Security hole discovered in Y! Music Unlimited

Written by James Delahunty @ 30 May 2005 7:29 User comments (6)

Robert Chapin, owner of Chapin Information Services, Inc. has been trying to get Yahoo to fix a security flaw he found in Y! Music Unlimited that could allow a user to download songs for free. The Music Unlimited service is seen as a sort of music rental service, like Napster To Go and Real's new subscription service. For $4.99 customers can download songs and store them on compatible portable devices, but as soon as they stop paying for the service the music would simple disappear.

In order to burn a song to a CD, users would have to pay 79c for the track. Once it is burned to the CD, it is free of any DRM protection and could easily be ripped into MP3 format using any of various tools on the Internet. Tools like PyMusique and Musik allow users to purchase songs from iTunes without having any DRM protection attached, but these tools don’t make it possible to obtain downloads for free.

"This afternoon we checked to confirm the problem is still live. We downloaded a copy of The Moody Blues - Never Blame The Rainbows For The Rain.wma. It isn't going to be one of my personal favourites, but it does illustrate the point. The music on Yahoo can be obtained quickly, easily, and freely." Chapin told AfterDawn.com in an email. Understandably however, he has not reveal just yet how to get the music for free and most likely wont until Yahoo fixes the problem.

Source:
p2pnet
Chapin Information Services (Press Release)

Thanks to Jon Newton of p2pnet for bringing this to my attention.

<Toshiba brings LightScribe to laptops >Plextor attacks open source programmers

6 user comments

131.5.2005 02:12

damo_red

Send private message to this user

Member

as kind as this guy is, isent he still stealing when hes downloadin for free, wonder what yahoo have to say about this

231.5.2005 09:08

etherz

Send private message to this user

Junior Member

I read the whole bloody article only to find he won't be releasing how he did it, why do we care then! Jks, its a shame he wont share his info, and we could all ruin yahoo! They would soon fix the security flaw then...

331.5.2005 09:49

Dela

Send private message to this user

Staff Member

Quote:
as kind as this guy is, isent he still stealing when hes downloadin for free, wonder what yahoo have to say about this

They will more than likely say thanks! lol you have to do things to proove these vulnerabilities exist!

431.5.2005 10:09

punx777

Send private message to this user

Senior Member

hey with yahoo music unlimited, can you de-drm it and burn it to a cd?

53.6.2005 04:31

borhan9

Send private message to this user

AfterDawn Addict

This article is pointless if u dont share the trick. Its not exactly "open sourcing" for everyone is it... when someone figures it out post it plz

66.6.2005 21:55

vudoo

Send private message to this user

Member

I don't see how you can download the music for FREE unless you share a friends subscription or use one of those password stealers in a yahoo chatroom that anouther subscriber has that actually pays for Yahoo and tells someone in a chat room they pay. Unless you know how to stop booters they can steal your password. This happens in chat all the time. But if you know the sites to go to you can get your passcode back. Only the super lame may lose their passcode for good. I suppose any music service would be open to trojan horses to steal passcodes from their subs. but really $4 a month is not bad. I have Rhapsody To Go and love it. I'm actually listening to a band called Thin Lizzy now which is an old 70's band. You don't get their full CD's on p2p. If you only like pop then hey p2p is the only way for you.

Comments have been disabled for this article.

	YouTube Premium starts showing ads to subscribers (13 Nov 2024 3:09) For years, YouTube Premium has been marketed as a way to enjoy an ad-free YouTube experience. But apparently, that is no longer the case, as Premium subscribers are now starting to see ads on the platform.
	Android 16 will launch sooner than expected (01 Nov 2024 6:45) Google announced that upcoming Android 16 will break the traditional once-a-year cycle of major Android launches. Next Android is poised to launch in Q2 of 2025, so Android 16 should ship before end of June, 2025.
	Winamp ends its "open source" project that wasn't really open source (20 Oct 2024 11:12) Less than a month after the legendary MP3 player Winamp made its source code public, the company has made a sudden U-turn and removed its code from distribution. 2 user comments
	Winamp released its source code - but didn't go open source (25 Sep 2024 12:38) The source code of Winamp has now been officially released. However, it hasn't become a pure open-source project, as its licensing terms prohibit the creation of new, different versions.
	Does your phone rattle? Here's why it happens (25 Aug 2024 8:30) When you shake your phone and hear a light rattle, clatter, or jingle, it's likely not broken. The culprit is probably the optical image stabilization (OIS) system in your phone's camera, meaning everything is functioning as it should. 2 user comments

	Does your phone rattle? Here's why it happens When you shake your phone and hear a light rattle, clatter, or jingle, it's likely not broken. The culprit is probably the optical image stabilization (OIS) system in your phone's camera, meaning everything is functioning as it should. 2 user comments
	Guide: Phone battery drains quickly - how to fix (iPhone / Android) In this guide, we go through the most typical reasons for rapid battery drain with phones, and look at potential reasons or solutions.
	GUIDE: Wi-Fi speeds are slow? Here are some tips Having problems with Wi-Fi speed and stability at home? Here are some tips to follow to alleviate the issues. 1 user comment
	What happens if you don't update Android? Sometimes it can be tempting to avoid updating to a new Android version. What happens if you decide to delay major updates to the OS?
	What IP rating for dust and water resistance means An IP classification (such as IP68) is given to mobile phones, Bluetooth speakers, and other devices, but what do these classifications mean? 1 user comment

Security hole discovered in Y! Music Unlimited

6 user comments

Latest news

Reviews

Guides

News archive

Subscribe

Sections:

Follow us:

	Roborock S8 MaxV Ultra review - obstacle avoidance doesn't work as it should, otherwise almost perfect robot vacuum We put the Roborock S8 MaxV Ultra through a very, very long review process. The $1800 mopping robot vacuum is almost perfect, but its obstacle avoidance was surprisingly bad, considering the price - and compared to its competitors.
	Sharge x OnePlus Pouch review: Beautiful power bank that supports SuperVOOC charging In our review, we take a look at Sharge's power bank that supports OnePlus SuperVOOC quick charging technology as well as standard USB PD charging. It has small design flaws, but despite those, the Pouch is very nice product. 1 user comment
	Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets Roomba Combo j7+ is the very first Roomba model to combine robot vacuum with mopping features. And Roomba Combo j7+ does all that with a very clever trick, which tackles the problem with mopping and carpets. But is it any good? We found out.