Spotify spews 'unencrypted' FREE MP3s all over creation

Chrome tool could ransack music vault, says coder


Spotify has tweaked the music player on its website after someone apparently found a way to harvest every single MP3 file from the audio-streaming service.

The media biz's playback site, which launched in November, did not encrypt data streamed to the listener's web browser, it is claimed. One enterprising programmer said he discovered the security shortcoming and exploited it using some JavaScript.

Judging by Robin Aldenhoven's code, the script read the page title of Spotify's in-browser player, which contains the name and artist of the currently playing track. The JavaScript combined that information with other data to construct the URL of the MP3 track fetched by the player.

Spotify hosts its massive collection of music on Amazon's CloudFront network, but up until Wednesday the streaming biz apparently served them as vanilla unencrypted MP3 downloads for its in-browser player. Thus, Aldenhoven's code was able to take the URL of any track and download the file to his computer, it seems.

Spotify has since altered its systems to break Aldenhoven's exploit, by streaming the music in an encrypted or obfuscated format* using Adobe's RTMP technology. Amazon has more on how to securely stream media from its cloud-backed distribution network here.

Before the change, Aldenhoven packaged up the JavaScript as a Google Chrome extension called Downloadify, which downloaded the currently playing Spotify track to the user's computer, according to Dutch site Tweakers [English translation]. Google withdrew the extension from its Chrome web store on Tuesday.

"So Spotify made a great HTML5 player for its service, but they forgot their encryption. Nice!" Aldenhoven wrote in his code bundle on GitHub.

But the Rotterdam-based programmer is no freetard. On Twitter, he supported Spotify's obligation to copyright holders.

"Google responded correctly to remove [the extension], but Spotify should not send DRM-free MP3s to users," he tweeted. "Artist can choose to share their music DRM free, but we don't need to force them. Spotify gave them the option to share the music the way artist wanted it, they should not break their commitment."

"I could not believe it myself that [Spotify] did so little to protect their library," he added.

Bloggers branded this episode "Spotify's nightmare realised" - but that's a stretch.

You needed to be a paid-up subscriber to get access to the player, or sign up for free access, and in either case Spotify knows who you are. Technically, you could have infiltrated a subscriber's computer, and swiped the data from that compromised machine, then copied the files somewhere else. It's all risky and laborious, and there are far, far easier ways of filling your boots with free MP3s.

Spotify's "nightmare" would be music companies losing confidence in its business, and declining to renew their music licensing agreements.

The streaming biz offers a legal "download as an MP3" option in some territories, but it's always been very half-hearted about the feature, and the prices have never compared well with dedicated download stores. Which is not surprising, really. It would be like the local spliff merchant offering you lessons in hydroponics. Where's the upside for him in that? ®

* This is based on an initial study of the code and examination of the traffic between a Vulture Central Mac and the Spotify player website over port 1935. If Spotify gets back to us, we'll update this article - sub-editor


Other stories you might like

  • Google has more reasons why it doesn't like antitrust law that affects Google
    It'll ruin Gmail, claims web ads giant

    Google has a fresh list of reasons why it opposes tech antitrust legislation making its way through Congress but, like others who've expressed discontent, the ad giant's complaints leave out mention of portions of the proposed law that address said gripes.

    The law bill in question is S.2992, the Senate version of the American Innovation and Choice Online Act (AICOA), which is closer than ever to getting votes in the House and Senate, which could see it advanced to President Biden's desk.

    AICOA prohibits tech companies above a certain size from favoring their own products and services over their competitors. It applies to businesses considered "critical trading partners," meaning the company controls access to a platform through which business users reach their customers. Google, Apple, Amazon, and Meta in one way or another seemingly fall under the scope of this US legislation. 

    Continue reading
  • Amazon fears it could run out of US warehouse workers by 2024
    Internal research says the hiring pool has already dried up in a number of locations stateside

    Jeff Bezos once believed that Amazon's low-skill worker churn was a good thing as a long-term workforce would mean a "march to mediocrity." He may have to eat his words if an internal memo is accurate.

    First reported by Recode, the company's 2021 research rather bluntly says: "If we continue business as usual, Amazon will deplete the available labor supply in the US network by 2024."

    Some locations will be hit much earlier, with the Phoenix metro area in Arizona expected to exhaust its available labor pool by the end of 2021. The Inland Empire region of California could reach breaking point by the close of this year, according to the research.

    Continue reading
  • I was fired for blowing the whistle on cult's status in Google unit, says contractor
    The internet giant, a doomsday religious sect, and a lawsuit in Silicon Valley

    A former Google video producer has sued the internet giant alleging he was unfairly fired for blowing the whistle on a religious sect that had all but taken over his business unit. 

    The lawsuit demands a jury trial and financial restitution for "religious discrimination, wrongful termination, retaliation and related causes of action." It alleges Peter Lubbers, director of the Google Developer Studio (GDS) film group in which 34-year-old plaintiff Kevin Lloyd worked, is not only a member of The Fellowship of Friends, the exec was influential in growing the studio into a team that, in essence, funneled money back to the fellowship.

    In his complaint [PDF], filed in a California Superior Court in Silicon Valley, Lloyd lays down a case that he was fired for expressing concerns over the fellowship's influence at Google, specifically in the GDS. When these concerns were reported to a manager, Lloyd was told to drop the issue or risk losing his job, it is claimed. 

    Continue reading
  • Amazon shows off robot warehouse workers that won't complain, quit, unionize...
    Mega-corp insists it's all about 'people and technology working safely and harmoniously together'

    Amazon unveiled its first "fully autonomous mobile robot" and other machines designed to operate alongside human workers at its warehouses.

    In 2012 the e-commerce giant acquired Kiva Systems, a robotics startup, for $775 million. Now, following on from that, Amazon has revealed multiple prototypes powered by AI and computer-vision algorithms, ranging from robotic grippers to moving storage systems, that it has developed over the past decade. The mega-corporation hopes to put them to use in warehouses one day, ostensibly to help staff lift, carry, and scan items more efficiently. 

    Its "autonomous mobile robot" is a disk-shaped device on wheels, and resembles a Roomba. Instead of hoovering crumbs, the machine, named Proteus, carefully slots itself underneath a cart full of packages and pushes it along the factory floor. Amazon said Proteus was designed to work directly with and alongside humans and doesn't have to be constrained to specific locations caged off for safety reasons. 

    Continue reading
  • Google recasts Anthos with hitch to AWS Outposts
    If at first you don't succeed, change names and try again

    Google Cloud's Anthos on-prem platform is getting a new home under the search giant’s recently announced Google Distributed Cloud (GDC) portfolio, where it will live on as a software-based competitor to AWS Outposts and Microsoft Azure Stack.

    Introduced last fall, GDC enables customers to deploy managed servers and software in private datacenters and at communication service provider or on the edge.

    Its latest update sees Google reposition Anthos on-prem, introduced back in 2020, as the bring-your-own-server edition of GDC. Using the service, customers can extend Google Cloud-style management and services to applications running on-prem.

    Continue reading
  • UK competition watchdog seeks to make mobile browsers, cloud gaming and payments more competitive
    Investigation could help end WebKit monoculture on iOS devices

    The United Kingdom's Competition and Markets Authority (CMA) on Friday said it intends to launch an investigation of Apple's and Google's market power with respect to mobile browsers and cloud gaming, and to take enforcement action against Google for its app store payment practices.

    "When it comes to how people use mobile phones, Apple and Google hold all the cards," said Andrea Coscelli, Chief Executive of the CMA, in a statement. "As good as many of their services and products are, their strong grip on mobile ecosystems allows them to shut out competitors, holding back the British tech sector and limiting choice."

    The decision to open a formal investigation follows the CMA's year-long study of the mobile ecosystem. The competition watchdog's findings have been published in a report that concludes Apple and Google have a duopoly that limits competition.

    Continue reading
  • Big Tech loves talking up privacy – while trying to kill privacy legislation
    Study claims Amazon, Apple, Google, Meta, Microsoft work to derail data rules

    Amazon, Apple, Google, Meta, and Microsoft often support privacy in public statements, but behind the scenes they've been working through some common organizations to weaken or kill privacy legislation in US states.

    That's according to a report this week from news non-profit The Markup, which said the corporations hire lobbyists from the same few groups and law firms to defang or drown state privacy bills.

    The report examined 31 states when state legislatures were considering privacy legislation and identified 445 lobbyists and lobbying firms working on behalf of Amazon, Apple, Google, Meta, and Microsoft, along with industry groups like TechNet and the State Privacy and Security Coalition.

    Continue reading

Biting the hand that feeds IT © 1998–2022