Why pirates can easily steal movies from Chrome
A glitch in Google Chrome makes it easy for pirates to download illegal copies of movies streamed from sites such as Netflix and Amazon Prime.
Alexandra Mikityuk with Telekom Innovation Laboratories in Berlin, Germany, and David Livshits from the Cyber Security Research Center at Ben-Gurion University in Israel reportedly told Google about the problem on May 24, but have not yet seen the issue solved.
Google鈥檚 Widevine EME/CDM technology is the source of the problem, specifically how Google implements the technology to stream encrypted video. The researchers have created .
The solution seems simple to Mr. Livshits and Ms. Mikityuk. Before they publicly reveal the details, however, they are waiting until at least 90 days have passed since they privately told Google about the issue, in an effort to avoid enabling others to steal content.聽Google鈥檚 Project Zero security analysis team to fix vulnerabilities they discover.
Google, however, did not clearly indicate what they plan to do about the glitch.
鈥淲e appreciate the researchers鈥� report and we鈥檙e examining it closely. Chrome has long been an open-source project and developers have been able to create their own versions of the browser that, for example, may use a different CDM or include modified CDM rendering paths. The Chrome browser, however, is required to protect compressed videos and does so,鈥� , according to Gizmodo.聽
Google is saying that even if it fixes the problem with new code, developers can make .
Livshits and Mikityuk suggest that the problem can be solved with a Chrome patch, but a more permanent fix would require designing the CDM, which sends and receives license information and decrypts videos for streaming, to run inside a Trusted Execution Environment, which would prevent someone from stealing streaming content.
Google acquired Widevine in 2010 to secure premium Youtube Channels and Chrome streams, but it is also found in聽
Although other digital rights management system errors have been uncovered in the past, Chrome鈥檚 vulnerability is unique in that it involves third-party systems that streamers trust to protect their content.
鈥淭he simplicity of stealing protected content with our approach [studios] which rely on such technologies to protect their assets,鈥� Livshits told Wired.聽
