Hacker News Reader

Comment by keyme | Hacker News Reader

I actually looked at the widevine DLL at some point out of curiosity. It didn't seem obfuscated in any way. Honestly I think getting the keys to the encrypted streams out of there is at the difficulty level of an average CTF challenge. The reason you don't see PoCs, is because it's strictly illegal to distribute such code. Even the act of reversing this DLL is illegal.

View on HN

Reversing a DLL is maybe illegal in US, but in other countries not necessarily. E.g. in Poland (maybe even whole EU) one can reverse engineer anything in order to make it work on their OS, hardware etc. - this is the law, it overrides any kind of EULA.

In 2017 it was obfuscated using Arxan's "ProtectIT" (you can view the patent) and did use whitebox cryptography. I didn't look at the dll, but at the .so file for linux (for fun). I guess it should be harder now

EDIT: If reversing this DLL/so is illegal, how I am supposed to be able to test for a potential security vulnerability? Not that I can do this, just wondering...

>how I am supposed to be able to test for a potential security vulnerability?

You aren't. There were some amendments made to DMCA recently that added a few more narrow provisions (mainly repairing tractors and such), but I don't think reverse engineering closed libraries was one of them. In particular, things close to DRM were not granted. For example, request for exemptions for tinkering with HDCP or optical drives were denied.

The article claims he informed them but in the original tweet thread it was the opposite and he said it wasn't even an exploit so didnt bother disclosing.

I think the guy is awesome and very likely he did what he claimed, but do get annoyed about low effort Twitter journalism. Prove it or don't write it. It's very simple.

Reply on news.ycombinator.com