How “Dirty” MP3 Files Are A Back Door Into Cloud DRM

tech cruncy ^ | 04.06.10 | Michael Arrington

[Coleus]

All the big music sellers may have moved to non-DRM MP3 files long ago, but the watermarking of files with your personal information continues. Most users who buy music don’t know about the marking of files, or don’t care. Unless those files are uploaded to BitTorrent or other P2P networks, there isn’t much to worry about.

A list of which music services are selling clean MP3 files without embedded personal information, and which aren’t, is here. Apple, LaLa (owned by Apple) and Walmart embed personal information. Amazon, Napster and the rest have resisted label pressure to do so.

A music industry insider who’s asked to remain anonymous writes to us:

Hidden in purchased music files from popular stores such as Apple and Walmart is information to identify the buyer and/or the transaction. You won’t find it disclosed in their published terms of use. It’s nowhere in their support documentation. There’s no mention in the digital receipt. Consumers are largely oblivious to this, but it could have future ramifications as the music industry takes another stab at locking down music files.

Here’s how it works. During the buying process a username and transaction ID are known by the online retailers. Before making the song available for download their software embeds into the file either an account name or a transaction number or both. Once downloaded, the file has squirreled away this personal information in a manner where you can’t easily see it, but if someone knows where to look they can. This information doesn’t affect the audio fidelity, but it does permanently attach to the file data which can be used to trace back to the original purchaser which could be used at a later date.

Retailers aren’t talking, but there’s ample proof of what’s transpiring. Using simple file comparison tools it’s possible to verify this behavior by purchasing identical songs using different accounts and see if they match. I emailed support departments for several retailers asking if they would acknowledge these actions and inquiring about what specific information they are embedding. Only 7digital responded saying they don’t use any watermarks. What retailers won’t say publicly is that the major record labels are requiring this behavior as a precondition to sell their music.

Certain record labels have aspirations to use this hidden data to control future access to music in a return to DRM (digital rights management). The labels yearn to control where you can listen to your music and this could be a backdoor for them to achieve it. When personal libraries are stored in the cloud, it becomes possible to retrieve this personal data and match it to a user identity. If the match is successful the song plays, but if not, access can be blocked through a network DRM system such as the one Lala patented (which is now owned by Apple).

For the scheme to work record labels need all retailers to support this and so far some notable names are resisting. Napster, Amazon and UK based 7digital are selling clean MP3 files. Files purchased from these stores do not have any user information whatsoever embedded into them. Other retailers such as Apple and Walmart have succumbed to label pressure to embed personal info.

Retailers and record labels should have the right to sell dirty files if they wish, however they should be obligated to disclose their practices in advance. Consumers should have this information so they can make an informed buying decision about whether to support dirty or clean MP3 vendors. If Barnes and Noble printed your name on pages of books you purchase that would be important information to know because it would affect the value of your book. Here the clandestine actions are even more worrisome because it could lead to a future lockdown of purchases. If the labels have plans to require cloud vendors to use this information in the future, they should disclose that as well.

Cloud Music And The New DRM

Apple, Google and Amazon are all reportedly in discussions with big labels to provide a cloud music service. These services will allow users to purchase rights to stream music, and they will also allow syncing of songs on your hard drive already so you can play those without repurchasing them (this was the original LaLa model).

The labels, say our source, are demanding that a user can only stream music that is watermarked to their username. Change the username, or try to stream music that you’ve ripped from a CD, and those songs won’t play.

In other words, it’s DRM déjà vu all over again.

[Psycho_Bunny]

Smart move. No one's going to figure out how to strip a watermark.

lol

[MrEdd]

1. I never upload files to share sites, so this isn’t a problem.
2. There is sofware to scrub the files just as there is software to crack DRM and I assume that the Napster crowd generally is savvy enough to use it.
3. Seveny cents to a dollar a song is cheap enough that fewer people mess with torrents and such anyway.

[RobRoy]

>>I never upload files to share sites, so this isn’t a problem.<<

For me it’s even easier: I never buy music. It’s all limewire all the time. But, to be honest, it’s pretty much all stuff I download for purposes of learning for my band.

When I buy music it’s on Vinyl, usually at garage sales.

[Smogger]

For godsakes the author needs to download a hex editor. What the hell is that? Notepad? LOL

[Wooly]

Limewire is probably the biggest source of Malware, Spyware and virus infections in existence at this time.
About a month ago, I was asked to look at a Notebook computer that on the first day out of the box and without having time to do the back ups, the owners son installed limewire and went music searching.
To make a long story short, this was the first time in about 9 years that I saw the results of a BIOS level virus. Needless to say the Notebook was a total loss.

[Bloody Sam Roberts]

Limewire is probably the biggest source of Malware, Spyware and virus infections in existence at this time.

Indeed. I've banned it from my PCs.

I used www.mp3va.com for years. You can pre-load your account and get songs for an average of 15 cents per song. Entire albums are even cheaper. Quasi-illegal? Perhaps. But so far, RIAA and others have been unable to shut it down through the courts.

[RobRoy]

I’ve been using limewire for years with no ill effects. Don’t ask me why.

[Coleus]

lime wire, isn’t that full of viruses?

[Coleus]

There is sofware to scrub the files just as there is software to crack DRM and I assume that the Napster crowd generally is savvy enough to use it. >>>>

what programs do that?

[RobRoy]

>>lime wire, isn’t that full of viruses?<<

People keep saying that. I use a wireless router and no other firewall. I’ve used limewire almost since it’s inception (someone here recommended it back in the day). I have yet to get any virus or malware from it. Maybe it’s just the type of stuff I download. I dunno...

[ScreamingFist]

To make a long story short, this was the first time in about 9 years that I saw the results of a BIOS level virus. Needless to say the Notebook was a total loss.

A BIOS level virus would require a program to flash the ROM would it not? And a re-flash would cure the problem......