Subscribe

Why pirates can easily steal movies from Chrome

Cybersecurity researchers alerted Google to this Chrome bug in May, but the company has not changed anything yet.

  • close
    Google's Chrome browser has a glitch that allows pirates to download videos illegally.
    Mark Lennihan/AP/File
    View Caption
  • About video ads
    View Caption
of

A glitch in Google Chrome makes it easy for pirates to download illegal copies of movies streamed from sites such as Netflix and Amazon Prime.

Alexandra Mikityuk with Telekom Innovation Laboratories in Berlin, Germany, and David Livshits from the Cyber Security Research Center at Ben-Gurion University in Israel reportedly told Google about the problem on May 24, but have not yet seen the issue solved.

Google’s Widevine EME/CDM technology is the source of the problem, specifically how Google implements the technology to stream encrypted video. The researchers have created a video showing how to exploit the loophole in Chrome.

The solution seems simple to Mr. Livshits and Ms. Mikityuk. Before they publicly reveal the details, however, they are waiting until at least 90 days have passed since they privately told Google about the issue, in an effort to avoid enabling others to steal content. Google’s Project Zero security analysis team gives vendors at least 90 days to fix vulnerabilities they discover.

Google, however, did not clearly indicate what they plan to do about the glitch.

“We appreciate the researchers’ report and we’re examining it closely. Chrome has long been an open-source project and developers have been able to create their own versions of the browser that, for example, may use a different CDM or include modified CDM rendering paths. The Chrome browser, however, is required to protect compressed videos and does so,” Google responded in a statement, according to Gizmodo. 

Google is saying that even if it fixes the problem with new code, developers can make a new browser that eliminates the code.

Livshits and Mikityuk suggest that the problem can be solved with a Chrome patch, but a more permanent fix would require designing the CDM, which sends and receives license information and decrypts videos for streaming, to run inside a Trusted Execution Environment, which would prevent someone from stealing streaming content.

Google acquired Widevine in 2010 to secure premium Youtube Channels and Chrome streams, but it is also found in more than 2 billion other devices.

Although other digital rights management system errors have been uncovered in the past, Chrome’s vulnerability is unique in that it involves third-party systems that streamers trust to protect their content.

“The simplicity of stealing protected content with our approach poses a serious risk for Hollywood [studios] which rely on such technologies to protect their assets,” Livshits told Wired. 

About these ads
Sponsored Content by LockerDome
 
 
Make a Difference
Inspired? Here are some ways to make a difference on this issue.
FREE Newsletters
Get the Monitor stories you care about delivered to your inbox.
 

We want to hear, did we miss an angle we should have covered? Should we come back to this topic? Or just give us a rating for this story. We want to hear from you.

Loading...

Loading...

Loading...

Save for later

Save
Cancel

Saved ( of items)

This item has been saved to read later from any device.
Access saved items through your user name at the top of the page.

View Saved Items

OK

Failed to save

You reached the limit of 20 saved items.
Please visit following link to manage you saved items.

View Saved Items

OK

Failed to save

You have already saved this item.

View Saved Items

OK