Download-happy users combated Microsoft's digital rights management (DRM) with the newest release of the encryption-cracker FairUse4WM, but an industry watchdog says that this seeming security hazard should have no effect on the enterprise -- at least, not yet.

The new version of FairUse4WM was made available on the Web last week, unhampered by Microsoft's previous lawsuit against the program's authors (whom Microsoft was unable to identify). It allows users to remove the copy protection from audio and visual files of Windows Media so that they can copy and share them with others.

While one might worry that this could lead to a cracking of enterprise DRM, this is not an issue as of yet, said Gord Larose, author of the popular online "DRM Dictionary" and senior application security engineer with the Vienna, Virginia-based security solutions provider, Cloakware. "FairUse4WM is primarily used in the media space, and is aimed at consumers," he said.

Use of Windows Media encryption is rare in the enterprise, as most people favor more mainstream encryption vendors, like Authentica and Sealed Media. "You're only at risk if you rely on Windows Media technology to protect your documents. But this is quite rare -- the requirements are quite different. It's not like you want a million people to read your documents," he said.

"The only enterprises that rely on protection of Windows Media files are enterprises in the media business. It will not have a significant effect on those using normal IT infrastructure (unless you count employees wasting more time by downloading files!)."

Enterprise-level DRM is beginning to make its way into the enterprise, according to Larose, but it hasn't made much headway yet. "We're starting to see that same kind of unification in the enterprise with DRM, and it will become significant eventually. Right now, there are no de facto enterprise DRM standards," said Larose.

But this will change someday. Said Larose: "Once DRM (in the enterprise) becomes systematic, we'll see hackers making enterprise a big target." Documents that could be hit would be valuable copyright-protected PDF's, such as costly industry analysis reports.

In an e-mailed statement, Microsoft corporate communications senior manager David Gunasegara said, "Microsoft is aware of the issue, and our breach response team is verifying the circumvention. Microsoft has long stated that no DRM system is impervious to circumvention -- a position our content partners are aware of as well.

"That is why we designed the Windows Media DRM system to support dynamic updates, should an issue like this occur. This update mechanism, referred to as renewal, does not require a new release of the Windows Media Player or the Windows Media Format Software Development Kit."

» posted by ITworld staff

Computerworld Canada

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine