论文标题
部分可观测时空混沌系统的无模型预测
Exploring Widevine for Fun and Profit
论文作者
论文摘要
多年来，数字权利管理（DRM）系统一直用作媒体内容保护侵害盗版的首选解决方案。随着使用过度平台（例如Netflix或Prime视频）对内容的消耗日益增长，DRM已被部署在许多被认为是潜在敌对环境的设备上。在本文中，我们专注于最广泛的解决方案，即封闭源宽阔的DRM。 Widevine安装在数十亿个设备上，依靠加密操作来保护内容。我们的工作介绍了一项对Android上的宽阔内部构造的研究，绘制了其独特的组件，并提出了与内容解密有关的不同加密密钥。我们提供了宽阔的结构视图，作为一项协议，其完整的关键梯子。基于我们的见解，我们开发了宽XTRACTOR，这是一种基于Frida的工具，可以追踪广泛的函数调用并拦截检查以进行检查。使用此工具，我们将Netflix用法分析为概念验证，并提出了有关用户跟踪的隐私问题。此外，我们利用我们的知识绕过了仅使用Android宽vine软件版本的混淆，即L3，并恢复其信任根。
For years, Digital Right Management (DRM) systems have been used as the go-to solution for media content protection against piracy. With the growing consumption of content using Over-the-Top platforms, such as Netflix or Prime Video, DRMs have been deployed on numerous devices considered as potential hostile environments. In this paper, we focus on the most widespread solution, the closed-source Widevine DRM. Installed on billions of devices, Widevine relies on cryptographic operations to protect content. Our work presents a study of Widevine internals on Android, mapping its distinct components and bringing out its different cryptographic keys involved in content decryption. We provide a structural view of Widevine as a protocol with its complete key ladder. Based on our insights, we develop WideXtractor, a tool based on Frida to trace Widevine function calls and intercept messages for inspection. Using this tool, we analyze Netflix usage of Widevine as a proof-of-concept, and raised privacy concerns on user-tracking. In addition, we leverage our knowledge to bypass the obfuscation of Android Widevine software-only version, namely L3, and recover its Root-of-Trust.
