Hacking Rdio Postmortem

the following post was a post i made couple of days ago. then took it down once i realized the affect it had on the rdio team.

the rdio team has taken steps to rate limit the downloading in the way described in the following post. which means its still possible but extremely slow to download. i am sure there are other illegal ways to get music you want.

on a personal note, i learned quite a bit from this experience.

it all started innocently enough. last day of work before a two week vacation. i use rdio all the time for music while programming. embarrassingly so in fact.

so in preparation for my trip, i was trying to download some of the talks from djangocon europe for my flight for offline enjoyment. using one of these pieces of software i noticed that it was able to download the current song i was listening to on rdio.

so 3 flights later and 4 days without reliable internet later. i managed to reproduce the fluke that i randomly ran into.

here is how i did it.

poking around.

once i saw that software i was using to offline videos was downloading rdio songs. i popped over into the inspector and took a look at the network tab and saw that they are sending a file called full-192.mp3 which means full song at a bitrate of 192k.

hmm. okay.

rolling up my sleeves

so i decided to crack out some tools. first i needed to get a better understanding of the communication between rdio’s servers and my machine.

enter mitmproxy , which is a man-in-the-middle proxy for http. this gave me a bit more of an understanding of the traffic rdio is sending around and eventually allowed me to script a way to download full mp3 versions of any song on their service.

on to the details.

as you can see in the image above; we were also able to capture the get request being sent for the full-192.mp3 which returns the entire song being requested.  that’s all good.

whats awesome is the response below.

yep, the entire content of the full-192.mp3!!

once you have reached this point a little (under 10 lines) script is all that is needed to download the full mp3 to your computer.

hopefully the rdio team gets a handle on this soon.

edit : same bug occurs in their “native” application as well on osx.

edit 2 : my intention here is not to be malicious. it is to point out this bug and see that it gets resolved and hopefully they will get it fixed soon. i love rdio as a service.