Looney Tunes: Exposing the Lack of DRM Protection in Indian Music Streaming Services Ahaan Dabholkar Sourya Kakarla Dhiman Saha [email protected] [email protected] [email protected] de.ci.phe.red Lab, Indian Institute Of Indian Institute Of Technology de.ci.phe.red Lab, Indian Institute Of Technology Bhilai Kharagpur Technology Bhilai Abstract developed online payment infrastructure and continual de- Numerous studies have shown that streaming is now the mand for content within the entertainment domain, projects most preferred way of consuming multimedia content and the global OTT service market to grow from $81.60 billion this is evidenced by the proliferation in the number of stream- in 2019 to $156.9 billion by 2024 exhibiting a CAGR (Com- ing service providers as well as the exponential growth in pound Annual Growth Rate) of 14% [38]. The Asia Pacific their subscriber base. Riding on the advancements in low region is set to record the highest growth rate during the cost electronics, high speed communication and extremely forecast period. According to a joint report published by cheap data, Over-The-Top (OTT) music streaming is now the the Indian Music Industry (IMI) and Deloitte India [18], the norm in the music industry and is worth millions of dollars. audio-video OTT market in India is valued at around US$ This is especially true in India where major players offer 280 million with nearly 150 million monthly active users the so called freemium models which have active monthly accessing soundtracks across various platforms. user bases running in to the millions. These services namely, Gaana[33], Airtel Wynk[32] and JioSaavn[34] attract a signif- icantly bigger audience than their 100% subscription based Service Name Business Model Origin Reference peers like Amazon Prime Music, Apple Music etc.[35] Given Bundle, Airtel Wynk Domestic [32] their ubiquity and market dominance, it is pertinent to do a Ad Supported systematic analysis of these platforms so as to ascertain their potential as hotbeds of piracy. This work investigates the re- Apple Music Paid International [4] silience of the content protection systems of the four biggest Amazon Music Paid International [2] music streaming services (by subscriber base) from India, Gaana Ad Supported Domestic [33] namely Airtel Wynk, Ganna, JioSaavn and Hungama. By considering the Digital Rights Management (DRM) system Hungama Ad Supported Domestic [6] employed by Spotify as a benchmark, we analyse the secu- Bundle, JioSaavn Domestic [34] rity of these platforms by attempting to steal the streamed Paid content efficiently. Finally, we present a holistic overview of the flaws in their security mechanisms and discuss possi- Spotify Ad Supported International [11] ble mitigation strategies. To the best of our knowledge, this Youtube Music Subscription International [13] work constitutes the first attempt to analyze security of OTT Table 1. OTT music services currently operating in India music services from India. Our results further confirm the time tested belief that security through obscurity is not a arXiv:2103.16360v1 [cs.CR] 30 Mar 2021 long term solution and leaves such platforms open to piracy and a subsequent loss of revenue for all the stakeholders. Revenue from digital means contributes nearly 78%to the overall recorded music industry revenue in India and Keywords: Digital Rights Management, Web Security, Piracy, 54% [27], globally. A survey of India’s audio streaming mar- OTT Audio Streaming ket reveals that it is primarily divided among domestic play- ers Wynk, Gaana, JioSaavn, Hungama and global players Spotify, Amazon Music, Apple Music and more recently 1 Introduction YouTube Music (Table 1). As per a consumer insights survey OTT is an acronym for “over-the-top” and refers to the dis- conducted by the IFPI in 2018 [28], an average internet user tribution of multimedia (audio, video) content over a pub- in India spends 21.5 hours every week listening to music, lic network. Recent trends have shown a mass adoption of higher than the global average of 17.8 hours. It is interesting smart mobile devices in the consumer market. This coupled to note that despite the popularity, contemporary literature with a higher penetration of high-speed, cheap Internet and lacks security analysis of any of the domestic OTT platforms the emergence of advanced technologies, such as 5G, 4G, and forms the primary motivation of this work. 156 Streaming Other Digital Physical salvage the situation. As a part of responsible disclosure, this 9 work was attempted to be communicated to the concerned Performance Rights Synchronisation 125 15 11 parties. With the exception of Wynk, response from others 110 7 13 94 12 is awaited. 88 16 9 2 14 12 3 11 Our Contributions 11 13 28 20 19 Our contributions can be summed up as follows - 109 20 20 83 • We present a security analysis of the content protec- 52 tion systems in place for four of the biggest music 31 34 streaming services (by subscriber base) in India. • We highlight the lax security protocols in place in all 2014 2015 2016 2017 2018 these services by attempting to steal content in an Note: All USD numbers above have been calculated using exchange rate $1 = INR 68.43 Source: IFPI, Global Music Report, 2019 undetectable way and provide proof of concepts to automatically acquire content by reverse engineering Figure 1. The dominance of streaming as the main source their content delivery protocols. of revenue in the Indian music industry [22] • We present a comparative study of these apps with the current state-of-the-art DRM systems. • We present a discussion on the design choices em- ployed by these services and make recommendations This easy and free access to content was thought to have to enhance their security. solved several issues regarding unsanctioned sharing of me- dia [30] as it provided Music-as-A-Service which was more Organisation Of The Paper lucrative to the consumer than content ownership [24]. How- The following sections contain the conclusions and results of ever, with the consequential emergence of “stream-ripping”, our experiments while reverse engineering said services. We piracy has increasingly kept pace. The gravity of the situa- first provide a primer on Adaptive Streaming in Section[2.1] tion reflects in the numbers where estimates point to almost which is used by most of the OTT streaming services and US$ 250 million lost each year in India alone while the es- which would help us elucidate the protocols involved clearly. timated number of stream-rippers in the US have grown to We follow this up in Section[2.3] with a brief note on present an alarming 17 million [42]. The surging popularity of such day DRM systems. Section[3] is dedicated to describing the platforms has also not been missed by the shadier sections Widevine DRM used by Spotify to protect it’s content, to of our society with more sinister agendas [14]. Couple this establish a benchmark for comparing the other services. This with the 40% - 60% of revenue that is lost to pirates, there is leads us into the results of the reverse engineering in Sec- hence a dire need to take a critical look at the security of such tion[4] where we give reconstructions of the protocols used. content delivering platforms. A recent paper on bypassing Section[5] contains discussions on the flaws in current DRM DRM protection in online video streaming [45] is one of the systems and the design choices made by these services fol- many research efforts highlighting the need to have a deeper lowed by our conclusions in Section[7]. understanding on how OTT services should be deployed in practice. 1.1 Responsible Disclosure In this work we systematically analyze the four leading OTT music service providers in India namely Wynk, Gaana, All the services mentioned here were contacted prior to sub- JioSaavn and Hungama comparing them to the best practices mission of this manuscript with reports on the vulnerabilities in the industry. To our great surprise, our research reveals in their protocols and with offers to collaborate on the fix.It that none of these platforms adopt any state-of-the-art DRM should be noted that none of these services have vulnerabil- protection. Contrary to this they actually attempt a very ity disclosure programs and hence finding a suitable point rudimentary form of code obfuscation. As a result, we were of contact was tough. When informed of the break, Airtel able to not only reverse engineer their protocols but also Wynk was all for the idea of a collaborative fix but ended devise mechanisms leading to automated, unsupervised and up deploying a haphazard patch without consultation and uninterrupted download of music from their servers. We proper notice which was broken eventually using the same develop detailed Proof-of-Concepts for the same and illus- techniques. trate case-studies on each of the platforms. To put things in context, we also investigate the Spotify web-application 2 Background and find it adopting very standard DRM protection making This section is provided as a primer for familiarising the it a benchmark in the comparative study that we furnish reader with certain technologies that are heavily referred to later. Finally, we discuss possible mitigation strategies to in this work. 2 2.1 Adaptive Streaming Classical streaming protocols used a technique called progres- sive streaming to deliver content. In this technique, a single file sitting on the vendors’s server was delivered to the client requesting it. Though this method was simple, it had some obvious inefficiencies which are demonstrated using atoy example below- 1. Consider two clients with two different displays, one having a 720p display and the other having a 4K one.