Murdoch's Hacker Speaks Out 86
This article from a Swiss newspaper recounts the appearance of Christopher Tarnovsky at the European Black Hat conference (link is to a Google translation of the French original). Next month Tarnovsky will testify in a lawsuit brought by a maker of satellite TV encryption systems (Kudeslki) against an Israeli company (NDS), for whom Tarnovsky worked until recently. (NDS is owned by Rupert Murdoch's News Corp.) While with NDS, Tarnovsky cracked Kudeslki's crypto, but claims he didn't post the result on the open Net. His responses to audience questions are amusing, in particular when someone from Microsoft asks him about breaking the Xbox 360 console. Tarnovsky replies (in the translation): "I have been offered 100,000 dollars for the break, but I replied that it was not enough."
Cheapskate (Score:3, Funny)
Re: (Score:2, Interesting)
Re: (Score:2)
I suspect that the 100,000 might be a collection from different sources with the goal of enticing people who might have the ability to accomplish the tasks. But I think the motivator is to slap MS.
Re: (Score:2)
only the HDD, only the HDD.
there are guides on how to copy movies to the 360's hd via Xsata etc, but they haven't gotten a way to say backup game discs to the 360's hd yet, or to put in a mod chip so you can play games backed up to hd-dvd-R discs.
the former is a better goal, more useful than the latter, after all the current crack lets you offload to a PC that could have an array of 750GB HDDS or something like that. HDs are way cheaper than hd-dvd-r's
Re: (Score:2)
I know the original Xbox had a single disc compromise that would let you backup and play games from the Xboxes HDD , without needing a mod chip or anything but i don't see that yet for the 360 (at least
Re: (Score:2)
That's fine, becaue the only games I've seen are DVD-sized games. The HD-DVD addon was only for movies. And now even that is dead.
Re: (Score:1)
that would have to save a significant cost for making new consoles if no games now or ever will use HD-dvd
Re: (Score:2)
Don't you know? (Score:1)
Re: (Score:2)
"I have been offered 100,000 dollars for the break, but I replied that it was not enough."
Any 4 year old can break an XBox 360 with their own toys.
Tonka trucks > all.
I wonder if this means it would take over 3x the work for him to crack it, or if it's only not enough because the benefit to the buyer (MS) is much greater than $100k. IE, with MS's Xbox360 install base, they should be willing to pay a lot more than that.
:D
Or maybe only 5 euros doesn't float his boat.
Re: (Score:1)
Reverse engineering genious (Score:5, Informative)
Re:Reverse engineering genious (Score:5, Informative)
Re: (Score:3, Informative)
Re: (Score:2, Interesting)
Re: (Score:2, Interesting)
Very likely, but Murdoch runs a large company and like most large companies the law is what they say it is unless and until ordered otherwise by a court.
Re: (Score:2)
Very big companies listen to courts? I thought all they listened to were threats at gunpoint.
InnerWeb
Re: (Score:2)
And then they can just ignore the multi-billion dollar fines, a la "Microsoft"...
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
NDS was accused of cracking the ITV Digital cards in the UK shortly after the released of terrestrial digital TV. NDS UK alledgedly posted the crack on a pay-TV hacking web site (House of Ill Compute) which it had some shady financial links to. This led to widespread counterfeit cards, and was blamed for the financial collapse of ITV Digital. The major beneficiary of the ITV Digital collapse was the other pay-TV service launching at the time - Sky Digital, which was, funnily enough, also owned by Murdoch. S
Trial date (Score:2, Interesting)
Most info on this trials documents has been sealed or blacked out like a UFO conspiracy
mostly to protect the outlandish claims of Echostar and their consultants from public
embarassment
Its all lies and soon the trial will reveal everything, this lawsuit loss and the 100 million or so they
owe Tivo after losing that lawsuit will be the final nail in Echostar's coffin.
JJ Gee enjoy your retirement.
first? (Score:2, Funny)
Sky TV uses Linux (Score:5, Informative)
in their set-top boxes in the EU/UK but they wont reveal the source code (try google'ing it or looking at their site you wont find it),
probably because you could decrypt the encryption on the Satellite stream,
shame that some companies (like murdochs) see Linux as free meal ticket and refuse to contribute anything back
still a GPL violation has never bothered billion dollar companies before, "i got mine screw you" seems to be the mantra of businesss/society thesedays
Re:Sky TV uses Linux (Score:5, Insightful)
The formula is not important and a good encryption algorithm should be free.
The key used is the protected part and should not be a part of the source code.
Re:Sky TV uses Linux (Score:5, Informative)
The formula is not important and a good encryption algorithm should be free.
The key used is the protected part and should not be a part of the source code.
Re: (Score:1)
Now if you know the card protocol, you can put a monitor on the smart card bus between the set-top
Re: (Score:2, Interesting)
Re: (Score:2)
I'm guessing if you were "really well heeled" you probably wouldn't be as interested in stealing satellite.
Either that, or you're really bored...
Re: (Score:1)
Re:Sky TV uses Linux (Score:5, Insightful)
Or, we have thought of it, it's just not as easy as you think. The problem is that the decoder has to have the key, otherwise the paying client can't watch TV. A pirate reverse engineers the decoder to find the key. The defence against this type of attack is to try and hide the key - one solution is to hide the key in hardware - the smartcard option. Another is to hide the code in software, using code obfuscators, virtual machines, whiteboxes. The final option is to obtain the key from a server, using two-way comms.
None of these solutions is fullproof, the first two choices are just security through obscurity - they can, and will, be hacked given enough time/incentive. The third option is problematic because what happens if the key server goes down? Plus, you need to have a whole head-end server infrastructure to support the solution, which the operators don't like. I know, I implemented the client half of such a system for a major content protection company a couple of years back.
Re: (Score:3, Interesting)
Re: (Score:1)
So then what you need to do is make it so that my box doesn't work UNLESS I call home, for example it needs to call home to get the key in the first place. This is the key server that I mentioned above, with the inconveniences that go along with it.
Re: (Score:2)
1. It has a built-in modem and uses an analogue phone line. You'll need to set up a box with an FXO port to defeat it; it's not as simple as firewalling ports on your router.
2. It refuses to operate if it can't phone home for any length of time.
These things have been properly thought through, y'know.
Re:Sky TV uses Linux (Score:5, Interesting)
Jiminicus, my job is to crack decoders. Well, at least half the time. The other half is spent designing systems to make the cracker's life difficult, by blocking the attacks that I have used myself.
For example, with your scheme, I would reverse engineer the official decoder, and then patch the code that checks the return code, so that the check always returns TRUE. Now, that can be defeated by making it so that the value returned by the server is actually a key. My next attack would then be to try and convince the server that I am a real official decoder, and that it should give me the key. Unless care is taken, I could probably get the necessary information for this by launching a man-in-the-middle attack on an official decoder.
The typical defence against this attack is to protect the link by using certificates signed by the encryption provider, and linked to the decoder's serial number. As a pirate, I then just extract the official certificate either from the decoder itself, or from the conversation of a real box. I can then clone the certificate/identity of the decoder, and the server will talk to me as though I'm a real decoder.
The response to that attack is to verify that there are not two decoders connected at the same time that use the same identity. But this is not as simple as it sounds. For performance reasons, servers are distributed to handle different 'parks' of decoders. But I have to maintain a synchronized list of currently logged in decoder identities across all servers. This is a definately non-trivial task, or at least that's what my collegues that work on the head-end code tell me.
Other options for a cracker include trying to find a way to compromise the head-end server, and then poke around on it to dig up signing certificates and other good stuff to circumvent the protection. Or he might launch a denial of service attack - most server solutions have a 'degraded' fall back mode where the TV signal is encrypted with a key kept locally in the decoder, to be used if the key servers fail for whatever reason. That key can of course be extracted by the traditional means.
Believe me, many, many, many people have tried to come up with solutions to this problem. The server approach that I have just outlined is the most secure that we have found to date, but as I have also described, it has problems too. Not to mention that it is expensive/complicated to implement.
Re: (Score:2)
Re: (Score:2)
Also, the prvious post was in reply to Jiminicus, who ap
Re: (Score:2)
Time was, if they scanned their server logs and noticed your box hadn't dialled in for a while, they wrote you a letter and shouted at you. This is because they log all your TV watching habits and sell them on to a ad firm who are a wholly owned subsidary
Re: (Score:2)
AIUI people who live in military-owned houses have caller ID disabled on their line and it can't be re-enabled - presumably they can't have multi-room?
Re: (Score:2)
I also strongly suspect this is why they still use a built-in modem and not the Ethernet port. It'd clearly be pref
Re: (Score:2)
Re: (Score:2)
In this day and age, it's probably easier and rather less risky to just download what you want to watch through torrents. Though that probably wasn't the case when Sky Digital first came about.
Re: (Score:1)
Re:Sky TV uses Linux (Score:5, Informative)
Some prototype work is being done on Linux boxes, but they're not available yet.
Posting anonymously for obvious reasons...
Re: (Score:1, Troll)
Re: (Score:3, Informative)
I presume you are talking about the Sky Broadband boxes, which are Netgear routers, for which Sky passes on the written offer to download the source from the Netgear website that Netgear provides to comply with GPLv2. While Sky has locked down their routers beyond what the standard Netgear firmware does, it is not clear that they have modified any GPLed source to do this, most likely all they have done is changed configuration files.
Given how strong Busybox has been in pursuing violations, I'd be surprise
Encryption U R Doin it wrong (Score:1)
Crypto patents and secrets are the reason (Score:2)
Re: (Score:2)
Re: (Score:2)
in their set-top boxes in the EU/UK but they wont reveal the source code (try google'ing it or looking at their site you wont find it), probably because you could decrypt the encryption on the Satellite stream, shame that some companies (like murdochs) see Linux as free meal ticket and refuse to contribute anything back still a GPL violation has never bothered billion dollar companies before, "i got mine screw you" seems to be the mantra of businesss/society thesedays
IANAL, and I don't know about GPL version 3, but my understanding about GPL is that you can release a product that contains both open and closed software, and you only have to GPL the software that directly contains GPL code. (As opposed to that which was produced by GPL development tools, or that which runs on a GPL operating system)
Correct my if I'm wrong, but hasn't Red Hat been doing this for years?
Le translation (Score:4, Funny)
Re: (Score:1)
Re: (Score:2)
Unfortunately, that's the only link I could find regarding that 2005 contest which Google won. They're probably still the best... http://www.astahost.com/googles-translation-wins-hands-down-t11662.html [astahost.com]
There's a problem with the linguistics in computational l
Re: (Score:1)
Re: (Score:1)
NDS sounds like a nasty company (Score:3, Informative)
Tarnovsky was in cahoots with another pair of hackers and when they turned state's evidence, one of them had a very unfortunate accident that left him dead.
Tarnovsky no doubt wants to get his profile as high as possible to make it more difficult to have an unfortunate accident himself.
Not for nothing, NDS comes from the same country that developed Kra Maga, a very vicious martial art based wholly on Cobra Kai's slogan.
Re: (Score:1)
Police? (Score:2, Funny)
Kudeslki?! (Score:2, Informative)
Break an Xbox? (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
It's OK because everyone else does it? (Score:3, Interesting)
Interesting.. so AIUI all the CA (conditional access) vendors routinely break each others' systems. That's not surprising in itself (I'll admit to having learned a fair bit from reverse engineering other peoples' code). It does seem a tad unethical though, especially the alleged release of the code. I wonder if the code release was a decision made by upper management at NDS / News Corp (and it wouldn't surprise me in the least if that turned out to be the case). From the outside, this looks a lot like a protection racket... "Buy our system, because it would be an awful shame if your revenue stream were to be... terminated"
Manual translation from french - FWIW (Score:5, Informative)
Image legend:
Christopher Tarnovsky: "Why would I have published these codes on the net for free? I am not stupid, and I never had the intention of taking that risk."
Main text:
PAID ACCESS SYSTEMS. A key witness in the court case opposing the Swiss group against the media giant News Corporation was passing by in Amsterdam, attending a conference on computer piracy. We met him.
François Pilet, Amsterdam
Saturday, March 29 2008
The audience is glued to the lips of Christopher Tarnovsky. In front of a podium of hackers and security specialists - with an average age of 25 - the self-taught electronics specialist revealed the techniques that allow him to break open chip cards that block access to pay TV chains in the whole world.
The scene takes place in the Mövenpick hotel in Amsterdam, where the European edition of the Black Hat conference was held Thursday and Friday last week. This is one of the prime professional meetings dedicated to computer piracy. Among the twenty or so speakers invited to this big get-together, Christoper Tarnovsky talked for more than one and a half hour in the "Lausanne" room - a sign of destiny (Tr. note: Lausanne is a Swiss city close to the headquarters of the Kudelski Group).
Employed by NDS
The 39 year old American is accused of having been recruited in 1999 by the Israeli company NDS, a competitor of Kudelski, to break the security codes of Canal+ (French Pay TV) and publish them on the Internet, and to have repeated the operation, to the detriment of the Swiss group and its clients. The publication of these codes allowed hundreds of thousands of savvy users to access encrypted TV channels without paying the subscription fees.
The American satellite TV company Echostar also uses Kudelski cards to protect their content. They confirmed having lost hundreds of millions of US dollars due to these pirate activities and demand one billion US$ of damages from NDS, a subsidiary of the media group News Corp.
This April, Christopher Tarnovsky will take the witness stand in a California court in defense of NDS, his employer for ten years following 1997. According to him, Kudelski and Echostar have wholly invented the conspiracy they claim having been victim of in order to mask the weakness of their encryption.
In his eyes, the case against NDS is nothing short of an extortion attempt. "Sure, I've broken the cards of Kudelski", he annoyedly states. "I was paid by NDS to do it. This is an activity that all companies in the trade do. But why would I have published these codes on the Net for free? I am not stupid, and I never had the intention of taking that risk."
Having become an awkward asset, Tarnowsky is no longer employed by the group since a year. He started his own company, Flylogic, through which he offers his know-how to electronics manufacturers, to test the resistance of new products to pirate attacks before they are launched.
Christoper Tarnovsky details the general weakness of systems based on certain chips designed by a handful of companies like Motorola and Infinenon (sic), systems used in products as divers as garage door remotes, car alarm systems and TV decoders.
"Unbreakable? That's wrong!"
"The manufacturers of semiconductors claim that their chips are unbreakable. The companies integrating them into their products trust the specifications they obtain. They believe that their secrets will be well kept. That is wrong, of course."
He showed pictures of his laboratory, set up with second-hand equipment worth a couple of thousand dollars. The centerpiece is a powerful Zeiss microscope to access the heart of the chip, where the precious codes are hidden. Successive layers of silicone are peeled away, using acids and lasers.
The engineer then explains how he takes over control of the card by short-circuiting one by one its protections with long microscopic needles. It takes a few minutes fo
Re: (Score:2)
sounds like he really knows what he's doing and he might just be the guy to break EPIC protection for the Chinese.
Kudelski's technology is used by DISH Network. (Score:3, Informative)
Nagravision is what "secures" DISH Network, Bell Open Vu, and a large number of smaller satellite-delivered television properties.
NDS is owned by the same company that owned DirecTV at the time of the Nagravision breach.
The story is predictable.