17 ms·

Microsoft PlayReady – Complete Client Identity Compromise

182 points by tithe 2y ago

earth-adventure 2y ago
So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?
- repelsteeltje 2y ago
  Yup. Basically the means to forge an authenticated cookie. [Update] It's a bit more subtle: Having the keys to forge a license request and decrypt server response allows you to emmulate or re-implement a DRM client. Because the server is oblivious to this fake, it will respond as though it's taking to a genuine "secure" client thereby ultimately exposing the content decryption key.
- xurukefi 2y ago
  The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers. The attack essentially means that they could write a program themselves that acts as "Windows.Media.Protection.PlayReady.dll" to get decryption keys from a server. What will happen now is that Microsoft will deprecate the client and release a new one with new obfuscation and new keys. The license servers will start rejecting the old cracked client. And then people will crack the new client. And the cycle continues.
  - nonrandomstring 2y ago
    > The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives Thanks for the clarification. Otherwise people would be worried about being targeted and having "personal" keys tied to a financial account or online identity getting sold and used by others to access arbitary content. This seems kinda good news for concerned users, but even worse news for Microsoft.
  - qingcharles 2y ago
    Does PlayReady now require a secure enclave/TPM on your PC? Otherwise as you say, the only thing protecting the keys is obfuscation. This has been the same way all the way back to the first Microsoft DRMv1 in 1998 (?). The decryption keys have to be stored on your device so you can play your media or your game. So, the level of encryption is totally moot. The level of obfuscation is all that really protects the content.
    - xurukefi 2y ago
      With PlayReady, as with any other DRM scheme really, there are different tiers. There is SL2000, which is done completely in software (whitebox crypto), and there is SL3000, which does require a TEE. Which tier is requried for which type of content is driven by streaming provider or studio requirements. I think it is pretty common to allow content up to 1080p to be used with whitebox crypto, whereas 4k+ content will require hardware DRM.
zeta0134 2y ago
> In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means. Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient storage format.
- deleted 2y ago
  [deleted]
- repelsteeltje 2y ago
  Yes, there is always the analogue loophole. And opening cryptography toolbox to control how users consume content is a lost cause. Crypto can only protect contents from adversaries that don't have the key. But here the paying user is the adversary and the only way the DRM can paint the video on screen is through that key. So DRM boils down to security through obscurity. Turns out obscurity is hard, expensive and never works very well.
Jerrrry 2y ago
Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information. The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the common script kiddie. This is how exploit chains get a foot-hold, and "secure" accounts get compromised like it was 2010 again.
- nonrandomstring 2y ago
  And it paints an even bigger target on domestic Windows machines used for media content. Who wants to "steal" their _own_ keys? Microsoft's broken DRM scheme creates objects of value which it then tries to store on the client's machine deliberately beyond the owners control and security management. It is adversarial to the user. This is clearly a no-win situation... hence the snarky sign-off about vendors "raising the bar", basically saying; Good luck with that! It really seems quite unhinged. So now there is collateral damage: - A motive to hack Windows machines to steal content keys. - A misuse of "identities" through a market in stolen keys - Pivots (as parent says) to other malware vectors So, predictably, because of DRM, Microsoft Windows is now an even more dangerous and insecure system. Why do people persist chasing this unnecessary, pathologically involuted technological misadventure? Surely "controlling and monitoring peoples content" is not a hill worth dying on?
  - Jerrrry 2y ago
    I'd agree, but licensed content can be revoked - MS is pretty good at publishing digests of "known-compromised" ID's/Serials/Private Keys. I'd be more concerned about any other, more important facets of a user's account/assets/property that assumes the DRM is secure, and leans on that.
- amaccuish 2y ago
  I don't understand a word you've said.
londons_explore 2y ago
Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.
- makin 2y ago
  Denuvo mostly works. Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all. The price is lowered performance, of course.
  - free_bip 2y ago
    That's a video game DRM scheme, not a video DRM scheme
  - ParetoOptimal 2y ago
    > Denuvo mostly works. Not for users: https://gamerant.com/denuvo-outage-servers-down-persona-5-royal-unplayable-online/ https://gamerant.com/denuvo-outage-servers-down-persona-5-ro... > Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all From what I hear, it's cracked in a matter of days or weeks. I haven't checked whether this is true or not, so I can't say you are wrong about some (most?) cracks taking months.
    - crtasm 2y ago
      Looking at the previous two years of uncracked Denuvo and only selecting games that seem notable: Dragon's Dogma 2 (2024) Like a Dragon: Infinite Wealth (2024) Suicide Squad: Kill the Justice League (2024) Street Fighter 6 (2023) Hi-Fi Rush (2023) Dead Space (2023) Star Wars Jedi: Survivor (2023) Persona 5 Tactica (2023) EA Sports FC 24 (2023) NBA 2K24 (2023) Assassin's Creed Mirage (2023) Atomic Heart (2023) Lost Judgment (2022) Sonic Frontiers (2022) Sonic Origins (2022) Persona 4 Arena Ultimax (2022) Persona 5 Royal (2022) Sniper Elite 5 (2022) Marvel's Midnight Suns (2022) Total War: Warhammer III (2022) Going back further there's more high profile games that were never cracked. The system seems to work as intended in some cases.
williamcraven 2y ago
[flagged]
logical_person 2y ago
do software cracks usually get posted to seclists? this is expected in the design of DRM...
deleted 2y ago
[deleted]
charles_f 2y ago
If like me you don't know what Playready is: > PlayReady is a media file copy prevention technology from Microsoft that includes encryption, output prevention and digital rights management (DRM). It was announced in February 2007.
squigz 2y ago
At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.
- dawnerd 2y ago
  And yet content will still be torrented within hours. It’s always the honest consumers that lose.
  - squigz 2y ago
    This assuredness that piracy will always win will be our demise.
    - dawnerd 2y ago
      The only way to reduce piracy is to make access easier and cheaper - something the music industry figured out. Sure music still gets pirated but its a lot less.
      - squigz 2y ago
        Well, no, that isn't the only way to reduce piracy. Another way would be widespread collaboration between the largest tech corporations to lock down the pipeline from manufacturing to sale and onward If users continue to accept this path, which... they seem to, that is where we'll inevitably end up.
        sspiff 2y ago
        What about the analog loophole? At some point, the data needs to be manifested in the real world.
        squigz 2y ago
        It's not as though there's no effort to close this loophole (see HDCP and probably others) - I don't expect them to give up any time soon Granted, pointing a camera at a screen and recording will always be possible - but I say if we ever reach the point where that is the only option, we've lost.

182 points by tithe 2y ago

So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?

repelsteeltje 2y ago
Yup. Basically the means to forge an authenticated cookie. [Update] It's a bit more subtle: Having the keys to forge a license request and decrypt server response allows you to emmulate or re-implement a DRM client. Because the server is oblivious to this fake, it will respond as though it's taking to a genuine "secure" client thereby ultimately exposing the content decryption key.
xurukefi 2y ago
The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers. The attack essentially means that they could write a program themselves that acts as "Windows.Media.Protection.PlayReady.dll" to get decryption keys from a server. What will happen now is that Microsoft will deprecate the client and release a new one with new obfuscation and new keys. The license servers will start rejecting the old cracked client. And then people will crack the new client. And the cycle continues.
- nonrandomstring 2y ago
  > The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives Thanks for the clarification. Otherwise people would be worried about being targeted and having "personal" keys tied to a financial account or online identity getting sold and used by others to access arbitary content. This seems kinda good news for concerned users, but even worse news for Microsoft.
- qingcharles 2y ago
  Does PlayReady now require a secure enclave/TPM on your PC? Otherwise as you say, the only thing protecting the keys is obfuscation. This has been the same way all the way back to the first Microsoft DRMv1 in 1998 (?). The decryption keys have to be stored on your device so you can play your media or your game. So, the level of encryption is totally moot. The level of obfuscation is all that really protects the content.
  - xurukefi 2y ago
    With PlayReady, as with any other DRM scheme really, there are different tiers. There is SL2000, which is done completely in software (whitebox crypto), and there is SL3000, which does require a TEE. Which tier is requried for which type of content is driven by streaming provider or studio requirements. I think it is pretty common to allow content up to 1080p to be used with whitebox crypto, whereas 4k+ content will require hardware DRM.

zeta0134 2y ago

> In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means. Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient storage format.

deleted 2y ago
[deleted]
repelsteeltje 2y ago
Yes, there is always the analogue loophole. And opening cryptography toolbox to control how users consume content is a lost cause. Crypto can only protect contents from adversaries that don't have the key. But here the paying user is the adversary and the only way the DRM can paint the video on screen is through that key. So DRM boils down to security through obscurity. Turns out obscurity is hard, expensive and never works very well.

Jerrrry 2y ago

Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information. The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the common script kiddie. This is how exploit chains get a foot-hold, and "secure" accounts get compromised like it was 2010 again.

nonrandomstring 2y ago
And it paints an even bigger target on domestic Windows machines used for media content. Who wants to "steal" their _own_ keys? Microsoft's broken DRM scheme creates objects of value which it then tries to store on the client's machine deliberately beyond the owners control and security management. It is adversarial to the user. This is clearly a no-win situation... hence the snarky sign-off about vendors "raising the bar", basically saying; Good luck with that! It really seems quite unhinged. So now there is collateral damage: - A motive to hack Windows machines to steal content keys. - A misuse of "identities" through a market in stolen keys - Pivots (as parent says) to other malware vectors So, predictably, because of DRM, Microsoft Windows is now an even more dangerous and insecure system. Why do people persist chasing this unnecessary, pathologically involuted technological misadventure? Surely "controlling and monitoring peoples content" is not a hill worth dying on?
- Jerrrry 2y ago
  I'd agree, but licensed content can be revoked - MS is pretty good at publishing digests of "known-compromised" ID's/Serials/Private Keys. I'd be more concerned about any other, more important facets of a user's account/assets/property that assumes the DRM is secure, and leans on that.
amaccuish 2y ago
I don't understand a word you've said.

londons_explore 2y ago

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

makin 2y ago
Denuvo mostly works. Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all. The price is lowered performance, of course.
- free_bip 2y ago
  That's a video game DRM scheme, not a video DRM scheme
- ParetoOptimal 2y ago
  > Denuvo mostly works. Not for users: https://gamerant.com/denuvo-outage-servers-down-persona-5-royal-unplayable-online/ https://gamerant.com/denuvo-outage-servers-down-persona-5-ro... > Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all From what I hear, it's cracked in a matter of days or weeks. I haven't checked whether this is true or not, so I can't say you are wrong about some (most?) cracks taking months.
  - crtasm 2y ago
    Looking at the previous two years of uncracked Denuvo and only selecting games that seem notable: Dragon's Dogma 2 (2024) Like a Dragon: Infinite Wealth (2024) Suicide Squad: Kill the Justice League (2024) Street Fighter 6 (2023) Hi-Fi Rush (2023) Dead Space (2023) Star Wars Jedi: Survivor (2023) Persona 5 Tactica (2023) EA Sports FC 24 (2023) NBA 2K24 (2023) Assassin's Creed Mirage (2023) Atomic Heart (2023) Lost Judgment (2022) Sonic Frontiers (2022) Sonic Origins (2022) Persona 4 Arena Ultimax (2022) Persona 5 Royal (2022) Sniper Elite 5 (2022) Marvel's Midnight Suns (2022) Total War: Warhammer III (2022) Going back further there's more high profile games that were never cracked. The system seems to work as intended in some cases.

williamcraven 2y ago

[flagged]

logical_person 2y ago

do software cracks usually get posted to seclists? this is expected in the design of DRM...

deleted 2y ago

[deleted]

charles_f 2y ago

If like me you don't know what Playready is: > PlayReady is a media file copy prevention technology from Microsoft that includes encryption, output prevention and digital rights management (DRM). It was announced in February 2007.

squigz 2y ago

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

dawnerd 2y ago
And yet content will still be torrented within hours. It’s always the honest consumers that lose.
- squigz 2y ago
  This assuredness that piracy will always win will be our demise.
  - dawnerd 2y ago
    The only way to reduce piracy is to make access easier and cheaper - something the music industry figured out. Sure music still gets pirated but its a lot less.
    - squigz 2y ago
      Well, no, that isn't the only way to reduce piracy. Another way would be widespread collaboration between the largest tech corporations to lock down the pipeline from manufacturing to sale and onward If users continue to accept this path, which... they seem to, that is where we'll inevitably end up.
      - sspiff 2y ago
        What about the analog loophole? At some point, the data needs to be manifested in the real world.
        squigz 2y ago
        It's not as though there's no effort to close this loophole (see HDCP and probably others) - I don't expect them to give up any time soon Granted, pointing a camera at a screen and recording will always be possible - but I say if we ever reach the point where that is the only option, we've lost.