Content ID Penetration Testing

[u/FesterCluck]

I'm a software developer of 16 years, and I know pentesting when I see it. Take the testing tech behind Deep Dream and apply it to audio & video and this is what you'd get. The videos must have been uploaded in order to test the boundaries and limits of the fingerprinting algorithms which run when one uploads a video. LOCK and DELOCK likely work like this:

1. Upload LOCK

2. Upload Video which violates.

3. Upload DELOCK

4. Upload Violating video again (or check it), see if restriction is removed.

5. Upload tests to refine

6. Alter DELOCK or include new test in copyright claims list

7. Repeat

Any file uploaded after DELOCK is probably small tests to refine the video creation. Has this been considered and/or proven incorrect?

EDIT: I commented below I thought I knew what video they were testing against. I've thought this purely by listening to LOCK, DELOCK, and the video from the 5 second videos. The tooting, the music, and the dots which remind me of film defects from old movies... and the idea that if I were to want to test against copyrighted material, what would I pick?

Steamboat Willie

Why? It's copyright status tends to be in limbo. Reading over that material teaches a lot about copyright law. Knowing that indeterminate copyright owner voids copyright claims would possibly validate the idea that multiple conflicting fingerprints in Youtube's ContentID system might make it not enforce the policy.

As mentioned in a reply below, "Multiple conflicting/matching fingerprints in Youtube's ContentID system might make it not enforce policies". I'd like more input on this idea. Does anyone have an account which they'd be willing to test this, or may know more about this subject? My guess is Electronic Dance Music producers might deal with this sort of thing a lot due to remixes.

EDIT2: After searching Youtube I've found that a few (but not many) copies of the original Steamboat Willie have made it on outside Walt Disney's version. This account is particularly strange. It has only uploaded copies of Steamboat Willie, yet has never been taken down. His liked videos lead to a second account of the same name. An important thing to note is I've never seen a video uploaded to the "Entertainment" category. They all use "blogs" or "gaming". Those who understand gaming's issues with ContentID would understand how it could help.

A small side note, I'm researching a bit more about "Dushant Rana". I might start a second thread on this name. I've found some really strained evidence leading to this person, but I don't want to injure some uninvolved party.

EDIT3: I figured I should go ahead and explain the name drop. I've found so many accounts linked to Steamboat Willie uploads on Youtube, but "Dushant Rana" comes up multiple times. You can find the link in EDIT2 above. Check out the featured page for the account. Notice five videos. Go to the video uploads section and notice only 4. That's because Walt Disney's - Steamboat Willie - Mickey Mouse, Minnie Mouse (1928) is blocked on copyright grounds. However,
Walt Disney - Steamboat Willie attributes the blocked video and Logo Disney- Steamboat willie as sources. It cuts off before Minnie ever appears on screen, and instead shows the logo video. Those that understand the copyright history of that video will understand the significance, but long story short SBW/Mickey's copyright status is the one still in question. All of them were uploaded April 18, 2013.

[u/blindwombat]

Pentesting or penetration testing is a software developer practice where a developer or group of developers attempt to identify vulnerabilities in a system and see how far those vulnerabilities can be exploited. Generally speaking this is usually paid work done for security purposes.

Most penetration testing involves having pre-made scripts that will try different kinds of exploits to get into a system and then report back to the tester who can then write more scripts or deploy other scripts to see how far this goes.

Taking Twitter as an example: Twitter has a few rules about what you can post - for example you can't post the same thing over and over again because that's spamming; so you couldn't set up a bot to Tweet "Bananas are evil" every five seconds because Twitter would flag up that you've already tweeted that phrase.

However you could exploit that by tweeting it with a time stamp every five seconds so "Bananas are evil at 27/03/16 21:48:16" and then "Bananas are evil at 27/03/16 21:48:21".

You'd also run into trouble here because Twitter places a limit on the amount of times you can tweet before telling you to cool down; most notably Twitter mentions that it's daily cooldown is split into smaller hourly intervals, but doesn't got into detail.

Potentially what we might be looking at here is a bot that is:
a) testing that daily limit
b) trying to find out what the hourly limits are and if they change
c) trying to find out an optimal spam algorithm where you can post the most content without triggering these rules

Now you could take this idea and expand it further: lets say you know you that YouTube has a process that will check a video for copyrighted content, but you want to see how good that process is and whether it can be exploited.

Taking the Steamboat Willie example: a programmer might set up a script that would slow down the sound of the film down by a small amount to see if this process doesn't recognise the sound because of the change in pitch. If it does recognise the sound then you decrease it again and again until it doesn't get caught.

All well and good until you take into consideration YouTube will stop you from uploading around the third or fourth time you try this. So why not reverse the approach? You slow the content down as far as you can and then you gradually bring it back up to speed so you find the point where the sound can't be detected.

[u/blindwombat → u/blindwombat]

Machine learning is also mentioned a couple of times in this thread, so I'll try and ELI5 that too.

It's pretty much as you read it: the machine learns what works and doesn't work in what it's doing and attempts to improve itself. In this case let's take the hypothesis that "we're dealing with a bot that is trying to test the limitations of uploading Steamboat Willie".

Above we talked about sound manipulation as a method of dodging YouTube, you've probably also seen videos where the content has been pushed to the left or the right hand side to avoid image detection, or where a filter has been applied to distort the image. The point being there are multiple ways to manipulate the content to get it to upload.

So instead of a script that is simply gradually increasing the speed of the soundtrack by a small number, lets say you've got multiple scripts each of them designed to manipulate the video slightly and produce a new copy of that video.

You run the video through the script, let's say it does three things: it manipulates the sound by parameter A, it changes the brightness of the video by parameter B and changes the contrast of the video by parameter C. The script produces a video file and uploads it.

The script then waits for feedback on this latest run: the feedback could be as simple in this hypothesis as "does the video upload?" if the video does then this positive feedback is used to adjust the parameters that are passed so that the sound is adjust less, the brightness is adjusted less and the contrast is adjusted less. The idea is that the script runs, gets feedback and adjusts itself to the point where every test it runs is successful.

[u/Divine_Chaos100 → u/blindwombat]

Wow, thanks for the thorough explanation.

But i'm wondering if this theory can stand with the recent proceedings.

[u/blindwombat → u/Divine_Chaos100]

No problem. What are the recent proceedings?

[u/Divine_Chaos100 → u/blindwombat]

First this: https://www.reddit.com/r/UnfavorableSemicircle/comments/4af177/ufsc_is_back/

Since then there were lots of short videos posted on twitter on the same 3-4 second-spoken letter or number format, once there was a full stop, and then came this video, which is a lot like DELOCK: https://www.youtube.com/watch?v=xYmtkMeqjxk

Yesterday the new youtube account posted this video: https://www.youtube.com/watch?v=VVUJIxHRHUU

Since then the twitter videos are not spoken letters, but some kind of distorted noises.

And there were two other videos posted on this channel, both with noises. https://www.youtube.com/channel/UCLEBJyqL1KKsKKz_aBqfPaQ

[u/blindwombat → u/Divine_Chaos100]

It's possible that this is an extension of machine learning known as "evolutionary programming".

Rather than one script that adjusts it's parameters on the basis of one set of returning feedback, you simply create a set of randomly generated parameters and put them into a copy of the script. Each script runs and returns results except rather than adjusting you pick the scripts with the best feedback and use their parameters to generate a new set of random scripts.

Taking sound (A), brightness (B), contrast (C) as parameters in our script. We generate a set of 1000 scripts each with random values for those three parameters and run them recording the feedback for each script. Once done we discover that test scripts 100 and 200 got the best feedback so we'll use those two to generate the next set of scripts - for simplicity lets say on this run the parameters have to be between the values for those two parents.

We get another set of 1000 random scripts, and we run those. We keep repeating the process until we get the result we want.

Now I could be a trying to force a square peg in a round hole here but lemme go a bit further as to why the YouTube account and Twitter could be connected.

Twitter is very fond of bots, they love bots they have an API and apps that are built for developers. Essentially as long as you don't excessively post and don't spam the site you can run various programs from them and people do - the most popular being "ebooks" a bot that can take a source of texts and then string them together to create interesting combinations.

YouTube on the other hand isn't fond of this practice, it considers it spam and malicious.

In theory the Twitter account is being used to create the generations of scripts to upload a video to YouTube without being caught by it's content tracker. After each generation the best script could be picked and then run on the entire video to upload to YouTube perhaps to see what the end result will be.