Understanding and Attacking DRM in Video Streaming

بسم الله، والصلاة والسلام على رسول الله، الحمدُ للّه الذي علّم بالقلم، علّم الإنسان مَا لم يَعلم، والصلاةُ والسلامُ على خيرِ مُعلّمِ الناسِ الخَيرِ مُحمد

whoami?

Hello everyone! My name is Usif Abuzahra, and I'm passionate about cybersecurity and exploring its core concepts.

What is DRM?

While the big usage of media content, companies want to protect their content from duplicates, prining, sharing, accessing and that's all are served under the conecpt of DRM.

DRM is a strategy to protect & prevent copyrighted materials from unauthorized access, sharing, printing, …

DRM enables authors, moviemakers and content creators to determine and control whom people can access the content and who cannot.

So DRM is the usage of technologies to determine and manage access to the copyrighted materials which is give the content creators to:

-restrict users who can editing, saving, printing, recording the screen or taking screenshots of thier content

-set expiry dates on media which prevents access to users beyond the deadline or limit the no. of times they can access the content

-limit media access to specific devices such as limiting the content only to users who in Egypt

Types of Content Saved by DRM?

-video DRM (we will focus on) -> examples: Netflix, Disney+

-Audio DRM -> examples: spotify, itunes

-E_book/document DRM -> examples: amazon kindle, adobe

-software or application DRM -> example: microsoft office

— Note: There are other types.

Major DRM Systems

widevine, fairplay, playready -> all of those are DRM systems works for saving the paid media content from piracy

-widevine is served by google and works on chrome and android devices

-fairplay is served by apple and works on iphone, ipad, safari, ...

-playready is served by microsoft and works on windows, edge, …

Types of DRM Mechanisms

• Software-based DRM: decryption, license checks, and key handling happen in the level of OS/application level.
• Hardware-based DRM: decryption, license check and key handling occur in an isolated hardware trusted env. (TEE) that the OS cannot inspect.
• Hybrid DRM: this use hardware security when it supported by the device which is more secure(because the OS doesn't see the decryption and displaying process) but when the device doesn't support the hardware security then it uses the software based DRM, then this way enable providing the highest level of security available on each device.

Process of delivering and palying the protected-DRM video

The protected-DRM video is an encrypted video sent to your browser through the CDN and then your browser to play the video (till now it is encrypted) it request license from the license server that allow him to decrypt the video.

now we own encrypted video + license then we've two ways to decrypt this video and playback

— to use the software mechanism which is decrypt, decode in the OS layer

—to use the hardware mechanism which is do the process in isolated environment (TEE)

Modern DRM ecosystems commonly support both hardware-based and software-based security paths, with the selected path depending on device capabilities, OS/browser implementation, and provider requirements.

Okay, now suppose we will use the software-based so, since we are watching the video through the browser then we use the this browser as client DRM to decrypt the video and playback it , and this process is happening in the OS layer in isolated environment but the video must eventually leave that protected environment to be displayed so, the video might be recorded and this is must be prohibted.

What if we used the hardware-based DRM?

The video is decrypted and decoded inside a hardware-backed TEE then passed through a secure hardware path directly to the display (the video doesn't appear in the normal memory) and preventing normal OS applications from accessing the decrypted frames.

Can we change the browser's configurations to use specific mechanism?

some browsers allow you to change the configurations of hardware acceleration and then the browser might use the software path (unsecure one), i want to demonstrate the before and after attempts of recording protected-DRM videos here but i can't due to the copyright and legal restrictions.

But how to change some browsers configurations to not use hardware acceleration?

firefox: settings-> search for perforamnce -> uncheck recommended performance and also hardware acceleration

brave: search for brave://settings/system -> uncheck graphics acceleration

edge: search for edge://settings/system -> uncheck graphics acceleration

you should relaunch any browser after changing the configurations

Another way to record DRM-protected videos?

There is another way for recording the DRM-protected videos.

some hackers go and create a VM-ware with windows OS for example and open the protected videos inside the machine and then start screen recording from the main OS on the device (the host OS)

This idea works alot because the host does not need to bypass DRM or access its decryption keys; it can simply capture the VM's rendered display output because the hypervisor controls the virtual display boundary.

Prevention

1-Hardware DRM + Secure Video Path: The video go through secret hardware tunnel. Normal computer no see it. Video safe from spy tool.

2-Forensic Watermarking: Embeds a unique, user/session-specific watermark into the video which is allowing leaked recordings to be traced back to their source.

3–Screen-Capture Detection & Blocking: Detects screen recording or mirroring and prevents protected content from being displayed, recorded, or captured while capture is active.

Resources

What Is DRM? Digital Rights Management Explained | Fortinet Digital rights management (DRM) is the use of technology to control and manage access to copyrighted material. DRM aims…

The Complete Guide to Modern Digital Rights Management Learn how digital rights management protects content and enables DAM for compliance. Discover DRM digital rights…

Everything You Need to Know About Digital Rights Management (DRM) An Exploration of DRM: From Definition to Controversy

What is Digital Rights Management? A DRM Guide | DoveRunner Digital Rights Management (DRM) Guide - What is DRM, How it Works, and why it's important for Protecting Digital…

Digital rights management (DRM): The complete guide - Castlabs Learn how DRM works for VOD, live, WebRTC, and offline. See OTT device coverage, key rotation, concurrency control, and…