment.

Dating back to 2004, another case saw Diebold, a manufacturer of electronic voting machines, wrongfully allege that two students had infringed the company's copyrights. The EFF and the Center for Internet and Society Cyberlaw Clinic at Stanford Law School stepped in to fight dozens of abusive copyright claims, eventually emerging with an agreed settlement of $125,000 in damages and fees.

The complaint and default judgment in the CBC case can be found here and here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company