Feeds

Spotify spews 'unencrypted' FREE MP3s all over creation

Chrome tool could ransack music vault, says coder

Gartner critical capabilities for enterprise endpoint backup

Spotify has tweaked the music player on its website after someone apparently found a way to harvest every single MP3 file from the audio-streaming service.

The media biz's playback site, which launched in November, did not encrypt data streamed to the listener's web browser, it is claimed. One enterprising programmer said he discovered the security shortcoming and exploited it using some JavaScript.

Judging by Robin Aldenhoven's code, the script read the page title of Spotify's in-browser player, which contains the name and artist of the currently playing track. The JavaScript combined that information with other data to construct the URL of the MP3 track fetched by the player.

Spotify hosts its massive collection of music on Amazon's CloudFront network, but up until Wednesday the streaming biz apparently served them as vanilla unencrypted MP3 downloads for its in-browser player. Thus, Aldenhoven's code was able to take the URL of any track and download the file to his computer, it seems.

Spotify has since altered its systems to break Aldenhoven's exploit, by streaming the music in an encrypted or obfuscated format* using Adobe's RTMP technology. Amazon has more on how to securely stream media from its cloud-backed distribution network here.

Before the change, Aldenhoven packaged up the JavaScript as a Google Chrome extension called Downloadify, which downloaded the currently playing Spotify track to the user's computer, according to Dutch site Tweakers [English translation]. Google withdrew the extension from its Chrome web store on Tuesday.

"So Spotify made a great HTML5 player for its service, but they forgot their encryption. Nice!" Aldenhoven wrote in his code bundle on GitHub.

But the Rotterdam-based programmer is no freetard. On Twitter, he supported Spotify's obligation to copyright holders.

"Google responded correctly to remove [the extension], but Spotify should not send DRM-free MP3s to users," he tweeted. "Artist can choose to share their music DRM free, but we don't need to force them. Spotify gave them the option to share the music the way artist wanted it, they should not break their commitment."

"I could not believe it myself that [Spotify] did so little to protect their library," he added.

Bloggers branded this episode "Spotify's nightmare realised" - but that's a stretch.

You needed to be a paid-up subscriber to get access to the player, or sign up for free access, and in either case Spotify knows who you are. Technically, you could have infiltrated a subscriber's computer, and swiped the data from that compromised machine, then copied the files somewhere else. It's all risky and laborious, and there are far, far easier ways of filling your boots with free MP3s.

Spotify's "nightmare" would be music companies losing confidence in its business, and declining to renew their music licensing agreements.

The streaming biz offers a legal "download as an MP3" option in some territories, but it's always been very half-hearted about the feature, and the prices have never compared well with dedicated download stores. Which is not surprising, really. It would be like the local spliff merchant offering you lessons in hydroponics. Where's the upside for him in that? ®

* This is based on an initial study of the code and examination of the traffic between a Vulture Central Mac and the Spotify player website over port 1935. If Spotify gets back to us, we'll update this article - sub-editor

Boost IT visibility and business value

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Fast And Furious 6 cammer thrown in slammer for nearly three years
Man jailed for dodgy cinema recording of Hollywood movie
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Ballmer leaves Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy
Press conference: ME ME ME ME ME ME ME (cont'd pg 94)
Call of Duty daddy considers launching own movie studio
Activision Blizzard might like quality control of a CoD film
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?