Evaluating New Copy-Prevention Techniques for Audio CDs

J. Alex Halderman

Princeton UniversityDepartment of Computer Science

2

Copy-Resistant CDs - Overview

• Modified discs– Play on CD players, hard to read on PCs

• Response to “consumer piracy”• Deliberate errors

– Audio data / metadata• Variations from several vendors• Few discs today; many coming soon

– BMG, EMI, etc.

3

Notable Drawbacks

• Primarily affects legitimate CD owners• Confusing hardware/software errors• Violates standards, bad engineering practice• Effectiveness for reducing unlawful

copying hasn’t been demonstrated

4

Interesting Questions for C.S.

1. Are they effective?2. How do they work?3. Can they be defeated?

Who wants to know?Record companies, musicians, policy makers, software authors, music buyers, researchers

5

Music City, 2001

MediaCloQ(SunnComm)

Tested Three Discs

Columbia/Sony, 2002

key2audio (Sony)

Universal, 2001

Cactus Data Shield (Midbar)

6

Not Addressed

Why would anyone want to copy these discs?

7

Question 1

Are these techniques effective?

8

Test Configurations

Covered range of deployed systems• Operating System

– Windows, Linux• Hardware

– Toshiba, Hitachi, IBM, Plextor drives• Software

– CD Player, MusicMatch, Nero, CloneCD (Windows)– CDP, CD Paranoia, CDR-DAO (Linux)

9

Test ResultsOS Drive Software Result

Win 98 Toshiba * 0/9

Win 2000

HitachiIBMSony

CD PlayerMusicMatchNero

0/90/90/9

CloneCD 6/9

Plextor CD PlayerMusicMatchNero

0/30/30/3

CloneCD 3/3

Linux Hitachi CDPCDR-DAO

0/30/3

CD Paranoia 1/3

Plextor CDPCDR-DAO

0/30/3

CD Paranoia 3/3

• Variety of errors– disc not detected

invalid datacrashes

– Toshiba drive broken until reboot

• Most tests failed (62/75)• Some successful

– CD Paranoia, CloneCD(Plextor hardware)

10

Implications

• Seemingly effective today against deployed hardware, typical applications

• Some configurations already can play– Greater compatibility is possible

• Different modes of failure– Schemes use slightly different measures

(more detail later)

11

Question 2

How do these techniques work?

12

How Do These Schemes Work?

• Exploit bugs, lack of robustness in hardware and software– Unexpected deviations from standards

• Two levels of failure– Hardware: Drives reject the discs (firmware)– Software: Apps fail even on “working” drives

13

Normal CD Structure

• Discs divided into tracks• Tracks listed in table of contents (TOC)• May be grouped into sessions• Drives read TOC from each session,

return list of tracks• CD players only see session 1

• Observed two main categories of deviations

TOCTrack 1Track 2

…

TOCTrackTrack

…

Session 1

Session 2

…

CD

pla

yers

CD

driv

es

14

Fake TOC Entries - Software• Invalid TOC entries in

session 2– Bad track locations– Audio marked as data

• Drive returns invalid listing, fools software

• CD players only read first session, unaffected

Real TOCTrack 1Track 2

…

Fake TOC

Session 1

Session 2

CD

pla

yers

CD

driv

es

Data Track

15

Fake Session Pointers - Hardware• Session 2 contains pointer to fake

session near outer edge of disk– Incomplete TOC, no lead out– Fatal errors in some hardware

(e.g. Toshiba)

• Possible variations– No pointers to earlier sessions– Physical incompatibilities making

earlier session hard to reach

Real TOCTrack 1Track 2

…

Fake TOC

Session 1

Session 2

CD

pla

yers

CD

driv

es

Fake Session

16

Question 3

Can these techniques be defeated?

17

Felt-Tipped Pen Hack

• Hides last TOC containing invalid track/ session entries

• Drives see only first TOC, so disc can be read normally

Outlaw felt-tipped pens!

Last TOC area obscured by marker

(Appeared on Chip.de early May 2002)

18

How to Adapt Hardware

• Direct fix — “compatibility mode” – Emulates CD player– Not even necessary

• Indirect fix — greater robustness– Fix bugs (firmware)– Better error reporting– More robust failure modes– Error interpolation

19

How to Adapt Software

• Bug fixes, greater robustness– Ignore obvious errors (warnings, not failure)– Scan for track starts by binary search– Interpolate over missing samples

• Changes ensure maximum compatibility with all faulty discs, not just copy-protected

20

Change is Underway

• Software– Audiograbber, CloneCD, and EAC have modes

for handling protected discs• Hardware

– Plextor, others work today

21

Can They Be Defeated?

• Yes!– Offer minimal protection today, but will be

easily adapted to (already happening)– Rate of adaptation proportional to rate of

deployment – Schemes ineffective against copying in the near

future (by the time they are widespread)

22

Conclusions

• Partial incompatibility with spec. won’t work – Software too easy to adapt and distribute

• Takes advantage of HW/SW flaws– Prohibiting circumvention would be to mandate bugs!

• Relies on stopping reading in most cases – but can be copied online if just some can read– True for tested discs– Circumvention easy, can’t be stopped everywhere

23

Conclusions

• In present form, these schemes are worse than useless– “Bad hacks”– Won’t prevent illegal copying– Inconveniences legitimate music owners– May make people less willing to buy CDs– Further alienates public from music industry

• Industry must find an alternative– DRM? New business model?