Slashdot Mirror
DVD Security Group Says It Has Fixed AACS Flaws
SkillZ wrote to mention an article at the IBT site discussing a fix to the security breech of the HD DVD and Blu-ray media formats. "Makers of software for playing the discs on computers will offer patches containing new keys and closing the hole that allowed observant hackers to discover ways to strip high-def DVDs of their protection. On Monday, the group that developed the Advanced Access Content System said it had worked with device makers to deactivate those keys and refresh them with a new set."
I read this bit:
"New high-def DVDs will include updated keys and instructions for older versions of the PC-playback software not to play discs until the software patch has been installed."
No one gives my computer instructions but me. So I will have nothing to do with either of these formats at all. I am just gonna say no and take my business elsewhere.
DVD is quite fine, and where it doesn't then there are hard drives. Hollywood can give me movies in a format I'll accept or they can e2fsck off.
My little Linux and tech blog
Actually they (the Doom9 crowd and the Xbox360 hackers) have already discovered a method that recovers Volume Unique Keys which is completely unrelated to the method they used before. One which doesn't require reprogramming the device (Although they have already done that as well)
So not only was AACS not really fixed (Just the key revoked) the velocity of revocation process is slower than the hacking process. And this revocation was a key for a software package, I imagine that the process for revoking the key for a hardware device, like the external Xbox360 HD-DVD drive to be slower, a lot slower.
Also given the nature of this sort of thing, I also figure pretty soon there will be increased interest in hacking a stand alone HD or BD player... as the price comes down I'm sure the allure of forcing revocation of a series of hardware players will attract attention.
I know I'd sure like to do it, if only to annoy and embarrass the AACS group.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Here is the important question:
;)
If you were the implementer of AACS on HD player SW, how would you hide the key? I can think of a few ways:
1. Keep the data in CPU registers and cache.
2. Split the keys up into smaller pieces, and spread them around when in memory.
It seems that both is basically security through obscurity, and that has not worked very well in the future.
If you respond to this with a clever way to do this, make sure you post the reason it will not stand up to hackers as well. Otherwise, keep it to yourself
don't cut it off www.mgmbill.org
You are entirely right. The volume key hack is pretty solid. In fact, if the Microsoft HD-DVD player were to be revoked and require a firmware patch to the existing runs of drives to play new discs, it really wouldn't make any difference at all. See the thing is, now that it is understood how to bypass AACS through the volume key, AACS could in fact keep revoking keys until they're blue in the face, but the process of extracting the volume key is already known, so it makes no difference.
Also, let me point out, I haven't read the code in its' entirety yet, but if I understand correctly, the volume key crack should actually be immune to key revokation, based on my understanding of AACS, key revokation should only effect device ids and once a method of extracting a volume ID is known, the revokation mechanism just no longer matters.
Of course, I'd also like to point out what others have already said. If a program exists that can read the data and decrypt it, then it's 100% obvious that the program can be reverse engineered. This is not an opinion, it's fact. I have on many occassions bypasses hardware dongles, FlexLM, trial periods, etc...
bypassing hardware dongles requires that you reverse engineer the driver to the dongle, this is just plain easy, all you need to do is find a disassembler that can handle the format, or if it's a kernel mode driver, then you just use a kernel mode debugger... not an issue. when you locate where the driver is being attached to from the program itself, then you just emulate the hooks. Even the most advanced dongles are easy to hack this way.
FlexLM... well... come on... this one is just so easy it's not worth talking about
Trial Periods... they can vary... depends on how obscure people want to make the code. But for the most part, they're not that hard. For example, I found a function reference in a DLL on PcAnyware (don't remember the version) called "TimeBomb()" which returned a boolean value. Not really that hard huh?
As for HD-DVD and BluRay... if all else fails, run the player (really really slow) through an emulator like QEmu and trap all IDE calls. Log the previous 1000 instructions run before the hook and then log until the first picture comes up. Then just review the log and read the source code left in the log. Hardest part is making it pretty enough to read... but if it means that much to you... well no problem.
- So... in brief... copyprotection is just a joke... laugh at it!
Someone just has to write a ps3 cell code to do the key guessing just like folding@home, 100,000 pirates, and whammo, it would be cracked really fast , maybe 24hrs. Ironically, that the device player to
make bluray popular could be used to actually crack the keys the fastest.
Liberty freedom are no1, not dicks in suits.
so you only have to make the time cost of copying high enough to make the legal offering more attractive.
Unfortunately, high prices and the lack of working copies/backups makes the legal offerings un-attractive for many. I have kids. I have cases that used to contain working DVD's. Lack of backups is a problem. I'm moving to a Linux Media Center PC. This new format is incompatible. A media server is a much better solution for most families than a shelf of out of order/broken/lost DVD's. The inability to make a backup/working copy is a crime. DVD's in the home make as much sense as a CD player tethered to your iPod instead of a hard drive. Kids don't take CD cases to school anymore. They know they get stolen, lost, broken, etc. They rip the CD's at home and load them on their iPod with the originals safely stored away.
SONY Dreamworks doesn't get it. I bought Open Season. It has some copy protection on it besides CSS. Guess which film won't be in the Media Center? Guess which brand I'm not buying in the future? Chances are that title won't be watched much simply because it's inconvienent. It's like copy protection on CD's. The kids have iPods. They rip their CD's. CD's that don't work are remembered. That artist and label get a critical review on their next release. Kids instead of buying CD's they can't use, look elsewhere such as P-P and sneakernet. Copy protection (Defective product) sends buying consumers elsewhere.
I remember what CD's and DVD's can't be ripped and who put them out.
Since I did buy Open Season, I will be looking for an already ripped copy or a solution to rip it myself. So far, the rip it myself solutions seem to be mostly commercial offerings.
The truth shall set you free!