Here's a story that is making the round on various tech news sites at the moment. On May 8th 2009, Adobe issued a takedown notice to SourceForge Inc, asking them to remove a project called rtmpdump from their website as - according to Adobe - it can be used to circumvent copyright protection measures. Even though the takedown notice doesn't mention it, rtmpdump can be used to record streamed content that is delivered via RTMP and (and this is the important part) RTMPE as well. The full wording of the notice can be found here. RTMPE is of course the encrypted flavour of RTMP, Adobe's real time messaging protocol (for which they apparently hold a patent).

As many of you will know, RTMP itself has been widely reverse engineered and documented, which made alternative RTMP servers such as Wowza and Red5 possible. Adobe have also recently announced that the RTMP specs will be made publicly available very soon, and so far I have heard of no action having ever been taken against anyone that implemented just RTMP. Quite clearly, the fuss is about RTMPE, not RTMP. It is the fact that rtmpdump can circumvent certain access controls that made Adobe react. By posing as a Flash Player, rtmpdump can connect to Flash Media Server and successfully pull and record an encrypted stream. In combination with the get_iplayer project rtmpdump made it possible to record all kinds of RTMP based content from sites such as channel4.com and the BBC iPlayer. The version of rtmpdump used within get_iplayer has now been removed and been replaced with a forked version called flvstreamer.

Flvstreamer only supports RTMP based delivery, it no longer works with RTMPE. SourceForge has also removed the project.

Of course all this comes way too late, and the RTME specs are now widely publicised and available to anyone to view - and implement it into new tools. No doubt it will not take long for alternatives to rtmpdump to emerge. What's more, it seems that Adobe has in fact drawn a whole lot of attention to this topic than it would have received had the takedown notice not been issued.

I cannot help but admire the efforts of the open source community. I think it is important that such weaknesses are made public so that improvements can be made, and standards raised. It now appears that RTMPE, while being able to offer an SSL-equivalent encryption strength during transmission, can be circumvented due to limitations in the handshake and SWF Verification features. It is clear that SWF-Verification is not totally secure since rtmpdump can pose as the authorised SWF - which it obviously isn't.

In this document which seems to originate from the author of rtmpdump and his close friends, Adobe receives quite a battering. Here's an excerpt:

"RTMPE is definitely not a 'Copyright Protection' mechanism.
An analysis of RTMPE [...] shows that RTMPE does nothing more than what SSL already does (provide end-to-end secrecy, except without the protection against man-in-the-middle attacks [...] and simply mathematically links a publicly-downloadable and publicly-obtainable SWF file to the connection.
Bottom line: All the information required to obtain the content is publicly available. There is no 'security'.
If the information isn't publicly available (such as the SWF file to be executed in the web browser) then the content cannot be obtained, either."

Interesting stuff. While I am no encryption expert I think I have a grasp on the weaknesses of this system.

I'm hoping to get an email interview with the author of rtmpdump set up very shortly. If you have any specific questions that you'd like me to put to him then please leave a comment below.


Posted on May 26, 2009 at 2:28 PM. 10701 views. 22 comments. Print