Slashdot Mirror
Doom9 Researchers Break BD+
An anonymous reader writes "BD+, the Blu-ray copy protection system that was supposed to last 10 years, has now been solidly broken by a group of doom9 researchers. Earlier, BD+ had been broken by the commercial company SlySoft." Someone from SlySoft posts a hint early in the thread, but then backs off for fear of getting fired. The break is announced on page 15.
The best part of all: the DMCA makes it perfectly legal to use with Linux since OEMs don't provide linux codecs.
Sony isn't having a ton of luck building an installed base of users of BD, even after buying their competition into submission. If they obsolete their installed base they have to start over again with thet negative examples of HD-DVD and the additional strike of cyclic obsolescence against them. It would be too obvious that the purchase of their content is actually a short term lease. That would be the death of BluRay before it's even well started, and it wouldn't even buy them an additional year before it was cracked again.
It's more likely that we're nearing the end of this DRM nonsense forever. Finally!
Or am I too optimistic of their intelligence? History does weigh heavily against my hopefulness here.
Help stamp out iliturcy.
What's more impressive is that the thread was started August 24th,
which means it took them 5 weeks and a few days to break BD+.
Kudos to them.
Is this just for MKBv7 (Media Key Block) or is BD+ permanently broken?
[Fuck Beta]
o0t!
> That being said BluRay burners are expensive enough, and the blank media is expensive enough that I'll probably
> still buy my BluRay movies on Amazon.com.
Which is perfectly good. I didn't buy my first DVD though until the protection was broken and I have no intention of buying anything BD until it is broken. I'm sure I'm not alone in this. Who wants to buy a BD movie until they can pull a copy to a DVD for portable players off in the rest of the house, the in car players, etc. Until we can yank clips out of one. Until we can play then on our non-Windows machines.
Once stable build of mplayer support this stuff and the battle of key revocation settles down I'll think about investing in the stuff. Not before.
Democrat delenda est
Maybe this breakthrough will finally make BluRay a popular format, so far I haven't seen much (or any) pick up.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Disrupting the consumers from viewing the new shiney will actually make them sit up and pay attention. I hope this screws a lot of people really hard to the point they say "HEY! WHAT THE HELL!"
I think this has actually happened a couple times. My first negative experience with DRM was as a kid - I bought a video game that kept insisting I 'insert the original disc'. Turns out they fubared the pressing such that even the original disc was seen as copied - didn't impress me with the quality control. It was something where pulling even a single disc and trying it out would have found the problem.
My second was with an E-Book program. I decided to check out this 'ebook' thing, downloaded the one Stephen King wrote years ago - the idea was that if you liked the book, you paid for the next installment. While I found the installment nice, the reader broke so many things that after reading it I uninstalled the reader and therefore the book. Never again. For example, it mostly broke copy/paste, as well as various other things in attempting to stop screen captures.
I mean, if I had wanted to copy the book, it would have only taken a few hours of my time to [i]retype the bloody thing[/i] using dual screens or even two computers. It wasn't a hugely long book, and I am a trained(if out of practice) typist. If I wanted to do a lot of books, some sort of OCR system would work.
Or just find & download it off the internet today.
Especially with the popularity of MP3 players that are quickly turning into media players, the 'average user' is seeing the effects of DRM more and more. Especially when they buy that DVD duplicator and discover it won't work for 'copyprotected' discs.
I don't read AC A human right
A lot of people are just not buying content - even though they would like to buy content - because they know that money spent that way is wasted and they don't want to throw their money away again.
At the risk of my karma, I'm going to mention that no one I know seems to fall into your generalization of people not buying Blu-Ray discs or players because of DRM. The most commonly cited reason for discs is lack of ubiquitous players (in cars, portable players, friends houses, etc) and the most common reason cited for players is the expense of a Blu-Ray mechanism. In fact, breaking the DRM makes Blu-Ray riskier for investors and therefore likely will increase costs (higher risk means higher cost) in the short term.
All in all, because Blu-Ray is 10x the bandwidth of any online "HD" movie source (and I use that term loosely for online offerings) and because online DRM is so much worse, I don't see it going away. Instead I see it likely to win over DVD-- DRM or not-- but not until manufacturing costs ramp down due to better technologies and economies of scale.
Consider this. Is a DRM-free H.264/AAC mp4 file more convenient, or is a DRM-laden disc that you can play in your car, computer, PS3, portable system, or friend's house by carrying around a 16 gram disc? I suspect for geeks it's the former, but for most consumers it's the latter, and it's really just about making players ubiquitous. The odd player out is, of course, the iPod. It's the one thing that is both ubiquitous and doesn't favor the disc. If the Blu-Ray consortium came to some agreement with Apple there it would go a long way towards gaining acceptance.
E pluribus unum
> If most BluRay players are hardware based, then as a movie studio I'd be tempted to simply write
> some BD+ code that looked for existing software players and banned all of them. Then the
> "trace a licensed player" step outlined above suddenly turns into a silicon reverse engineering
> problem instead of a software reverse engineering problem. Much harder.
Even then, you can still run the BD+ code in the VM, and trace it under the VM, and figure out what makes it fail, and ensure that it sees a VM environment which doesn't look like an existing software player. Or any kind of software player. And you may have the ability to modify the software player to explore what triggers the problem (a lot of people who's software players no longer play the latest releases would be rather thankful for a patch).
Harder, but a boatload easier than tracing silicon.
The BD group pretty much has to outlaw software players entirely to avoid this kind of attack.
c.
Log in or piss off.
Yes I know. What I meant was, what proportion of BluRay watching people watch the movies on their laptops or desktops, vs a dedicated hardware player or PS3. And yes I expect the PS3 does a lot of it in software too. Point is, I also expect tracing the BD+ VM in a PS3 to be quite hard.
I agree that the BD group may eventually be backed into a corner over software players, at which point it'll boil down to pure economics. I read that the vast majority of BluRay players in the world are PS3, although of course, that doesn't mean the vast majority of used BR players are PS3s.
I honestly have no idea what proportion of BluRay watchers watch via their PCs, but the equation is simple - take a graph of disc sales. Presumably at some point its BD+ program is cracked and sales will fall as high quality rips show up on the internet - I'd imagine the graph looks like a sharp rise upwards on release week followed by a gradual decay into nothingness over time, with a sharp drop around the time the BD+ program is cracked (assuming it lasts long enough that you can even get a sales baseline, ie, not within a few days).
Now let's say 10% of BluRay watchers use a PC, so reduce your project sales by 10% but remove the sharp drop due to piracy, take the integral of both graphs and see if the difference is positive. If it's big enough it might be worth abandoning PC playback to avoid the piracy (or shift that sales cliff to a point where sales were low anyway).
If the economics don't look like that, then the BD group needs to try and get PowerDVD and friends seriously buffed up, security wise. It's certainly possible to make x86 code annoying and difficult to reverse engineer, but very few people can do it well. I'd imagine most of them don't work for BluRay player software companies.
I'd be very interested in a chart of every BluRay title released and when it was cracked, but I doubt such information is publically available.
Unfortunately this will probably just mean that a ton of consumers will be SOL when they implement new encryption schemes on BluRay that aren't supported by some existing players.
Good! Maybe then the consumers can start to understand why DRM sucks, especially systems where their decryption keys can be disabled after the purchase. It's unfortunate that they'll have to learn this the hard way, but there is not much we can do about that.
"The content must contain sufficient information for the content to be decoded. Anything one software can do, another software can do (see Knuth, et seq)."
From the copy of "Beneath Apple DOS" (copyright 1981) that happens to be on my shelf, page B1;"It seems reasonable at this time to say that it is impossible to to protect a disk in such a way that it can't be broken. This is, in large part, due to the fact the diskette must be bootable; i.e. that it must contain at least one sector which can be read by the program in the PROM on the disk controller card. This means it is possible to trace the boot process by disassembling the normal sector or sectors that that must be on the disk."
So they have been flogging this dead horse for 27 years. High marks for persistence, low marks for, well, everything else.
Anyone want to package this tool up with the PS3 mplayer vo driver for the PS3 Ubuntu Intrepid release?
--
make install -not war
I understand where you're coming from, but it probably will make Blu-ray less attractive.
The issue with BD+ is it's the equivalent of the hacks game writers used to put into games for 8-bit computers in the 1980s that would do little timing loops and check various memory locations to make sure that nobody's plugged in any hardware they shouldn't. These hacks were almost always universally awful, with users having to screw around trying to find combinations of things that'd work to play games afflicted with these "copy prevention" methods. And, whenever Commodore or Sinclair released an updated computer, it'd break a certain percentage of those games.
Right now there are tens of models of Blu-ray player. BD+ has posed to be a problem even so, but for the most part the problems have been "containable" with manufacturers releasing firmware updates to fix the issues as they've come up. Another thing that's made this containable has been the fact that the system hasn't been universally deployed - indeed, the vast majority of discs do not have this ACM applied - and where applied the hacks have been simple checks of the "I run, therefore I am" type. The only VM they've been looking for is Slysoft's.
Now two things are going to happen. The first is that the BD+ scripts are going to get ever more complicated. This increases the number of Blu-ray models that'll get false positives. Worse, the false positives will increasingly be because of a bug in the script, not the player, which will make player manufacturers a little less happy about patching their firmware to fix the problems.
The second - unrelated to BD+ being cracked - is that the number of Blu-ray player models is going to increase, and the number of manufacturers involved in Blu-ray will start to become somewhat greater than the "We're all a bunch of happy Blu-ray supporters" group that currently make players. Virtually everyone making Blu-ray players today wants Blu-ray to succeed enough to be prepared to do anything to do it. This is unlike, say, DVD where most player manufacturers know that DVD has succeeded and therefore just want to make money.
Taken together: we're looking at increasingly unreliable scripts, with many, many, more opportunities (player configurations) to fail, and consumers rioting because they're finding the only way to watch every movie they buy or rent is to own two or three players, or a Playstation 3 (which'll probably be the only Blu-ray player everything gets tested on.)
CSS was a predictable algorithm that could only be implemented one way. When it was cracked, that was not a disaster for DVD, indeed it probably helped the format.
AACS is a predictable algorithm that can only be implemented one way. When it was cracked, that was not a disaster for HD DVD or Blu-ray, indeed it probably helped the HD formats.
BD+ is an unpredictable algorithm based upon technologies that have failed in the past, will continue to fail, and which have failed for Blu-ray already. The ONLY way the Doom9 crack is going to be helpful for Blu-ray is if it convinced Fox et al to drop the technology. As for me, it's on my list of reasons why I'm not going to get Blu-ray. If the BDA removes BD+, and works on Blu-ray's other flaws, I might reconsider my stance. But everything's going to get worse, and Hollywood will blame pirates in the same way as some idiot who accidentally shoots and kills his wife because he didn't expect her to enter the house via the backdoor blames "criminals" for making him scared in the first place.
You are not alone. This is not normal. None of this is normal.
Once SOny notices that happening, they'll make sure to give every PS3 (or small groups of PS3s) it's own key. Then, when one is compromised, they know more or less who did it, and don't provide an update for those PS3s when they revoke the key.
How many PS3's are you willing to buy?
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant