AACS Hack Blamed on Bad Player Implementation

seriouslywtf writes "The AACS LA, those responsible for the AACS protection used by HD DVD and Blu-ray, has issued a statement claiming that AACS has not been compromised. Instead, they blame the implementation of AACS on specific players and claim that the makers of those players should follow the Compliance and Robustness Rules. 'It's not us, it's them!' This, however, does not appear to be the entire truth. From the Ars Technica article: 'This is an curious accusation because, according to the AACS documentation reviewed by Ars Technica, the AACS specification does not, in fact, account for this attack vector. ... We believe the AACS LA may be able to stop this particular hack. While little is truly known about how effective the key revocation system in AACS is, in theory it should be possible for the AACS LA to identify the players responsible for the breach and prevent later pressings of discs from playing back on those players until they are updated. As such, if the hole can be patched in the players, the leak of volume keys could be limited to essentially what is already on the market. That is, until another hole is found.'"

Comments

I'm mixed on this.

[grub]

Part of me wants them to find a proper fix for these holes. My CableCo phoned me because I've already gone way over my quota this month.

Of course not, dear...

[bhamlin]

Of course it's not your fault. Your highly paid engineers are WAY smarter than anyone else.

DRM is silly

[tfinniga]

You give them the lock.

You give them the key.

You hope that they can't figure out how to put one into the other.

High fives.

Re:DRM is silly

[Abnormal Coward]

I agree. The only way to show that this DRM protected is shite is for people not to buy. Copying media in my option has never been a problem, I've had a a lot of tape copys from people and went and brought the cd/tape because I really like the music. Same with movies and TV, I've brought DVD's and TV boxed sets after downloading DIVX copys from the 'net. If the boys at the top (RIAA/MPAA) ensure there music is cheap enough its a no brainer. The real battle is here is that 'they' want to tell you want to buy and set any price they like. Its all about control (time to put on your tin hat). Well fuck them, where the consumers we should decide what to buy, and what is an accecptable price. So back to my orginal point, the only way to show is with your wallet ....

Re:DRM is silly

[Anonymous Coward]

If there's one thing history has proven, it's that encryption is an absolute, unbreakable method of keeping people out of things you don't want them in.

Period.

Blame Canada

[euri.ca]

It's a widely known fact that Canada is responsible for 50% of the HD DVD piracy.

Even worse, the AACS specification does not, in fact, account for this large sparsely populated country.

Never!

[Troed]

if the hole can be patched in the players

It cannot, ever, unless they disallow software players from any platform not running on Trusted Computing enabled hardware and a Trusted Computing enabled operating system.

Until then, no DRM scheme works.

None.

It's that simple.

Ahh... the fun begins!

[monopole]

If they are really going to use the device revocation option, things are going to get way fun.
Players which will only play certain discs and not others, instant obsolescence for entire classes of $1000 players.
This makes the format wars look like a sales promotion!

I need to buy, rip, and store the content

[sdo1]

Open letter to the MPAA: I hope a true "CSS" style hack is found. Otherwise, I'm remaining on the sidelines and I won't be buying any HD-DVD or Blu-Ray discs.

Hear that, MPAA!?!?! I said BUYING. You claim piracy costs sales, but you MUST then subtract the lost sales due to your overbearing copy protection. I have about 2000 CDs and about 600 DVDs in my collection. I have no HD-DVD or Blu-Ray discs. And I don't plan on it either unless things change.

It's a new world. And in this new world, I have an expectation of device portability. That means when I buy a 5" media-containing silver platter, I expect to be able to store it on a server in my house to stream it to my living room or my computer or my bedroom. I expect to be able to re-compress it for my laptop or my ipod (or -like device) for watching when traveling. I have no desire to be tied to a specific (and expensive) playback device in a specific location. You're terrified of future storage capacity that will reach into the terrabytes on small devices, but to me, that's the thing that's keeping me interested at the moment in the stuff you have to sell... the knowledge that I can have that portability in movies and TV the same way I have it for the music that I've collected over the years. The RIAA freaked out when MP3's came along, but to be honest, my interest in music had waned significantly. But now, with so much available at my fingertips, I'm VERY interested in hearing new things and I'm buying probably more than ever before (though none through the DRM-crippled iTunes store).

I will gladly buy the media, but I expect that at that point, our relationship is OVER. Thanks, goodbye. Now if I want to extract images from the movie, print them out, and wall-paper my room with them, that's MY business, not yours.

-S

And in other news:

[dpbsmith]

The Hindenburg did not catch fire, it was merely the hydrogen in the Hindenburg that caught fire.

The Titanic did not sink, it was just that Captain Smith did not adhere to the specifications as to how the Titanic should be operated (it says clearly on page 216, "Do not allow icebergs to rip open more than four of the water-tight compartments.")

And talk of "blunders" in the Battle of Balaclava are hogwash.

Re:To be expected

[MoxFulder]

I wonder what they're going to say when it's brutally apparent that ALL software players can be compromised.

In my mind, we're already there :-) The logical next step is to allow only hardware and partial-hardware players. For a PC, this would mean having some kind of "trusted" chip on your motherboard which can encrypt and decrypt data using keys that are hard-wired in.

Of course, hardware solutions can be broken too. I can envision a couple of ways this will happen:

• If the keys are truly embedded in the "trusted" ASIC: Making custom chips is expensive. There are substantial setup costs for each new mask, so there will be enormous economic pressure to only have one or a few versions of the chip. This means once one version gets cracked, millions of computers will be freed. What will it take to read the keys off an ASIC? A scanning electron microscope, that's what. As a bored physics grad student currently sitting 10 feet away from an SEM, I can tell you it'll happen :-)
  
• If the keys are somehow individualized to each computer, they'll be stored on a flash-based FPGA, or in some kind of microcontroller's flash memory. Manufacturers of such flash-based devices go to great lengths to make it so that the code stored in flash can't be read off of the device, but this is nothing more than the same ol, same ol security through obscurity... figure out the magic voltage that you need to apply to pin 12, and oops there goes the security. Smart card hackers have already figured out ways around the protection in the common PIC16C84 microcontroller.
  

Bottom line: DRM is futile because it requires the distribution of a SECRET PIECE OF DATA (the decryption keys) in UNENCRYPTED form (the keys themselves must of necessity be unencrypted). All the crap interposed between the user and the keys is merely security through obscurity. QED.