Doom9 Researchers Break BD+

An anonymous reader writes "BD+, the Blu-ray copy protection system that was supposed to last 10 years, has now been solidly broken by a group of doom9 researchers. Earlier, BD+ had been broken by the commercial company SlySoft." Someone from SlySoft posts a hint early in the thread, but then backs off for fear of getting fired. The break is announced on page 15.

Comments

Congratulations!

[symbolset]

A hearty congratulations to the brilliant programmers of Doom9, including Oopho2ei - who claims not to be a "professional programmer".

Unfortunately

[Anonymous Coward]

Unfortunately this will probably just mean that a ton of consumers will be SOL when they implement new encryption schemes on BluRay that aren't supported by some existing players.

Re:Unfortunately

[Wuhao]

Wonderful. Finally, people won't look at me like I'm from Mars when I tell them that DRM affects legitimate paying customers like them.

Re:Unfortunately

[Lumpy]

Oh I hope so. I hope that Sony and the rest of those idiots over-react hard and screw most all customers with BluRay players.

Disrupting the consumers from viewing the new shiney will actually make them sit up and pay attention. I hope this screws a lot of people really hard to the point they say "HEY! WHAT THE HELL!"

Now they need to crack HDCP.

And YET AGAIN...

[Khyber]

The common man proves that if man can make it, man can break it.

This is a lesson companies will NEVER LEARN when it comes to DRM.

As always with DRM

[symbolset]

The content must contain sufficient information for the content to be decoded. Anything one software can do, another software can do (see Knuth, et seq). Therefore if there's an available software that can decode the encrypted content it must be possible for open software to decode the encrypted content. Removing the encryption using open software eliminates the protections against copying provided by the closed software and the game is over.

Thus DRM is a fool's errand. It always has been.

The illusion of protectability is however easy to sell for vast sums of cash to content owners who desperately want it to be possible.

Re:As always with DRM

[Bender0x7D1]

Therefore if there's an available software that can decode the encrypted content it must be possible for open software to decode the encrypted content.

Possible != Feasible. It is possible for me to brute force AES-256 but it isn't feasible for me to do so.

Re:As always with DRM

[sjames]

Therefore if there's an available software that can decode the encrypted content it must be possible for open software to decode the encrypted content.

Possible != Feasible. It is possible for me to brute force AES-256 but it isn't feasible for me to do so.

The point is, the 'legitimate' (w/ DRM I use that term loosely) doesn't brute the key, and the legitimate software can be watched in action. That means that reverse engineered Free software can be created to do the same thing.

Hardware trickery to make it harder to do that also increases the incentive to find a way. Somebody somewhere will find a way to dissect it.

The job is even harder since it will always be a plaintext attack.

Re:As always with DRM

[davolfman]

So what you do is shotgun it. You hack away at memory until you find the player key for every software player you can, and see if you can get a few hardware player keys while your at it. You then build a failover into your code so they have to disable play on a significant useful fraction of the players out there in order to keep you from copying a disk.

Re:As always with DRM

[prisoner-of-enigma]

So all you need to do is examine the update and pull the new key out of it.

If you'd think about it for a moment, you'd realize that if it were that easy, BD+ would've been cracked long ago. It wasn't, so clearly it is not "all you need to do."

While Sony is demonstrably stupid in believing DRM cannot be bypassed for at least ten years, they are not stupid enough to send out an update where the new keys can be easily snagged. I'm sure you can get the technical details of why what you propose is folly if you head over to the Doom9 forums. You probably need to read up on the basics of encryption and keys first, though, since your knowledge in this area seems a bit lacking.

Forget copying, I want to play my BR under Linux

[janek78]

I don't really care if I can copy my BluRay disks or not (I'm too lazy to back up my movies - if I break a disk and I like the film, I get a new one).

But I would love to be able to play my legally bought films under Linux without having to reboot (or having to go to jail for that matter). Maybe one day. :)

Re:cool!

[repvik]

Fortunately, citizens outside the United States of Asshats* doesn't have to bother with this whole DMCA crap.

* Referring to lawyers et.al.

How does it work?

[tangent3]

Hoping some expert can describe how this all works to the masses out here. From a quick glance through the forum, this is what I think is happening...

BD+ movies are released with corrupted data
A conversion table is required to fix the corruption
The conversion table is built using code on the BD+ disk that runs on the BDVM.

The bulk of the work on the forum thread seems to be an effort to reverse engineer the opcodes and libraries (called TRAPs?) available in the BDVM, and to reimplement the VM.

I'm not a security or crypt expert, but I can't imagine how anyone can expect this kind of security to remain secure for 10 years.

Re:How does it work?

[Kjella]

The short answer is - think of it as a computer application, a simple one can simply to its job. An advanced one can try to determine if it's being debugged, running in a VM clone or whatever. They can still pull new rabbits out of the hat that can cause problems. As usual though, the pirates will share the good copy and the "casual" guy trying to use alternative OS/software will have a broken player. What you're seeing here is not new by any standard, AnyDVD HD was there first and obviously output from it has been doing the rounds on P2P. This is mostly a battle to make it so that you can pop in a BD, fire up an open source player and have it work.

Your secure edifice...

[nzgeek]

I think a quote from a famous internet wordsmith is in order here:

Someone needs to emphasize this in such a way that the right people see it: people who pirate software enjoy cracking it. The game itself is orders of magnitude less amusing. And their distributed ingenuity will smash your firm, secure edifice into beach absolutely every Goddamn time. There are no exceptions to this rule.

Re:Forget copying, I want to play my BR under Linu

[Jah-Wren Ryel]

I don't really care if I can copy my BluRay disks or not (I'm too lazy to back up my movies - if I break a disk and I like the film, I get a new one).

Clearly you have no children living with you.

These are important points for dialog

[symbolset]

no one I know seems to fall into your generalization of people not buying Blu-Ray discs or players because of DRM.

We shall see. Most people don't know really why they're not trusting of innovation in content technology. The advantages of open content though are immediately obvious and so when the content owners open up the content it starts flying out the door.

All in all, because Blu-Ray is 10x the bandwidth of any online "HD" movie source (and I use that term loosely for online offerings) and because online DRM is so much worse, I don't see it going away. Instead I see it likely to win over DVD-- DRM or not-- but not until manufacturing costs ramp down due to better technologies and economies of scale.

"Never underestimate the bandwidth of a station wagon full of backup tapes." Technology has passed this one by, but the truth of it remains. Content providers would do well to sell the right to the content separately, and let people figure out how to get the content on their own. If they must, they can offer content at kiosks you take your external hard drive to. The tree huggers should like the idea of transport-media free content distribution at the very least - that's less mylar disc in the landfill.

Consider this. Is a DRM-free H.264/AAC mp4 file more convenient, or is a DRM-laden disc that you can play in your car, computer, PS3, portable system, or friend's house by carrying around a 16 gram disc?

For the car and portable system a downrezzed movie that fits on an 8GB SDHC card are sufficent, and that form factor is considerably more convenient than a disc that doesn't even fit in your pocket - and is too fragile to carry that way anyway. People do this on their EEE all the time. A 360GB external 2.5" USB drive is bigger and heavier but smaller than a BD with case so it still fits in your pocket, is less susceptible to scratching, fits multiple movies on one disk, and has many other advantages.

Open content means you can make backups. You can convert to your target platform. You can move your content to where you want it and any technology that can play it will continue to play it for all time. DRM content does not have any of these advantages. Most importantly that last one.

Re:As the article says...

[ceoyoyo]

"can even execute arbitrary code on the machine"

Oh excellent. I think I'll skip BD, thank you.

Re:last barrier

[sjames]

Samsung has a $200 player which comes with 4 free movies. Given that the movies retail for $35 a pop, that is $140 in free movies with a $200 player. The rumors is said player will go for $150 on Black Friday. A player for $150 with $140 in free movies is a pretty good deal.

The biggest problem with BluRay is retail stores charging $35 for movies. DVDs are often selling for $10 or less. Knock BluRay prices down to $25 a movie or less and I'll bite.

Gotta be careful with that math. The movie is WORTH $10-$15 (based on DVD pricing and people's apparent willing to pay that), so it's $60 worth of movies claiming to be a $140 dollar value, just like the blue-screen commercials where they give away the '$100 value' worth of the stuff they couldn't sell in the last blue-screen ad and really just don't want cluttering up their warehouse (here, you throw this away!).

Millions bought our "shiny penny" for $100 and millions more bought our "crisp 10 spot" for $150, but if you act RIGHT NOW, you (yes, you) can have BOTH for the low low price of $99.95! You know It the deal of a lifetime BECAUSE I'M SHOUTING!

Re:The end of DRM is good news for content owners

[Bert64]

What's to stop you putting that DRM-free file onto a 16 gram disc...
Or onto a memory stick for that matter...
Or a portable hard drive that will store a large number of movies...

DRM-free gives you a lot of freedom, you can do whatever suits you best, your choices are not taken away from you.

Support the forums

[eiapoce]

I am proud of having been a contributor of the Doom9 forums. Go and pay you tribute: they demonstrated to the industry once again that DRM is a sick idea and will NEVER work.

P.S. Now I can go and buy a BD recorder. Just as I did with the first DVD Writer after deCSS.

Re:As the article says...

[squiggleslash]

And here's the hilarious part: as soon as they (the movie publishing industry) do start trying to be clever with BD+ attacks trying to find the Doom9 VM and variants thereof, they'll screw up discs so they're unplayable on numerous legitimate players. Pretty much the only thing that hasn't sunk BD+ so far is the fact that there are very few different models of player in circulation. As it is, it's still fallen over before.

Re:As the article says...

[swillden]

I honestly have no idea what proportion of BluRay watchers watch via their PCs, but the equation is simple - take a graph of disc sales. Presumably at some point its BD+ program is cracked and sales will fall as high quality rips show up on the internet - I'd imagine the graph looks like a sharp rise upwards on release week followed by a gradual decay into nothingness over time, with a sharp drop around the time the BD+ program is cracked (assuming it lasts long enough that you can even get a sales baseline, ie, not within a few days).

By this theory, you should see DVD sales drop to nothing almost instantaneously.

Even if Blu-Ray copy protection were as utterly broken as DVD copy protection is, the disks would still sell fine. Of course, then there are the people like me, who don't pirate anything, but refuse to buy media they can't copy at will. I'll stick with DVDs until the Blu-Ray cracks are so automated and key distribution infrastructure so well-developed that I can do what I want with Blu-Ray media.

Re:As the article says...

[RCL]

I think it's more about fear of losses than actual losses itself. Most people who buy pirated stuff cannot afford buying (the same amount of) legal stuff, so it is incorrect to count all the counterfeit sales as "losses".

As an example: people in Russia earn about $400/month on average - do you think it increases the chances for Linux/free software popularity? No, everyone just buys counterfeited Windows, which costs about 2-3$ in semi-legal shops. You can even find custom Windows "distros" on the net. Does that count as "loss of sales" for Microsoft? I doubt that.