Microsoft PlayReady – Complete Client Identity Compromise

https://seclists.org/fulldisclosure/2024/May/5

by tithe • 2 years ago

182 168 2 years ago

So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?

repelsteeltje5• 2 years ago

Yup.

Basically the means to forge an authenticated cookie.

[Update]

It's a bit more subtle: Having the keys to forge a license request and decrypt server response allows you to emmulate or re-implement a DRM client.

Because the server is oblivious to this fake, it will respond as though it's taking to a genuine "secure" client thereby ultimately exposing the content decryption key.

xurukefi2• 2 years ago

The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers.

The attack essentially means that they could write a program themselves that acts as "Windows.Media.Protection.PlayReady.dll" to get decryption keys from a server. What will happen now is that Microsoft will deprecate the client and release a new one with new obfuscation and new keys. The license servers will start rejecting the old cracked client. And then people will crack the new client. And the cycle continues.

nonrandomstring3• 2 years ago

The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives

Thanks for the clarification.

Otherwise people would be worried about being targeted and having "personal" keys tied to a financial account or online identity getting sold and used by others to access arbitary content.

This seems kinda good news for concerned users, but even worse news for Microsoft.

qingcharles3• 2 years ago

Does PlayReady now require a secure enclave/TPM on your PC? Otherwise as you say, the only thing protecting the keys is obfuscation. This has been the same way all the way back to the first Microsoft DRMv1 in 1998 (?).

The decryption keys have to be stored on your device so you can play your media or your game. So, the level of encryption is totally moot. The level of obfuscation is all that really protects the content.

zeta0134• 2 years ago

In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means.

Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient storage format.

repelsteeltje5• 2 years ago

Yes, there is always the analogue loophole. And opening cryptography toolbox to control how users consume content is a lost cause. Crypto can only protect contents from adversaries that don't have the key. But here the paying user is the adversary and the only way the DRM can paint the video on screen is through that key.

So DRM boils down to security through obscurity. Turns out obscurity is hard, expensive and never works very well.

Jerrrry3• 2 years ago

Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information.

The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the common script kiddie.

This is how exploit chains get a foot-hold, and "secure" accounts get compromised like it was 2010 again.

nonrandomstring3• 2 years ago

And it paints an even bigger target on domestic Windows machines used for media content.

Who wants to "steal" their _own_ keys?

Microsoft's broken DRM scheme creates objects of value which it then tries to store on the client's machine deliberately beyond the owners control and security management. It is adversarial to the user. This is clearly a no-win situation... hence the snarky sign-off about vendors "raising the bar", basically saying; Good luck with that! It really seems quite unhinged.

So now there is collateral damage:

  - A motive to hack Windows machines to steal content keys.

  - A misuse of "identities" through a market in stolen keys

  - Pivots (as parent says) to other malware vectors

So, predictably, because of DRM, Microsoft Windows is now an even more dangerous and insecure system. Why do people persist chasing this unnecessary, pathologically involuted technological misadventure? Surely "controlling and monitoring peoples content" is not a hill worth dying on?

Jerrrry3• 2 years ago

I'd agree, but licensed content can be revoked - MS is pretty good at publishing digests of "known-compromised" ID's/Serials/Private Keys.

I'd be more concerned about any other, more important facets of a user's account/assets/property that assumes the DRM is secure, and leans on that.

amaccuish• 2 years ago

I don't understand a word you've said.

Jerrrry3• 2 years ago

Find an endpoint that checks the validity of the DRM token they have broken.

See if that endpoint just hinges on that DRM token, since its crypto-secure, why check any other fields?

Spoof other fields.

10k+ 0-day exploit.

londons_explore• 2 years ago

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours?

I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

makin• 2 years ago

Denuvo mostly works. Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all. The price is lowered performance, of course.

free_bip• 2 years ago

That's a video game DRM scheme, not a video DRM scheme

ParetoOptimal3• 2 years ago

Denuvo mostly works.

Not for users: https://gamerant.com/denuvo-outage-servers-down-persona-5-ro...

Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all

From what I hear, it's cracked in a matter of days or weeks. I haven't checked whether this is true or not, so I can't say you are wrong about some (most?) cracks taking months.

lossolo3• 2 years ago

Allegedly they have a custom approach to each new game, so cracks can take months to appear

It's because it's tedious to crack it, it's not really a rocket science, they just generate new VM for the binary so you can't automate it, they inject A LOT of code paths which you need to manually follow and change. That's the only reason why games stay uncracked for months. It's a war of attrition.

with some unpopular games never having been cracked at all

That's not exactly true actually, you need to pay for Denuvo license every year, that's why after some months or a few years it's removed from most of the games.

jsheard7• 2 years ago

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanently broken though so everything is immediately available in at least 1080p.

4K Blurays are currently always ripped due to an unfixable compromise in Intel SGX allowing PowerDVDs keys to be extracted, they could close that hole by revoking PowerDVDs keys for new Bluray releases but they haven't done that yet. I imagine they will at some point because PowerDVD requires SGX to play UHDs, and Intel stopped supporting that on newer consumer hardware, so 4K Bluray playback on PCs is effectively being phased out.

ricktdotorg• 2 years ago

^^^ great comment. hard to imagine a better synposis of 4k DRM in ~2 grafs. thanks!

panzi2• 2 years ago

so everything is immediately available in at least 1080p.

Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)

h4x0rr• 2 years ago

Couldn't scene groups just keep the exploits for decrypting streams for themselves? Is there any way for Netflix/Widevine/PlayReady to detect this?

devrand• 2 years ago

It does seem like Netflix has been doing a decent cat-and-mouse game with Widevine for anything over 540p the last few months. There's been several shows that took several days to get properly copied (i.e. not just screen recorded).

486sx33• 2 years ago

“4K Bluray playback on PCs is effectively being phased out.”

Which will only perpetuate and speed up the problem. 4K blu ray discs suck on a lot of new tvs and players for frame rate and detail so the best visual experience is going to be on high dpi PCs (or Mac? Retina?)

If I can’t play a 4K blu ray I purchased on my pc… I’m going to probably download a ripped version and not feel guilty about it since I purchased the disc …

My M2 Pro can decode and play 4K without breaking a sweat and with amazing battery life on VLC player

grishka3• 2 years ago

the entire signal path to use strong encryption

But the display panel itself still receives an unencrypted LVDS signal, which should not be too hard to decode. There are (were?) also cheap HDMI splitters that conveniently strip HDCP.

Your only issue is that yes, you can't get at the original compressed video stream and have to reencode, possibly losing a tiny bit of quality.

m4tu4g• 2 years ago

To add more to this, not essentially 4K is the only thing behind L1, even HD streams can be with L1.

It's entirely the services' choice to use what they want, like they can even put SD stream behind L1 and leave 4K for L3 (this happens widely in lesser known services & L2 is hardly used). Also Amazon's 4K is different from Netflix's 4K considering the key revocation TAT. So everything changes from service to service.

int_19h8• 2 years ago

Not immediately; sometimes when they revoke the keys it can take a few months for the likes of StreamFab and AnyStream to catch up even with 1080p. E.g. StreamFab is currently stuck on 480p for Netflix, and it has been like that since January.

miki123211• 2 years ago

The point is pressure on equipment manufacturers, making borrowing and streaming work for digital content, maybe also deterring casual piracy, not necessarily protecting videos from appearing on tpb.

gwbas1c• 2 years ago

have never kept the bad guys out

Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.

I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter" sign that you can choose to ignore if you have reason to do so.)

Otherwise, DRM really only works when the people consuming the content have motivation to keep it secret. (IE, corporate and military secrets.)

repelsteeltje5• 2 years ago

Funny thing is that most streaming platforms only have DRM because content owners pressure them. It's expensive and a huge hassle to get right.

While indeed DRM barely contributes in fighting redistribution over Pirate Bay, it does prevent stream sharing. Ie.: the platform saves a lot of CDN bandwidth by forcing that onto torrents.

andsoitis• 2 years ago

A lot of "piracy" comes from the people who spend the most money on the content they pirate.

That doesn’t strike me as a valid statistic. Where are you getting that data from?

gjsman-10009• 2 years ago

“Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.”

This is laughably, obviously false. Don’t let the Reddit bubble of all 300 people who do this, or the 1.2% of Yuzu users who actually dumped their own keys, distort your understanding of reality.

tawa9102930• 2 years ago

HDCP is broken so none of it really matters.

The resulting files ("webrips") aren't a lossless copy of the original, but are good enough for most.

Salgat2• 2 years ago

Yeah web-dls might be hit or miss but webrips are such good quality that it's irrelevant for most folks anyways, since it's nearly the same quality you'd see on your TV.

gorkish5• 2 years ago

I posted elsewhere in the thread but it bears repeating, "The analog hole has gone fully digital." The generational loss from one recompression is effectively unnoticeable. What a ridiculous arms race!

bombcar3• 2 years ago

The point of the DRM schemes is basically to keep video "hard enough to copy that normies don't do it". And not even "normies can't find it on the Pirate Bay" but "you can right click and download from Netflix."

If they mostly succeed at that, they consider it good enough.

jorams4• 2 years ago

If that were true it would be possible to watch in 4k resolution on Netflix on Linux. But it's not.

ParetoOptimal3• 2 years ago

I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

A PR campaign to make people think getting that content for free is harder than it is?

hannob• 2 years ago

DRM schemes never worked, and it has been speculated that the people building them always knew it, but had other goals.

Backn in the days it was: Of course you can break DVD copyprotection schemes. But you cannot build a legal opensource DVD player software. Today it's: Of course every Netflix series can be found on the pirate bay. But you're not legally allowed to build an alternative netflix player frontend.

gjsman-10009• 2 years ago

From the executive’s perspectives, DRM is working just fine.

People can’t just go get a random browser extension to save videos.

Alternative and unlicensed clients are illegal.

Sure, there’s some piracy - but even at the end of the day, pirates would watch a smartphone recording to save a buck.

To them, DRM does not have to be perfect to be a good investment; any more than copyright needing to be perfect or Speed Limit sign enforcement needing to be perfect.

Plus, every layer of complexity that gets broken, is another line for convincing the DOJ or the Jury about malicious intent.

burningChrome2• 2 years ago

Just as an aside and probably a dumb question - is Pirate Bay still a thing? I know they have archival stuff you can access, but I thought Pirate Bay died out a long time ago and even pier to pier networks have all but disappeared with streaming.

I feel like this is kind of a naïve question, but I haven't needed to use pier to pier stuff since streaming did become the standard and remember a lot of articles on Pirate Bay shutting down around 2014. Some of the 1070's movies I've found on YouTube that aren't on any streaming platform like the 1982 movie Dreams Don't Die about a graffiti artist played by Ike Eisenmann.

somenameforme• 2 years ago

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's own screen with a quick ML software polish job, would look near to completely indistinguishable from the original content.

I imagine the reason so much money has been spent on it is because studios prefer to blame piracy than content for increasingly poor sales. So they see it as their salvation and are willing to pay big bucks, even if it's impossible. That's a primo ground for hucksters and charlatans to make a killing. Something similar happened in poker where players wanting to use fully automated software to make their decisions ended up just stepping outside the cat&mouse game and using a setup with a second computer + cam - completely and absolutely impossible to detect.

eddd-ddde• 2 years ago

I imagine in the future DRM is directly embedded in the viewers brain and if it detects pirate content it just fries you.

I genuinely can't imagine any other form of DRM being successful.

bee_rider3• 2 years ago

In the absolute worst case a high resolution/hertz cam on one's own screen with a quick ML software polish job, would look near to completely indistinguishable from the original content.

I’m not even interested in piracy (no ethical dilemma I just can’t be bothered), but I think this would be an absolutely fantastic tech demo, and also very funny. Ultimately the video has to be displayed on a screen, so this must be the final defeat for DRM, right?

nonrandomstring3• 2 years ago

I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

Sunk cost investment bias [0].

Past a certain point, even when the outcome is obviously futile, it becomes a mixture of accumulated momentum and pure bloody mindedness to "build it if it kills us". Companies like Microsoft or Sony have entire departments of people working on "rights management".

Nobody has the courage to just say, "Sorry guys, this is a fool's errand, we're going to shut it down and move you all onto something more productive".

[0] https://en.wikipedia.org/wiki/Sunk_cost

jvanderbot• 2 years ago

It doesn't need to work, it needs to be a clearly demarcated legal boundary. If it's hard enough that it takes effort to cross, you can prosecute.

Someone who wanders in the woods might not be blamed for trespassing. But someone who hops a fence with a sign on it doesn't have much defense.

squigz7• 2 years ago

I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

Because the goal isn't actually to "keep the bad guys out" - it's to strip user freedom and privacy, and make a shit load of money at the same time

daveoc642• 2 years ago

The DRM clearly does work in preventing "casual piracy" - where average users do things like downloading a file and keeping it forever (even after cancelling a subscription) or copying the file to a friend.

yencabulator• 2 years ago

Video streaming hasn't been "a file" in a long time. HLS et al download little snippets at a time, adjusting to current bandwidth circumstances, typically with video and audio separate, etc. Even without DRM, the average user couldn't "download a file" from Netflix.

Retr0id• 2 years ago

At this point, video DRM is more of a legal protection than a technical protection.

devwastaken• 2 years ago

No. It is fundamentally impossible. DRM centralizes piracy, it makes it profitable both socially and financially to pirate harder. As DRM tries to get harder it actually gives pirates more power.

These pirates release high quality content that is better than the service provides on most devices. Typically in HEVC as well, requiring less download size.

It's also great for those that don't have consistent Internet and want to download over time.

DRM and anti piracy are a snake oil industry for business suit types that think they're protecting their assets. They're not, but they don't understand the infinitely copiable nature of digital. They want control at any cost.

nevir• 2 years ago

Publishers demand it, but don't understand it.

The platforms roll their eyes, but implement it anyway; cause it's a rounding error, and keeps publishers happy

whoopdedo• 2 years ago

I don't believe the "Digital Video Express"[1] (aka DIVX[2]) discs were ever cracked while they were on the market. But that's only because they were only sold for 1 year and nobody bought any. Even now finding information about the disc format is rare. Although anyone who has a reason to try probably should be able to do it easily since it was just 3DES.

[1] https://en.wikipedia.org/wiki/DIVX

[2] And this is when I remember that Wikipedia links are case-sensitive

logical_person• 2 years ago

do software cracks usually get posted to seclists? this is expected in the design of DRM...

charles_f• 2 years ago

If like me you don't know what Playready is:

PlayReady is a media file copy prevention technology from Microsoft that includes encryption, output prevention and digital rights management (DRM). It was announced in February 2007.

squigz7• 2 years ago

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

dawnerd3• 2 years ago

And yet content will still be torrented within hours. It’s always the honest consumers that lose.

squigz7• 2 years ago

This assuredness that piracy will always win will be our demise.

015a• 2 years ago

At some point it escalates to where the media providers make watching their media so expensive, time consuming, and difficult that piracy ramps back up.

It sounds dumb, like "why would companies shoot themselves in the foot like this" but trust that they will. They always do. Corpobrain is a form of autopilot, there's no one with intelligence in charge not because the people who work at media companies are dumb (though, they are), but because there's just literally no one in charge. Its autopilot. Each iterative decision in isolation makes sense, but when zoomed out and interpreted holistically they're killing their own business.

watermelon02• 2 years ago

I think this is already the case today; streaming players don't work unless the whole chain from the player to the display is verified.

The only reason it's possible to copy such content is because keys were leaked in the past, and they are not blacklisted.

clwg• 2 years ago

That sounds an awful lot like an Xbox, and I personally don't think we're too far off from those becoming general purpose cloud connected DRM computers coupled with recurring monthly subscriptions for all your app/game/content needs.

tithe• 2 years ago

...unless your entire computer is locked down and "verified"...

This is exactly what the WEI (Web Environment Integrity)[0] specification sought to achieve, but at the browser level.

[0] https://en.wikipedia.org/wiki/Web_Environment_Integrity

surajrmal• 2 years ago

Most operating systems already offer this. At some point only native apps will be supported instead of the web if browsers don't also provide it.

Microsoft PlayReady – Complete Client Identity Compromise

Related Stories