Skempi:the MP3'sPublished: 04-10-2013 | Author: Michel Greijmans
As I began explaining in the previous article, Skempi's platform tried to do their best when it comes to protecting the MP3's. Unfortinately getting them is still quite easy given you have the correct tools.
To be fair, the website is still in BETA, so there is still a chance that the "hole" I'm going to expose today is going to be patched. The hole isn't very big, they did their best protecting the files from hotlinking by utilizing sessions and random file URL's. Example of an error when using an expired/hotlinked file/URL:
<Error> <Code>AccessDenied</Code> <Message>Access Denied</Message> <RequestId>F40AB481228E12AE</RequestId> <HostId>X77xIMxspzfe2ujrk8pgla0vouSZ6pAF7CjY8+MchvdzFcaC23WABq6ffyFbn1nB</HostId> </Error>
The problem that I'm going to talk about in this article is that the site utilizes HTML5 to play MP3's. These MP3 files are downloaded to your browser's temporary cache, where it's stored for a limited time. Using debugging tools, or addon's like FlashGot you can retreive the MP3 file while it's (being) cached.
To be fair to the Skempi Crew:
I'm writing this article to further explain and demostrate the flaw in the website. The site's crew has been notified before the publication of this article of the problem.
the Security Flaw
I'm demonstrating the security flaw with the solely educational purpose. Attempting to try what is described below is done at own risk. Keep in mind that what I'm about to demonstrate direcly violates the site's Disclaimer:
In this demonstration I'm using the FireFox Web Browser, sorry Chrome fanboys, can't help ya today. The reason why we're using FireFox in this demonstration is because we're going to need the FlashGot plugin. Unfortinately this plugin doesn't exist for Google Chrome, and for as far as I know there is no simmilar plugin for Chrome.
Once you have FireFox installed with the FlashGot plugin we're ready to continue.
Downloading the MP3
Once you meet the above requirements downloadig the MP3 becomes an easy task. What you need to do now is login to Skempi, and play the desired song you want to download. While it's buffering/playing the FlashGot icon would appear in the Add-Ons bar in your FireFox window:
If you right-click on this icon you should get the following menu, showing a list of "captured" media on the page:
The desired MP3 file should be in the list, and by clicking it your browser will initiate the download. You should now find the file in your Downloads folder.
Technically the file isn't an MP3, but it's basically the same format. Most, if not all players should be able to play this file, if not you might need to rename it to an .mp3 file.
Technical Information about the file(s)
What I've noticed is that all files on Skempi have the correct media info (Title, Artist, Album, Album Art, Year and so on...) information included in the files, which is very neat! Most files on Skempi are of high quality (192-320kbps), some, older songs unfortunately are just 128kbps.
Below is a summary of the file used in this demonstration:
Complete name : zwaai_single_2012_tony_montana_music_5f355aa3d3469a465c804f2982000bec.mpga Format : MPEG Audio File size : 5.71 MiB Duration : 3mn 7s Overall bit rate mode : Constant Overall bit rate : 192 Kbps Album : Zwaai (Single) Album/Performer : Tony Montana Music Track name : Zwaai Track name/Position : 1 Grouping : MUS Performer : Tony Montana Music Publisher : Menasa Genre : House Recorded date : 2012 Cover : Yes Cover MIME : image/jpeg Audio Format : MPEG Audio Format version : Version 1 Format profile : Layer 3 Mode : Joint stereo Duration : 3mn 7s Bit rate mode : Constant Bit rate : 192 Kbps Channel(s) : 2 channels Sampling rate : 44.1 KHz Compression mode : Lossy Stream size : 4.29 MiB (75%)
To be continued...