A PHP Error was encountered

Severity: Notice

Message: Only variable references should be returned by reference

Filename: core/Common.php

Line Number: 257

Skempi: Downloading the MP3's | Michel Greijmans

Skempi: the MP3's

Published: 04-10-2013 | Author: Michel Greijmans

As I began explaining in the previous article, Skempi's platform tried to do their best when it comes to protecting the MP3's. Unfortinately getting them is still quite easy given you have the correct tools.

To be fair, the website is still in BETA, so there is still a chance that the "hole" I'm going to expose today is going to be patched. The hole isn't very big, they did their best protecting the files from hotlinking by utilizing sessions and random file URL's. Example of an error when using an expired/hotlinked file/URL:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>F40AB481228E12AE</RequestId>
<HostId>X77xIMxspzfe2ujrk8pgla0vouSZ6pAF7CjY8+MchvdzFcaC23WABq6ffyFbn1nB</HostId>
</Error>

Explaining the

The problem that I'm going to talk about in this article is that the site utilizes HTML5 to play MP3's. These MP3 files are downloaded to your browser's temporary cache, where it's stored for a limited time. Using debugging tools, or addon's like FlashGot you can retreive the MP3 file while it's (being) cached.

To be fair to the Skempi Crew:

I'm writing this article to further explain and demostrate the flaw in the website. The site's crew has been notified before the publication of this article of the problem.

the Security Flaw

I'm demonstrating the security flaw with the solely educational purpose. Attempting to try what is described below is done at own risk. Keep in mind that what I'm about to demonstrate direcly violates the site's Disclaimer:

Requirements

In this demonstration I'm using the FireFox Web Browser, sorry Chrome fanboys, can't help ya today. The reason why we're using FireFox in this demonstration is because we're going to need the FlashGot plugin. Unfortinately this plugin doesn't exist for Google Chrome, and for as far as I know there is no simmilar plugin for Chrome.
Once you have FireFox installed with the FlashGot plugin we're ready to continue.

Downloading the MP3

Once you meet the above requirements downloadig the MP3 becomes an easy task. What you need to do now is login to Skempi, and play the desired song you want to download. While it's buffering/playing the FlashGot icon would appear in the Add-Ons bar in your FireFox window:

If you right-click on this icon you should get the following menu, showing a list of "captured" media on the page:
The desired MP3 file should be in the list, and by clicking it your browser will initiate the download. You should now find the file in your Downloads folder.
Technically the file isn't an MP3, but it's basically the same format. Most, if not all players should be able to play this file, if not you might need to rename it to an .mp3 file.

Technical Information about the file(s)

What I've noticed is that all files on Skempi have the correct media info (Title, Artist, Album, Album Art, Year and so on...) information included in the files, which is very neat! Most files on Skempi are of high quality (192-320kbps), some, older songs unfortunately are just 128kbps.
Below is a summary of the file used in this demonstration:

Complete name                            : zwaai_single_2012_tony_montana_music_5f355aa3d3469a465c804f2982000bec.mpga
Format                                   : MPEG Audio
File size                                : 5.71 MiB
Duration                                 : 3mn 7s
Overall bit rate mode                    : Constant
Overall bit rate                         : 192 Kbps
Album                                    : Zwaai (Single)
Album/Performer                          : Tony Montana Music
Track name                               : Zwaai
Track name/Position                      : 1
Grouping                                 : MUS
Performer                                : Tony Montana Music
Publisher                                : Menasa
Genre                                    : House
Recorded date                            : 2012
Cover                                    : Yes
Cover MIME                               : image/jpeg

Audio
Format                                   : MPEG Audio
Format version                           : Version 1
Format profile                           : Layer 3
Mode                                     : Joint stereo
Duration                                 : 3mn 7s
Bit rate mode                            : Constant
Bit rate                                 : 192 Kbps
Channel(s)                               : 2 channels
Sampling rate                            : 44.1 KHz
Compression mode                         : Lossy
Stream size                              : 4.29 MiB (75%)

this problem

To be continued...