A video "encryption" strategy I encountered today, anyone ever seen this?

[CursedLemon]

Hey all, so I did a little tech support for a client today involving playback of some video files they received from a governmental entity of some kind. They received them in the form of a USB stick with a couple of .zip files, these .zip files contained .ts videos with a few other extraneous files in their company. The office couldn't play them back with the default Windows player or VLC.

I hopped onto the computer and attempted to check the video data with MediaInfo - it showed absolutely nothing. I then attempted to load to the .ts files into Avidemux, program said it couldn't find a muxer.

Here is the folder contents for one of the .zip files:


[Attachment 94112 - Click to enlarge]

Examining one of the .bat files shows the following code:

@echo off
SETLOCAL
start .//VLC//vlc.exe -f --adaptive-use-access Mac-Play-Video-B70B76AC-02DB-6042-2395-B856A7016587-Manifest-DO-NOT-TAMPER.m3u8

Double-clicking on this .bat file appears to launch the portable version of VLC specified in the folder above and successfully starts playing the video.

Now obviously this is some kind of security strategy, but I'm kind of curious if anyone can make sense of what it is? How is this encryption being applied to the .ts file? Does the .ts container naturally contain this functionality? How is decryption happening here?

[jagabo]

Examine the m3u8 files with a text editor. There are probably some clues there.

[CursedLemon]

Examine the m3u8 files with a text editor. There are probably some clues there.

Here's a snippet of one of the files:

#EXTM3U
#EXT-X-VERSION:4
#EXT-X-TARGETDURATION:4
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-KEY:METHOD=AES-128,URI="https://app.guardify.com/v1/key.php?iv=0&value=MURUSFY1eUsrNzdOUFVPZEozM [truncated by myself for security]
#EXTINF:4,
#EXT-X-BYTERANGE:638464@0
B70B76AC-02DB-6042-2395-B856A7016587VidaNyx.ts
#EXT-X-KEY:METHOD=AES-128,URI="https://app.guardify.com/v1/key.php?iv=1&value=MURUSFY1eUsrNzdOUFVPZEozMzZrR3Nyc0JhQUVENVF3enlHWi9Cbm [truncated by myself for security]
#EXTINF:4,
#EXT-X-BYTERANGE:711584@638464
B70B76AC-02DB-6042-2395-B856A7016587VidaNyx.ts
#EXT-X-KEY:METHOD=AES-128,URI="https://app.guardify.com/v1/key.php?iv=2&value=MURUSFY1eUsrNzdOUFVPZEozMzZrR3Nyc0JhQUVENVF3enlHWi9C [truncated by myself for security]
#EXTINF:4,

Looks like this Guardify service is the culprit. Does this code imply that the decryption keys must be fetched from the included web links, i.e. you wouldn't be able to play these without an active internet connection?

[jagabo]

Does this code imply that the decryption keys must be fetched from the included web links, i.e. you wouldn't be able to play these without an active internet connection?

I believe so.