Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Java Media

Blu-Ray Players Hackable Via Malicious Discs 107

Posted by Soulskill from the physical-media-increasingly-sketchy dept.
An anonymous reader writes: Some Blu-Ray disc interactive features use a Java variant for UIs and applications. Stephen Tomkinson just posted a blog discussing how specially created Blu-Ray discs can be used to hack various players using exploits related to their Java usage. He hacked one Linux-based, network-connected player to get root access through vulnerabilities introduced by the vendor. He did the same thing against Windows Blu-Ray player software. Tomkinson was then able to combine both, along with detection techniques, into a single disc.
This discussion has been archived. No new comments can be posted.

Blu-Ray Players Hackable Via Malicious Discs More

Blu-Ray Players Hackable Via Malicious Discs

Comments Filter:

  • I should think so! (Score:4, Insightful)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Saturday February 28, 2015 @03:45PM (#49155245) Homepage Journal

    My Blu-Ray player runs Linux and hasn't had a firmware update since 2011. I'd be shocked if it didn't have remote root holes accessible via network, let alone local privilege escalation exploits in Java.

    • Re:I should think so! (Score:5, Insightful)

      by fuzzyfuzzyfungus ( 1223518 ) on Saturday February 28, 2015 @04:20PM (#49155343) Journal
      I suspect that there are a number of ways in, given the usual attention given to firmware quality; but blu-ray isn't helped by having a security model marked by absolute paranoia about the precious 'content' escaping, combined with some amount of incompetence and a lot of pure apathy about any other security concern.

      With both the BD+ vm and the BD-J stuff, there is a lot of attention paid to 'ooh, the an unauthorized player attempting to do unauthorized things with the content on the disk?!'; but the contents of the disk are largely treated as trusted and the playback device is treated almost entirely as a potential adversary, not as a potential target, either from the disk side or the network side.

      • Re: (Score:1)

        by Anonymous Coward

        Then there is the other end.

        https://vimeo.com/110257380#at... [vimeo.com]
        https://vimeo.com/111417458 [vimeo.com]

        This dude basically owned the whole device. He just skipped messing with the DRM as that was not his end goal. He was basically able to inject code in. He had total control of both the cpus in the device. The cpu is trusted...

        Then I see things like this
        https://www.youtube.com/watch?... [youtube.com]

        These devices can be 100% hacked. It only takes time and some semblance of ability.

        • Do you have any better links with the freak dude at vimeo?

          All the videos skip and stall or play sound without advancing the video for some reason.

          Oh and props for the youtube link. Even though it was likely above my skill level, it was captivating and interesting. From the start of the vimeo links, it sounds like it might be good too.

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        With both the BD+ vm and the BD-J stuff, there is a lot of attention paid to 'ooh, the an unauthorized player attempting to do unauthorized things with the content on the disk?!'; but the contents of the disk are largely treated as trusted and the playback device is treated almost entirely as a potential adversary, not as a potential target, either from the disk side or the network side.

        This is an unfortunate part of the Blu-Ray standard - the only people who are supposed to be able to author a Blu-Ray disc

    • Re:I should think so! (Score:5, Insightful)

      by Dutch Gun ( 899105 ) on Saturday February 28, 2015 @04:22PM (#49155361)

      That was my first thought as well. "It uses Java (probably an older, unpatched version), so of course it's got massive security holes." But seriously, does anyone think there's even a remote chance that in 2015, malware is going to be transported by Blu-ray disc? This is an interesting tech demo, and it's always good to be aware of the potential of these things, but it doesn't seem to be a likely threat vector.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        I think that is also what they said about the sony rootkit embedded on CDs...

      • Re: I should think so! (Score:5, Interesting)

        by bill_mcgonigle ( 4333 ) * on Saturday February 28, 2015 @04:42PM (#49155435) Homepage Journal

        but it doesn't seem to be a likely threat vector.

        Do some traffic analysis on your target's porn habits at the ISP, leave a compromised disc about his favorite kink in a bag on the ground near where he parks his car, and use his "connected" player to zero-day the other equipment on his LAN, installing the APT without even needing to pretend about premesis warrants or anything.

      • Re:I should think so! (Score:4, Interesting)

        by fuzzyfuzzyfungus ( 1223518 ) on Saturday February 28, 2015 @04:43PM (#49155441) Journal
        It doesn't rank terribly high on the list of choices, given that it would be a pain in the ass to get your malware pressed into a reasonable number of disks(without suitable insider access to the later stages of disk manufacture process, in which case you might have some real room for fun); but there is one little detail that might get rather ugly:

        With 'BD Live', disks can be authored to include access to network resources, as well as locally stored assets, in their Java-driven interactive content stuff. Now, there is no way for an attacker to change the URLs a disk requests; but nor is there a way for anyone else to do so. Whatever was stamped into the disk at production will remain until the disk leaves use.

        Given that companies come and go, and company interest in specific products tends to wane even faster, I would be very, very, very, surprised if the various companies releasing 'BD Live' disks have managed to always retain control of the domain names that their disks will attempt to access. It wouldn't be a terribly high value exploit; but since a disk will attempt to access exactly the same URLs until it dies, you might be able to score a steady trickle of reliable re-infections by snapping up any lapsed domains associated with BD Live disks and adding a little 'bonus content'.

        • Any BD-J apps will need to be signed with a private key that matches the public key in the cert pressed to the disc, won't they?

          • Re: I should think so! (Score:4, Insightful)

            by fuzzyfuzzyfungus ( 1223518 ) on Saturday February 28, 2015 @05:54PM (#49155807) Journal
            I think that the apps are supposed to be signed(at least to get useful elevated priviliges, like access to the network or to the player local storage); but if a signed, legitimate, app makes a network request to a server that is no longer friendly, then it becomes a question of input validation, even if the application signing scheme is 100% in order and nobody screwed any part of that up.

            Call me a pessimist; but I'd bet nontrivial money that a lot of the 'interactive' cruft that is pumped out to bulk up 'special edition' releases is barely up to the challenge of presenting a helpful error message if it gets a 404 from the remote host, much less not falling over and wagging its tail against moderately clever malice. In that case, it'd be a fully signed and approved app doing the work, but taking action based on (ill-founded) trust in content it downloaded.

        • Re:I should think so! (Score:4, Interesting)

          by Dutch Gun ( 899105 ) on Saturday February 28, 2015 @06:16PM (#49155933)

          With 'BD Live', disks can be authored to include access to network resources

          I'm in a many-years-long battle with my PS3, which may be the best example of my irrational stubbornness that I can think of. Every time I play a Blu-ray disk, it asks me if I want to give it internet access. Every. Damn. Time. Why even make a setting called "BD Internet Connection: Allow/Confirm"? Seriously, I can't just set it to "no"?

          For years now, each time that question comes up, I select "no" and think to myself "Screw you, Sony!" There's no way to rationally explain it, but hell will freeze over before I select "yes".

          Now I just have another reason to keep selecting "no". Faith in my cause renewed, the battle continues...

        • You wouldn't need to get it pressed on a lot of disks but imagine if an ISO file of some movie was altered and when little johny downloads it and burns it in order to play on the large screen TV in the living room or perhaps a friends house, it's there.

          Now what can this malware do. That depends, can it open a proxy and ping me so I can bounce my IP off yours? Can it sit idle until someone commands it to participate in a massive DDOS attack? Or can I use it to gain access to the blue ray player and have it s

      • I tend to agree, the people I know that use blue ray don't have Internet. There's plenty of cheap boot legs next to the red box in the shadier parts, but the people buying them don t have Internet. For the rest of the people I know, a few dollar rental online here and there covers the gap of Netflix.

      • I was actually thinking I could probably use this to overcome the region restrictions on my blu-ray player. This seems like the type of hack that is used by the owner of the device to do things Sony didn't want the player to do, not so much the make-this-device-a-bot type.
      • The memory of the device contains all of those precious keys they are worried about getting into the hands of evil hackers. While I'm fairly certain blu-ray has been broken for a long time, mostly by grabbing the keys from software players. This adds another avenue to discover valid keys from any player.

      • Re: (Score:2)

        by Trogre ( 513942 )

        Why not? Honestly, why would a motivated enough studio not do such a thing? Remember the BMG rootkit fiasco. The only problem for them was that they were caught.

        • "Remember the BMG rootkit fiasco."

          Exactly. I'm not trusting in their ethics... just that they're not so incredibly stupid as to try the same disastrous plan a second time.

      • This is an interesting tech demo, and it's always good to be aware of the potential of these things, but it doesn't seem to be a likely threat vector.

        - The head of security for Iran's nuclear program on hacks via compromised thumb drives.

      • Actually, given the ready availability of pirated discs in most cities, I can easily imagine a pirated blu-ray of a popular movie containing an exploit. Seems obvious and really useful.

    • I'd be shocked if it didn't have remote root holes accessible via network,

      Contrary to popular belief, being 'old' does not instantly make you exploitable.

      Its not like it runs Oracle Java (maybe it does, maybe it doesn't)

      Its probably not LISTENing on the network, in which case its probably fairly safe, how many years has it been since theres been a remote kernel exploit of ANY kind, let alone one that'll get you some sort of access to run code?

    • Re: (Score:2)

      by Lumpy ( 12016 )

      Most bluray players run linux and never get updates. the OPPO Bluray player has an rs232 port on back that if you power cycle it and are fast enough, you can get a shell login as root.

      NEC TV sets are the same way.

    • I have the same comment about nearly every networked camera system ever.

    • People still use physical media? What is this 2005?
      • At least physical media allows you to own the product.

      • People still use physical media? What is this 2005?

        The Internet connections available in some geographic areas are effectively stuck in 2005.

  • Best defense is not to care (Score:1)

    by Anonymous Coward

    If you can, have the "computer" that you use for such things not matter if it gets hacked. If your blue ray player has no writable storage or network access and you power it off after every use, there is no danger: all a disc could do when played is show stuff and play sounds, which can happen regardless of the hack. Lack of risk exposure, so you can literally not care about the threat, is always better than trying to actually secure something.

    • Re:Best defense is not to care (Score:5, Interesting)

      by txoof ( 553270 ) on Saturday February 28, 2015 @04:21PM (#49155351) Homepage

      I suppose not caring works, but it seems like this is a great vector to turn hardware players into Zombies. If I were a criminal, I could think of a lot of things that could be done with even 1% of the world's internet connected players. Do you really want your Blu-Ray player to be part of a botnet sending spam or participating in denial of service attacks?

      If for no other reason, think of the impact on your bandwidth and electric bill. I certainly don't want a house full of hackable hardware. When (if) the internet of things arrives without security and 10% of the fridges, air conditioners, electricity meters, washing machines, pet doors, TVs and driers are all hacked because manufacturers couldn't be bothered to secure them, I think you'll probably care. It will bring the interwebs to its knees.

      • I'd not be terribly interested in the capabilities of the players themselves(routers make better zombies and are way more internet facing and unlikely to be turned off, and generally atrocious on security); but I would be very, very, nervous about anything that serves as a nice, subtle, persistent implant on a LAN.

        Even enterprises have a nasty habit of pretending that they can get away with a little sloppiness 'inside the firewall', and consumer gear often can't be persuaded not be absurdly trusting of a

    • Re:Best defense is not to care (Score:4, Interesting)

      by arth1 ( 260657 ) on Saturday February 28, 2015 @04:30PM (#49155391) Homepage Journal

      If you can, have the "computer" that you use for such things not matter if it gets hacked. If your blue ray player has no writable storage or network access and you power it off after every use, there is no danger

      I don't think there's a single BD player out there that doesn't allow for either software updates or updates to the BD codes that allow/disallow you to decode disks.

      One I have requires a USB key to be present to cache validity information for disks you have already watched - without it, it still works, but requires contacting the mothership through Internet whenever re-inserting any disks newer than the latest firmware update.

      BD disks these days even come with extras like links to youtube videos, that play on the BD player. That's an attack vector right there. Do they all use https and check the validity of the cert to avoid MITM attacks, using only name servers with signed entries? I highly doubt it.
      If I wanted to hack it, I feel fairly confident that I could do so. I'd start by hooking up to the (convenient) JTAG interface, and learn as much as i could that way, before starting to probe from the outside, i.e. through discs, USB or TCP/IP. But it would be low on my list if things I own that I want to hack. My car is more interesting.

      • I've had a blu-ray player for a few years. I've never once every considered plugging it into my router (it doesn't have wifi). I've never, and still don't see, any reason to connect it to the net.

        • Re: (Score:2)

          by jedidiah ( 1196 )

          In other words, you have a BD player too old to matter in this context. Current players do more than just decode spinning plastic. They also have all of those apps that connect to all of those interesting video services that you just conveniently ignored.

          • Re: (Score:2)

            by Lumpy ( 12016 )

            I have a 6 month old Bluray player and it's not connected to ethernet in any way. not even wireless.

            the "smart" functions of a bluray player are a sad, sad joke compared to a Roku 3. Why would someone intentionally use the horrible half assed crap internet capabilities on a bluray player?

            I have it to play the random Disc I may or may not get, a huge amount of video is not available online so I have to get it on a spinning piece of plastic.

            • I was using my samsung Smart tv for youtube, as Roku didn't have a youtube. That changed ~6 months ago so I started to use both. Then Samsung tried to insert ads into my playback , so I disconnected the TV from the network.

              What will it take for companies to learn if you don't want to provide support for 10 years don't design a device that requires your constant support for 10 years?

              • Looks like samsung solved the problem by convincing you to use a different device...

              • That's why I won't pay extra for a smart TV. I figure that its smart features will be obsolete within three years anyway, which is nowhere close to the useful life of the TV itself, and that I will have to buy some sort of external device if I want to continue to have smart features that will work with current services. (Currently that would be a Roku, an Amazon Fire TV, an Apple TV box, or something similar.)

          • It's a smart player. I just can't stand the smart functions and use a Roku instead.

  • These players were designed from the ground up to keep you on a leash forever, so of course they will try every way to force firmware updates on you even if you deny yours access to the internet. They never thought much about keeping the device secure, except against the customer.

  • Blu-Ray Players Hackable Via Malicious Discs (Score:3)

    by SeaFox ( 739806 ) on Saturday February 28, 2015 @04:12PM (#49155311)

    ...that are inserted by their owners.

    Always good to remember a venerability is a venerability, but a trojan is a trojan.

      - People buying legitimate blu-ray titles are not going to have this issue.
      - Even people downloading pirated content are not going to have this issue... as long as they are downloading just video files and not trying to pirate the entire disc with menus.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      People buying legitimate blu-ray titles are not going to have this issue.

      Unless the bluray came from Sony. Zing.

      Oh, and buck feta.

    • Re: (Score:1)

      by Anonymous Coward

      - People buying legitimate blu-ray titles are not going to have this issue.

      Because official media never contains malware. [rationallyparanoid.com]

    • Re: (Score:1)

      by Anonymous Coward

      Always good to remember a venerability is a venerability

      Are you saying those Blu-Ray players deserve great respect because they're so old? :-)

    • that are inserted by their owners

      Not necessarily, because not everybody lives alone. Anybody in your household with the opportunity to insert a disc can attempt to exploit a vulnerability like this. I imagine that most people do not regularly disconnect their BD players and keep them under lock and key.

      • Re: (Score:2)

        by SeaFox ( 739806 )

        Not necessarily, because not everybody lives alone. Anybody in your household with the opportunity to insert a disc can attempt to exploit a vulnerability like this.

        If you're worried about your security from other people in your home, you have bigger problems than your BD player.

  • I have hated blueray since the day it came out. I hated the initial cost of the players. I hated that the first generation of players were often incompatible with later disks. I hated that they made you watch FBI warnings, company logos, etc. I hated that they wanted me to rent them from sleazy stores like blockbuster. I hated that Sony slimed the HD DVD thing. I hated that you couldn't get a reasonably priced blueray burner for a computer. I hated the exorbitant cost of a blank blueray for a computer.

    B
    • Unfortunately, it's not just blu ray: 'BD-J' is their specific variant; but it is based on the so-called 'Globally Executable MHP', a truly horrifying acronym-standard-soup constructed to enable vaguely interoperable java-based UI atrocities for various flavors of set top box associated with DVB-T, DVB-S, and DVB-C(Basically, all digital broadcast and cable activity that isn't ATSC, ISDB, DTMB, or some fully proprietary oddball).

      BD-J is North America's main point of contact with this delightful substanc

  • Wanna know a secret? (Score:5, Interesting)

    by Solandri ( 704621 ) on Saturday February 28, 2015 @04:48PM (#49155467)
    I'll let you in on a little secret. I own lots of Blu-ray discs, but I don't actually own a Blu-ray player. I buy the disc (whatever my thoughts on Copyright, it is the law and the content producers do deserve to be paid), then I download a Blu-ray rip of the movie from a torrent site. Toss the file on my media server, and call it a day. They get their money, I don't have to deal with their forced previews and FBI warnings. I really have to wonder what they're thinking. First they complain about piracy, then they respond by making their products worse for legit customers than for pirates.
    • If I remember right, you're still considered to be in violation of copyright because you're using an unapproved rip. Your possession of the disk does not change the status of your torrented file. Now while ripping your own disks for personal use is still a violation of the DMCA (I'm pretty sure 'cause you're breaking the encryption to make the rip), it stays away from the whole torrent thing and may give you a better quality file, if only in terms of quality / file size and what language subtltles you get.
      • NO. Sony v. Universal (and subsequent rulings) have made it clear, it does not matter where a backup comes from, as long as you dont share it. If he downloaded the movie directly, without uploading anything, hes totally 100% legit in the clear. A backup is a backup is a backup, regardless of origin, you just cant share it.

        • NO. Sony v. Universal (and subsequent rulings) have made it clear, it does not matter where a backup comes from...

          Well, one Bing search and the first hit I get is from Legalzoom [legalzoom.com] which has a pretty straightforward writeup. You may be interested in the section labeled "DMCA Basics", but more relevant to the subject at hand they say "What the DMCA does, through DRM, is make the circumvention illegal, not the actual copying. So, now, even if you own your DVD and are trying to make a personal copy ... it is illegal to bypass DRM protection measures to make your backup". Note I didn't say anything about copyright or fair u

          • Not completely correct. You can do bit for bit copying of a DVD for a backup, keeping the encryption intact, you just cannot break the encryption. They are considered separate issues. The DCMA treats fair use as a necessary casualty. Its an interesting twist, but mostly irrelevant to Sony v. Universal other than encrypted DVDs in particular as a source for backups.
          • Luckily most sane countries have exemptions for just such situations :)

            • But unfortunately, "most sane countries" place onerous requirements on people born in not-sane countries who wish to live and work there.

        • Re: (Score:2)

          by PRMan ( 959735 )
          Torrenting IS sharing. You are sharing back small pieces of the file. That's distribution.

        • NO. Sony v. Universal (and subsequent rulings) have made it clear, it does not matter where a backup comes from, as long as you dont share it.

          Where do you get that? I see UMG v. MP3.com which decided exactly the opposite. The backup has to be made by you from a genuine copy, not transmitted by someone else through the Internet.

  • Isn't the very point of this player's system, that the player serves the interests of the disc's publisher over the interests of the users, where the users' needs should always yield whenever there is a conflict? That's not a mere technicality; it's the very essence. From the spec's pov, this is desirable operation. Nothing has been subverted.

  • can you use this on trun off HDCP / region lock?

    • Re: (Score:2)

      by SeaFox ( 739806 )

      Wouldn't it be easier to buy a blu-ray player that has that ability? There are certain makes available in the U.S (I'm going to assume you're in the U.S.) that have hidden player settings menus to control BD region specification. It's not possible to get a true "region free" (it plays everything) player, you'll have to change the player whenever you go from discs from one region to another. But at a cost of $50-$100 it's affordable to buy it as a second BD player to set to your favorite secondary region tha

  • and so now they can do what to my stuff?

  • Arguably off topic, but anyone that thinks on-disc custom menus with interactive content are a good idea should have watched my grandmother try to just play a DVD. Pop the disc in, hit pay. Then after wading through unbypassable FBI warnings (how can they even get away with some of the things they claim in those messages?) and previews, you finally get to the movie. Erm no. It's video loop with an integrated menu. She could hardly remember which remote was which, let alone what button did what. Trying t

  • Hey guys Linux is secure right? Can we please stop pretending open source means secure? Closed source doesn't mean secure either but the argument you often hear is "X is open source" "Open source things are secure" "Therefore X is secure".

    • Re: (Score:2)

      by ledow ( 319597 )

      Claiming, or falling for, any argument that "open-source is secure" is a complete failure to understand. Security is relative, not absolute. To get this ass-backwards just makes you look like an idiot. Believing anyone who says ANYTHING "is secure" is utter stupidity (rather than "is more secure", for instance)

      It's like saying "metal's secure". No it's not. I can walk around a sheet of metal just as easily as a pane of glass. However, a metal lock built to the same design as, say, a glass one is likel

  • Does anyone else just want to sit down with the genius who decided to put a Java runtime into a standard for home video and have a long, fireside chat?

    Possibly involving the poker and some of the larger blocks of firewood?

Slashdot Top Deals

Business is a good game -- lots of competition and minimum of rules. You keep score with money. -- Nolan Bushnell, founder of Atari

Close