Florian Roudot

Nowadays, streaming services, such as Netflix, rely on Digital Rights Management (DRM) systems to deliver their protected content. These systems aim to prevent piracy. Specifically, non-subscribers are prevented from accessing the content altogether, while subscribers are prevented from acquiring decrypted copies of the media to avoid uncontrolled distribution. Among the currently deployed DRM systems, Google Widevine is the most widely used, especially on desktops, where it provides a fully software-based solution.

In this paper, we investigate Widevine’s decryption interface and its integration in modern web browsers. We show that Widevine’s boundary (i.e., its output after media decryption) is inherently unprotected and can be intercepted with relative ease. Under an attacker merely observing this interface, we show that audio content can be trivially recovered because the decrypted samples are returned prior to decoding. We further identify that, under a commonly used Widevine configuration, the same "decrypt only" behavior also applies to video, enabling direct recovery of video frames. When this misconfiguration is absent, we show that Widevine still outputs decrypted and decoded frames that can be efficiently re-encoded with negligible quality degradation.

Based on our findings, we build an attack that "downloads" any content protected by Widevine into a playable format on both Linux and Windows. Finally, we assess the effectiveness of our attack by applying it to premium streaming platforms.

Streaming services like Netflix, Prime Video, and HBO Max rely on DRM solutions to ward off piracy. By enabling the distribution of encrypted content, DRM systems prevent subscribed users from downloading the streamed content, as well as unauthorized users from having access to it.

Google Widevine, one of the most deployed DRMs, provides a fully software-based solution on desktop platforms to ensure portability. In this paper, we empirically investigate the security protections implemented by Widevine to counter an attacker tampering with its interactions within its environment, namely with the operating system and the hosting browser. Focusing on randomness and time, we uncover new flaws in the Widevine license acquisition process, particularly targeting the freshness and expiration of the licenses. To demonstrate the effectiveness of our findings, we develop Narrowbeer, a practical replay attack allowing legitimate users to generate never-expiring licenses, and enabling unauthorized users to reuse these licenses to access premium content without subscription. Finally, we validate our attack against real-world streaming services by succeeding in repeatedly playing the same license on different desktop devices.

Streaming services such as Netflix, Amazon Prime Video, or Disney+ rely on the widespread EME standard to deliver their content to end users on all major web browsers. While providing an abstraction layer to the underlying DRM protocols of each device, the security of this API has never been formally studied. In this paper, we provide the first formal analysis of Widevine, the most deployed DRM instantiating EME.

We define security goals for EME, focusing on media protection and usage control. Then, relying on the TAMARIN prover, we conduct a detailed security analysis of these goals on some Widevine EME implementations, reverse-engineered by us for this study. Our investigation highlights a vulnerability that could allow for unlimited media consumption. Additionally, we present a patched protocol that is suitable for both mobile and desktop platforms, and that we formally proved secure using TAMARIN.