Slashdot Mirror
AACS Hack Blamed on Bad Player Implementation
seriouslywtf writes "The AACS LA, those responsible for the AACS protection used by HD DVD and Blu-ray, has issued a statement claiming that AACS has not been compromised. Instead, they blame the implementation of AACS on specific players and claim that the makers of those players should follow the Compliance and Robustness Rules. 'It's not us, it's them!' This, however, does not appear to be the entire truth. From the Ars Technica article: 'This is an curious accusation because, according to the AACS documentation reviewed by Ars Technica, the AACS specification does not, in fact, account for this attack vector. ...
We believe the AACS LA may be able to stop this particular hack. While little is truly known about how effective the key revocation system in AACS is, in theory it should be possible for the AACS LA to identify the players responsible for the breach and prevent later pressings of discs from playing back on those players until they are updated. As such, if the hole can be patched in the players, the leak of volume keys could be limited to essentially what is already on the market. That is, until another hole is found.'"
Did anybody really expect the AACS LA to say anything other than what they did? (Besides, maybe "we give up"?)
You give them the lock.
You give them the key.
You hope that they can't figure out how to put one into the other.
High fives.
Powered by Web3.5 RC 2
if the hole can be patched in the players
It cannot, ever, unless they disallow software players from any platform not running on Trusted Computing enabled hardware and a Trusted Computing enabled operating system.
Until then, no DRM scheme works.
None.
It's that simple.
it's in my head
Why is Ars saying they believe they can stop this hack by revoking the player key? The original person who cracked it specifically didn't release the key I thought and was only releasing TITLE keys which will be much more dangerous to revoke yes?
Not that it matters much either way because this attack vector will always exist for any kind of system they come up with. Since it will always exist someone will rip it and post the movie on bittorrent.
They are actually probably pretty happy that this is the only possible hack anyways since it isn't anywhere near as useful as DeCSS.
This is also a sure-fire way to kill a format. Usually technology is promoted via word-of-mouth, and when the drive of the early adopters begin to fail, the word will spread that you can't trust either Blu-Ray or HD-DVD.
In short, AACS is doomed if it does, doomed if it doesn't.
H0ek
Think you're smart? Prove you've got brains!
And would you bet money on the impossibility of spoofing a specific motherboard identity?
Similar things have been done before in so many different scenarios... Just to take a trivial example, MAC addresses were supposed to be unique for each network card, too.
The private key for your motherboard will be - it will never leave a single chip. Sure, if you have the hardware you can in theory obtain it, but this will require stuff like electron microscopes.
How do you account for this hole:
1) Asus' servers get "hacked".
2) The keys to all Asus motherboards get posted on the web
3) Sales of Asus motherboards skyrocket.
4) Asus issues a press release to the effect of: "It was the fault of those damn dirty hackers. We have no idea how this happened. Excuse us; we must return to sifting through this mountain of cash".
The hardware manufacturers have no incentive to play nice with the Trusted Computing scheme. This is just a repeat of DVD Region Coding. The manufacturers just started producing players that ignore the region code, because they outsold the locked players. Of course the first few on the market were "accidents", "mistakes", and "test designs".
In a Trusted Computing world, machines with a broken TC implementation will be cheaper to make and command a higher price in stores. What do you think will prevail?
Well, the solution to that is easy. Rip keys from a very prolific hardware player.
Imagine if the keys that got leaked came from, say, the PS3. Can you imagine the shitstorm that Sony would throw if the first million or two buyers couldn't play Blu-Ray movies anymore? Those keys would never get revoked.
I've upped my standards, so up yours.
All you need is one very pissed-off average geek that can't watch their bought-n-paid-for movie and the whole non-DRM'ed movie is likely going to be out there for everyone else, that can't watch their own copy, to download it. In fact, the more players that they "revoke" the keys for, then the more pissed-off geeks there will be, and the more movies that will likely be available for download. Its a loosing proposition any way you look at it. With DRM the "fix" becomes "the problem". The only people that win are the ones writing the DRM and spoon feeding the Board room executives that don't know that DRM can't work.
When will they ever learn that you can't solve a SOCIAL PROBLEM using technology of any kind. In fact they should wise up and realize that its the professionals that build specialized hardware that copy the "protected" disk bit-by-bit, then burn a thousand copies, and are making big bucks off of all the boot-leg copies. Those are the ones they should go after, not the average people that paid for the movie and just want to watch what they paid for, when and where they want to. So, RIAA/MPAA, take it from a security geek, know thy enemy! You can't fix a problem if you don't even try to understand what the problem is!