Serious Concerns About Ovi Store and DRM FL

[ilsocio]

I just spent some time to experiment Ovi Store and I'm quite disappointed.
I bought 3 applications:
- FSecure Mobile Security (PROTECTED with DRM FL)
- Advanced Device Locks (NOT protected with DRM FL)
- WaveSecure Lite (NOT protected with DRM FL)

I've saved all the 3 installation package on the PC and I've been able to install the application on all mine devices. But I paid each software only for 1 device!
Now I could install these applications on every device I like and I could also send these to my friends for FREE...

As a developer, the absence of every kind of license management is simply a nonsense for me.
How can we developer protect our software and avoid the FREE spreading of the software?

Moreover, these installation package don't need to be cracked or certified with DevCert.
Anyone can install them and use the FULL application without paying nothing!
Probably soon, we will see all the Ovi Store applications available for free on some warez website...

I'd like to know opinions from other developers and from Ovi Store Team also.

Marco

[jimgilmour1]

I just spent some time to experiment Ovi Store and I'm quite disappointed.
I bought 3 applications:
- FSecure Mobile Security (PROTECTED with DRM FL)
- Advanced Device Locks (NOT protected with DRM FL)
- WaveSecure Lite (NOT protected with DRM FL)

Hi Marco,
FSecure Mobile Security . Can be loaded from Ovi website fsecure latest version does *NOT* require payment. see Ovi description "3 months protection for one smartphone". time limited see "http://mobile.f-secure.com/downloads/trial/mobile-security5-s60-os91-fsc-oem.sisx" seems to be same file probably not DRM locked.


- Advanced Device Locks (NOT protected with DRM FL)
Advanced Device Locks on OEM site

License:
Shareware

Last updated:
08-04-2009
Shareware download does not have a DRM lock on above website so why have one Ovi?.

The price on Ovi is higher!, but you are allowed to do that.

WaveSecure Lite you can find this on mosh WaveSecureLite
and of course the Ovi store version is £2 more expensive than on the . If you did not load from Mosh first
status from website
How to purchase?

Download the trial version and try the software for 3 days. Upon purchase, you get a serial number. Go to lite.wavesecure.com and enter your serial number to get an activation code to unlock the application.

Requirements:

· Symbian S60 2nd/3rd edition

Limitations:

· 3 days trial

Special edition for Ovi then!!, why bother DRM on a demo


The only concern here is that we could be paying for a DEmo and paying higher than the owners website, which may be what you have done.

Thanks
Jim

[ilsocio]

Hi Jim,
you linked only trial versions... mine concerns are about full versions!
I didn't bought the trial or demos, I bought the FULL applications and I could spread these package to anyone and he will got the FULL unlocked versions without pay nothing.
I've sent you an email so you can check by yourself that you'll be able to install full apps, without need to pay the developer.

FSecure Mobile Security: I've read about the 3 months description, but I can install it on 1000 devices and use it for 3 months on each device. (probably I will be able also to install it again at the end of the 3 months, just need to format the device)
The installation package is different from the one you linked.
The trial you linked can be used only for 7 days, while the full version I got from Ovi can be used for 3 months.

Advanced Device Locks: The trial version you've linked is limited to 7 days.
The full version I got from Ovi can be used forever.

WaveSecure Lite: The trial version you've linked is limited to 3 days.
The full version I got from Ovi can be used forever.

[jas76]

Hi,

This indeed is a very serious problem for publishers. Can some official person please provide comment on this.

Jas

[Nokia Ron]

I've asked the Ovi team to directly reply to this.

Ron

[briansmith]

Marco (or anybody): have you heard anything about this issue yet?

It seems like Nokia is doing a much better job of answering technical questions now, but this DRM issue seems to have slipped through the cracks.

[ilsocio]

Hi Brian,
I've been contacted by fsecure and I provided them all the details to reproduce the scenario.
Unfortunately, still waiting for Ovi Team reply.

Marco.

[Dmitry_Tarasov]

I just spent some time to experiment Ovi Store and I'm quite disappointed.
I bought 3 applications:
- FSecure Mobile Security (PROTECTED with DRM FL)
- Advanced Device Locks (NOT protected with DRM FL)
- WaveSecure Lite (NOT protected with DRM FL)

I've saved all the 3 installation package on the PC

but how are you managed to do that? When you buy application in Ovi Store sis file do not saves at the phone. So how do you get it on PC?

[jimgilmour1]

Hi,
Whilst we know there is a problem this is being addressed by the Ovi team.

As developers I find this difficult to see why you are telling every hacker going how to break into the Ovi store in detail. We know there are weaknesses but do we need to show everyone one to bypass

This will help allow more people to attempt to take *YOUR* products.

For your information these problems had solutions proposed and documented on the Wiki, before the store was opened,but Many people,and developers, were of the opinion that they were not interested in DRM protection etc, the just want there products available for purchase after the effort required and cost to get them listed.

There are more proposed soloutions which would totally lock out download to annything other than mobile phones,but these are objected by people who want to keep a local copy of the file.

My checking has found much more than the information you listed here however I am not sharing this with everyone here, or by email, to the *PROTECT YOUR PRODUCTS* from being possibly taken for free.



Jim

[jas76]

There are more proposed soloutions which would totally lock out download to annything other than mobile phones,but these are objected by people who want to keep a local copy of the file.

Coloured statement itself is a problem. When it is known that anyone having local copy can remove the wrapper, how could Nokia agrees to this objection. And I will be very interested to see the links to those objections.

I can agree from user's perspective that in case of file delete, he might want to get a copy of it but that should be determined by his account what application he/she has purchased. If purchased already and dwonloading again it may be free or minor cost (as it will take Ovi store bandwidth/resource). But providing a local copy is biggest mistake.

[briansmith]

Hi,
As developers I find this difficult to see why you are telling every hacker going how to break into the Ovi store in detail. We know there are weaknesses but do we need to show everyone one to bypass

Jim, anybody that even thinks for two minutes about how to work around OMA DRM 1.0 forward lock will realize it is trivial. It is important that all developers understand how trivial it is to bypass the DRM so they understand the risks.

I am very interested in the Wiki pages you mentioned that discuss solutions to this problem. Please post a link to them.

[ilsocio]

As developers I find this difficult to see why you are telling every hacker going how to break into the Ovi store in detail. We know there are weaknesses but do we need to show everyone one to bypass

Jim, as every developer knows, "security through obscurity is not security".
Moreover, as you can see, it is pretty easy to fool the OviStore and navigate it from the PC and doesn't requires any particular skills.

Developers/Publishers needs to have guarantees that their software will not be spread for free...
And they must be properly informed that (currently) Ovi Store, doesn't give them such guarantees.

Since separated delivery is not supported by all the devices, Nokia could introduce in Ovi Store the support for instant purchase notification to the developer webserver (like Handango) and delivery the registration codes to the customer during the purchase.
Or also a simple delivery of licenses codes taken from a list (like SoftwareNokiaMarket).

AFAIK, at least the 90% of the symbian software available on the market, already uses some kind of protection based on imei/registration code, so introducing this kind of license management support will also benefits of an higher number of applications ready to be published immediately!

I really hope that Nokia will take this in consideration and will introduce asap some kind of license management, because at current stage, (imho) OviStore is suitable for free contents only.

Marco.

[jimgilmour1]

Jim, anybody that even thinks for two minutes about how to work around OMA DRM 1.0 forward lock will realize it is trivial. It is important that all developers understand how trivial it is to bypass the DRM so they understand the risks.

I am very interested in the Wiki pages you mentioned that discuss solutions to this problem. Please post a link to them.

Here is the FN Wiki articles they are by FN Champions
Firstly by How to protect Flash Lite content with OMA DRM 1.0 when content is packaged into a Symbian installer .sis
From Forum Nokia Wiki
written by Biskero


How to use Vista personal webserver to test OMA DRM 1.0
written by jimgilmour1

How_to_protect_WRT_widgets_with_OMA_DRM_1.0 How to protect WRT widgets with OMA DRM 1.0
written by jimgilmour1


How to create OMA DRM v1.0 content written by Antony Pranata


These are a selection of specially written articles, by FN Champions.

On this discuss board DRM and Download FAQ content protection used on Ovi

On Wiki in the search box type "OMA DRM 1.0" which will give a list of articles on DRM.

Finally another person and myself discussed this at Ovi and Dynamic (RPN) registration code server?

The publisher decided not to publish yet due to costs of creating a new version and concerns like people on this thread

Jim Gilmour
Forum Nokia Wiki Adminstrator
Wiki Adminstrators are not paid by Nokia

[gailu]

Hi Jim,

Thanks for the links to articles. However all these articles describe to protect content (media/image files etc). Is there any article that describe how to protect a simple application. I am sure there will be lots of developers interested in that.

We have a simple SMS handling application. No media file or any other content. Based on this discussion thread I believe it is now proved that application can be downloaded to PC and after removing .dm wrapper it can be distributed freely on torrents.

I am holding publication of my application and I believe there will be other publishers in same situation. What should we do next in order to avoid very trivial hack and redistribution.

I believe lets not focus what happened instead let us focus what Ovi can do to protect application and a time frame when they can provide a solution so that everyone can plan accordingly.

We are need to see next proposal by Ovi Team for application protection from this kind of trivial hack. Till now Ovi has asked for fully unlocked signed sis file. What is there proposal now. If we need to add some code in order to protect our application we are ready for that. But there must be clear instructions for developers.

When can we expect an answer/proposal?

[gailu]

Hi,

Can Ovi Store Team please update on this issue?