6 ms·
The repo readme is pretty telling - this is being leaked to force this particular key to be blacklisted, I guess one group annoyed with others and wanting to cu
by garblegarble 5y ago
The repo readme is pretty telling - this is being leaked to force this particular key to be blacklisted, I guess one group annoyed with others and wanting to cut off their access (and presumably the leaking group already has other L1 keys so doesn't fear this key being burned...)
- charcircuit 5y agoor they had the skills to just dump it again Edit: nvm I understood which key you were talking about. I would have replied, but I'm rate limited.
- garblegarble 5y agoAh, I thought L1 keys were burned into hardware, so blacklisting this key was effectively blacklisting a bunch of Lenovo tablets from accessing 4K HDR streaming? Edit: looks like I'm wrong about this, and the Widevine L1 keys can be changed with a firmware update. There's an interesting breakdown of how it works on Qualcomm chips here: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-execution.html http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...
- londons_explore 5y agoDoes this mean if I have a lenovo tablet that currently streams 4K, that it will lose 4K video support? Could I ask Lenovo for a refund?
- nikanj 5y agoYes and yes. Lenovo probably doesn’t give a shit, though. But you can ask!
- Scoundreller 5y agoDepends on the country. Some do have some liability on manufacturers and/or vendors for defects. Unsure if an asterisk in their click through contract about key revocation would even matter.
- garblegarble 5y agoI would think so (the repo suggests this is a Lenovo TB-X505X key, I'd imagine they're at least per-product). I could certainly be be wrong about L1 keys being burned-in, that was just my understanding of it (vendor docs say things like "Hardware DRM", but maybe I'm jumping to conclusions from marketing speak) The Widevine spec doesn't say either, it just says that all processing is within the Trusted Execution Environment, so I suppose the keys could be loaded/updated in firmware. I'm looking for more docs now... Edit: looks like I was wrong and they can be changed with firmware updates: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-execution.html http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...
- alias_neo 5y agoTEE is an environment with hardware backed attestation, you run a piece of software in the "black box" to do things like key generation etc. My educated guess, having used TEE/TrustZone for keys is that they could update the payload (the "Trusted Executable") with a new one to resolve the issue.
- jeroenhd 5y agoYou should be able to ask Lenovo for a refund if you've bought the device with this feature in mind and if Lenovo advertised the ability to watch 4K on your preferred streaming service. If the device just happens to support 4k, you may be out of luck. You could try sueing the parties that are supposed to deliver the 4k content and have revoked the key, but I doubt you'll get much out of them. If you rely on DRM, the media industry has all the keys. You're left to their whims when it comes to content consumption, and there's very little you can do.
- NavinF 5y agoWould they release a firmware update with new keys though? If they can’t fix the vulnerability, the new keys would get dumped just like the old ones.
- betterunix2 5y agoThere is something amusing about weaponizing the key revocation process like this...
- hatware 5y agoEverything about it is fascinating. These people all have day jobs yet they provide a better experience than the multi-trillion dollar corporations that are releasing the product in the first place.
- londons_explore 5y agoThese people probably all have day school... I think most people who get past school age tend to retire out of this crowd of people...
- Wiseacre 5y agoI would just like to point out that this is a forum called Hacker News.
- nurettin 5y agoPeople come to HN to discuss whether the hacking blog's title was too big for their tastes or if the content is readable by every disabled person under the sun. The comment section is literally pain incarnate for actual hackers.
- hatware 5y agoAre you implying that young adults are more responsible for the state of piracy today than adults? I don't see that at all.
- dijit 5y agoI feel like I have to defend the parent here. My experience in the nulling/warez/pirating community is that it tends to be young adults doing the majority of the work and mostly they do it for kudos and not monetary benefit. Adults might be giving them the kudos, but the hard work (again, in my experience) is young adults, of school age.
- tyingq 5y agoI also noticed it provides part of the functionality with a .pyc file, without including the normal python source. This one, for example: https://github.com/widevinedump/WV-AMZN-4K-RIPPER/blob/main/wvripper.pyc https://github.com/widevinedump/WV-AMZN-4K-RIPPER/blob/main/... I'd be a little leery of running that outside of a sandbox.
- rolandog 5y agoDo you think it could probably be decompiled? [0]. [0]: https://stackoverflow.com/a/14808336/297570 https://stackoverflow.com/a/14808336/297570
- masterofpupp3ts 5y agoForgive me for my ignorance, but would you mind explaining why providing functionality with a .pyc is potentially a red flag? I'm interested in learning more about Python codebases.
- tomc1985 5y ago.pyc files are the compiled bytecode for its corresponding .py file. It's scrambled, you would need a decompiler to inspect the source code and it would be very hard to read (compared to the original source). People typically ship .pyc files when they want to hide what they are doing, for a wide variety of reasons.
- masterofpupp3ts 5y agoOh! That makes complete sense. I didn't know .pyc was the bytecode of a Python file. Thank you!