A method of detecting an unauthorized access of data, the method comprising: receiving data from a content provider (125, 150) by a content reproducing device, the data being protected by encryption prior to the receiving; storing the received data in a memory storage device of the content reproducing device; decrypting the received data stored in the memory storage device into unencrypted data by a media player module executed on a processing device of the content reproducing device; storing the unencrypted data as unprotected data in an unprotected buffer such that the unprotected data is vulnerable to unauthorized access; obtaining an address range of the buffer of the content reproducing device; intercepting system application programming interface calls related to memory access of the address range of the buffer; comparing the intercepted system application programming interface calls to an expected sequence of memory access calls; determining that a particular system application programming interface call is unauthorized when the particular system application programming interface call accesses the address range of said buffer while not belonging to the expected sequence of memory access calls; and transmitting a message to the content provider in response to a determination that the unauthorized access of data has occurred, wherein the message includes identification information of the content reproducing device or identification information of a licensee of the data. receiving data from a content provider (125, 150) by a content reproducing device, the data being protected by encryption prior to the receiving; storing the received data in a memory storage device of the content reproducing device; decrypting the received data stored in the memory storage device into unencrypted data by a media player module executed on a processing device of the content reproducing device; storing the unencrypted data as unprotected data in an unprotected buffer such that the unprotected data is vulnerable to unauthorized access; obtaining an address range of the buffer of the content reproducing device; intercepting system application programming interface calls related to memory access of the address range of the buffer; comparing the intercepted system application programming interface calls to an expected sequence of memory access calls; determining that a particular system application programming interface call is unauthorized when the particular system application programming interface call accesses the address range of said buffer while not belonging to the expected sequence of memory access calls; and transmitting a message to the content provider in response to a determination that the unauthorized access of data has occurred, wherein the message includes identification information of the content reproducing device or identification information of a licensee of the data. belonging to the expected sequence of memory access calls; and transmitting a message to the content provider in response to a determination that the unauthorized access of data has occurred, wherein the message includes identification information of the content reproducing device or identification information of a licensee of the data.