"Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

The repo readme is pretty telling - this is being leaked to force this particular key to be blacklisted, I guess one group annoyed with others and wanting to cut off their access (and presumably the leaking group already has other L1 keys so doesn't fear this key being burned...)

or they had the skills to just dump it again

Edit: nvm I understood which key you were talking about. I would have replied, but I'm rate limited.

Ah, I thought L1 keys were burned into hardware, so blacklisting this key was effectively blacklisting a bunch of Lenovo tablets from accessing 4K HDR streaming?

Edit: looks like I'm wrong about this, and the Widevine L1 keys can be changed with a firmware update. There's an interesting breakdown of how it works on Qualcomm chips here: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

There is something amusing about weaponizing the key revocation process like this...

Does this mean if I have a lenovo tablet that currently streams 4K, that it will lose 4K video support? Could I ask Lenovo for a refund?

Everything about it is fascinating. These people all have day jobs yet they provide a better experience than the multi-trillion dollar corporations that are releasing the product in the first place.

Yes and yes. Lenovo probably doesn’t give a shit, though. But you can ask!

I would think so (the repo suggests this is a Lenovo TB-X505X key, I'd imagine they're at least per-product). I could certainly be be wrong about L1 keys being burned-in, that was just my understanding of it (vendor docs say things like "Hardware DRM", but maybe I'm jumping to conclusions from marketing speak)

The Widevine spec doesn't say either, it just says that all processing is within the Trusted Execution Environment, so I suppose the keys could be loaded/updated in firmware. I'm looking for more docs now...

Edit: looks like I was wrong and they can be changed with firmware updates: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

Depends on the country. Some do have some liability on manufacturers and/or vendors for defects. Unsure if an asterisk in their click through contract about key revocation would even matter.

You should be able to ask Lenovo for a refund if you've bought the device with this feature in mind and if Lenovo advertised the ability to watch 4K on your preferred streaming service.

If the device just happens to support 4k, you may be out of luck. You could try sueing the parties that are supposed to deliver the 4k content and have revoked the key, but I doubt you'll get much out of them.

If you rely on DRM, the media industry has all the keys. You're left to their whims when it comes to content consumption, and there's very little you can do.

These people probably all have day school... I think most people who get past school age tend to retire out of this crowd of people...

TEE is an environment with hardware backed attestation, you run a piece of software in the "black box" to do things like key generation etc.

My educated guess, having used TEE/TrustZone for keys is that they could update the payload (the "Trusted Executable") with a new one to resolve the issue.

I would just like to point out that this is a forum called Hacker News.

Are you implying that young adults are more responsible for the state of piracy today than adults? I don't see that at all.

I feel like I have to defend the parent here. My experience in the nulling/warez/pirating community is that it tends to be young adults doing the majority of the work and mostly they do it for kudos and not monetary benefit.

Adults might be giving them the kudos, but the hard work (again, in my experience) is young adults, of school age.

I also noticed it provides part of the functionality with a .pyc file, without including the normal python source. This one, for example: https://github.com/widevinedump/WV-AMZN-4K-RIPPER/blob/main/...

I'd be a little leery of running that outside of a sandbox.

Young adults aren't breaking into streaming devices to extract the CDM keys. They also aren't running trackers like Orpheus and Redacted. Those are small examples, but I'm not sure I understand how young adults would ever have the mobility and network to do these things.

Would they release a firmware update with new keys though? If they can’t fix the vulnerability, the new keys would get dumped just like the old ones.

these young adults havent learned the utility and nessecity of anonymity

Er, you may not have been a young adult with l33t hardware hacking skills, but others were.

A lot of them started as young adults, but the scene has been going on for over 20 years. Some people quit over time, and some other joined as they got old enough to contribute, but I wouldn't paint with as wide of a brush as you're doing.

George Hotz (geohot) was a teenager when he cracked the iPhone and was 20 when he cracked the PS3. So...yes, young adults certainly can extract keys if they have the time and motivation, and being young adults they often have plenty of time on their hands.

It was definitely the case for me! I aged out of warez when I got a full time job.

I think the warez ‘golden age’ was 1995-2015.

Before that most of the protections were just not that severe (and thus interesting), and after 2015 Steam, Netflix and Spotify severely stemmed the influx of people being exposed to piracy and thus potentially going deeper into the culture.

Tangentially related but I think that’s also why in a strange way the advent of the smartphone and other ‘curated technological experiences’ has lowered computer literacy for the average person born after ~1995.

They are. Plenty of them are more than talented enough for it.

Using George Hotz as an example is pretty disingenuous. He is clearly not your average young adult, even for the average of HN.

Can you provide a counter-example or is this all anecdotes?

Odd comparison, I wasn't basing this off of my experience as a young adult.

That was some funny stuff. Watching this guy make Sony freak out and chase after him down the street with lawyers. Halt varlet, for I shalt sue!

Yeah, I think software piracy was a huge part of technological learning for me from an early age, figuring out how to the name of what I was even looking for (cracks, Warez), using astalavista, early torrent clients, forwarding ports, finding good torrents, using a firewall to block applications, applying cracks, learning about loaders, key generators, patches, protectors, and later reverse engineering and cracking software myself... staring at assembly in IDA for a few days straight so you can do something no one else online has done is a pretty interesting experience and probably one of the most formative ones to my enjoyment of computing.

Forgive me for my ignorance, but would you mind explaining why providing functionality with a .pyc is potentially a red flag? I'm interested in learning more about Python codebases.

.pyc files are the compiled bytecode for its corresponding .py file. It's scrambled, you would need a decompiler to inspect the source code and it would be very hard to read (compared to the original source).

People typically ship .pyc files when they want to hide what they are doing, for a wide variety of reasons.

Do you think it could probably be decompiled? [0].

[0]: https://stackoverflow.com/a/14808336/297570

Oh! That makes complete sense. I didn't know .pyc was the bytecode of a Python file. Thank you!

People come to HN to discuss whether the hacking blog's title was too big for their tastes or if the content is readable by every disabled person under the sun. The comment section is literally pain incarnate for actual hackers.