How did they do that?

MySpace Media Service XML Access

[inveni0]

I'm trying to prevent the download of MP3 files from my website, which streams (progressively downloads) them from within a Flash file.

I tested the methods used by several different websites by activating my FireBug console within Firefox and watching the individual items pop up as they load (FireBug makes it easy to see ALL files that appear on the page). It appears they use some kind of Token System. An example:

<profile>
<timestamp>1188921555</timestamp>
<name>EzraJane</name>
<playstoday>33</playstoday>
<downloadedtoday>0</downloadedtoday>
<totalplays>12502</totalplays>
<autoplay>0</autoplay>
<allowadd>1</allowadd>
&#8722;
<playlist>
<song bsid="33126782" title="This Road" songid="0" plays="3136" comments="" rate="" downloadable="" imagename="http://b7.ac-images.myspacecdn.com/02035/74/64/2035744647_m.jpg" imagedesc="<br>" filename="Jvk0EhrEUkMhlMq0/l9aRfJJNXQJGAp1YzHBYsLdfJogBGVVAV8cmFxtDG+aavhP2HpLWWBPbmynBalPEI=" url="http://media.myspace.com/services/media/mediahitcounter.ashx?i=MIGdBgorBgEEAYI3WAOLoIGOMIGLBgo" lyrics="" purl="" durl="http://cache07-music01.myspacecdn.com/51/std_617abc3a4cfff4fe41cda6f689701bad.mp3" token="A3558xvjVHt6ARr6TY2c/ZsoTnGAd2WoVMYhdmzdWflJryiHzI9yuYZbYciQJqWltJ3o=" curl="http://cache07-music01.myspacecdn.com/51/std_617abc3a4cfff4fe41cda6f689701bad.mp3? bandid=82180519&songid=33126782&p=OTEvN="/>
<song bsid="33140286" title="Redemption" songid="0" plays="4838" comments="" rate="" downloadable="" imagename="http://b4.ac-images.myspacecdn.com/02035/43/44/2035744434_m.jpg" imagedesc="<br>" filename="gl+DTFJqO9LSYRKTZGUGSrRw3peqBkf8TJxsMysf/bz57w5HiKTrR0qFzevRogYjdY0geDcRrRExd74rJ0oUGDY=" url="http://media.myspace.com/services/media/mediahitcounter.ashx? i=MIGdBgorBOLoIGOMIGLBgorBgEE" lyrics="" purl="" durl="http://cache04-music01.myspacecdn.com/29/std_341500f73d2faa604f11ae44d4cf11ce.mp3" token="ESo1szP4xqPFl4BiurasCVBxghaqrFqwaULFuZ2bdENek/N34wXWVdJdHeL86oshlhacSyipBIXqfwHGss=" curl="http://cache04-music01.myspacecdn.com/29/std_341500f73d2faa604f11ae44d4cf11ce.mp3? bandid=82180519&songid=33140286&p=OTEvNTAvO1="/>
<song bsid="71707148" title="Come On Rain" songid="0" plays="918" comments="" rate="" downloadable="" imagename="http://b9.ac-images.myspacecdn.com/02048/99/79/2048339799_m.jpg" imagedesc="<br>" filename="MyyrvLqUu6mxO7I0T56+6e7Rp4lznGHYlVI71gNCnCOxCcO0KTZwKiWvn5ByqQXKtyqMJeYex6cX9As7jlUJOBiQ=" url="http://media.myspace.com/services/media/mediahitcounter.ashx? i=MIGdBgorBgEEAYI3WAOLoIGOMIGLBgorBg" lyrics="" purl="" durl="http://cache10-music02.myspacecdn.com/79/std_fef6ea666cabb3901fa216a25edb5a2e.mp3" token="aCYzguyrZPfjHCaoKsNpYnzRY5xRWjTLbBvPSOpeFucRr5hYqKz8TPCExXCxoRsgRUEIpEB8gPpgMgUe8u/4+Oj+/poRRNTHiQujiHhDEKo=" curl="http://cache10-music02.myspacecdn.com/79/std_fef6ea666cabb3901fa216a25edb5a2e.mp3? bandid=82180519&songid=71707148&p=OTEvNTA="/>
<song bsid="74074425" title="Spinnin Lights" songid="0" plays="662" comments="" rate="" downloadable="http://cache10-music02.myspacecdn.com/75/full_853c8b4fe268eb82d55553d70ba237c4.mp3" imagename="http://b8.ac-images.myspacecdn.com/02051/80/77/2051127708_m.jpg" imagedesc="<br>" filename="+PkdxIBVvvnkkwfL048qP4bBdaxXY6/ 3QeAJnnmkcOk1eR7OIoqodmgLoStRyLUYwu5ihgn//Dx5ZR/y3Vcl0zPYwAiF7kUedNkNxVIlrus=" url="http://media.myspace.com/services/media/mediahitcounter.ashx? i=MIGdBgorBgEEAYI3WAOLoIGOMIGLBgorBgEEAYI3WAMBoH0wewIDAgABAgJmAwICAMAECK5JfGA87AYsBBCAt1pfDGo%2bH9clipmBGerB" lyrics="" purl="http://myspacem-519.vo.llnwd.net/91/50/82180519/82180519_6e45131b.mp3?e=1189007955& h=5b84ffdbcecd7def7d36d3807cf1a344" durl="http://cache10-music02.myspacecdn.com/75/std_853c8b4fe268eb82d55553d70ba237c4.mp3" token="8fs7g55d4qI4+v9RvCc/YX/GNjJHmAi5sC9FRpM92Oi3hmSBQs4Kn+ADsNUXxDFPFV+pDTtgIttmhybjiL7nE=" curl="http://content.music.myspace.com/music.ashx?bandid=82180519&songid=74074425& p=OTEvNTAvODIxODA1MTkvODIxODA1MTlfNmU0NTEzMWI="/>
</playlist>
</profile>

What exactly are they doing to provide instance based access to these files? I need to duplicate it, if possible.

Thanks!

[edited by: jatar_k at 7:15 pm (utc) on Sep. 6, 2007]
[edit reason] removed part of tokens to fix sidescroll [/edit]

[vincevincevince]

1) Never give out the stream URL
2) Never give out the stream URL
3) When you generate a page with the flash movie in it, add a random ID and the real URL into a database table - put the random ID into the movie player instead of the real URL
4) When the request for the random ID comes through (getmovie.php?id=23423423), look up in the database - delete row - and redirect to the real URL or pipe the real URL's data
5) Every half an hour, delete all URLs in the database which have been there more than half an hour.

[inveni0]

Thanks for the reply. I solved the issue using the following method to prevent direct downloading of MP3 files streamed via Flash:

1) A flash file uses loadVariablesNum to load an external PHP file.
2) The PHP file copies a predetermined MP3 file (its true URL stored within the PHP script) to a random file name. The random file name is then printed for the Flash file to read.
3) Once the PHP script has loaded, the Flash movie loads the MP3 file.
4) Immediately, the Flash file then calls another PHP script that deletes the copied MP3 file.

Somehow, Flash continues to load the MP3 file, even though it's been deleted (I'm sure it does this because it has been moved to the server's temp directory.) Now, I just need some type of security to prevent the first PHP script from being run manually.

[inveni0]

It looks like the only way to make this as hack proof as possible is to have flash post a variable to the PHP script. This allows the script to validate that the MP3 is being called by the flash file. If the PHP script doesn't see this variable, then it will not process the MP3s. This, in conjunction with cache disabling, helps to prevent any loading of a valid link.

Can anyone see any obvious holes in this? To date (besides running a streaming media server) this is the best method of content protection I've seen.

[inveni0]

Okay, here's a bug:

The mp3 file can not be downloaded UNLESS the user allows the full song to load and then pastes the URL into his/her browser as a direct link. Pasting before the song has loaded gives a 404 Error. Does anyone know of a way to keep an MP3 from fully loading?

[inveni0]

Problem solved.