Slashdot Mirror
Security Researcher Cracks Google's Widevine DRM (L3 Only) (zdnet.com)
The L3 protection level of Google's Widevine DRM technology has been cracked by a British security researcher who can now decrypt content transferred via DRM-protected multimedia streams. ZDNet's Catalin Cimpanu notes that while this "sounds very cool," it's not likely to fuel a massive piracy wave because "the hack works only against Widevine L3 streams, and not L2 and L1, which are the ones that carry high-quality audio and video content." From the report: Google designed its Widevine DRM technology to work on three data protection levels --L1, L2, and L3-- each usable in various scenarios. According to Google's docs, the differences between the three protection levels is as follows:
L1 - all content processing and cryptography operations are handled inside a CPU that supports a Trusted Execution Environment (TEE).
L2 - only cryptography operations are handled inside a TEE.
L3 - content processing and cryptography operations are (intentionally) handled outside of a TEE, or the device doesn't support a TEE
"Soooo, after a few evenings of work, I've 100% broken Widevine L3 DRM," [British security researcher David Buchanan] said on Twitter. "Their Whitebox AES-128 implementation is vulnerable to the well-studied DFA attack, which can be used to recover the original key. Then you can decrypt the MPEG-CENC streams with plain old ffmpeg." Albeit Buchanan did not yet release any proof-of-concept code, it wouldn't help anyone if he did. In order to get the DRM-encrypted data blob that you want to decrypt, an attacker would still need "the right/permission" to receive the data blob in the first place. If a Netflix pirate would have this right (being an account holder), then he'd most likely (ab)use it to pirate a higher-quality version of the content, instead of bothering to decrypt low-res video and lo-fi audio. The only advantage is in regards to automating the pirating process, but as some users have pointed out, this isn't very appealing in today's tech scene where almost all devices are capable of playing HD multimedia [1, 2].
L1 - all content processing and cryptography operations are handled inside a CPU that supports a Trusted Execution Environment (TEE).
L2 - only cryptography operations are handled inside a TEE.
L3 - content processing and cryptography operations are (intentionally) handled outside of a TEE, or the device doesn't support a TEE
"Soooo, after a few evenings of work, I've 100% broken Widevine L3 DRM," [British security researcher David Buchanan] said on Twitter. "Their Whitebox AES-128 implementation is vulnerable to the well-studied DFA attack, which can be used to recover the original key. Then you can decrypt the MPEG-CENC streams with plain old ffmpeg." Albeit Buchanan did not yet release any proof-of-concept code, it wouldn't help anyone if he did. In order to get the DRM-encrypted data blob that you want to decrypt, an attacker would still need "the right/permission" to receive the data blob in the first place. If a Netflix pirate would have this right (being an account holder), then he'd most likely (ab)use it to pirate a higher-quality version of the content, instead of bothering to decrypt low-res video and lo-fi audio. The only advantage is in regards to automating the pirating process, but as some users have pointed out, this isn't very appealing in today's tech scene where almost all devices are capable of playing HD multimedia [1, 2].
I didn't even know that Google is in this shit business. Good to know, in order to avoid products that use this DRM crap.
I remember back in the early 2000s when google sounded like some sort of geek paradise where they also paid you.
Now it's all about privacy violation and apparently DRM now too. Yuck.
SJW n. One who posts facts.
With respect to piracy of entertainment streams, what does it matter when HDCP is so eminently hackable? Widevine has been around forever and has not made any difference to unauthorized recording and distribution of video and audio.
Widevine protects the stream down to the user's endpoint where it is conveniently stripped of any effective protection. I don't see how the entire stream path can ever be completely locked down.
Widevine exists only to satisfy contract demands by content providers to protect the streams. Lot$ spent (and passed on to the consumer) to do nothing.
Be honest. If you got paid to develop something you KNOW cannot work and are not required to make it work... would you refuse?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Did anyone even know about this before now?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The key to Netflix's success: Ease to use (even my mother can find and watch the series she likes, without my help) and reasonable price. Is it so hard to put it in the minds of executives from content companies?
Religion: The greatest weapon of mass destruction of all time
Yup. For all those 5 of us still using firefox post-52 Quantum, the old NPAPI plug-in architecture/plumbing is still inthere, alive and well. It is used to support certain "strategic" plug-ins. Only by "invite".
Flash is the one which garnered the most publicity, but a few others still exist, and Google's SandVine is among them. In my install, the other one is Cisco's H264 decoder Plug in. Others may exist. Please notice that this has nothing to do with your previous install. If your plug-in is in the white list, it will be installed. If not, firefox will refuse to run it, even if all the plumbing is still there because "Quantum" and "Reasons"...
*** Suerte a todos y Feliz dia!
I pity people who think they "need" to buy HD / 4K / 8K. I've literally never looked at a movie and thought "Oh, that needs more resolution". Not in 1980's VHS, not now.
Now, computer desktops may be different - that requires per-pixel accuracy in some cases - but you'll find that those people who do 4K desktops also have anti-aliasing and all kinds of other shit enabled too.
It's a pissing contest. I pity them if they honestly cannot watch SD without flinching. First, because it's just in their heads, second, it's because they're looking for flaws rather than watching the movie, third, because they are never going to be satisfied, fourth because it costs them more to get the same level of satisfaction as I get from SD.
SD. Stereo. 44Khz audio. 128Kbit MP3. Non-HDR. I'd be happy if we'd never gone past SVGA.
Think to yourself: When was the last time you had the VERY LATEST tech and said "Oh, that's still pixellated?" Never. So why would you then need to replace that technology a few years later for something "better"?
Because when you had SD it was an improvement over analogue video, when you got HD it was an improvement over SD, etc. etc... and you only cared if you sat there counting dots.
I would until I found a job that was more personally fulfilling. I once worked on a doomed project, and it was demotivating as hell. I was weeks away from quitting when the guy in charge got canned.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Ooo! That's exactly what Mr. Robot said!
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Vision checked regularly.
95" diagonal projected display, capable of 1080p.
Literally, I stopped pressing the HD channels as they do nothing. I never bought films in HD (unless they were the same price as the SD version), because they do nothing. I watch Netflix, Amazon Prime, DVB-T2, and everything else in SD.
At the distances involved, even at a huge screen size, it makes no difference. None. Sure, if you projected my Windows desktop there, I'd notice straight away if it wasn't even in the original rez, and I could spot a stray dot on the screen at 20 paces.
But watching moving video content, even animations? No. I can't notice it. Nor can most people.
I've literally challenged people who give me this shit at parties to tell me whether the screen is on BBC One or BBC One HD, etc. They can't, no more than random chance.
P.S. I've watched 2001 in both formats. a) It's a dire movie filled with nothing but music and endless slow-motion space scenes with no dialogue - you have all the time in the world to spot a pixel, so any encoding of it is going to have a real easy time removing edges and anything you do spot will be MPEG artifacts. b) I wouldn't be able to tell the difference, unless challenged, and allowed to get right up close to the screen.
Play it under VLC, with the right aliasing and deinterlacing options etc. and I guarantee you can't tell the difference. In which case, I'd rather pay for the SD version and turn on such options.
He cracked this bs and now Google and Netflix cut access to streaming of people with L3 devices. Even if you pay HD, you are now restricted to 480p.