An Interest In:
Web News this Week
- April 26, 2024
- April 25, 2024
- April 24, 2024
- April 23, 2024
- April 22, 2024
- April 21, 2024
- April 20, 2024
Protecting audio and music assets with Node and Javascript
In my previous post I discussed my latest small project of building an external music player for Bandcamp. What I realized is that many similar sites and services can easily be abused for pirating content, in particular copyrighted audio, music and video. In this post I will discuss several strategies for protecting such content.
Obtaining mp3 files (and other digital content) can usually be done by looking at the HTTP requests that are being made upon playing/using that particular content. In Bandcamp's case I only had to look at the network traffic and spot the "mpeg" data type of 5.37MB in size, then by copy pasting the GET URL you can download its corresponding mp3 file.
Today it's nearly impossible to fully secure digital content, there's always some way of obtaining it. But the purpose of security systems is to make the hacker's / pirate's life very painful. Either by making the process very long and/or complex, in the hope of them giving up.
A very basic, yet quite effective method is to encrypt the sensitive assets. In Bandcamp's case, they can encrypt the mp3 contents server-side using some key, send it to the client, and let the client's JavaScript code decrypt and play it. The client can still download the encrypted mp3 file, but without the proper decryption algorithm it's a useless file. This method is only as effective as our ability of hiding and obfuscating the decryption function.
In the code below I show my prototype for doing all of this.
NodeJS server code
"use strict";const express = require("express")const app = express()const { Readable } = require('stream')const fs = require('fs')app.get("/audio", function (req, res) { res.setHeader('Access-Control-Allow-Origin','*') xor_encrypt()})function xor_encrypt() { // read audio file to buffer let buff = fs.readFileSync('./audio.mp3') // determine encryption key let key = buff[buff.length-1] // encrypt buffer contents buff = buff.map(x => x ^ key).map(x => ~x) // store the encryption key as last element buff[buff.length-1] = key // transform buffer to stream let readStream = Readable.from(buff) // send stream to client readStream.pipe(res) readStream.on('end', () => { res.status(200).send() })}app.use(express.static('.'))const serverHost = "localhost"const serverPort = 3007app.listen(serverPort)
JS client code
let curr_track = document.createElement('audio')var oReq = new XMLHttpRequest()oReq.open("GET", 'http://localhost:3007/audio', true)oReq.responseType = "arraybuffer"oReq.onload = function(oEvent) { xor()}oReq.send()function xor() { // convert arrayBuffer to regular Array const arr = oReq.response var byteArray = new Uint8Array(arr) // obtain encryption key let key = byteArray[byteArray.length - 1] // use key to decrypt contents byteArray = byteArray.map(x => x ^ key).map(x => ~x) // restore key byteArray[byteArray.length - 1] = key // convert byteArray to Blob const blob = new Blob([byteArray], { type: 'audio/mp3' }) // create playable URL from Blob object const url = URL.createObjectURL(blob) // memory leak possible! curr_track.src = url curr_track.load()}// now you can bind 'curr_track.play()' to some click-event
The code above contains comments for each step, so it should be self-explanatory. The method for encryption relies on simple yet highly efficient bitwise operators (xor and not).
In the client code, the url
variable points to a temporary in-memory Blob object representing the mp3 file. If you print this url
to console you will get something like this:blob:http://localhost:3007/9a2ffb47-72af-4c58-a0f9-08b9a63b81d0
If you then copy paste this into a new tab you'll be able to play/download the decrypted mp3 track. This Blob object exists in-memory as long as your website window remains open, else it gets garbage collected; this also means that creating many Blobs can lead to memory leaks (but there is a method for cleaning them up manually).
This encryption strategy works fine, we made it harder for users to download mp3 files. It's still possible once a user figures out how the decrypt function works, then they can automate it. Or by debugging/editing the JavaScript code they can similarly obtain the mp3 file.
Alternatively, instead of using a Blob object, you could use base64 encoding, but that's just as trivial as Blobs are at decoding and downloading the binary contents.
A further improvement is to use many different encryption/decryption methods (instead of one) at random, but then again some kind of identifier will be needed to determine which method should be used client-sided. Once again the hacker/pirate can figure this out.
The bottom line is that we use the html5 tag for playing tracks, more specifically by providing an URL for its src
attribute. To provide more security we should investigate different methods and techniques for playing audio without the need of using the <audio>
tag.
Original Link: https://dev.to/codr/protecting-audio-and-music-assets-with-node-and-javascript-2p92
![Share on Facebook](https://www.webnuz.com/images/site/facebook_icon.png)
Dev To
![Dev To](https://www.webnuz.com/uploads/feeder_images/devto-logo.png)
More About this Source Visit Dev To