Neowin.net

Our good buddy Patrick Norton (of TechTV's "The Screen Savers" fame) has discovered that it's possible to rip mp3's of Universal's music CD's, protected by the Cactus Data Shield system, using a DVD drive! (Just spotted the story in my mid morning browse of SlashDot).

With a purchased copy of the "More Music" CD, I discovered that it is possible to copy the disc and burn MP3s from it using software freely available for download online.

With the copy protection working, a Windows PC shows the files and automatically runs the CactusPJ audio player that comes with the CD. (The CactusPJ player features difficult-to-see buttons and needs a second window to show track info. It also shows up as possible spyware on Ad-aware 5.6.) In theory, it's the only way to play audio from a CDS-protected disc on a Windows machine. Without significant effort, you can't play this disc with any other player, nor can you rip it to MP3 audio -- in theory.

However, a number of computer systems with DVD drives don't "see" the copy-protected version of the disc. The systems that didn't see the copy-protected files -- files we understand are installed by Midbar Tech's Cactus Data Shield -- just showed a normal audio CD.

On the computers where the copy protection didn't work, you can see all 14 CDA tracks on "More Fast and Furious." While Track 1 wouldn't play (using WinAMP, WMP, MusicMatch, and so on), the rest of the tracks play normally. More importantly, all the tracks were rippable to MP3 format.

It turns out that the DVD drives in the systems we tested SEE straight through Midbar Tech's copy protection. The drives don't see the files CDS installs on the audio CD, nor are they confused by the table of contents tweaking done by the CDS.

We tested the DVD drive, an NEC DV-5700A, on a number of different Windows 98 and XP systems. None of the machines had any trouble seeing or ripping all the tracks, or playing tracks 2 through 14. NEC doesn't normally sell retail, but it supplies DVD drives to Dell. In fact, all of the Dell systems we tested saw through the copy protection.

This is copy protection? Here's a better question: Are all Dell owners with DVD drives who buy CDS copy-protected discs in violation of the Digital Millennium Copyright Act? Perhaps, if they purchase the NEC DVD drive just for the purpose of circumventing the copy protection.

News source: The Screen Savers

Secure packets

Of late, wireless, or Wifi, networks have become very popular because they are cheap and easy to set up, and remove the need for lots of unsightly, expensive cables.

However, the method Wifi networks use to scramble data, known as Wireless Equivalent Privacy (Wep), has been comprehensively defeated by both security professionals and hackers.

The vulnerabilities have led some hacker groups to engage in "war-driving" expeditions which map wireless networks and show which ones are open to attack.

To improve Wep, RSA has developed "Fast Packet Keying" which gives each packet of data its own encryption key. Anyone gathering data from such a network would have a much harder job breaking into the packets of information.

RSA pointed out that the fault with Wep did not lie with the RSA-authored RC4 algorithm it used to encrypt data.

Instead, it lay with the way that the computers were sharing a wireless network and the hub shuffling data around all of them.

Wep provided too little protection for the way that hubs and the connected computers decided on how to encrypt data packets travelling through the air.

Security experts found that by capturing packets they could gradually work out the encryption key being used to scramble the data passing across the network.

With enough information, a determined malicious hacker could find the key to descramble all the data passing across a network.

Protection problems

But some experts fear that the system developed by RSA will not do enough.

"The damage has already been done as far as Wep is concerned," said Bob Brace, from Nokia's internet communications division which develops security systems to protect voice and data networks. "Users see it as a weak security system."

Other security experts fear that a beefed up encryption system will do little to protect wireless network users.

Ian Peacock, a consultant at net security firm Defcom, said often many companies failed to even turn on the Wep encryption system when they installed a wireless network.

He said security audits by Defcom of wireless networks used by its clients showed that some failed to take even the most basic precautions.

"The number of networks around the City [of London] that do not have Wep enabled is scary," he said. "Those that set up and use the latest technology often do not appreciate that there are emergent security issues."

Mr Peacock said the ease with which wireless networks could be set up fooled many people into thinking their new network was secure.

However, he said, the start-up settings of many wireless networks meant they were vulnerable to attack.

Despite the shortcomings there is a lot that users can do to protect themselves.

"There's a shortlist of at least 20 things you can change to make wireless networks more secure," he said.

At the very least, anyone using a wireless network should change default IDs, turn on Wep, place the network behind its own firewall and use extra levels of encryption to secure traffic passing across it and into other corporate networks.