Hello All,

On Jun 11, 2024 Microsoft engineer posted on a public forum
information about a crash experienced with Apple TV service on a
Surface Pro 9 device [1].

The post had an attachment - a 771MB file (4GB unpacked), which leaked
internal code (260+ files [2]) pertaining to Microsoft PlayReady such
as the following:
- Warbird configuration for building PlayReady library
- Warbird library implementing code obfuscation functionality
- static libraries with symbolic information either required or
related to PlayReady client library building, this includes OEM,
crypto, ARM TEE / HW related libs a preprocessed C++ header file with
PlayReady constants, unpublished classes and their methods declaration

In general the above leaked key information related to PlayReady
internals and implementation. Leaked data should be sufficient to
completely reverse engineer Microsoft PlayReady operation (HW based
one in particular).

As such, on Jun 12, 2024 we notified Microsoft PlayReady and MSRC
about the leak shortly following its discovery.

We verified that it is possible to build
Windows.Media.Protection.PlayReady.dll  library (debug build and
without Warbird encryption / obfuscation) from the leaked code. A
follow up post by another Microsoft engineer provided guidelines on
how to proceed with the building process [4] (this post has been also
removed).

We also verified that Microsoft Symbol Server didn’t block request for
PDB file corresponding to Microsoft internal warbird.dll binary
(another leak / bug at Microsoft end).

The leak violated Microsoft's own guidelines [5] for posting link
repro information in public. These guidlines clearly state the
following among others:
- "All information in reports and any comments and replies are
publicly visible by default"
- "Don't put anything you want to keep private in the title or content
of the initial report, which is public"
- "To maintain your privacy and keep your sensitive information out of
public view, be careful"

The described leaks are yet another manifestation of what we have been
already aware of - the problems and inconsistencies observed at
Microsoft end with respect to PlayReady security and the way secrecy
of the implementation is implemented and/or maintained by the company.

While Microsoft removed the post (within 12 hours from the
notification), the company hasn't removed the leak itself so far [3].

There are some chances this post is to put Microsoft to action though...

Thank you.

Best Regards,
Adam Gowdiak

----------------------------------
Security Explorations -
AG Security Research Lab
https://security-explorations.com
----------------------------------

References:
[1] MSPR leak (screenshot 1)
    https://security-explorations.com/samples/mspr_leak_screenshot.png
[2] MSPR leak (files list)
    https://security-explorations.com/samples/mspr_leak_files.txt
[3] MSPR leak (screenshot 2)
    https://security-explorations.com/samples/mspr_leak_screenshot2.png
[4] MSPR leak (screenshot 3)
    https://security-explorations.com/samples/mspr_leak_screenshot3.png
[5] How to report a problem with the Microsoft C++ toolset or
documentation (Reports and privacy)
    https://learn.microsoft.com/en-us/cpp/overview/how-to-report-a-problem-with-the-visual-cpp-toolset?view=msvc-170#reports-and-privacy