Slashdot Mirror
Vista DRM Cracked by Security Researcher
An anonymous reader writes "Security researcher Alex Ionescu claims to have successfully bypassed the much discussed DRM protection in Windows Vista, called 'Protected Media Path' (PMP), which is designed to seriously degrade the playback quality of any video and audio running on systems with hardware components not explicitly approved by Microsoft. The bypass of the DRM protection was in turn performed by breaking the Driver Signing / PatchGuard protection in the new operating system. Alex is now quite nervous about what an army of lawyers backed by draconian copyright laws could do to him if he released the details, but he claims to be currently looking into the details of safely releasing his details about this at the moment though."
As fast as you can
If only we could fall into a woman's arms without falling into her hands
How about a team of pro bono attorneys who are willing to defend (fight?) cases like this in which a researcher simply wants to share his/her findings? Sort of like a non-profit organization.
Sounds like somebody will soon get a juicy job offer from Microsoft to tighten up the system...
Give a man fire, and you warm him for the night. Set a man on fire, and you warm him for the rest of his life.
... but there is no space in the margin of this comment to write it.
"Vista DRM cracked by anybody with the desire to do so".
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
and then ask Network Solutions to suspend their domain. It works on GoDaddy domains.
I called it a mighty Sperm Whale, she called it Finding Nemo.
Just release it, the deluge of bad PR will suck the moneyline away from the lawyers long enough for you to jet to Aruba or somewhere.
stuff |
Now that people know it is possible, I am sure it is only a matter of time before others across the globe attempt to find the weakness. Some of these people won't even be affected by USA law, unless they decide to visit or transit through the country.
Jumpstart the tartan drive.
Mark says that it's possible. He also says enough that someone else as "skilled in the art" as he is can probably figure out what he did.
And what he did, if I understand correctly, is have some of his own code run as kernel without it being in a "test signed" driver. That seems to be the essense of his approach. Once you figure out how to do that, you can basically do anything, and Microsoft can't stop you.
Alex Ionescu is the main kernel/HAL developer for the GPL'ed ReactOS project (www.reactos.org), which is aiming for an OS that is fully binary AND driver-compatible with Windows XP/Vista. If you look through the work he's done in the ReactOS SVN (developer name 'ion'), I have no doubts that he's fully capable of analyzing and defeating any kernel-level protections in Vista.
Although ReactOS can share a lot of work with the WINE project for the win32 userland, it could still use any developers that are familiar with win32 development and would like to see a truly free operating system capable of using windows drivers/software.
After all, it's only going to get cracked sooner or later. So there is no point is there?
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Excellent news.
What with HD-DVD and Blu-Ray being cracked already, and now this, combined with all the hate and general unity by consumers against the big movie and music industry, how much more signal do they need that DRM is pointless and unwanted and to finally stop trying to force it on us?
that he put his name to it, rather than just release his findings anoymously from a public internet terminal.
If I drive a car, or heck use a toaster. Isn't it legal for me to give the product to a mechanic or someone versed in the art to check whether it's safe or not?
.. I need to know if the DRM or digital signing is crap. I don't want spyware to be fakely "digitally signed" and run on my system. If the DRM is crap why would anyone release anything with it? Why are software companies able to prevent or hinder research into the security of their products and announcements to the public w.r.t their safety?
So if I use windows
Yes, I know it's been said very many times before, but I'm moved to say it again. It's simply obscene that runaway copyright law provisions should be used to casually stomp on this kind of freedom of speech, especially in the U.S.A., where allegedly there is a First Amendment guaranteeing freedom of speech. I would very much like to see a full-out legal confrontation between these terroristic laws as they stand, and the Constitution. The alleged and artificial "right" of the smirking lawyers at commercial companies to keep their nasty little secrets does not in any sense abrogate the innate, natural right of the people to talk to each other about any damn thing they want, particularly complex subjects, and in any way they wish, including via carrier pigeons and Morse code, let alone in plain English (or whatever language) on the Web.
It's really a shame that other countries such as Sweden actually surpass the U.S.A. in this area.
Frankly, this pisses me off enough that I'm very strongly tempted once my finances improve enough for the expensive legalities, to spit in the eyes of these jerkoffs with a direct, blunt and extremely widespread explanation (possibly on a Russian server to further annoy and frustrate them) of whatever it is that they absolutely are frantic to not have explained, along with the text of the Constitution with the First Amendment highlighted in red. I think a well-crafted attack on this crap would gather quite a lot of support, moral and otherwise.
A truly excellent pizza parlor is a delight unto the heavens. Treasure the sauce and the toppings!
Since the DRM in Vista is so inextricably tied in to the OS, then ANY hack which allows you to run stuff at kernel level will, by definition, be able to break the DRM. Which begs the question: could Sony's next rootkit be a violation of the DMCA, instead of just a huge pain in the ass?
"can't run, can't hide...oh well, return 0"
...which is designed to seriously degrade the playback quality of any video and audio running on systems with hardware components not explicitly approved by Microsoft. Woah! "anyvideo and audio"? I thought it was just Blu-ray and HD-DVD movies which have the Image Constraint Token (ICT) flag set. TFA quotes it as "some premium content", which doesn't make it much clearer. Anyone want to clarify?What's purple and commutes? An Abelian grape.
What's purple and commutes? An Abelian grape.
The DMCA doesn't have arms, it has tentacles. Horrible, oozing, pus-filled tentacles.
Someone in America cracked this first.
Weaselmancer
rediculous.
Could not be more redundant.
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo.
(Also, that "sentence" I quoted is a fragment. And you didn't capitalize "i" in the previous sentence, which is actually a run-on.)
It's a shame that things have come to a point where developers/security researchers have to worry about releasing findings like this, perhaps *even* when they are not under US law.
There needs to be an installer to bypass the PMP and DRM functionality in Vista so that every user can have the right to CHOOSE!
Relocating to San Francisco / Palo Alto... Hire me?
Well, he's already probably a bit screwed.
Here's the problem: there's virtually no way to get in trouble, if you just release an exploit anonymously. (By definition, if it's truly anonymous, they can't catch you; there are lots of ways to basically ensure your anonymity today.) Where you start to get in trouble is when you want to release an exploit that's going to ruin somebody's day and take credit for it.
This comes up with regards to other, less-politically-sensitive bugs. When you step forward and take credit for something that you've released, you're basically holding up a big "come and get me!" sign. It's a lot easier to sling mud at a person, than it is at some anonymous entity on the Internet.
It's really taking credit that burns people, not releasing the bug/hack/exploit. It would have been trivial for this guy to release his code, anonymously or even pseudonymously, and keep it firewalled from his real-world identity. If he had done that, there might have been some attempts to uncover who he really was, but I doubt anyone would try that hard -- it's harder to go after someone that's anonymous, than an actual person. With a person, you have something to put in your mind under 'enemy,' that you just don't have with some vaporous person or persons on the Internet. Being anonymous diffuses a lot of the hatred, because it's harder to hate someone that might not exist. By standing up and taking credit, you're accepting everything.
Personally, if I were to discover something like this, there's no way I'd publicly admit it. I live a happy enough life without becoming some sort of hacker/security icon; the downsides of becoming the next Dimitry Sklyarov seem far greater than the possible benefits. Release the code somewhere in public, maybe signed with a private key that you have stashed away (so, decades down the line, you'd be able to claim it, if you wanted to and if the statute of limitations had run out), and only communicate via Usenet dead-drops and anonymous remailers. The tools to remain completely hidden are all there -- heck, you could probably do interviews in Wired under a psuedonym, the only absolute would be keeping the Clark-Kent-esque secret of your true identity hidden, and I'm not sure if some people would be able to swallow their pride enough to do that.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Thank you. I am enlightened.
"can't run, can't hide...oh well, return 0"
I don't think so. Businesses don't care; this will not affect them. Home users don't care; they don't want Vista. It's the lack of a compelling reason to purchase Vista that's stopping people from purchasing Vista. Windows 95 was a major upgrade. Windows XP was a major upgrade. They both got major attention. Windows Vista is a minor upgrade. It adds eye candy and some features that only business users typically need (like whole-disk encryption, which is a recipe for disaster in the hands of home users.)
The bottom line is that home users will be the major adopters of Vista because they will get the machine with Vista and they will run it with Vista. Corporate users who get new machines in with Vista will probably, if they have a volume license, run Windows XP on them instead, for the foreseeable future, not least because Vista has a brand-spanking-new TCP/IP stack which at least in the beta was known to be vulnerable to a whole laundry-list of otherwise-outdated attacks, things Windows hasn't been vulnerable to since the late nineties. Personally my biggest concern about vista on the corporate desktop (luckily not a decision I have to make) is that the network stack will be a vector of attack into the network, one that our firewall has no power to stop since users are continually opening outgoing connections.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
[sig]
Suppose I *did* pay for Vista.
Suppose my current hardware is fast enough and has enough resources to run even the most demanding of applications.
Suppose my current monitor can handle the resolutions required.
Suppose I did have a hd-dvd drive and some movies.
Imagine how pissed I would be if I couldn't watch them at native resolution because according to Microsoft I had the wrong connector.
I want an Operating system, not a restricted system.
liqbase
Even if Vista were perfect and beyond any cracks/hacks, the DRM on the media will be defeated on other platforms. The content will then spread without DRM. Somebody in Hong Kong or Vietnam will make a standalone Blu-Ray/HD-DVD player that rips directly to open formats, and that will be that.
All the effort MS is putting into this will not make the studios happy, and will not make the customers happy. I think they made a bad choice.
Bigtime Consulting - "We're the best because we cost the most"
This is a Blog entry, not an Article or News story. From the Blog...
1). It doesn't work out of the Box.
That being said, it turns out the code I've written does not work out of the box on a Vista RTM system.
2). It uses a method provided by Microsoft.
As part of the Protected Media Path, (PMP), Windows Vista sets up a number of requirements for A/V software and drivers in order to ensure it complies with the demandes of the media companies.
3). It hasn't been tested.
Although used on its own, this POC doesn't do anything or go anywhere near the PMP (I don't even have Protected Media, HDMI, HD-DVD, nor do I know where PMP lives or how someone can intercept decrypted steams),
4). Author is more afraid of the DMCA than of violating Microsofts EULA terms.
a particularly nasty group of lawyers could still somehow associate the DMCA to it, so I'm not going to take any chances.
This isn't a story. Its pre-mature speculation.
Enjoy,
It's just the normal noises in here.
actually, his first name, too. but that argument makes google a 50% russian company.
. . . the only incentive one needs to complete a task is the knowledge that it has been, and can be done. It doesn't much matter if he releases his code. TFA has enough info for anyone savvy enough to duplicate his work. Once it's out of the bottle, it'll be like WGA all over again. Another cat . . . another mouse . . . another cat . . . But perhaps the knowledge that Windows ultimate "security" DRM is, indeed, insecure will turn out to be the mouse that roared.
"If your parents never had children, chances are you wonât either." -Dick Cavett
"It's time to un-PMP ze audio"
Didn't read TFA, but when I saw this in the blurb:
draconian copyright laws
...I just assumed it was us.
Weaselmancer
rediculous.
If it didn't have some FUD right in the summary.
'Protected Media Path' (PMP), which is designed to seriously degrade the playback quality of any video and audio running on systems with hardware components not explicitly approved by Microsoft..
No. It doesn't. It does it for specific DRM content.
These restrictions only apply to DRM content, such as HD DVD or Blu-ray. User's standard unprotected content will not be faced with these restrictions.
http://en.wikipedia.org/wiki/Protected_Video_Path
but he claims to be currently looking into the details of safely releasing his details about this
Freenet: It's Not Just For Kiddie Porn Anymore(TM)
+++ATH0
US law is like Man Law - a universal truth with a reach that transcends all borders.
No one ever said we have to upgrade to Vista.
No sig for you. YOU GET NO SIG!
Administrators can turn PatchGuard off at boot time. He didn't break it.
There's no way to turn off PatchGuard off, only Driver Signing, which watermarks your desktop and disables PMP. Ways to break Patchguard 2.0 were published recently by "Skywing" on uninformed.org
Hey, it's not my fault you can't understand a simple sarcastic analogy. Vista's DRM limits the capabilities of a media file in a misguided attempt to increase security. A governor limits the capabilities of a car, and using it to deter theft would be just as stupid as using Vista-style DRM. The only relevance of the governor to the analogy is in representing a performance limitation.
"If you really want to do something about it, just go find the guy who made the original comment and smack him on the back of the head. Extra points if you knock his brains out of his mouth."
Hey, you can't knock someone's brains out of their mouth! Like you'd say, "Most people have no fucking idea what is going on inside their body, and if they do have an idea, they have no idea how it's actually put together."
Oh wait, you weren't trying to make a point about anatomy, you were just expressing yourself through (childish) language. I guess it is easy to misunderstand someone's language if you're too busy trying to be arrogant. Tell me, is it difficult going through life with your head so far up your ass?
Tags != Comments, and -1 (Troll) != -1 (I Would Respond Angrily To This Poster So They Must Be Trolling)
*does a jig with two thumbs up*
*stabs self in eyes with thumbs*
JAZZ HANDS!
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Standard encryption is easy. Keep your keys safe from the bad guys and as long as you use a reasonable encryption, things are fine.
DRM is difficult: You have to give the end user the keys, and then trust that only the uses that you've prescribed are allowed. Giving the keys to the end user is stupid, so the keys are given ONLY to a trusted module inside the end users machine. That trusted module is supposed to A) keep the keys secret, and B) enforce the rules that accompany the key. (e.g. you rented this for a week and a week has gone by).
If you have a general purpose computer, it's very difficult to have a trusted software module that can't be cracked somewhere inside.
In the backup-hddvd case, examining the core of the userspace program revealed volume and title keys. But the "master keys" are still somewhere inside.
In this case the operating systems trusted platform that should prevent that kind of tricks has been broken. Now you can insert your own debugger into the trusted core, and examine other stuff inside the trusted platform. Or you can claim to be a trusted driver, who has to have access to the unencrypted HD content.
In any case, as long as there is no hardware trusted module, it is always possible to run a good enough simulation, and run the DRM software under the simulation in a virtual machine.
And even if you DO have a hardare DRM module, I don't think it's possible to get right if you have a passive element on one side. For example a HDDVD is passive. So it can't verify the other side, and only give up the keys if it has confirmed the other side to be a trusted DRM module.
What more, if there were no copyright, there wouldn't be a need for GPL (you could "steal" other people's code by using it in a closed-source product, but you wouldn't have any way to profit from it, so noone'd bother).