Justin starts a blog

Hacking back at the pirates

Copyrighted material is a big problem on video hosts, and blip is no exception. One of the ways we keep tabs on copyright violators is by looking at link sites. Right now we only monitor one, surfthechannel.com. Their clean interface makes it sooo easy to crawl.

Recently they’ve figured out that we and possibly others are watching, because they started “encrypting” their URLs. Their custom flash player decrypts this, and then passes it on to their server-side redirector which stats streaming the video from blip, or whomever.

I decompiled (why is it called decompiling when interpreted languages are never compiled) their Flash player but couldn’t find the encryption code. Turns out they’re using a commercial product which allows for custom skinning by loading another Flash swf. That’s where the “encryption” was. I use quotes because it’s not encryption at all. This is what they do:

1. Base64 encode the URL
2. Insert long known strings of junk into the string
3. Base64 encode the string again

Once you know the strings you can just split them out and rejoin. I have to admit that it was clever that they placed this code within the skin swf, modifying _root.FLVUrl at just the right time.

Anyway we’re monitoring them again, although not as quickly as I’d like. I’m convinced their redirector uses the same strategy, only I don’t know the strings. My next hack will be to collect a bunch of those URLs, compare them to figure out the strings, and then skip the redirector altogether.

Here’s the code if you want it, in perl:

sub decode_retardocrypt { my $str = shift; my $str2 = decode_base64($str); my $str3 = join(”,split /53245346354634563247123YjQ1ZTc1OTI5OT401823741237409812734083428034532828928384944213412344/,$str2); my $str4 = join(”,split /1234123412735723450982734509827345982345OT3748102349871230489712304987059823405981233848848392983829204982310948234059823450982345/,$str3); my $str5 = join(”,split /841239048809809809238409309109108123478901234jEjdQjd71230497123047123409871230498712309487120938471029347810982374292890820938120495994928393810991928384/,$str4); my $result = decode_base64($str5); return $result; }

BTW, video hosting site piracy stats to follow. Early results, it’s all youtube and megavideo.