4 ms·

I actually looked at the widevine DLL at some point out of curiosity. It didn't seem obfuscated in any way. Honestly I think getting the keys to the encrypted s

by keyme 8y ago

I actually looked at the widevine DLL at some point out of curiosity. It didn't seem obfuscated in any way. Honestly I think getting the keys to the encrypted streams out of there is at the difficulty level of an average CTF challenge. The reason you don't see PoCs, is because it's strictly illegal to distribute such code. Even the act of reversing this DLL is illegal.

A2017U1 8y ago
The article claims he informed them but in the original tweet thread it was the opposite and he said it wasn't even an exploit so didnt bother disclosing. I think the guy is awesome and very likely he did what he claimed, but do get annoyed about low effort Twitter journalism. Prove it or don't write it. It's very simple.
zb3 8y ago
In 2017 it was obfuscated using Arxan's "ProtectIT" (you can view the patent) and did use whitebox cryptography. I didn't look at the dll, but at the .so file for linux (for fun). I guess it should be harder now EDIT: If reversing this DLL/so is illegal, how I am supposed to be able to test for a potential security vulnerability? Not that I can do this, just wondering...
- bubblethink 8y ago
  >how I am supposed to be able to test for a potential security vulnerability? You aren't. There were some amendments made to DMCA recently that added a few more narrow provisions (mainly repairing tractors and such), but I don't think reverse engineering closed libraries was one of them. In particular, things close to DRM were not granted. For example, request for exemptions for tinkering with HDCP or optical drives were denied.
krzyk 8y ago
Reversing a DLL is maybe illegal in US, but in other countries not necessarily. E.g. in Poland (maybe even whole EU) one can reverse engineer anything in order to make it work on their OS, hardware etc. - this is the law, it overrides any kind of EULA.

4 ms·

I actually looked at the widevine DLL at some point out of curiosity. It didn't seem obfuscated in any way. Honestly I think getting the keys to the encrypted s

by keyme 8y ago

A2017U1 8y ago
The article claims he informed them but in the original tweet thread it was the opposite and he said it wasn't even an exploit so didnt bother disclosing. I think the guy is awesome and very likely he did what he claimed, but do get annoyed about low effort Twitter journalism. Prove it or don't write it. It's very simple.
zb3 8y ago
In 2017 it was obfuscated using Arxan's "ProtectIT" (you can view the patent) and did use whitebox cryptography. I didn't look at the dll, but at the .so file for linux (for fun). I guess it should be harder now EDIT: If reversing this DLL/so is illegal, how I am supposed to be able to test for a potential security vulnerability? Not that I can do this, just wondering...
- bubblethink 8y ago
  >how I am supposed to be able to test for a potential security vulnerability? You aren't. There were some amendments made to DMCA recently that added a few more narrow provisions (mainly repairing tractors and such), but I don't think reverse engineering closed libraries was one of them. In particular, things close to DRM were not granted. For example, request for exemptions for tinkering with HDCP or optical drives were denied.
krzyk 8y ago
Reversing a DLL is maybe illegal in US, but in other countries not necessarily. E.g. in Poland (maybe even whole EU) one can reverse engineer anything in order to make it work on their OS, hardware etc. - this is the law, it overrides any kind of EULA.