Hacker News Reader

Comment by A2017U1 | Hacker News Reader

A2017U1

Buchanan tweeted he cracked something. It's been hinted that pirates have cracked widevine for Netflix already. Why is there half a dozen articles on it? Anyone can tweet claims, show some proof.

POC || gtfo

View on HN

I actually looked at the widevine DLL at some point out of curiosity. It didn't seem obfuscated in any way. Honestly I think getting the keys to the encrypted streams out of there is at the difficulty level of an average CTF challenge. The reason you don't see PoCs, is because it's strictly illegal to distribute such code. Even the act of reversing this DLL is illegal.

The article claims he informed them but in the original tweet thread it was the opposite and he said it wasn't even an exploit so didnt bother disclosing.

I think the guy is awesome and very likely he did what he claimed, but do get annoyed about low effort Twitter journalism. Prove it or don't write it. It's very simple.

In 2017 it was obfuscated using Arxan's "ProtectIT" (you can view the patent) and did use whitebox cryptography. I didn't look at the dll, but at the .so file for linux (for fun). I guess it should be harder now

EDIT: If reversing this DLL/so is illegal, how I am supposed to be able to test for a potential security vulnerability? Not that I can do this, just wondering...

>how I am supposed to be able to test for a potential security vulnerability?

You aren't. There were some amendments made to DMCA recently that added a few more narrow provisions (mainly repairing tractors and such), but I don't think reverse engineering closed libraries was one of them. In particular, things close to DRM were not granted. For example, request for exemptions for tinkering with HDCP or optical drives were denied.

Reversing a DLL is maybe illegal in US, but in other countries not necessarily. E.g. in Poland (maybe even whole EU) one can reverse engineer anything in order to make it work on their OS, hardware etc. - this is the law, it overrides any kind of EULA.

Reply on news.ycombinator.com