Facebook's ContentID Clone Had A Vulnerability That Opened Up Ability For Users To Game Others' Videos

from the this-stuff-ain't-easy dept

Earlier this year, we noted that Facebook had launched its own ContentID clone, called Rights Manager, which was a response to a bunch of angry YouTubers who were annoyed at people "freebooting" popular YouTube videos onto Facebook. We noted that, like ContentID, we fully expected the system to be abused to take down content. While we haven't heard examples of that just yet, it does appear that Rights Manager had some serious vulnerabilities that enabled anyone else who was signed up for Rights Manager to manipulate the information and rules on any other video in the system (including, obviously, those claimed by other users).
Simply put, an imposter could easily wander into your anti-imposter pages without logging in first.

According to Muthiyah, pirates could actually have used Rights Manager to rip off their own copies of your reference copies, thus freebooting directly via the anti-freebooting interface
To its credit, Facebook fixed the problem and paid the researcher who found it a bug bounty of $4,000.

However, this does point out something rather important. Building these kinds of systems is really difficult. Beyond the problem of abuse that we frequently talk about, bugs and security flaws are a real risk as well. And yet, many in the film and recording industries still insist that it's "easy" to build a filtering system like this and that all sites should be legally required to do so. And, sure, Facebook and Google and the likes can afford to pay lots of money to build systems -- even buggy ones -- and then have bug bounties and such. But smaller companies aren't able to do so. Requiring them to do so basically wipes out the possibility of smaller startups entering the space and cedes the market, permanently, to the giant companies that everyone complains about.
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: contentid, copyright, filters, rights manager, security, videos
Companies: facebook

Reader Comments

Subscribe: RSS

View by: Time | Thread

  1. identicon
    Anonymous Coward, 12 Aug 2016 @ 6:32am

    Re: Have at it then

    This is partly what makes copyprotection enforcement difficult in general. It's opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what's still protected and what's not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.

    Plus the penalty structure is very one sided. Unlike real property laws, where the burden lies on someone claiming to own property that's not in their possession to prove they in fact own it before depriving them of its use, with IP laws it's easy for someone to deprive someone else of content they don't have protections to and have it removed from youtube or someplace else and then the burden lies on the person that originally uploaded it to prove that they do have IP privileges over that content under penalty of perjury to get it restored. They can face huge penalties if they are infringing and the service provider can face huge penalties for not removing it, penalties worse than grand theft when compared to real property laws. In the meantime if the person that issued a false takedown turns out to be wrong it's just an accident, no big deal, and they are unlikely to receive any punishment or maybe a slap on the wrist if they're unlucky. Imagine if I can claim your refrigerator and deprive you of using it and make you prove it belongs to you before allowing you to use it. Then, after all that, nothing happens to me for being wrong.

    The whole system is messed up period. It's what you get when corporate sociopaths write laws.

    It's Whatever's inability to respond to this that made him leave, at least for now. He tries to compare IP laws to real property laws but when the above is brought up to him he has absolutely nothing to say. What can he say? Making IP laws more like real property laws would actually be a step towards making them more reasonable and proportionate.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Make this the First Word or Last Word. No thanks. (get credits or sign in to see balance)    
  • Remember name/email/url (set a cookie)

Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

Introducing the new Techdirt Insider Chat, now hosted on Discord. If you are an Insider with a membership that includes the chat feature and have not yet been invited to join us on Discord, please reach out here.

Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it

Email This

This feature is only available to registered users. Register or sign in to use it.