Saturday, October 31, 2020

TorrentFreak's Latest News

 

'Deciphering' YouTube's Rolling Cypher in Your Browser is a Piece of Cake
Ernesto Van der Sar, 30 Oct 10:02 PM

youtube cipher rollingDownloading audio and video from YouTube is generally not allowed, as the video service clearly states in its terms of service.

Despite this restriction, there are numerous 'stream-ripping' tools available on the web that do just that.

These tools have legal uses but they are also a thorn in the side of music industry outfits, who see them as a major piracy threat. That was illustrated once again last week when an RIAA takedown notice wiped youtube-dl off GitHub.

The Rolling cipher

According to the RIAA, youtube-dl violates the DMCA's anti-circumvention provisions because it bypasses YouTube's 'rolling cipher' technical protection measure. That sounds rather complicated, but publicly little is known about how it works.

To find out more we reached out to YouTube, which didn't respond to our inquiry. However, we did find out more about the 'rolling cipher' in a judgment from a German court in Hamburg. This 2017 verdict was explicitly mentioned in the RIAA's takedown request to GitHub.

At the Hamburg court, copyright holders argued that YouTube's 'rolling cipher' is an effective technological protection measure under EU law. It's so complex that average users can't decipher it.

"In the case of the video at issue, the user would have to filter out the 22 encoded URLs from a total of 72,338 characters, then find the 'S variable' of each URL, decipher it – using the respectively valid, because changing key – and then the newly generated URL use to get the video," their argument was.

In the 2017 verdict, the court went along with this assessment ruling that encryption by the so-called "S variable" or "rolling cipher" is a technical measure within the meaning of Germany's Copyright Act.

DIY Downloading From YouTube

At TorrentFreak, we have relatively little knowledge about encryption, so it would be impossible for us to bypass this 'rolling cipher,' one would think. However, after a few Google searches, we learned that pretty much every browser can do this by default.

Once you know the trick it takes only 20 seconds or so to download the audio or video from any YouTube clip, using only a browser and no dedicated ripping tools.

Our 'deciphering' quest started in Chrome but works in Firefox and other browsers as well. Because we don't want any trouble, we used Dubioza Kolektiv's Pirate Bay song as the test video. When that was loaded up, we opened Chrome's devtools inspector, and navigated to the 'network' tab.

The devtools inspector shows you what requests are made by a page. When we filter for the keyword 'audio', several URLs appear, all pointing to chopped up audio streams from the YouTube video.

devtools

Without any encryption knowledge, we opened one of these streams in a separate browser tab. As expected, this didn't immediately bring up the full audio with the Pirate Bay song. That requires the extra step of removing the last part of the URL, which starts with "range=".

When that's done the audio clip shows up in full and it can be played just fine. In fact, Chrome even offers the option to download it.

download cipher

While we didn't dare to go that far, we heard that it indeed saves just fine. And when the 'weba' extension is renamed to MP3, it will play offline too.

Downloading From YouTube is Easy

So there we have it. In just a few clicks and keystrokes we managed to bypass YouTube's copyright protection using a browser. We didn't see any rolling cipher in the process and anyone can do it.

That brings us back to the RIAA's takedown request and the cited court verdict, which said that "an average user is not able to access the video info file, let alone decipher it." Either we are geniuses or the court's statement is wrong, at least for the present situation.

The above is the simple conclusion, but there's more to it, which gets a bit technical.

But Where's the Encryption?

After talking to several experts we learned that YouTube uses different 'signatures' for video URLs. Most have a fixed "sig" parameter, but there are also others that use an "s" parameter. In the latter cases, the player's JavaScript is called with this "s" parameter which varies (or 'rolls').

That parameter shuffling is likely what rightsholders refer to with a 'rolling cipher.' However, this doesn't involve any real encryption and youtube-dl doesn't use it, as it simply executes the JavaScript code with a JavaScript interpreter, much like a browser does.

Over the past weeks, dozens of experts have chimed in about the legality or illegality of tools such as youtube-dl. We are not going to add to this, as these questions are ultimately up to a court to decide.

Stream-Rippers are Not Needed

What our little quest shows, however, is that there doesn't appear to be any encryption to stop average users from downloading files in a browser. Anyone can download audio and video from YouTube without a dedicated stream-ripping tool.

That leads us to the final question, which we will leave unanswered. Or perhaps it answers itself. If youtube-dl is violating the DMCA because it allows people to download audio from YouTube, should browsers such as Chrome be outlawed as well?

From: TF, for the latest news on copyright battles, piracy and more.

Ololo.to Shuts Down After Being Targeted By ACE Anti-Piracy Coalition
Andy Maxwell, 30 Oct 11:00 AM

Streaming KeyBack in 2018, streaming search engine Alluc announced that it would be closing down.

Considering the site's length of service, an impressive 13 years, a sizeable gap was left in the market for some kind of replacement.

While there are plenty of indexing sites around, dedicated search engines have proven less easy to find in the current climate.

The Rise of the Ololo Streaming Video Search Engine

On April 1, 2018, a new streaming video search engine appeared. Named Ololo and located at Ololo.to, the site gave users the ability to search for the latest movies and TV shows.

By crawling some of the largest video hosting platforms on the planet, including the now-defunct Openload, Streamango, Rapidvideo and Verystream, for example, the site became a hit with users.

Ololo

"With ololo you can search hundreds of websites at one place and you can also use ololo as an alluc alternative. Help us spread the word and tell your friends who are looking for alluc alternatives," the site previously announced.

One Year Ago: Ololo Takes a Big Hit

Exactly a year ago, the unlicensed video streaming market received a huge blow when Openload, a massive file-hosting platform generating more traffic than legal services such as Hulu or HBO Go, was suddenly shut down along with stablemates Streamango, Streamcherry, and Verystream.

All had been shuttered after coming under pressure from global anti-piracy coalition Alliance for Creativity and Entertainment, which required their operators to pay a "significant" damages award. The action had a serious knock-on effect for Ololo too, which previously crawled the platforms looking for content.

"Goodbye openload, streamango, verystream. This is gonna hurt us for a long time," the site reported at the time.

Recovering and Moving On – For a While

During the months to follow, Ololo added support for even more sites including Viduplayer.com, mystream.to, upstream.to, videobin.co, prostream.to, onlystream.tv, and many more. As recently as May this year, Ololo began offering support for other platforms including streamtape.com and oogly.io.

As a result and from a standing start a little over two years earlier, the site was generating significant traffic, pulling in an estimated two million visitors per month**, many of whom commented on the quality of the platform and the results produced. However, trouble lay ahead.

At some point, the site's Twitter account was suspended for violating the platform's rules. The nature of the violation isn't known but the account, which was supposed to be used to notify users of outages, would've come in handy.

Without warning from the site's operator/s, Ololo suddenly went down in the past few days leaving the following message: "ololo says goodbye! The ololo search engine has been discontinued."

Ololo goodbye

While many of the site's users felt the closure was a complete surprise, recent history reveals that the search engine had some problems. It isn't clear whether these were the direct cause of the site shutting down but in the scheme of things, it's likely they played a part.

Pressure from Hollywood – Blocking

Earlier this month we reported how group of major Hollywood studios, Netflix, and other movie companies had obtained a new pirate site-blocking injunction in Australia.

The injunction targeted 78 domains, requiring that the majority of ISPs in Australia block them moving forward. On the list was Ololo, with the applicants in the case stating that the search engine's "primary purpose or effect" was to infringe or facilitate the infringement of copyright.

While a blocking order in Australia wouldn't have affected the site's traffic too much, another more significant event was on the horizon. After successfully shuttering Openload and colleagues a year ago, the Alliance for Creativity and Entertainment (ACE) was on the heels of Ololo too.

Pressure from Dozens of Companies – DMCA Subpoena

This month, ACE obtained a DMCA subpoena compelling the Tonic domain registry, the operator of Ololo's .to domain, to hand over information on many sites, including Ololo.

As a result, Tonic was ordered to disclose the identities, including names, physical addresses, IP addresses, telephone numbers, e-mail addresses, payment information, account updates and account histories of the people operating the sites, Ololo.to included.

Again, it is not clear whether the blocking, subpoena, or the prospect of being unmasked caused the shutdown of Ololo but the timing of the site's closure raises plenty of questions. However, with the platform now consigned to history, perhaps it will be allowed to just fade away.

Update: **A statement sent to TF by Ololo indicates that contrary to SimilarWeb stats, Ololo only received "6,000 to 8,000 visitors daily." The site supplied additional information as follows;

"We never made a single cent from this website, although there was one popup to cover server costs it was not enough. With such small traffic we had to pay this site from our pockets," the statement reads.

"With that being said, closing ololo was in our minds many times before. The recent Australian block and now ACE taking actions were the final signals for us to shut down this site for good.

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company

No comments: