13 ms·
Trying to extract Widewine key: A journey to failure
- marcodiego 5y agoHmmm... Would love if this allows me watch netflix using a fully FLOSSed arm sbc.
- baybal2 5y agoThe point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't bother to put a single OTA. This is also likely why Netflix uses such a silly restrictions as refusing to run on old Android version numbers on some Snapdragon handsets, which are easily root bypassable.
- step21 5y agoWhat's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.
- baybal2 5y agoWidevine L1 - the hardware DRM in ARM trustzone with individual keys for each chip.
- nyuszika7h 5y ago1080p WEB-DLs are very common if you're in the right places, but even public trackers should have plenty. 4K is slightly less common but does also happen, with frequency depending on the streaming service.
- gruez 5y ago>so at least it protects fullhd or 4k. Not really. Popular streaming-exclusive shows often get 1080p versions released within a few hours, and the 2160p versions released within a few days.
- drudu 5y agoI cannot find a single popular movie that's available to stream which isn't also available as a 4k WEB-DL on a popular, well known, private tracker.
- denkmoon 5y agoThe Grand Tour S04E03 4k web-dl is readily available on private torrent trackers hours after public release on Amazon Prime. No idea what encryption Amazon use, but suffice to say it is thoroughly broken by someone out there. Given the expense of acquiring those presenters and the production costs of their shows, and how they bring people to the Prime video platform, I suspect Amazon is reasonably interested in keeping that content protected.
- nyuszika7h 5y agoLately Google has mostly stopped revoking whole devices. Instead, when someone extracts a key from a device and it leaks publicly, they just revoke that one specific device's key. That improves the experience for legitimate users, but also means the person who extracted the key can just go buy another device of the same model and use the same exploit to extract a new working key.
- vladvasiliu 5y agoI've never really looked long into these things, but now that most GPUs do the actual video decoding, how come it's still not possible to use Linux or any random OS? Isn't the GPU supposed to somehow guarantee that it only sends the decrypted stream to a compliant screen? Isn't this the point of HDCP? When this was done in software, I understand that open source decoders could have been modified to pipe the clear stream to disk, but now the software basically just hands the encrypted blob to a "trusted" hardware decoder. Or am I missing something?
- MaXtreeM 5y agoLinux is not the issue here but ARM processor as OP said. First DRM library for ARM came only earlier this year so finally I am able to play DRM content on Raspberry Pi 4 in Chromium but I am not going to because chromium is painfully slow and plugin maintainers have figured out how to play Netflix in Kodi. edit: DRM library still doesn't get to "fully FLOSSed"
- vladvasiliu 5y agoSo then Netflix et al.'s requirement of Windows or macOS in order to play high definition video is purely artificial on x86? Last time I checked (a few months ago) they didn't even support Chrome (either Windows or Mac) for UHD, they required Safari, Edge or their own Windows app.
- jeroenhd 5y agoThe UHD restriction is not a technical one. Content producers and the rest of the media industry has strict requirements about streaming. UHD content uses proprietary DRM systems from Microsoft and Apple that are considered more secure than WideVine, which is why those browsers are permitted to watch 4k. You can't watch UHD content on Edge for Linux, for example, because the necessary DRM isn't implemented.
- Macha 5y agoAlthough, you used to be able to watch it in Windows Edge in Wine.
- detaro 5y agoactual title: Trying to extract Widewine key: A journey to FaIlUrE
- classified 5y agoThe bad font on GitHub makes "FaIlUrE" look like "FallUrE". I thought it must have been a typo.
- zinekeller 5y agoBad Windows font, probably. It's just using the default system fonts, which in case of Segoe UI doesn't employ caps for I. Ironically, Segoe (just Segoe, the reference font) do have caps on I.
- classified 5y agoI stand corrected (I didn't look up the CSS, can't do that in Safari on iPad). That leaves room for improvement in my browser's default font then.
- zinekeller 5y agoNote that system fonts usually can't be overridden in browsers, you need to inject custom CSS with the override.
- londons_explore 5y agoEvery time this is broken, am I right in saying all encrypted media needs to be re-encrypted with the updated version of widevine?
- baybal2 5y ago> Every time this is broken, am I right in saying all encrypted media needs to be re-encrypted with the updated version of widevine? Yes, but so far no big Netflix-like website did it. It's a credible guess that all encrypted L1 content long been downloaded, and is just waiting decryption (NF used to use HTTP to serve encrypted files in the open, without any API wall some years ago)
- Mindwipe 5y agoNo. The media is encrypted with Common Encryption regardless. This is only about key management.
- numpad0 5y agoBy this point everyone would agree that platforms that eliminate all piracy dies. So they’ll send out couple DMCAs until it’s sufficiently unknown and that’ll be all.
- nyuszika7h 5y agoNo. Once Google revokes an old version of the CDM, the servers will refuse to issue a license for that version. The license basically contains encrypted keys for the content. If you already saved the decrypted keys for a specific content, you will be able to decrypt it even after the revocation, but you won't be able to get the keys for any new content with that version anymore. We're not (yet) at the point where actual content keys are rotated frequently, because that sounds like a lot of effort though technologies exist for this already, they're just not in widespread use.
- azalemeth 5y agoFrom the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy my games from gog.com and itch.io and the like, get media from free-to-air television and state broadcasters, and buy music either from the artist or from good and reputable music labels like hyperion.co.uk. I buy books in a dead-tree form, or as DRM-free PDFs. I will simply not buy, use, or support DRM and I occasionally tell firms that I am not giving them business because of their inane corporate decisions. This might seem like a hard rant, but all of these binary blobs can be broken with varying degree of difficulty -- as this person's work shows -- because DRM is fundamentally pointless. It's such a waste of human endeavor! Think how many CPU cycles are burnt doing this! Estimate what the total cost of HDCP + Widevine + DRM etc is on the planet! It is pointless, insulting, and frustrating! </rant>.
- 10000truths 5y ago> This might seem like a hard rant, but all of these binary blobs can be broken with varying degree of difficulty -- as this person's work shows -- because DRM is fundamentally pointless. I think that this ease of circumventing DRM is actually an indirect, but major, reason why movie theaters will never really go away. Online streaming new movie releases is great for direct-to-consumer business, but it comes with the risk of losing control of your distribution due to ease of piracy. Why would a frugal person pay $30 for "premier access" to a new movie on Disney+ when they can just go to Pirate Bay and torrent a perfect-quality rip for free? It's much easier to keep AMC Theatres in line than a global network of average Joes.
- wincy 5y agoI used to go to the movie theatres all the time and spend $30+ to see a movie in the Dolby Digital Experience and the like, but it’s easier for me to pirate than it is for me to sign up for whatever streaming service and watch a movie there. They’re always available immediately after release in the highest quality.
- ramshanker 5y agoSo in the end, Widevine complexity won. For now. I have always thought that obfuscation is easier to undo. It is the underlying MATH which is difficult. The best anti-cheat are Math heavy than the instruction trickery. Though both are present simultaneously.
- bawolff 5y agoFrom the repo > In the end, I only extracted about half of the RSA key. Not a cryptographer, but i thought half the rsa key was all you needed with coopersmith's attack.
- Godel_unicode 5y agoAlthough I too am no cryptographer, I believe there is an additional constraint where the public exponent needs to be small. Also the paper I read says these conditions can lead to discovery of the key in "polynomial time" which doesn't necessarily mean fast.
- bawolff 5y agoI'm again talking out of my depth, so take this with salt, but my understanding is the small public exponent is for the sterotyped message version of that attack not the partial key recovery variant. Looking at this page https://www.cryptologie.net/article/222/implementation-of-coppersmith-attack-rsa-attack-using-lattice-reductions/ https://www.cryptologie.net/article/222/implementation-of-co... it looks like the exponent isn't even an input to the algorithm when doing key recovery
- bubuanabelas 5y agoDRM consumes more energy annually than Bitcoin (needs to be fact checked) so breaking it and distributing the decrypted media is a favor to the environment and humanity.
- YetAnotherNick 5y agoCan someone explain what's the point of DRM for video streaming when you can do screen recording so easily. It could make sense in books and games but why is netflix such a heavy proponent for it?
- bawolff 5y agoDepending on the solution,it might involve watermarking so that they can trace where the streams that end up on the internet come from and cut off those users. If nothing else, im sure it shows up in the analytics if someone's netflix account is 24/7 streaming every episode of every show without break. Although the real answer is probably: studios require it in their contracts and netflix has to play nice.
- Wowfunhappy 5y ago> If nothing else, im sure it shows up in the analytics if someone's netflix account is 24/7 streaming every episode of every show without break. That would happen with or without DRM.
- lathiat 5y agoYou will most likely find that your OS gives you a black square for the DRM content when you record the screen. This is facilitated by OS support on Windows, iOS, etc. It’s also why HDCP exists to prevent capture from HDMI etc.
- zucker42 5y agoHasn't this person committed a crime if they are in the U.S.?[1] Not that I think that this is morally wrong, just that I've always been concerned that people who try this and gain enough attention could face legal penalties. I would not do something like this without taking measures to stay anonymous. A similar case is the PS3 hacking case. [1] https://www.law.cornell.edu/uscode/text/17/1201 https://www.law.cornell.edu/uscode/text/17/1201
- krageon 5y agoThe world is large, so I'm not convinced this is an interesting question unless we're already certain where they are. We don't bother to discuss Indian or Chinese law on these matters either (even though both of those countries are also large).
- joshmn 5y agoThe majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort. What's the point if someone with a faint degree of technical ability can redirect your content? I'd argue you're just putting lipstick on a pig. The idea itself is nice; I get the point. If I'm a studio I want people to pay for the product. DRM doesn't encourage people do that at all. It's like the idea of media blackouts in local markets: you're just driving people to alternative sources, not to buy a cable package.
- native_samples 5y agoThe majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort But, apparently not Widevine and not the kind of HN reader who wrote the article. They spent weeks trying to extract the key and failed. The article is a story of their failure.
- joshmn 5y agoThat's one way of looking at it. Who says you need to extract the key for playback?
- native_samples 5y agoThe thing with the key is also checking if you're licensed, and negotiating with the OS/GPU/display device to prevent you from screen recording it. So the key isn't useless. It doesn't stop you from pointing a camera at the screen and recording it that way, but stuff like Cinavia can stop that too. So, the key does matter.
- BizarroLand 5y agoMy dad used to say that locks are only used to keep the honest criminals out.