Still More on News Corp. Hacking Charges

Spike and others wrote in about this ongoing saga: subsidiary of Vivendi claims that a subsidiary of News Corporation cracked their satellite TV smart cards and posted for public download. (See our previous stories.) Two new stories from the Associated Press and Yahoo note that although the two companies are apparently dropping the original lawsuit (since News Corp. is making a large investment in Vivendi), Echostar is now claiming they were hacked too and the U.S. Justice Department is investigating possible criminal charges.

Comments

Re:So they claim...

[Angry White Guy]

The evidence that they are citing is the $40,000 stuffed in electrical equipment.
Although this is pure speculation, having your technology leaked to the hackers, forcing an industry-wide upgrade to new technology which is leaked to the hackers, forcing... makes an interesting business model.

"Security"

[phil reed]

It's interesting to note that DirecTV is in the process of sending out new smart cards for all of their satellite receivers nationwide. The letter announcing that fact cites "security", but it doesn't say whose security they are worried about. Unsophisticated DirecTV users will, of course, assume it's the user's security that's at stake.

Re:"Security"

[Angry White Guy]

Actually, it is for the users security. Not that someone is going to get their personal information or be able to track what they watch, but security of their investment. If anyone remembers the old pay-tv programs ON and IT, they remember that they went out of business because everyone was pirating their signal. Canada was a haven for home-brew on boxes. They filtered accross the border, everyone had them, and nobody was paying for them. Because it was a complete hardware solution, the company had to strike a balance between acceptable levels of piracy, cash flow, and cost to change the boxes of their subscribers.

This is exactly what is going to happen to DirectTV, but they only have to send out new cards, not entire receivers. When piracy gets too high, they ship another card. It's much easier to ship a card, to have the user install it, and coordinate the effort. But once the piracy becomes rampant, then the legitimate subscribers will have lost their initial hardware investment.

Re:"Security"

[elvum]

They're still twisting the English language to their own ends. They need to explain why users have to install their new cards, but "security" sounds so much friendlier than "to protect our revenue stream", despite the two being far from synonymous...

Corporate hacking

[killmenow]

Frankly, I don't care if companies hack each other...so long as I benefit.

Continuous update

[Zeinfeld]

An interesting feature of the satelite smartcard scene is that the protection schemes are designed with the knowledge they can be craked.

Ultimately no security scheme based on commodity hardware is secure against a determined attack. Even the clipper chip was broken. If the adversary has a scanning electron microscope available they are going to be able to reverse engineer the chip. Ross Andersson did a paper on this a while back.

The strategy the satellite companies use today is economic rather than purely technical. What they do is to design smart cards which are subject to progressive security flaws. They then send out different variations on the smart card to different customers.

The trick is that the pirate does not know which of the flaws matter and which do not. So if the pirate clones a particular card perfectly the satellite company can respond cheaply and effectively by just replacing the small number of cards that have been compromised.

If the pirate makes a more general attack the satelite co looks for any small difference between the cloned card and the genuine cards and programs a deactivation code to take advantage.

Most cloned cards are not perfect since the pirates are in competition with each other. It is better to get a cloned card out in 3 weeks than to wait a n extra couple of months and allow a competitor to steal the market.

The satelite cos generally wait until the pirates have sold a significant number of cards before sending out the deactivation codes. This discredits the pirates with more customers. If the customers learn that using a pirate card ends up costing them more than being honest in addition to being inconvenient they are more likely to turn honest. Another trick is to disable the cards right before big events.

dismay, delight, dismay

[gosand]

dismay: The title of the article says "hacking" when it means "cracking".

delight: The text of the article gets the term right, saying that their smart cards were "cracked".

dismay: The text then misuses the term again, saying Echostar was hacked.

Come on folks, if a site that supposedly is "news for nerds" can't get the term right, how is anyone else expected to?
(and don't give me the BS that hacking and cracking are the same thing)

ahh simpsons

[Jonny Ringo]

Homer:Well I just bought some shares of News Corp.
Lisa: Dad that's fox!
Homer: Sell! Sell!