Slashdot Mirror
Satellite TV Hacker Tells His Story
Wired is running a story about Christopher Tarnovsky, the man who was accused of working for NDS, a company owned by Rupert Murdoch's News Corp., to sabotage a competitor's satellite TV system. Wired had a chance to speak with Tarnovsky and get his description of how the smart-card hacking war developed. Quoting:
"Tarnovsky, who was known online as 'Big Gun,' says Ereiser offered him $20,000 to fix cards that were killed by ECMs, and he agreed. Each time NDS created a countermeasure, Tarnovsky would analyze the code and find a way to circumvent the countermeasure. He did it while working full-time as a software engineer for a semiconductor company in Massachusetts. 'I'd be at work and I'd check the IRC (channel) to see if they'd launched their Thursday countermeasure yet,' he says. 'It was like a chess game for me. I couldn't wait for them to do a countermeasure because I would counter it in minutes.' It wasn't long before NDS came courting. Tarnovsky had a contact at the company to whom he'd begun passing information about holes in its software, even supplying patches to fix them."
...hax0ring da set-top boxes for 2009 DTV sWitChover!
If you build it, nerds will come. Soylentnews.org
This was a good story when I read it last year too.
That video was pretty damn cool. I didn't know chips could be disassembled that way.
"No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
Wow, can we get this guy to decode some of the Bluray keys used? Break HDCP? His method is pretty straight forward, easy to follow, and looks fool proof. Expose layers in the chip and read the data directly. I don't see how manufactures can stop this. As long as the key is physically somewhere in the hardware, it should be possible to access it. I guess the reason this isn't done more often is because of the expense of the high powered microscope, toxic chemicals, and fume hood.
Now we need the max headroom video Pirate to tell his story.
The guys at Flylogic really make some high quality micro chip reverse engineering (I was going to say porn).
Is he taking interns? I'll go clean his house for free in exchange for knowledge.
So, when does Murdoch go on trial?
I was shocked when I read TFA and found that it didn't easily summarise as "I spent ages hacking the system, then got bored because there was nothing worth watching".
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
I spent years hacking satellite television, from the early days, the glory days of the H and HU cards and then left the scene when DTV killed with the P4 card and lawsuits. I've written my own 3Ms and emulators. What Chris has done in this video really is the ultimate holy grail of smart card hacking. The security layer he is referring to, at least on NDS cards, is sort of a sticky layer that when you attempt to pull off the coating to access the bus, it simply rips up many of the thin wires on the chip and you're SOL. This is enough to discourage casual hackers and those without good resources. It also, as he mentions late in the video, eliminates the need for using "glitching", which was accomplished using a specially programmed Atmel chip and some software, to attempt to oscillate the voltage in such a manner that allows you to read/write to the card without having a properly signed packet. Dumping ROMs is exceptionally difficult to do, even with the thoroughly hacked HU cards, and he can just casually do it with his setup. Makes me think he could also dump the ASIC, something even in the heyday of DTV hacking, was never accomplished. This would eliminate the need for an access card at all- once you've dumped the ROMs, got a valid EEPROM, all you need to do is emulate the ASIC and opcodes for the processor (which on the HU card was a Texas Instruments TMS370 chip with a modified instruction set).
Can someone give a brief summary as to why it is NOT ok to use radio waves permeating my property however I see fit? (Even if that means decrypting commercial programing?)
I mean...
Since NDS fired him he's been consulting for two semiconductor companies and a manufacturer of dongle tokens, but he misses his life in electronic warfare. If NDS doesn't want him, he says he'd be happy to work for Nagrastar -- jumping sides once again. "I could design a whole entire chip for them like I did for NDS," he says. "NDS thinks today that their technology is superior to everybody else's and it probably is, because they're 17 years ahead of Nagra technologically. But Nagra could catch up overnight if they used my services. "I'm a very valuable asset as far as smart-card technology goes," he adds. "I know everything about (NDS) as far as their intellectual property models go."
Then again, its Wired magazine. They exist purely to create arrogant douchebags, dont they?
Wait a minute here. Wasn't DirecTV trying to get people to settle for upwards of $3K for stealing signals, and suing them for absurd amounts over 6 figures.
Is the end result of all that litigation a $1500 fine? Or is this somehow different?
for(i=0, inumCountermeasures, i++)
decompile()
analyze()
deployreverseattack()
Elegant, yet simple!
The techniques Tarnovski used to burn the top off with acid is failure analysis stuff.
I knew a guy who worked at a chip manufacturer and that's what he did. Failure analysis.
Burn the top of the chip off with what he called "formic acid" (I think, this was over 20 years ago) which "didn't hurt the chip".
They would then look at it under a microscope and try to determine what had failed.
The second microscope Tarnovsky was using looked to be a wire bonder.
It welds wires on by hand, with a pantograph type positioner.
So you can connect the chip to the leads, for example in the package, common for eproms. You can see the little leads in the window of older eproms.
But hackers can also use those to reconnect the last link of a programmable chip like a PAL that has had the security fuses blown after programming. Then you can just read the program out of the chip. OOPS, there goes that programmable security.
I had a chance to get one of those once, but it was a big one. Too big for me.
The little tabletop one in the video would be neat. I would grab one of those if it ever presented itself.
Tarnovski used that wire bonder to grab the signals off the chip internally, where they are actually running.
Those smartcards are likely a serial device, but if you can get back to where the data bus is parallel maybe that is before the inherent security.
The guy is obviously good. Wonder if he has a college degree?
.
There's nothing unusual, given sufficiently powerful microscopes and positioners (and that is really the only reason why thousands of people aren't doing this already - any satellite TV hacker knows the process), about being able to attach a probe to the inside of a chip to read from it in vivo.
What makes this guy unique is a complete lack of loyalty - he works for the highest bidder, and even then is ready to stab them in the back when his contract is complete. He's analogous to a lawyer- knowing that both sides are equally corrupt, he can take advantage by selling his services to both sides, so that no-one ends up any better off at the end. Except Tarnovsky.
The one application-specific challenge here is removing the "security layer" without ripping apart the layer underneath. But given that this guy's outstanding skill appears to be social engineering, I'd say it's more likely he had access to insiders who developed the chips and could advise him on what they used in failure analysis.
The only moral of the story here is that an arrogant, ethics-free mercenary with access to any tool he pleases is given way too much admiration in the twenty first century.
Christopher Tarnovsky, the guy portrayed in the article, IS Flylogic. Yes, this is slashdot and nobody reads the article, but it even links to flylogic.net.
"to fix cards that were killed by ECMs"
The cards are not attacked by ECM's but by the EMM's . The ECM's just contain the operational keys to open the stream on the fly.
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci331380,00.html
The idiot uses Windows. How stupid is this guy? Didn't he know that what he was doing was wrong? Fuck him.
Glass.
Someday DRM will be so good that anybody with sufficent access and/or power and the motivation will be able to embed code that you can't read and analyze on the games and dvds that you buy in order to do whatever they want to on your electronic systems...
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
Oh Yea... Chuck is the one who decided that the assembler and linker shouldn't be distributed with CP/M because users don't need to write programs. Luckily Apple doesn't agree and they do distribute the software development with the operating system. Of course now days Microsoft gives away development software too. Too bad I lost my taste for Windows development before the software was free. I paid for thousands of dollars of buggy Windows compilers before I saw the light.
Thirty years ago I designed the hardware and wrote the software for the first smart card. It was a card for a Savin copier that contained the number of authorized copies an individual could make. I guess I am just too simple minded. It never occurred to me to play both sides on that game. Although there probably wasn't much market for pirate copy cards. It was an interesting project though with an 8085 based controller and the first bit looping hardware I had heard of. The fun part was learning no normalize the loop if the card got pulled unexpectedly.
I guess he should be careful though that he doesn't work for someone who is happy to knock him off after he does the work so he doesn't turn on them later. I am sure there are organized crime and government agencies that wouldn't have any more problem sanctioning him than he has breaking people's security measures. He needs to be careful that he is not worth more money dead than alive :-)
I didn't know this.
This absolutely invalidates all other viewpoints he may have had about any topic whatsoever.
"There is nothing nice about Steve Jobs and nothing evil about Bill Gates." - Chuck Peddle