News for hackers. Stuff that matters.

A comment on "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix. Parent comment

Re:"Widevine Dump":Leaked Code Downloads HD Video from Disne... by garblegarble on Monday December 27, 2021 @11:14AM (#29703675)
I would think so (the repo suggests this is a Lenovo TB-X505X key, I'd imagine they're at least per-product). I could certainly be be wrong about L1 keys being burned-in, that was just my understanding of it (vendor docs say things like "Hardware DRM", but maybe I'm jumping to conclusions from marketing speak)

The Widevine spec doesn't say either, it just says that all processing is within the Trusted Execution Environment, so I suppose the keys could be loaded/updated in firmware. I'm looking for more docs now...

Edit: looks like I was wrong and they can be changed with firmware updates: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

[ Parent | on HN ]
Re:"Widevine Dump":Leaked Code Downloads HD Video from Disne... by alias_neo on Monday December 27, 2021 @11:28AM (#29703804)
TEE is an environment with hardware backed attestation, you run a piece of software in the "black box" to do things like key generation etc.

My educated guess, having used TEE/TrustZone for keys is that they could update the payload (the "Trusted Executable") with a new one to resolve the issue.

[ Parent | on HN ]