Slashdot Mirror
$350 Hardware Cracks HDMI Copy Protection
New submitter LBeee writes "German Researchers at the Ruhr University Bochum built an FPGA board-based man-in-the-middle attack against the HDCP copy protection used in HDMI connections. After the leak of an HDCP master key in 2010, Intel proclaimed that the copy protection was still secure, as it would be too expensive to build a system that could conduct a real-time decryption of the data stream. It has now been proven that a system can be built for around $350 (€200) to do the task. However, the solution is of no great practical use for pirates. It can easily be used to burn films from Blu-ray discs, but receivers which can deliver HDTV recordings are already available — and they provide the data in compressed form. In contrast, recording directly from an HDMI port results in a large amount of data."
recording directly from an HDMI port results in a large amount of data
With the high prices and todays HDDs, it makes recording from the HDMI even that much more economically unfeasible...
...it would be too expensive to build a system that could conduct a real-time decryption of the data stream.
Then how, exactly, is anyone supposed to be able to ever watch? Oh, yeah, right. Duh. Every freaking HDTV with HDMI input has to conduct real-time decryption of the data stream. Where do these companies even find these fucktard spokespeople???
Maybe this will finally make HDMI manageable for audio/visual crews when faced with multiple HDCP encumbered HDMI sources that need to switched and/or crossfaded in real time. Right now it is damn near impossible to implement any form of HDMI switching due to the ridiculous handshake times needed when protected HDMI sources see changes in the destination. Currently the only way to handle it is with a black market HDMI to component converter which introduces often unacceptable video delays in addition to requiring multiple Digital-to-Analog and Analog-to-Digital transitions along the way.
NetInfo connection failed for server 127.0.0.1/local
Ok the data is encrypted... But the TV's and stuff use it are consumer devices. Many of them are below the $300 mark.
So if some guy found a chip that decodes HDMI in a $100.00 device takes it out and wires a new device with a different function and sells it for $300.00 he may be making money without actually decryption the HDMI. I mean my TV is HDMI. and a digital single goes into the DLP chip It would be logical that the DLP data is unencrypted by the time those electrons get there.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
What our German friends seem to have forgotten is that in the United States, we have the awesome lobbying power of the MPAA. Now they're going to make it difficult to impossible to buy FPGA programmers. If that sounds ridiculous to you, remember how difficult they made it to obtain Smart Card writers once people started figuring out how to clone DirecTV cards.
Tired of FB/Google censorship? Visit UNCENSORED!
At no point in the entire history of the Euro has €200 been $350. The Euro peaked in 2008 at around $1.60 and is today at $1.33. At that conversion rate, €200 equals about $266.
Since when does €200 = $350 US? Even if we assume the "high" rate that the Euro used to fetch, it was still only worth about 1.4 USD, thus equated to approximately $280 US, not $350.
This solution doesn't make too much sense given that tools are readily available to capture the source material before it is decoded/uncompressed and sent over HDMI. Many available tools can open up Blu-ray discs (with AnyDVD HD being the most prominent). As well, individuals that have the know-how can often capture the MPEG2/AVC TS streams from STBs via FireWire.
Since some people seem confused as to why this is special and what it actually does.... I'll try to explain some things.
Yes, HDCP happens right at the I/O chip, and you can extract unencrypted raw video bitstreams in a variety of ways. All involve actually opening up the receiver device and soldering on wires.
Typical HDCP compliant devices use a ROM with a vendor key that's attached right to the I/O device. Industry standard devices such as the ADV7441 or AD9889 from Analog Devices fully support this, and interface to the rest of the system with a standard raw video bit stream. The contents of these vendor ROMs are typically unique to each vendor and their contents are not even disclosed to the vendor. They do not contain the master key, but are somehow related to it. This is cheap - the ROM's probably cost pennies, and the cost is more about registering as a certified HDCP compliant device. It's pretty much a plug-and-play solution for display device vendors - simply attach the vendor code ROM to the receiver chip, and the device just outputs unencrypted video to the rest of the system.
There are various mod kits for adding SDI or unencrypted DVI/HDMI outputs to things like Blu-Ray players, but they all work just by connecting to the raw bitstream lines AFTER the decryption at the actual HDMI receiver chip.
On an HDMI cable, the actual encryption that takes place is specific to keys on both sides, so can't generally be universally cracked. If a vendor key becomes compromised, future Blu-Ray players can blacklist it.
What makes this solution useful, is that it's just about the only way to crack the encryption on-the-wire without having to open anything up or solder anything, and it can't be prevented by simply blacklisting vendor keys.
Back when the key was leaked, I figured the only thing that would keep it from being put to use was the lack of a practical use. But now there's talk of releasing movies on PPV in conjunction with their release in theaters. A device like this could have 1080 BD-quality rips of movies available on the internet the same day they're in theaters. Just grab the stream via PPV, compress it, and seed it. Also applies to any other PPV event that normally wouldn't be available anywhere but thru the cable company.
I can't help notice the horrible exchange rate they get..
Right now I have a situation where I can't watch Blu-rays on my PC. I have everything you should need, an ideal setup even. I have a high end video card that does HDCP, I have Windows 7, I have a monitor that does HDCP, and I have a receiver that does HDCP. Everything works, looks, and sounds, great. However when I play a Blu-ray, it says "Nope."
Why?
Well because of the way my video and audio are hooked up. My graphics card is hooked directly via DVI to my monitor. No problems there. However it then has a second HDMI output to an HDMI soundcard, which goes HDMI to my receiver. The reason is HDMI requires a video clock to send sound and the soundcard doesn't generate one. No problem, the second out is just a mirrored output, just a dummy out to get video clock.
However Blu-ray doesn't allow for that. No splitting the signal. Even though both devices are HDCP enabled, it won't allow it.
So hell, I might build one of these (particularly since where I work, we have Xilinx ISE). Would solve the problem and mean any future HDCP problems are easy to solve too.
They try and outlaw FPGAs they'll find themselves up against a massive backlash from companies far bigger than they are. People like Cisco, Intel, and so on. FPGAs get used in all kinds of commercial gear. They aren't a hardware hacker's toy (not that they can't be that just isn't what they are for) they are a device when it would cost too much to do a run of ASICs, but you need more specialization than a CPU can give you. Also they are for devices that need field updatability.
This guy's been selling a variety of products to allow your old component or VGA only devices play from HDMI sources. http://www.hdfury.com/buy-hdfury-now/ Some models are around $250
you know: if everybody believes in dragons .. lo-and-behold: there are dragons! (same thing holds with rain)
"the electron belongs to the people(tm)"
And rip the bluerays.
All you need is a dual core cpu and 1.6GB of RAM
http://www.cs.sunysb.edu/~rob/hdcp.html
Blu-ray content can be ripped *exactly* using programs like MakeMKV and all the significant video media is released on Blu-ray these days. There's no need to try to capture this material from HDMI.
1) My monitor is a professional display (an NEC MultiSync 2690WUXi). Among its other features is hardware calibration. It has internal correction tables to produce extremely accurate output, calibrated to any curves I like. To do that, the video card must be able to communicate with it via DDC/CI which it can't do through the receiver, since the receiver gets those commands, not the monitor. I didn't pay $1200 for a monitor and calibration hardware to not have it work to its optimum potential.
2) Latency. I am a gamer, and I want as low a latency as I can have to my monitor, particularly since as a professional monitor its scaler already introduces a bit of latency (33ms). If I feed the signal through my receiver, it will introduce additional latency in an effort to perfectly synchronize audio and video. I would rather have less latency and a minor sync problem.
3) I often operate the computer without sound. Right now, since I'm surfing the web, I don't feel the need to listen to anything. Thus the receiver is off. It puts out about 200 watts at idle since it is a fairly high power, high bias unit (a Denon 3808CI if you are wondering). I'd rather save the power, and more importantly not heat up my room, when it isn't needed. Can't do that if I feed video through it.
My setup is designed to meet my needs, and it does very well. It has no issues with anything, except for Blu-ray. The only reason it has such an issue is a stupid artificial restriction.
Submitter plagiarised the summary from The H:
http://www.h-online.com/security/news/item/Researchers-conduct-successful-MITM-attack-on-HDCP-copy-protection-1384543.html
http://www.monoprice.com/products/product.asp?c_id=101&cp_id=10114&cs_id=1011411&p_id=8667&seq=1&format=1#largeimage
I killed da wabbit -Elmer Fudd
Your suggestions might have merit, though the DDC/CI one is problematic because not only do commands have to get passed but SpectraView II (the NEC software) has to recognize this display.
The setup I have now was done because it is easy and it works. Requires 1 extra cable and a simple setting in Windows. I haven't bothered to look at other ways around because playing Blu-rays on my computer isn't all that high priority. I have a home theater setup too.
The reason a HDCP bypass device interests me isn't just because it solves this problem, I could solve it in other ways (an HDMI signal generator would do the trick, though they are costly) but because it solves this problem and any other I ever have caused by HDCP.
It is one of those things that bites you in the ass when you don't expect it. Like with this. I never expected it would be a problem, after all: all devices in the setup are HDCP compliant and I can check to see the communication is working.
So if I had a device to solve this problem, then if another one presents itself later, or at work or something, I can grab the device and solve it.
http://www.monoprice.com/products/product.asp?c_id=101&cp_id=10114&cs_id=1011411&p_id=8667&seq=1&format=1#largeimage
Dear god! Why?!?
Composite is analog so there's some loss of image quality.
I have a $35 no-name chinese-made HDMI repeater that strips HDCP from anything you feed to it. Quite useful for watching BluRay output on my old non-HDCP TV. Doing it with an FPGA is a nice trick, but doing it with off-the-shelf parts selling for $35 retail is more convenient :-).
Even the summary gets this right.
This is about HDCP, which exists on both HDMI and DVI. I wouldn't be surprised to find something similar on DisplayPort.
This is not about HDMI, which can deliver an unencrypted video signal, just as DVI can.
Honestly, this makes about as much sense as saying "Reverse engineers crack ethernet copy protection" when talking about Ubisoft's DRM.
Don't thank God, thank a doctor!
Using SlingBox or a variety of HDMI capture devices with built in H.264 codecs, you can capture the compressed stream. Those other devices are designed to function on HDMI but do not function with HDCP equipped devices.
That being said... I managed to hack a board like this together months ago... it wasn't even complicated. Did it using a $149 FPGA board and a $299 HDMI In/Out adapter for it. I needed it not for copying, but for SlingBox.
It depends on your preferences, with my eyesight it really does not matter, nor would it to most older adults.
I killed da wabbit -Elmer Fudd
You'd probably call me an 'older' adult. Preserving full picture quality definitely (still) matters to me.
Actually I probably wouldn't based on your answer.
I killed da wabbit -Elmer Fudd