Feeds

Aussie bloke hacks way to top of music charts with MIDI-based tunes

Oi, actual musos, you're doing it all wrong – security expert

Combat fraud and increase customer satisfaction

A security engineer has successfully hacked his way to the top of the music charts in Australia with songs whose quality can only be enjoyed while on Class A drugs, apparently.

Peter Fillmore told SC Magazine that his fake artist account had gobbled up nearly one million hits before it was taken offline.

The Melbourne-based payments security expert said he wanted to test the robustness of music-streaming services such as Spotify and Pandora by seeing if they had fraud detection systems in place.

But, perhaps surprisingly, he was able to hack his way into the online music charts with relative ease. He inserted tunes such as I've only known you for five minutes and I want you dead, too and Right now, I'm very hungry! without a hitch.

Fillmore told the mag that he had managed to scoop up hundreds of thousands of plays for his pisspoor tunes in the space of just a month. It meant that, for a short time, the programmer's songs had surpassed the likes of artists such as P!nk, Nicki Minaj and Australian electronica star Flume.

Fillmore also made some cash from the experiment – roughly $1,000 in royalties – after shelling out just $30 to set the whole thing up.

Best of all, Fillmore said he had never played an instrument in his life before.

He told the magazine that he had bought three Amazon-linked compute instances — virtual servers that run applications — and created a bash script to simulate three listeners playing his songs 24 hours a day over the course of one month.

His first efforts - assembled from heaps of old MIDI files, were spotted several times by moderators at Spotify after he was shopped by the users. But then he decided to group some new tracks – sourced from public domain works using the computational power of Wolfram to generate the composition – into an album, and his success rate started to rise. All of his "hit songs" were released under the pretend moniker of John Matrix.

How was he able to crack the vault on online streaming music services without quickly arousing suspicion about fraudulent plays, you might wonder?

Fillmore told the mag that he believed that many of the services lacked automated analysis. Instead, as with so many Web2.0 properties out there, the systems rely heavily on users to report music that they suspect to be fake tunes.

A suspension notice then tells account-holders that they have breached the terms of service, thereby leaving another gaping hole for hackers to exploit, Fillmore argued.

The engineer, who carried out his test for Ruxcon, said that - after receiving suspension notices - he was unable to get responses to requests for more information about his account being frozen.

He reckoned that the lack of intervention opened up the system to abuse by potentially allowing artists to unleash DDoS attacks on rival musicians on the streaming services, which could then redirect clicks from cloud computing instances controlled by the hackers straight to a competitor's tracks on the network.

Another key thing Fillmore noted from his research was that gaming the system did not require "artists" to have any musical ability whatsoever.

"As it turns out, you're doing it wrong if you want to make money in music by being a musician," he told the SC.

It mattered even less that reviews of his music - which included an album named Kim Jong Christmas - were unfavourable, Fillmore said.

One reviewer, who was suspicious of the tunes, apparently said: "There's [sic] ain't no party like a Korean Worker's Party. But seriously, what the hell is this doing on high rotation?" While another simply suggested that Fillmore's music might be improved while "on cocaine". ®

3 Big data security analytics techniques

More from The Register

next story
OpenBSD founder wants to bin buggy OpenSSL library, launches fork
One Heartbleed vuln was too many for Theo de Raadt
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Got Windows 8.1 Update yet? Get ready for YET ANOTHER ONE – rumor
Leaker claims big release due this fall as Microsoft herds us into the CLOUD
Patch iOS, OS X now: PDFs, JPEGs, URLs, web pages can pwn your kit
Plus: iThings and desktops at risk of NEW SSL attack flaw
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Apple inaugurates free OS X beta program for world+dog
Prerelease software now open to anyone, not just developers – as long as you keep quiet
prev story

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.