Facebook's ContentID Clone Had A Vulnerability That Opened Up Ability For Users To Game Others' Videos

from the this-stuff-ain't-easy dept

Earlier this year, we noted that Facebook had launched its own ContentID clone, called Rights Manager, which was a response to a bunch of angry YouTubers who were annoyed at people "freebooting" popular YouTube videos onto Facebook. We noted that, like ContentID, we fully expected the system to be abused to take down content. While we haven't heard examples of that just yet, it does appear that Rights Manager had some serious vulnerabilities that enabled anyone else who was signed up for Rights Manager to manipulate the information and rules on any other video in the system (including, obviously, those claimed by other users).
Simply put, an imposter could easily wander into your anti-imposter pages without logging in first.

According to Muthiyah, pirates could actually have used Rights Manager to rip off their own copies of your reference copies, thus freebooting directly via the anti-freebooting interface
To its credit, Facebook fixed the problem and paid the researcher who found it a bug bounty of $4,000.

However, this does point out something rather important. Building these kinds of systems is really difficult. Beyond the problem of abuse that we frequently talk about, bugs and security flaws are a real risk as well. And yet, many in the film and recording industries still insist that it's "easy" to build a filtering system like this and that all sites should be legally required to do so. And, sure, Facebook and Google and the likes can afford to pay lots of money to build systems -- even buggy ones -- and then have bug bounties and such. But smaller companies aren't able to do so. Requiring them to do so basically wipes out the possibility of smaller startups entering the space and cedes the market, permanently, to the giant companies that everyone complains about.
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: contentid, copyright, filters, rights manager, security, videos
Companies: facebook

Reader Comments

Subscribe: RSS

View by: Time | Thread

  1. identicon
    gmail login, 26 Jul 2017 @ 12:57am

    very good

    This is partly what makes copyprotection enforcement difficult in general. It's opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what's still protected and what's not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Make this the First Word or Last Word. No thanks. (get credits or sign in to see balance)    
  • Remember name/email/url (set a cookie)

Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

Introducing the new Techdirt Insider Chat, now hosted on Discord. If you are an Insider with a membership that includes the chat feature and have not yet been invited to join us on Discord, please reach out here.

Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it

Email This

This feature is only available to registered users. Register or sign in to use it.