Incident: Vulnerability in Google's Widevine DRM Allows Movie Piracy

Published Date: 2016-06-24

Postmortem Analysis
Timeline 1. The software failure incident happened about eight months before the researchers found the bug, which was reported in the article published on June 24, 2016 [Article 45005]. Estimation: Step 1: The researchers found the bug about eight months before the article was published. Step 2: The article was published on June 24, 2016. Step 3: Estimating back eight months from June 2016, the software failure incident likely occurred around October 2015.
System 1. Widevine EME/CDM technology implemented by Google in Chrome browser [45005]
Responsible Organization 1. Hackers exploited a vulnerability in Google's Widevine EME/CDM technology used in Chrome browser to save illegal copies of movies streamed on platforms like Netflix and Amazon Prime [45005].
Impacted Organization 1. Hollywood studios and content providers like Netflix and Amazon Prime were impacted by the software failure incident reported in Article 45005. The vulnerability in Google's Widevine EME/CDM technology allowed users to save illegal copies of movies streamed on Chrome from these platforms [45005].
Software Causes 1. Vulnerability in the Widevine EME/CDM technology used by Google Chrome for streaming encrypted video [45005].
Non-software Causes 1. Lack of a Chrome patch issued by Google to fix the vulnerability in the Widevine EME/CDM technology used for streaming media through Chrome [45005].
Impacts 1. The vulnerability in Google's Widevine technology allowed individuals to save illegal copies of movies streamed on Chrome using sites like Netflix or Amazon Prime, potentially leading to unauthorized distribution of copyrighted content [45005]. 2. The flaw in the implementation of the digital management system could compromise the security of protected content, undermining the trust of content providers and studios in the protection of their assets [45005]. 3. The failure to issue a patch promptly after being alerted to the vulnerability could have exposed users to the risk of having their decrypted content hijacked while streaming, highlighting a delay in addressing critical security issues [45005].
Preventions 1. Implementing a Chrome patch to fix the vulnerability in the Widevine EME/CDM technology used for streaming encrypted video in Chrome [45005]. 2. Designing the Content Decryption Module (CDM) to run inside a Trusted Execution Environment (TEE) to protect the decrypted content in a secure memory space [45005].
Fixes 1. Google issuing a patch to fix the vulnerability in the Widevine EME/CDM technology used in Chrome [45005].
References 1. Security researchers David Livshits from the Cyber Security Research Center at Ben-Gurion University in Israel and Alexandra Mikityuk with Telekom Innovation Laboratories in Berlin, Germany [45005] 2. Google spokesperson [45005]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the vulnerability in the Widevine DRM system used by Google Chrome has happened again within the same organization. The article mentions that in 2001, a Russian programmer discovered vulnerabilities in the encryption system Adobe used for protecting electronic books, and a group of researchers found flaws in the digital watermarking technology created by the Secure Digital Music Initiative. However, the Chrome vulnerability is different as it involves a third-party system that streamers trust to protect their content. This incident highlights a recurring issue within Google's Widevine DRM system [45005]. (b) The software failure incident related to vulnerabilities in digital rights management systems is not exclusive to Google. The article mentions that in 2001, vulnerabilities were discovered in the encryption system Adobe used for protecting electronic books, and flaws were found in the digital watermarking technology created by the Secure Digital Music Initiative. This indicates that similar incidents have occurred with other organizations and their products and services, showcasing a broader issue within the digital rights management landscape [45005].
Phase (Design/Operation) design, operation (a) The software failure incident in the article is related to the design phase. The vulnerability in the Widevine EME/CDM technology used by Google Chrome to stream encrypted video was identified by security researchers. The flaw allowed users to exploit the system and save illegal copies of movies streamed on Chrome through platforms like Netflix or Amazon Prime. The issue was attributed to the way Google implemented the technology, allowing for the copying of decrypted content as it streams [45005]. (b) The software failure incident is also related to the operation phase. The vulnerability in the Widevine technology allowed for the exploitation of the system during the operation of streaming encrypted video content. Users could hijack the decrypted movie right after it was decrypted and being passed to the player for streaming. This operation-related flaw enabled the copying of protected content, posing a risk to content providers like movie studios [45005].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily within the system. The vulnerability exists in the way Google implements the Widevine EME/CDM technology that Chrome uses to stream encrypted video [45005]. The flaw allows individuals to save illegal copies of movies streamed on Chrome using sites like Netflix or Amazon Prime. The issue lies in the implementation of the digital management system called Widevine, which Google owns but did not create. The flaw allows users to copy decrypted content as it streams, indicating a failure within the system's design and implementation. (b) outside_system: The software failure incident does not seem to be primarily due to contributing factors originating from outside the system. The vulnerability in the Widevine EME/CDM technology is a result of how Google implemented the system within Chrome, rather than external factors beyond Google's control [45005].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is primarily due to a vulnerability in the Widevine EME/CDM technology used by Google Chrome to stream encrypted video content. This vulnerability allows individuals to exploit the system and save illegal copies of movies streamed on Chrome through platforms like Netflix or Amazon Prime [45005]. (b) Human actions also play a role in this software failure incident. The security researchers, David Livshits and Alexandra Mikityuk, discovered the vulnerability and reported it to Google on May 24th. Despite alerting Google to the problem, the tech giant has yet to issue a patch to address the vulnerability. The researchers created a proof-of-concept executable file to demonstrate the exploit but have not disclosed the details of the vulnerability to prevent misuse until at least 90 days after their disclosure to Google [45005].
Dimension (Hardware/Software) software (a) The software failure incident in the article is not related to hardware issues but rather to a vulnerability in the software system used by Google's Chrome browser for streaming media [45005]. The vulnerability exists in the way Google implements the Widevine EME/CDM technology, which allows users to exploit a flaw to save illegal copies of movies streamed on Chrome through sites like Netflix or Amazon Prime. This vulnerability is a software issue rather than a hardware one. (b) The software failure incident in the article is directly related to software issues. The vulnerability in the Widevine EME/CDM technology used by Google's Chrome browser to stream encrypted video is a software flaw that allows users to bypass protections and save illegal copies of movies streamed on Chrome [45005]. The researchers identified a bug in the implementation of the digital management system, which enables the copying of decrypted content as it streams, highlighting a software-related failure.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. The vulnerability in the Widevine EME/CDM technology used by Google's Chrome browser was discovered by security researchers who found a way to exploit the flaw to save illegal copies of movies streamed on Chrome from sites like Netflix or Amazon Prime [45005]. The researchers created a proof-of-concept executable file to demonstrate how the vulnerability could be exploited, highlighting the potential for piracy and theft of protected content. The researchers also emphasized the risk this vulnerability poses to Hollywood studios that rely on such technologies to protect their assets [45005].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions but rather due to a vulnerability in the way Google implements the Widevine EME/CDM technology used to stream encrypted video through Chrome. The security researchers discovered a flaw in the system that allowed users to save illegal copies of movies streamed on Chrome from sites like Netflix or Amazon Prime. They alerted Google to the problem, but Google has yet to issue a patch [45005]. (b) The software failure incident was not a result of accidental decisions but rather a vulnerability in the implementation of the Widevine DRM system owned by Google. The flaw allowed for the copying of decrypted content as it streams, posing a risk for content providers like Hollywood studios who rely on such technologies to protect their assets [45005].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The vulnerability in the Widevine EME/CDM technology used by Google Chrome to stream encrypted video was discovered by security researchers David Livshits and Alexandra Mikityuk. They found a flaw in the implementation of the digital management system, Widevine, which allowed users to exploit the system and save illegal copies of movies streamed on Chrome through platforms like Netflix and Amazon Prime [45005]. (b) The software failure incident can also be considered accidental as the vulnerability in the Widevine technology was not intentionally created by Google but was a result of the way the system was implemented. The researchers who discovered the flaw did not disclose details about the bug immediately to prevent unauthorized exploitation, indicating that the vulnerability was not introduced intentionally but was a result of oversight in the development process [45005].
Duration permanent, temporary (a) The software failure incident described in the article is more likely to be considered permanent. The vulnerability in the Widevine EME/CDM technology used by Google Chrome to stream encrypted video allowed for the exploitation of the flaw to save illegal copies of movies streamed on Chrome [45005]. The researchers who discovered the vulnerability believe that the issue can be fixed easily with a Chrome patch, but also suggested a more comprehensive solution involving the design of the CDM to run inside a Trusted Execution Environment (TEE) to prevent future vulnerabilities [45005]. The vulnerability has apparently existed since Google embedded the Widevine technology in its browser, indicating a long-standing issue that required attention [45005]. (b) The software failure incident could also be considered temporary to some extent. While the vulnerability was present and exploitable, the researchers did not disclose detailed information about the bug until at least 90 days after their disclosure to Google to prevent unauthorized exploitation [45005]. This temporary aspect is related to the delay in publicly disclosing the vulnerability to allow time for a fix to be implemented.
Behaviour value, other (a) crash: The article does not mention any instance of a system crash where the software completely loses its state and fails to perform any intended functions. (b) omission: The software failure incident described in the article is related to a vulnerability in Google's Widevine technology used for streaming encrypted video through Chrome. This vulnerability allows users to exploit the system and save illegal copies of movies streamed on platforms like Netflix and Amazon Prime [45005]. (c) timing: The article does not mention any instance of the system performing its intended functions correctly but at the wrong time. (d) value: The software failure incident is related to the system performing its intended functions incorrectly by allowing users to copy decrypted content as it streams, which should be protected [45005]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The software failure incident involves a security vulnerability in the Widevine technology used by Google Chrome, allowing users to exploit the system and save illegal copies of streamed movies, which is a form of unauthorized content copying [45005].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence non-human, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) The software failure incident described in the articles did not directly result in any property loss or financial harm to individuals or organizations [45005]. (e) unknown (f) The software failure incident impacted non-human entities, specifically the vulnerability in the Widevine EME/CDM technology used by Google's Chrome browser allowed for the potential theft of protected content, affecting movie studios and content providers [45005]. (g) unknown (h) The articles discuss potential consequences of the software failure, such as the risk posed to Hollywood studios relying on DRM technologies to protect their assets, but there is no specific mention of actual observed consequences [45005]. (i) unknown
Domain entertainment (a) The failed system was intended to support the entertainment industry. The vulnerability in the Widevine EME/CDM technology used by Google Chrome allowed users to exploit a flaw to save illegal copies of movies streamed on platforms like Netflix and Amazon Prime [Article 45005]. This incident directly impacts the protection of digital content in the entertainment sector.

Sources

Back to List