By Charlie Sorrel
http://www.wired.com
Programmer James Laird wanted to help his girlfriend stream her iTunes music in her new house, so he hacked away at Apple’s private key for streaming music, reverse-engineered the script, and made it available to the public.
Laird calls his open source Perl script Shairport, which lets hardware and software receive AirTunes music from iTunes.
Apple uses a public-key encryption scheme for AirTunes streaming. This lets anyone encrypt and stream audio to the AirPort Express (or other compatible device), but iTunes would only stream to Apple devices. Now, with Shairport, iTunes can be tricked into streaming audio to anything at all.
Laird did this by cracking open the AirPort Express (literally), dumping the ROM and then searching around for the private key. Apparently this was easy to find, as Apple had hidden the private key “in the ROM image, using a scheme that made the de-obfuscation code itself stand out like a flare.” He then cracked the crypto and now has the key.
This is combined with an ALAC (Apple Lossless Audio Codec) decoder to make a small package that can be installed on computer. It’s unlikely that hardware manufacturers will risk using this solution, but it’s easy to see how a home user could install it on an unused computer or even a Linux-based router.
That means we’ll likely see some third-party programs taking advantage of Shairport. For example, someone might make an app for the Xbox 360 capable of streaming music from iTunes on your PC. Or, say you have a MacBook Air and want to stream music to your friend’s iMac — Shairport makes this possible.
When up and running, the Shairport machine shows up as a regular AirTunes share in iTunes, or on your iPad or iPhone, and works just as you’d expect, so Laird’s girlfriend can use it just like her old AirPort Express.
I wonder: Will Apple will close this hole? It seems pointless to do so, as this hack will likely only be used by intrepid hackers such as you, dear Gadget Lab reader. Still, with Apple, you never know.
ShairPort 0.01 released [Mafipulation via Hacker News via Apple Insider]
