3 ms·

The L1 device key they posted was already revoked earlier today. The tools themselves might continue to work for a while longer with an appropriate non-revoked

The L1 device key they posted was already revoked earlier today. The tools themselves might continue to work for a while longer with an appropriate non-revoked key depending on how much services want to change up their APIs.

scoopertrooper 5y ago
I can't see them changing up their APIs in any meaningful way. It'd seem kind of pointless to me. At the end of the day, if you're exposing something on the internet, then it won't take a huge amount of time for people to reverse engineer how web clients interact with the server. Main game should be rotating the L1 keys. I don't know about L2 keys, but rotating L3 keys seems like a lost cause to me, some dude made a Chrome extension that can extract them. Some theorise that Microsoft's Pluton/TPM antics with Windows 11 are a ploy to bring L1-style keys to the desktop. https://www.extremetech.com/computing/317512-microsoft-pluton-chip-will-bring-xbox-like-security-to-windows-pcs https://www.extremetech.com/computing/317512-microsoft-pluto... https://www.anandtech.com/show/16269/microsoft-pluton-hardware-security-coming-to-our-cpus-amd-intel-qualcomm https://www.anandtech.com/show/16269/microsoft-pluton-hardwa...
- nyuszika7h 5y ago
  You can't really "rotate" L1 keys without breaking HD playback on millions of old vulnerable devices and pissing off a ton of legitimate customers in the process. A hardware vulnerability can't be fixed with a software update. Instead, nowadays when a key is leaked usually Google just revokes the key of the unique device it was extracted from and not the entire model. But major streaming services often blacklist or limit playback quality on known compromised models. As for L1 on desktop, Google did announce exactly that [1], but TPM would be likely too weak for that, so maybe something like Intel ME would be used. But so far there's no evidence of them actually rolling anything like that out. So for now if you want hardware DRM on desktop you have to use Edge or native Windows 10 apps with PlayReady DRM. And about the APIs, streaming services do sometimes change up APIs, make old app versions stop working, etc., but often things work with no or minimal changes even years later. They do have to be careful not to break compatibility with all of their own apps across multiple platforms as well. [1] https://web.archive.org/web/20210819093936/https://widevine.com/news https://web.archive.org/web/20210819093936/https://widevine....
- adityapatadia 5y ago
  Here is the plugin: https://github.com/cryptonek/widevine-l3-decryptor https://github.com/cryptonek/widevine-l3-decryptor
marcan_42 5y ago
Widevine is completely broken ever since Nvidia Tegra devices were irreparably compromised due to a boot ROM bug. You can just pull the L1 key from any one of them, and Google can't mass revoke the entire device class since it would screw over a ton of legitimate users. (I don't know the details of how to dump the keys, I just know it's possible by definition given the security loss on that platform, and I'm sure some people have tooling for this somewhere)
- nyuszika7h 5y ago
  Well, what they did to Nvidia Tegra devices is either downgrade them to L3, or revoke them and issue a new L1 key for them. OTA updates patched something, but a hardware flaw can't be patched fully with a software update. However, most people nowadays are simply exploiting phones and tablets with old vulnerable MSM chips, there are a lot more of those to choose from. Usually what Google does now is when someone publicly leaks a compromised device key, they revoke the unique key of that specific device but not the whole model. However, sometimes streaming services (especially Amazon, Netflix and Disney+) may still choose to blacklist an entire vulnerable model and limit it to SD playback.

scoopertrooper 5y ago

I can't see them changing up their APIs in any meaningful way. It'd seem kind of pointless to me. At the end of the day, if you're exposing something on the internet, then it won't take a huge amount of time for people to reverse engineer how web clients interact with the server. Main game should be rotating the L1 keys. I don't know about L2 keys, but rotating L3 keys seems like a lost cause to me, some dude made a Chrome extension that can extract them. Some theorise that Microsoft's Pluton/TPM antics with Windows 11 are a ploy to bring L1-style keys to the desktop. https://www.extremetech.com/computing/317512-microsoft-pluton-chip-will-bring-xbox-like-security-to-windows-pcs https://www.extremetech.com/computing/317512-microsoft-pluto... https://www.anandtech.com/show/16269/microsoft-pluton-hardware-security-coming-to-our-cpus-amd-intel-qualcomm https://www.anandtech.com/show/16269/microsoft-pluton-hardwa...

nyuszika7h 5y ago
You can't really "rotate" L1 keys without breaking HD playback on millions of old vulnerable devices and pissing off a ton of legitimate customers in the process. A hardware vulnerability can't be fixed with a software update. Instead, nowadays when a key is leaked usually Google just revokes the key of the unique device it was extracted from and not the entire model. But major streaming services often blacklist or limit playback quality on known compromised models. As for L1 on desktop, Google did announce exactly that [1], but TPM would be likely too weak for that, so maybe something like Intel ME would be used. But so far there's no evidence of them actually rolling anything like that out. So for now if you want hardware DRM on desktop you have to use Edge or native Windows 10 apps with PlayReady DRM. And about the APIs, streaming services do sometimes change up APIs, make old app versions stop working, etc., but often things work with no or minimal changes even years later. They do have to be careful not to break compatibility with all of their own apps across multiple platforms as well. [1] https://web.archive.org/web/20210819093936/https://widevine.com/news https://web.archive.org/web/20210819093936/https://widevine....
adityapatadia 5y ago
Here is the plugin: https://github.com/cryptonek/widevine-l3-decryptor https://github.com/cryptonek/widevine-l3-decryptor

marcan_42 5y ago

Widevine is completely broken ever since Nvidia Tegra devices were irreparably compromised due to a boot ROM bug. You can just pull the L1 key from any one of them, and Google can't mass revoke the entire device class since it would screw over a ton of legitimate users. (I don't know the details of how to dump the keys, I just know it's possible by definition given the security loss on that platform, and I'm sure some people have tooling for this somewhere)

nyuszika7h 5y ago
Well, what they did to Nvidia Tegra devices is either downgrade them to L3, or revoke them and issue a new L1 key for them. OTA updates patched something, but a hardware flaw can't be patched fully with a software update. However, most people nowadays are simply exploiting phones and tablets with old vulnerable MSM chips, there are a lot more of those to choose from. Usually what Google does now is when someone publicly leaks a compromised device key, they revoke the unique key of that specific device but not the whole model. However, sometimes streaming services (especially Amazon, Netflix and Disney+) may still choose to blacklist an entire vulnerable model and limit it to SD playback.