Widevine DRM Cracked. DCP Still Safe. Projectionists, Do Your Thing.

The Widevine DRM for streaming websites has already been cracked. The private RSA key used by Widevine, hidden in the Chrome browser and Android OS, has been compromised in plaintext. People have used it to decrypt the AES keys for movies on streaming platforms.

So… Why has nobody pulled off the ultimate cinema heist?

All it would take is getting the private RSA key from an SMB (Secure Media Block — it's a piece of hardware inside a digital cinema projector), and using that key to obtain the plaintext AES keys from the KDM for any movie, and then obtaining the unencrypted DCP.

I get that this would be too technical for the cinema staff — but isn’t there any projectionist out there with a software engineer friend who could pull off a digital cinema heist?

Projectionists and software engineers must unite… for the cinema heist of the century.