Why pirates can easily steal movies from Chrome

Cybersecurity researchers alerted Google to this Chrome bug in May, but the company has not changed anything yet.

A glitch in Google Chrome makes it easy for pirates to download illegal copies of movies streamed from sites such as Netflix and Amazon Prime.

Alexandra Mikityuk with Telekom Innovation Laboratories in Berlin, Germany, and David Livshits from the Cyber Security Research Center at Ben-Gurion University in Israel reportedly told Google about the problem on May 24, but have not yet seen the issue solved.

Google’s Widevine EME/CDM technology is the source of the problem, specifically how Google implements the technology to stream encrypted video. The researchers have created a video showing how to exploit the loophole in Chrome.

The solution seems simple to Mr. Livshits and Ms. Mikityuk. Before they publicly reveal the details, however, they are waiting until at least 90 days have passed since they privately told Google about the issue, in an effort to avoid enabling others to steal content. Google’s Project Zero security analysis team gives vendors at least 90 days to fix vulnerabilities they discover.

Google, however, did not clearly indicate what they plan to do about the glitch.

“We appreciate the researchers’ report and we’re examining it closely. Chrome has long been an open-source project and developers have been able to create their own versions of the browser that, for example, may use a different CDM or include modified CDM rendering paths. The Chrome browser, however, is required to protect compressed videos and does so,” Google responded in a statement, according to Gizmodo. 

Google is saying that even if it fixes the problem with new code, developers can make a new browser that eliminates the code.

Livshits and Mikityuk suggest that the problem can be solved with a Chrome patch, but a more permanent fix would require designing the CDM, which sends and receives license information and decrypts videos for streaming, to run inside a Trusted Execution Environment, which would prevent someone from stealing streaming content.

Google acquired Widevine in 2010 to secure premium Youtube Channels and Chrome streams, but it is also found in more than 2 billion other devices.

Although other digital rights management system errors have been uncovered in the past, Chrome’s vulnerability is unique in that it involves third-party systems that streamers trust to protect their content.

“The simplicity of stealing protected content with our approach poses a serious risk for Hollywood [studios] which rely on such technologies to protect their assets,” Livshits told Wired.