Microsoft sues over source code theft

[Audionut]

Microsoft has filed a federal lawsuit against an alleged hacker who broke through its copy protection technology, charging that the mystery developer somehow gained access to its copyrighted source code.

For more than a month, the Redmond, Wash., company has been combating a program released online called FairUse4WM, which successfully stripped anticopying guards from songs downloaded through subscription media services such as Napster or Yahoo Music.

Full story here.
http://news.zdnet.com/2100-3513_22-6119892.html

[Mug Funky]

it'll be interesting to see what happens with the next WM update.

[DarkZell666]

Hehe we all know where that one comes from ... :)

But just how much stolen code do you bet MS is using ? x)
(L)GPL code for example. If that isn't hypocritical ... I'm snow-white in bikini :p

[cypher_soundz]

do you have any pics?

but on topic: How do they know who he is?

if i where to release such a program i would do it behind a anon proxy chain, with enough free sites to uplaod too as well, it seems like the perfect way to go about it in this unpredictable world.

Regards
cyph

[jggimi]

Cypher: read the article in the link. Search for the subtitle "using courts to track"

[Wilbert]

Do they know if he's from the US?

[Shinigami-Sama]

Do they know if he's from the US?

Do you think that that will really stop them?

they really just need to grow up and deal with it; they're acting like 4 year olds

[DarkZell666]

they're acting like 4 year olds
true indeed, you named it :D

I'm really intrigued by this "cat & mouse" game.
Something that can be cracked so easily should be rewritten completely don't you think ? This "we can fix it in no time" and "oh dammit he did it again" stuff is very wierd imho.

I can easily imagine something coming from MS being very bloated at the core (if they can sell a bloated OS to the masses they can easily sell bloated DRM software to a couple of online stores), so I'm not too surprised after all.

But it's just like if MS's DRM system depends on a passphrase and that the guy is simply cracking the new passphrase each time. This is just too quick of a "crack 'n patch" game for it to be something else ... any guesses at what's happening ?

[foxyshadis]

they're acting like 4 year olds
No, explorartory (and even "predatory") lawsuits are a staple of large corporations. Especially since the DCMA, lawsuits over circumvention often come even before a patch, it's the best legal recourse they have. (Regardless of how I feel about it.) So I don't know where the "4 year old" comment comes from.

Even if they have no real reason to suspect code theft, and I'm sure it must be one possibility, they need something that sounds a little better than "our DRM is too easily crackable" to sue with.

[Shinigami-Sama]

the comment was at how they act towards it. I know they/mostly do do these mostly useless lawsuits; but the fact that they should know better than to launch them on fairly shaky terms. Escpecialy when they themselves are more than likly to be guilty of the samething

[viodentia]

While I'm around, I'll give a little background.

Firstly, there is no such thing as untraceability. I erroneously believed that I could stay within untested areas of the law. The trajectory of this case has dire implications.

First, even if Microsoft doesn't find me, they will use this to claim copyright on fairuse4wm and use that to cease distribution. This solves the "problem" of mirrors in countries lacking anti-circumvention laws.

If Microsoft prevails in getting my identity, then they'll win regardless of whether I face them in court. I suspect that some providers could easily be coaxed into initiating civil actions, which will be time and resource intensive to fight.

Finally, source code was wholely unnecessary. Microsoft started with a poor design decision - they decided to use common library routines for encryption/decryption, and had to keep the key in a recognizeable format.

The library routine that implements ECC point multiplication was not designed for use in a "secure" component and indirectly called kernel32.HeapAlloc. (ECC is implemented by "multiplying" a point with "large" integer value which is the private key - The library routine took the private key as a parameter on the stack!!!) One simple DLL hook later, and the rest is Windows application development.

Microsoft's first change was to do the equivalent of inlining the exponentiation function - this changed the stack frame, but the number of bytes passed to HeapAlloc was the same.

Microsoft's second change was to use a modified version of the routine, changing the way it allocates memory and using some secondary encryption on the private key constant. However, this time I was bored with DLL hooking, and thanks to suggestions/ideas from c0redump I implemented something different.
(There are DLL hooking opportunities left in the code, should anyone else be so inclined).

[DarkZell666]

Lol, so if I understood rightly you didn't even need -and wouldn't have been able, anyway- to decipher the key 'cause they're giving it to anyone willing to read it on a silver plate ;)

So much for secure software huh ? :x