‘Deciphering’ YouTube’s Rolling Cypher in Your Browser is a Piece of Cake

[Anna Kushina (櫛名アンナ)]

The RIAA and other music groups recently accused youtube-dl and related stream-ripping tools of circumventing YouTube's 'rolling cipher' protection. While that may sound complex, anyone can download full audio and video files from YouTube, using nothing more than a web browser. It's surprisingly easy and we failed to spot any ciphers.

Downloading audio and video from YouTube is generally not allowed, as the video service clearly states in its terms of service.

Despite this restriction, there are numerous ‘stream-ripping’ tools available on the web that do just that.

These tools have legal uses but they are also a thorn in the side of music industry outfits, who see them as a major piracy threat. That was illustrated once again last week when an RIAA takedown notice wiped youtube-dl off GitHub.

The Rolling cipher

According to the RIAA, youtube-dl violates the DMCA’s anti-circumvention provisions because it bypasses YouTube’s ‘rolling cipher’ technical protection measure. That sounds rather complicated, but publicly little is known about how it works.

To find out more we reached out to YouTube, which didn’t respond to our inquiry. However, we did find out more about the ‘rolling cipher’ in a judgment from a German court in Hamburg. This 2017 verdict was explicitly mentioned in the RIAA’s takedown request to GitHub.

At the Hamburg court, copyright holders argued that YouTube’s ‘rolling cipher’ is an effective technological protection measure under EU law. It’s so complex that average users can’t decipher it.

“In the case of the video at issue, the user would have to filter out the 22 encoded URLs from a total of 72,338 characters, then find the ‘S variable’ of each URL, decipher it – using the respectively valid, because changing key – and then the newly generated URL use to get the video,” their argument was.

In the 2017 verdict, the court went along with this assessment ruling that encryption by the so-called “S variable” or “rolling cipher” is a technical measure within the meaning of Germany’s Copyright Act.

DIY Downloading From YouTube

At TorrentFreak, we have relatively little knowledge about encryption, so it would be impossible for us to bypass this ‘rolling cipher,’ one would think. However, after a few Google searches, we learned that pretty much every browser can do this by default.

Once you know the trick it takes only 20 seconds or so to download the audio or video from any YouTube clip, using only a browser and no dedicated ripping tools.

Our ‘deciphering’ quest started in Chrome but works in Firefox and other browsers as well. Because we don’t want any trouble, we used Dubioza Kolektiv’s Pirate Bay song as the test video. When that was loaded up, we opened Chrome’s devtools inspector, and navigated to the ‘network’ tab.

The devtools inspector shows you what requests are made by a page. When we filter for the keyword ‘audio’, several URLs appear, all pointing to chopped up audio streams from the YouTube video.

https://torrentfreak.com/images/devtools.jpg

Without any encryption knowledge, we opened one of these streams in a separate browser tab. As expected, this didn’t immediately bring up the full audio with the Pirate Bay song. That requires the extra step of removing the last part of the URL, which starts with “range=”.

When that’s done the audio clip shows up in full and it can be played just fine. In fact, Chrome even offers the option to download it.

https://torrentfreak.com/images/saveaudio.jpg

While we didn’t dare to go that far, we heard that it indeed saves just fine. And when the ‘weba’ extension is renamed to MP3, it will play offline too.

Downloading From YouTube is Easy

So there we have it. In just a few clicks and keystrokes we managed to bypass YouTube’s copyright protection using a browser. We didn’t see any rolling cipher in the process and anyone can do it.

That brings us back to the RIAA’s takedown request and the cited court verdict, which said that “an average user is not able to access the video info file, let alone decipher it.” Either we are geniuses or the court’s statement is wrong, at least for the present situation.

The above is the simple conclusion, but there’s more to it, which gets a bit technical.

But Where’s the Encryption?

After talking to several experts we learned that YouTube uses different ‘signatures’ for video URLs. Most have a fixed “sig” parameter, but there are also others that use an “s” parameter. In the latter cases, the player’s JavaScript is called with this “s” parameter which varies (or ‘rolls’).

That parameter shuffling is likely what rightsholders refer to with a ‘rolling cipher.’ However, this doesn’t involve any real encryption and youtube-dl doesn’t use it, as it simply executes the JavaScript code with a JavaScript interpreter, much like a browser does.

Over the past weeks, dozens of experts have chimed in about the legality or illegality of tools such as youtube-dl. We are not going to add to this, as these questions are ultimately up to a court to decide.

Stream-Rippers are Not Needed

What our little quest shows, however, is that there doesn’t appear to be any encryption to stop average users from downloading files in a browser. Anyone can download audio and video from YouTube without a dedicated stream-ripping tool.

That leads us to the final question, which we will leave unanswered. Or perhaps it answers itself. If youtube-dl is violating the DMCA because it allows people to download audio from YouTube, should browsers such as Chrome be outlawed as well?

Source: Torrentfreak.com