Microsoft PlayReady – Complete Client Identity Compromise
1–10 of 175 posts
Re: Microsoft PlayReady – Complete Client Identity Compromise
#2So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?
Re: Microsoft PlayReady – Complete Client Identity Compromise
#3> In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means.
Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient storage format.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#4> In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means. Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient s…
[deleted]
Re: Microsoft PlayReady – Complete Client Identity Compromise
#5Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information.
The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the common script kiddie.
This is how exploit chains get a foot-hold, and "secure" accounts get compromised like it was 2010 again.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#6Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours?
I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#7So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?
Yup.
Basically the means to forge an authenticated cookie.
[Update]
It's a bit more subtle: Having the keys to forge a license request and decrypt server response allows you to emmulate or re-implement a DRM client.
Because the server is oblivious to this fake, it will respond as though it's taking to a genuine "secure" client thereby ultimately exposing the content decryption key.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#8So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?
The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers.
The attack essentially means that they could write a program themselves that acts as "Windows.Media.Protection.PlayReady.dll" to get decryption keys from a server. What will happen now is that Microsoft will deprecate the client and release a new one with new obfuscation and new keys. The license servers will start rejecting the old cracked client. And then people will crack the new client. And the cycle continues.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#9Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.
Denuvo mostly works. Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all. The price is lowered performance, of course.
Re: Microsoft PlayReady – Complete Client Identity Compromise
#10Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.
Denuvo mostly works. Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all. The price is lowered performance, of course.
That's a video game DRM scheme, not a video DRM scheme