Hackers build backdoor into iTunes

A trio of independent programmers has released new software that allows people to tap into Apple Computer's iTunes music store and purchase songs free of any anticopying protections.

Joined by Jon Johansen, the Norwegian programmer responsible for distributing DVD-cracking code in late 1999, the programmers say their "PyMusique" software is a "fair" interface for iTunes, primarily aimed at allowing people who use the Linux operating system to purchase music from Apple's store.

Jon Johansen

But with a Windows version of the software also available, it's likely to trigger a legal response from Apple, which has closely guarded access to its online music store and has depended on its copy-protection software to gain rights to sell music online.

In an interview late Friday, one of the program's creators, 17-year-old Pennsylvania high school student Cody Brocious, said the ability to save songs without copy protection was essentially an accident derived from the way Apple's system downloads songs. He said the software wasn't intended to harm Apple.

"The intent of the project was to be able to purchase files from the iTunes Music Store," Brocious said. "I believe very firmly that the project is ethical and does nothing but good for the community at large."

Apple representatives had no immediate comment on the software.

The PyMusique release is the latest and most ambitious skirmish in a long-running battle between Apple and hackers intent on removing digital-rights management from the company's songs. As the most popular online music store, Apple has helped prove that consumers will purchase copy-protected songs but also has been a test case for whether that copy-protection can sustain attacks.

The release draws from the work of a handful of scattered programmers over the past year who have successively identified how different pieces of the iTunes software works.

Brocious said he started his project after hearing of another programmer's work creating a Web-based interface to the iTunes store.

He and other programmers found that the iTunes store downloads songs wrapped in encryption, but that music purchasers are given the key to unlock that encryption when they buy a song. Ordinarily, the iTunes software would then rewrap the song in Apple's FairPlay digital rights management software, he says--but with their Linux version, that separate step didn't turn out to be necessary.

The result was a song that had been paid for and downloaded, but lacked the copy protections Apple's store ordinarily provides.

Brocious, who has left his most recent development on the software to another programmer, said he hasn't been contacted by Apple and

hasn't talked to a lawyer. Because PyMusique doesn't actually break through Apple's copy protection, the programmers have predicted in previous blog postings that the software is legal.

Apple's iTunes terms of service do seem to disallow any unauthorized access, however.

"You will not access the service by any means other than through software that is provided by Apple for accessing the service," the iTunes terms of service says.

Annette Hurst, a San Francisco copyright attorney, said the software appeared to cross legal lines. The Digital Millennium Copyright Act, or DMCA, bars software that "avoids" or "bypasses" antipiracy mechanisms, she said.

"Those are pretty broad words," she said. "I would be very concerned about this if I were their lawyer.

A test of the PyMusique software showed that it did allow the purchase of songs from iTunes, and that the songs were saved in the unprotected AAC digital music format rather than in Apple's protected Fairplay format. Songs could not be downloaded without establishing an iTunes account and paying the ordinary price for the music.

Apple's rights-management software already allows iTunes customers to burn the songs they buy to CDs, which can themselves be ripped into unprotected MP3 files.

Johansen said the work is specific to Apple's store, and would not be easily applied to other download stores such as those operated by Napster and Microsoft.

"I can't say whether it's possible without looking into it first," Johansen said in an e-mail. "The iTunes Music Store sells files in a open format--AAC--which is what makes it attractive."

Johansen said that two other programmers, Travis Watkins and Brocious, had done much of the work on the Linux software, while he had developed the Windows version.

The Norwegian programmer has been a constant thorn in the side of the entertainment industry for more than half a decade, as the most public face among programmers testing the power of rights-management protections.

As a teenager in 1999, he worked with other still-anonymous programmers to create and release software called DeCSS, which allowed Linux-based computers to play DVDs, but that could also be used to copy the movies. That action led to years of legal battles in which Hollywood studios and their allies sued Web sites and software makers trying to keep the DeCSS code offline and off store shelves.

That legal strategy was successful; judges in the United States ruled that the code was illegal to distribute or sell. Nevertheless, DVD-ripping programs remain widely available online.

Johansen himself was prosecuted in Norway as a result of his work on DeCSS, but was ultimately acquitted.

The programmer has since turned his attention to Apple's iTunes store, studying the interior workings of the software and coming up with tools that can help strip the copy protection off purchased songs. The PyMusique release is related, but not directly dependent on his earlier work, Johansen said.