Narrowbeer: A Practical Replay Attack Against the Widevine DRM

Florian Roudot, Mohamed Sabt, Univ Rennes, CNRS

34th USENIX Security Symposium · Day 1

This technical article delves into the research presented in "Narrowbeer: A Practical Replay Attack Against the Widevine DRM," a paper by Florian Roudot and Mohamed Sabt from IRISA, Univ Rennes, and CNRS, presented at USENIX Security. The work investigates the security of Google's **Widevine Digital Rights Management (DRM)** system, a widely deployed software-based solution used by major streaming services like Netflix, Prime Video, and HBO Max to protect premium content from piracy. Unlike previous research that primarily focused on breaking Widevine's internal software protections or cryptographic mechanisms, this paper shifts its attention to how Widevine interacts with its host environment, specifically the operating system and web browser, concerning fundamental security properties like randomness and time.

AI review

This is the kind of research that makes vendors deeply uncomfortable — not because it breaks fancy crypto, but because it exposes a design assumption so obvious in hindsight that you wonder how it shipped. The T2 < T1 flaw is embarrassing for Widevine, and the replay attack is elegant, practical, and devastating to the entire license-based DRM model on desktop.