What is the security/copy protection model for streaming media services?

Question

I realize this is a broad question, but maybe there is a simple answer

From my understanding, Streaming media services such as Amazon instant video, Netflix, and others do all decryption client side. What I do not understand is that if this is true, and the videos ever exist in a decrypted state, what prevents users from harvesting them en masse?

I am assuming the exact method of decryption somehow makes it less than trivial to just grab image / audio frames but I am wrong to assume that this is possible, or even easy?

I've always been curious how streaming streaming media providers circumvent this issue. I know some streaming providers (free ones like youtube) simply acknowledge that it is possible to save the videos, and don't do much to prevent it, but I would imagine that it is core to the business model of companies like netflix to make it neigh impossible to save a movie once you've rented it.

Answer

Just to make that this question doesn't seem too broad, I want to clarify that a direct answer to this question would show me how streaming media providers prevent users from trivially downloading their videos (via obfuscation / cpu features perhaps?)

Answer 1

If you can see or hear it, then you can record it. Even without messing with the obfuscation/encryption, it is trivial to copy the content, just start a screen recording program and enjoy.

I doubt cryptography is ever involved, it's mostly a matter of obfuscation; if the attacker can break the obfuscation and reverse engineer their player applet, then they will do the same to get the key if crypto is involved, so why bother ?

Content providers used to use some garbage called Flash to create an applet capable of talking to their server over RTMP and get the video stream from there. Note that the video is only streamed, never downloaded to disk, so the only place the decrypted/deobfuscated frames ever exist is in the computer's memory for a short period of time; that limits the "exposure" to a level they deem acceptable (or rather, a level Hollywood is forced to accept because it's either that or not selling their movies on the Internet at all).

Now content providers are aware of the decline of Flash's popularity and are starting to use HTML5 Encrypted Media Extensions, a plugin interface allowing a browser to communicate with the site's proprietary and obfuscated software that will be decrypting/deobfuscating the video frames before sending them back to the browser's media player which would play them; essentially the same thing as Flash except the proprietary applet now only does decryption instead of being the actual video player.

In the end, there is no way to prevent saving the content, so providers are trying to limit the damage :

• first off, it's quite hard and time consuming (but never impossible) to reverse engineer the Flash or EME applet and most people won't bother, they will either accept the restrictions or go somewhere else (unfortunately what they don't understand is that "somewhere else" also means "some pirate site" and they're loosing even more money by not letting honest users save the content they bought)

• the content isn't downloaded in advance but streamed in real time, this allows some control over how much content can potentially be saved, as their server won't accept to stream more than one file (or a few if they're lenient) simultaneously per account, which means the pirates wouldn't be too efficient at ripping content from the site and will look for other sources, ie. physical DVDs or Blu-Ray discs which are rippable more efficiently and as a bonus offer more quality than streaming, so web-rips (as they call them) are often done only for content not yet available on physical media, as a way for pirate teams to be more popular by leaking the content before it's physically released