Facebook's ContentID Clone Had A Vulnerability That Opened Up Ability For Users To Game Others' Videos
from the this-stuff-ain't-easy dept
Earlier this year, we noted that Facebook had launched its own ContentID clone, called Rights Manager, which was a response to a bunch of angry YouTubers who were annoyed at people “freebooting” popular YouTube videos onto Facebook. We noted that, like ContentID, we fully expected the system to be abused to take down content. While we haven’t heard examples of that just yet, it does appear that Rights Manager had some serious vulnerabilities that enabled anyone else who was signed up for Rights Manager to manipulate the information and rules on any other video in the system (including, obviously, those claimed by other users).
Simply put, an imposter could easily wander into your anti-imposter pages without logging in first.
According to Muthiyah, pirates could actually have used Rights Manager to rip off their own copies of your reference copies, thus freebooting directly via the anti-freebooting interface
To its credit, Facebook fixed the problem and paid the researcher who found it a bug bounty of $4,000.
However, this does point out something rather important. Building these kinds of systems is really difficult. Beyond the problem of abuse that we frequently talk about, bugs and security flaws are a real risk as well. And yet, many in the film and recording industries still insist that it’s “easy” to build a filtering system like this and that all sites should be legally required to do so. And, sure, Facebook and Google and the likes can afford to pay lots of money to build systems — even buggy ones — and then have bug bounties and such. But smaller companies aren’t able to do so. Requiring them to do so basically wipes out the possibility of smaller startups entering the space and cedes the market, permanently, to the giant companies that everyone complains about.
Filed Under: contentid, copyright, filters, rights manager, security, videos
Companies: facebook
Comments on “Facebook's ContentID Clone Had A Vulnerability That Opened Up Ability For Users To Game Others' Videos”
Building any new complicated system difficult and expensive period. Any new complicated system is going to be plagued with bugs at first until they get fixed with time. The same thing happened with e-mail servers and whatnot.
OMG THE SYSTEM HAD A BUG!!!! HOLY SHIT AWESOME REPORTING!!!
Re: Re:
Anonymous64 just hates it when due process is enforced.
Have at it then
And yet, many in the film and recording industries still insist that it’s “easy” to build a filtering system like this and that all sites should be legally required to do so.
‘Easy’ in the same sense that it’s ‘easy’ to spot infringement I would guess, which is to say difficult to very difficult for the ones in the best position to know, and yet (somehow) impossibly simple for those lacking the required knowledge.
As for the assertion that making such a filtering system is ‘easy’, easy enough to call them on that particular lie: “Well in that case by all means demonstrate how cheap and easy it is to create an accurate filtering system capable of handling the kind of traffic our site deals with on a regular basis. If it’s really that easy shouldn’t take you much time or effort at all to create such a filtering system.”
Re: Have at it then
This is partly what makes copyprotection enforcement difficult in general. It’s opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what’s still protected and what’s not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.
Plus the penalty structure is very one sided. Unlike real property laws, where the burden lies on someone claiming to own property that’s not in their possession to prove they in fact own it before depriving them of its use, with IP laws it’s easy for someone to deprive someone else of content they don’t have protections to and have it removed from youtube or someplace else and then the burden lies on the person that originally uploaded it to prove that they do have IP privileges over that content under penalty of perjury to get it restored. They can face huge penalties if they are infringing and the service provider can face huge penalties for not removing it, penalties worse than grand theft when compared to real property laws. In the meantime if the person that issued a false takedown turns out to be wrong it’s just an accident, no big deal, and they are unlikely to receive any punishment or maybe a slap on the wrist if they’re unlucky. Imagine if I can claim your refrigerator and deprive you of using it and make you prove it belongs to you before allowing you to use it. Then, after all that, nothing happens to me for being wrong.
The whole system is messed up period. It’s what you get when corporate sociopaths write laws.
It’s Whatever’s inability to respond to this that made him leave, at least for now. He tries to compare IP laws to real property laws but when the above is brought up to him he has absolutely nothing to say. What can he say? Making IP laws more like real property laws would actually be a step towards making them more reasonable and proportionate.
very good
This is partly what makes copyprotection enforcement difficult in general. It’s opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what’s still protected and what’s not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.