Security – Geert de Graaf

The Mr. Robot VR experience was a one time event (21-07-2016 1:45 p.m. ET). You needed the With.in app to watch the Mr. Robot VR experience.

I wanted to view this video another time so i did everything in my power to download this video! I succeeded this is my story:

With.in app

Files on my phone

Once the preload was finished I tried to open the video/audio files on my phone with no success. The files were encrypted.

Gut feeling

I had this gut feeling that the key would be sent before or during the one time event. To get the key i used a mobile packet capture app, I ran the capture during the one time event. After being blown away by the Mr. Robot VR experience I looked at the capture and found the encryption-key.

Missing lock

Getting the encryption-key was easy part. The tough part is getting the files decrypted using “DfZw7wrIxvSdHP3S“. I had to find out the used encryption method to decrypt the files.

Decompiling

I decompiled the android apk to find the used encryption method. I downloaded a recent version from apk4fun. To decompile the app I used a tool called dex2jar, to view the exported jar file i used the tool JD-GUI it can be downloaded from github.

The lock

After a while i found the method “EncryptedVideoDataSource” it included the final clue “private String algorithm = “RC4″;”

Decrypting (finally)

Now we can decrypt the files. I created a program to decrypt using RC4 in Visual Studio it can be downloaded from github. After decoding i had 5 playable files.

Compositing the audio and video

Unfortunately the audio/video files are separated I cannot play this on my VR headset.

I had to integrate the audio into the video. The audio included 4 stereo mp3’s for 360 audio. I found that you can effortlessly create the needed file using Adobe Premiere. After exporting it from premiere I can finaly re-enjoy the Mr. Robot VR experience.