carinstaller
join:2001-08-20
New Bedford, MA
|  Hacker cracks hi-def DVD encryption
Hacker Cracks High-Def DVD Encryption System
David Garrett, newsfactor.com
Sat Dec 30, 2:25 AM ET
The movie industry may rue the day it challenged hackers to break its
new encryption system for high-def DVDs, claiming it was bulletproof.
The day after Christmas, a hacker known only as Muslix64 posted a hack
to a Doom 9 forum that appears to shoot holes in their claim.
The hack consists of a program, BackupHDDVD, and a set of encryption
keys that would allow users to decrypt, and thus copy, high-definition
movies protected by the Advanced Access Content System (AACS), such as
Full Metal Jacket, The Last Samurai, and The Fugitive.
AACS was designed to replace the aging Content Scrambling System
(CSS) used on older, non-high-def DVDs. Industry bigwigs such as Sony,
Disney, and Warner Brothers have adopted AACS to keep pirates from
making and selling illegal copies of their movies.
Hacker cracks hi-def DVD encryption - news.yahoo.com
See the video here at YouTube
Muslix64's post at Doom9 forum
|
|
drjim
Premium,MVM
join:2000-06-13
Long Beach, CA
clubs: | Oh, well.....wonder how many lawsuits this will start?
Seriously, "If You Build It, They Will Crack It".
--
One man's Magic is another man's Engineering. |
|
thender2
Glamour Profession
Premium
join:2004-05-16
Staten Island, NY
1 edit | reply to carinstaller
quote:
. Industry bigwigs such as Sony,
Disney, and Warner Brothers have adopted AACS to keep pirates from
making and selling illegal copies of their movies.
That's preposterous. It was made to prevent me from encoding a copy to play on my portable, as well as play the copy I bought. It was made to restrict the hardware and software I use to play it on.
Above all, it was made to put an unhealthy amount of control in the hands of the content creators. It was made to be a pain in the ass.
I'm glad it's gone.
--
The Problem With Music.
Our Rationale
Time to rewrite the DMCA. |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to drjim
said by drjim  :. . "If You Build It, They Will Crack It". That's the bottom line, right there.
Maybe someday they'll get a clue, and figure out that the ill will and wasted money is not the way to go.
We can only dream . . . . |
|
carinstaller
join:2001-08-20
New Bedford, MA
| reply to thender2
That's preposterous. It was made to prevent me from encoding a copy to play on my portable, as well as play the copy I bought. It was made to restrict the hardware and software I use to play it on.
Above all, it was made to put an unhealthy amount of control in the hands of the content creators. It was made to be a pain in the ass.
I'm glad it's gone.
It also stops open source OS's and programs like Linux from being able to play HD-DVD's. |
|
thender2
Glamour Profession
Premium
join:2004-05-16
Staten Island, NY
|  said by carinstaller :That's preposterous. It was made to prevent me from encoding a copy to play on my portable, as well as play the copy I bought. It was made to restrict the hardware and software I use to play it on.
Above all, it was made to put an unhealthy amount of control in the hands of the content creators. It was made to be a pain in the ass.
I'm glad it's gone.
It also stops open source OS's and programs like Linux from being able to play HD-DVD's. Linux is for terrorists and pirates.
Plus, no one uses linux anyway, so who cares if they can play it or not?
--
The Problem With Music.
Our Rationale
Time to rewrite the DMCA. |
|
Kilroy
Premium,MVM
join:2002-11-21
Ann Arbor, MI
 ·WOW Internet and C..
| reply to AB
said by AB :Maybe someday they'll get a clue, and figure out that the ill will and wasted money is not the way to go. You'd think. The main problem is that the end user has to have a key to unlock it. As long as the end user has information necessary to display the data it can and will be cracked. Since not giving the end user the information necessary to display the data makes the data useless there is no way for DRM to work.
The more burden that is placed on the end user to use DRM protected media will force the end user to seek out a DRM free alternative. So, DRM makes pirates.
--
How hard does DRM have to bite before business abandon it? |
|
87134275
Nocturnal Desert Intruder
Premium
join:2005-08-19
Toronto, Can | reply to carinstaller
-
How gullible can these bigwigs in the DVD industry be to assume that nobody can crack their encryption?
The rule of physics: If it can be done, it can also be undone.
- |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to Kilroy
said by Kilroy :. . DRM makes pirates. Thieves, you mean? (I despise the term "pirate". A euphemism to make what they are doing sound romantic, and not so illegal and immoral. None of them are sitting around on a keg of grog saying yo-ho-ho. But I digress.)
You're absolutely right. And I have no problem whatsoever in anybody using a 'work-around' to get fair use out of the CD or DVD that was legally bought and paid for, if that's what's necessary. Quite a difference though, between that and making the latest release freely available to all comers on your P2P site, and willingly and happily trafficking in such items.
IMO, if the RIAA & MPAA would just make it very simple and relatively cheap to play CD's and DVD's at your leisure, on whatever media you choose, most people would simply opt to avail themselves of that method. Why do something illegal when it's not necessary?
On the flip side, if simple, easy, fair use is in place for CD's & DVD's, make the penalties for anybody caught stealing to be such that no one in their right mind would do it.
The problem currently, as I see it anyway, is that the RIAA & MPAA don't want to allow 'fair use', yet also want to throw the book at anyone caught using a 'work-around', or downloading illegally. This is the attitude that creates the so-called "pirates" (thieves) you are referring to, as well as makes relatively law-abiding citizens such as myself consider the RIAA & MPAA to be complete asshats, and feel no sympathy whatsoever for their "cause". They're greedy bastards, is about what it amounts to. |
|
drjim
Premium,MVM
join:2000-06-13
Long Beach, CA
clubs: | And they've ALWAYS been greedy bastards! I just read something the other day where the RIAA now wants a cut of tee-shirt and poster sales that take place at concerts and online!
--
One man's Magic is another man's Engineering. |
|
antiserious
The Future ain't what it used to be
Premium
join:2001-12-12
Scranton, PA
| reply to thender2
said by thender2 :Linux is for terrorists and pirates. Plus, no one uses linux anyway, so who cares if they can play it or not?
And the moon is made out of green cheese. 
Seriously, thanks for the chuckle. Maybe, next Christmas, you'll get a clue.
--
" But luckily for me they had to stop then and re-load,
and by the time they'd done that I was heading Down The Road "
|
|
nixer2000
@seudo.net | Everybody knows the moon is made out of Swiss cheese.  |
|
ppcpunk
join:2001-02-11
Davenport, IA | reply to AB
Unauthorized copying is not stealing, it's unauthorized copying and there IS a difference.
I see people saying this all the time and it makes me think they are the same people who say moronic things like "abortion is murder." |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| said by ppcpunk :Unauthorized copying is not stealing, it's unauthorized copying and there IS a difference. . . . I agree with you. But most of those who are not simply 'unauthorizedly copying', but flat-out stealing, are the same ones who fashion themselves "pirates", rather than the thieves that they actually are. They don't mind being a thief, they just don't want to be called a thief. |
|
astirusty
Premium
join:2000-12-23
Henderson, NV
 ·AT&T Southwest
| reply to thender2
said by thender2 :Linux is for terrorists and pirates. Plus, no one uses linux anyway, so who cares if they can play it or not? I knew it all along, the U.S. Govt. is just a bunch of pirates!
Site Computer Procs RMax OS Segment
Classified BladeCenter LS20, Opteron 2.2 GHz 1644 4048 Linux Classifie
Classified BladeCenter LS20, Opteron 2.2 GHz 1644 4048 Linux Classifie
Classified BladeCenter LS20, Opteron 2.2 GHz 1644 4048 Linux Classifie
Classified BladeCenter LS20, Opteron 2.2 GHz 1644 4048 Linux Classifie
Defense Classified Cluster Platform 4000 DL145 Opter 1024 2802 Linux Classifie
Defense Classified ProLiant BL460c EM64T Xeon 51xx 3 528 4182 Linux Classifie
Defense Classified ProLiant BL460c EM64T Xeon 51xx 3 440 3485 Linux Classifie
Fermi National Accelerat Opteron 2.0 GHz, Infiniband 2400 6894 Linux Research
Government Cluster Platform 3000 DL360G4 Xeo 640 3174 Linux Classifie
Government Cluster Platform 4000 DL145 Opter 1108 3085 Linux Classifie
Government Cluster Platform 4000 DL145 Opter 1108 3085 Linux Classifie
Government Cluster Platform 6000 rx1620, Ita 504 2871 Linux Classifie
Government Cluster Platform 3000 DL360G4 Xeo 512 2739 Linux Classifie
Government Classified Cluster Platform 3000 DL360G4 Xeo 1000 4624 Linux Governmen
Government Classified Cluster Platform 3000 DL360G4 Xeo 1000 4624 Linux Governmen
Government Classified Cluster Platform 3000 DL360G3 Xeo 1024 2880 Linux Governmen
Lawrence Livermore Nation Appro Xtreme Server - Quad Optero 2304 8181 Linux Research
Lawrence Livermore Nation MCR Linux Cluster Xeon 2.4 GHz - 2304 7634 Linux Research
Lawrence Livermore Nation xSeries Cluster Xeon 2.4 GHz - Qu 1920 6586 Linux Research
Lawrence Livermore Nation xSeries x335 Cluster, Xeon 3.06 G 1540 6232 Linux Research
Lawrence Livermore Nation Intel Itanium2 Tiger4 1.4GHz - Q 4096 19940 Linux Research
Los Alamos National Labor Opteron 2 GHz, Myrinet 2816 8051 Linux Research
Los Alamos National Labor Opteron 2.6 GHz, Infiniband 1620 6677 Linux Research
Los Alamos National Labor Opteron 2.6 GHz, Infiniband 1080 4721 Linux Research
Los Alamos National Labor Appro HyperBlade 1028 3357 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Los Alamos National Labor IBM eServer x3755 Opteron dual co 1152 4379 Linux Research
Naval Research Laboratory Cray XD1, 2.2 GHz 864 3041 Linux Research
NNSA/Sandia National Labo PowerEdge 1850, 3.6 GHz, Infiniba 9024 53000 Linux Research
Sandia National Laborator Cluster Platform 3000 DL360G4 Xeo 1028 3511 Linux Research
Sandia National Laborator Cluster Platform 3000 DL360G4 Xeo 1028 3511 Linux Research
Sandia National Laborator Cluster Platform DL360G3, Pentium 1024 2880 Linux Research
Sandia National Laborator Cluster Platform DL360G3, Pentium 1024 2880 Linux Research
Sandia National Laborator Cluster Platform 3000 DL360G4 Xeo 512 2739 Linux Research
US Army Research Laborato LNX Cluster, Xeon 3.6 GHz, Myrine 2048 10650 Linux Research
US Army Research Laborato eServer Opteron 2.2 GHz. Myrinet 2320 7185 Linux Research
Wright-Patterson Air Forc SGI Altix 3700 Bx2, 1.6 GHz, NUMA 2048 11652 Linux Research
Wright-Patterson Air Forc Cluster Platform 4000 DL145 Opter 2048 7925 Linux Research |
|
mattei
Moderated, now muzzled
join:2001-03-19
Canada
| reply to carinstaller
CSS this is not. They did learn some lessons the last time out.
AES-128 has not been cracked. AACS has not been cracked. Approximately 150 titles now in circulation (now in circulation, not titles of the same name in circulation 6 months from now) are open to decryption via compromised title keys obtained from a poorly protected player and/or a compromised player key. This was expected and planned for. Now we all get to see how well that plan works out.
Eventually having 500+ hardware player keys find their way into the public realm is a more likely compromise than all-out defeat. I suppose death by a thousand cuts would take the form of regularly updated title key lists, with compromised player keys remaining unmentioned and valid.
Of course, in the short-term, arguing over details is mostly academic while watching an HD-DVD movie sans DRM. Pass the popcorn. |
|
Hall
Premium,MVM
join:2000-04-28
Dayton, OH | reply to carinstaller
I'm going to go out on a limb here and say it... There's something fishy about this whole thing. Let's see how it all pans out.
--
This is my .sig. I like it bold. |
|
waka
join:2002-06-01
Tacoma, WA | muslix64 has posted to doom9 again with BackupHDDVD V1.00. He also provides some insights as to what he has been doing. Looks interesting at the least. |
|
mattei
Moderated, now muzzled
join:2001-03-19
Canada
| reply to Hall
Cyberlink responds to allegations (generated in the rumor mill):
»msmvps.com/blogs/chrisl/archive/···980.aspx
muslix64 reappears:
I spent the last few days reading a lot of articles on BackupHDDVD, reading a lot of people's post/comments on various websites.
This is the time to set the record straight about this new tool and what the impacts are.
First I need to clarify some points.
Revocation:
In the AACS system, there is 4 types of revocation:
Drive revocation
Host revocation
Device revocation (with MKB)
Content revocation
There is no such thing as "title key revocation" and "volume key revocation"
-------------
Now, here is a list of affirmations I have seen lately.
Affirmation 1: You did not break AACS, just the player
My comment: I did not break AACS, but I find a way to decrypt movies and I have bypassed all the revocation system.
Not that bad...
Affirmation 2: The BackupHDDVD circumvention tool won't last long
My comment: As long as insecure players will exist, it will last...
And insecure players will always exist, in fact you can extract keys from any player! Some players are just easier to extract the key from. Being lazy, I prefer to extract keys from an insecure player than a secure one.
And the AACS spec says "Device keys must be protected!" but they did not said that about volume key, fatal mistake!
Affirmation 3: The keys can easily be revoked.
My comment: What keys are you talking about?
As I stated before, there is no such thing as "title key revocation" and "volume key revocation". If someone publishes only volume keys, there is no way to know from which player these keys where extracted from, making the revocation system useless. They can do content revocation, but to revoke what? All movies before 2007? They can do player revocation, so I will just change the player I'm using, big deal...
So what is the AACS revocation system good at?
It is good for that scenario:
Someone post on the net, a tool that do the complete decryption automatically. Off course the program use stolen device keys from an official player. They (AACS and friends) will eventually get their hands on this program, look at the device keys and revoke them. Making that player unable to play new titles. But the author of this program can pre-extract a bunch of devices keys from different players and release them, one at the time, when the previous one have been blacklisted. The AACS spec says "Device keys must be protected!" so I suppose they put more effort in protecting these keys then the volume key in memory.
Affirmation 4: BackupHDDVD is nothing, only one person out of a million have the technical skills to extract keys.
My comment: BackupHDDVD is a proof of concept.
Picture this:
Few skilled persons can do massive volume key extraction, and send the keys to a central server on the internet. Then, they create an easy to use decryption program, with a nice GUI that do online key recovery. That way, my father and your father can backup movies.
Or they can send the keydb.cfg file on P2P networks (BitTorrent, E-Mule, etc..)
See the problem now?
Affirmation 5: You can extract keys from software player on personal computer but not on hardware player.
My comment: It's easier to extract keys from software player, but it also possible to extract keys from hardware player (the set-top box in your living room!)
Conclusion:
The attack I describe in "Affirmation 4", is not here yet, but it's coming. So I give MPAA and AACSLA a head start. Start to think what you can do about that.
To totally block this attack, they need to put different keys on every disk! Now, they only have different keys for different movies. I don't know about the manufacturing process of the disk. This solution may not be possible.
The best they can do, is doing shorter manufacturing run of a particular movie, so it would be difficult to get your hand on every "pressing" of a movie.
When they design AACS, they assume people will look for the device keys. I don't care about device keys. I do care about volume key. Having the device keys mean that you have to re-implements all the complex crypto and do the full AACS process.
I leave all this dirty job to the player and recover only the volume key.
There is 3 important things in cryptography:
1-Private key protection
2-Private key protection
3-Private key protection
Did I break AACS? I don't know. What do you think?
I'm not going to work on this anymore, I'm taking a vacation! |
|
javaMan
Premium,MVM
join:2002-07-15
San Luis Obispo, CA
| reply to antiserious
said by antiserious :said by thender2 :Linux is for terrorists and pirates. Plus, no one uses linux anyway, so who cares if they can play it or not? And the moon is made out of green cheese. Seriously, thanks for the chuckle. Maybe, next Christmas, you'll get a clue. I believe he was being facetious.
--
Woe unto them that call evil good, and good evil; that put darkness for light, and light for darkness. . . Isa. 5:20 |
|
