Facebook's ContentID Clone Had A Vulnerability That Opened Up Ability For Users To Game Others' Videos

from the this-stuff-ain't-easy dept

Thu, Aug 11th 2016 2:40pm — Mike Masnick

Earlier this year, we noted that Facebook had launched its own ContentID clone, called Rights Manager, which was a response to a bunch of angry YouTubers who were annoyed at people "freebooting" popular YouTube videos onto Facebook. We noted that, like ContentID, we fully expected the system to be abused to take down content. While we haven't heard examples of that just yet, it does appear that Rights Manager had some serious vulnerabilities that enabled anyone else who was signed up for Rights Manager to manipulate the information and rules on any other video in the system (including, obviously, those claimed by other users).

Simply put, an imposter could easily wander into your anti-imposter pages without logging in first.

According to Muthiyah, pirates could actually have used Rights Manager to rip off their own copies of your reference copies, thus freebooting directly via the anti-freebooting interface

To its credit, Facebook fixed the problem and paid the researcher who found it a bug bounty of $4,000.

However, this does point out something rather important. Building these kinds of systems is really difficult. Beyond the problem of abuse that we frequently talk about, bugs and security flaws are a real risk as well. And yet, many in the film and recording industries still insist that it's "easy" to build a filtering system like this and that all sites should be legally required to do so. And, sure, Facebook and Google and the likes can afford to pay lots of money to build systems -- even buggy ones -- and then have bug bounties and such. But smaller companies aren't able to do so. Requiring them to do so basically wipes out the possibility of smaller startups entering the space and cedes the market, permanently, to the giant companies that everyone complains about.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: contentid, copyright, filters, rights manager, security, videos
Companies: facebook

6 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Coward, 11 Aug 2016 @ 4:21pm

Building any new complicated system difficult and expensive period. Any new complicated system is going to be plagued with bugs at first until they get fixed with time. The same thing happened with e-mail servers and whatnot.
[ link to this | view in chronology ]
This comment has been flagged by the community. Click here to show it

Anonymous Coward, 11 Aug 2016 @ 4:55pm

OMG THE SYSTEM HAD A BUG!!!! HOLY SHIT AWESOME REPORTING!!!
[ link to this | view in chronology ]
- Anonymous Coward, 12 Aug 2016 @ 2:12am
  
  Re:
  Anonymous64 just hates it when due process is enforced.
  [ link to this | view in chronology ]
That One Guy (profile), 11 Aug 2016 @ 6:53pm

Have at it then
And yet, many in the film and recording industries still insist that it's "easy" to build a filtering system like this and that all sites should be legally required to do so.

'Easy' in the same sense that it's 'easy' to spot infringement I would guess, which is to say difficult to very difficult for the ones in the best position to know, and yet (somehow) impossibly simple for those lacking the required knowledge.

As for the assertion that making such a filtering system is 'easy', easy enough to call them on that particular lie: "Well in that case by all means demonstrate how cheap and easy it is to create an accurate filtering system capable of handling the kind of traffic our site deals with on a regular basis. If it's really that easy shouldn't take you much time or effort at all to create such a filtering system."
[ link to this | view in chronology ]
- Anonymous Coward, 12 Aug 2016 @ 6:32am
  
  Re: Have at it then
  This is partly what makes copyprotection enforcement difficult in general. It's opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what's still protected and what's not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.
  
  Plus the penalty structure is very one sided. Unlike real property laws, where the burden lies on someone claiming to own property that's not in their possession to prove they in fact own it before depriving them of its use, with IP laws it's easy for someone to deprive someone else of content they don't have protections to and have it removed from youtube or someplace else and then the burden lies on the person that originally uploaded it to prove that they do have IP privileges over that content under penalty of perjury to get it restored. They can face huge penalties if they are infringing and the service provider can face huge penalties for not removing it, penalties worse than grand theft when compared to real property laws. In the meantime if the person that issued a false takedown turns out to be wrong it's just an accident, no big deal, and they are unlikely to receive any punishment or maybe a slap on the wrist if they're unlucky. Imagine if I can claim your refrigerator and deprive you of using it and make you prove it belongs to you before allowing you to use it. Then, after all that, nothing happens to me for being wrong.
  
  The whole system is messed up period. It's what you get when corporate sociopaths write laws.
  
  It's Whatever's inability to respond to this that made him leave, at least for now. He tries to compare IP laws to real property laws but when the above is brought up to him he has absolutely nothing to say. What can he say? Making IP laws more like real property laws would actually be a step towards making them more reasonable and proportionate.
  [ link to this | view in chronology ]
gmail login, 26 Jul 2017 @ 12:57am

very good
This is partly what makes copyprotection enforcement difficult in general. It's opt-out, instead of opt in, so the government refuses to carry any of the burden of letting us know what's still protected and what's not and they refuse to require IP holders to carry any of that burden. They also carry none of the burden of ensuring that, once content does enter the public domain, it becomes publicly available. There is no requirement to register content in such a way that the government has a copy of that content for identification (to avoid infringement) and for release once it does enter the public domain. Plus copy protection lengths last so long that it can be hard to keep track of when something was created and when it will enter the public domain (not that anything ever enters the public domain anymore due to corporate lobbying). The public carries all of the burden.
[ link to this | view in chronology ]