Slashdot Mirror
Blu-Ray Players Hackable Via Malicious Discs
An anonymous reader writes: Some Blu-Ray disc interactive features use a Java variant for UIs and applications. Stephen Tomkinson just posted a blog discussing how specially created Blu-Ray discs can be used to hack various players using exploits related to their Java usage. He hacked one Linux-based, network-connected player to get root access through vulnerabilities introduced by the vendor. He did the same thing against Windows Blu-Ray player software. Tomkinson was then able to combine both, along with detection techniques, into a single disc.
My Blu-Ray player runs Linux and hasn't had a firmware update since 2011. I'd be shocked if it didn't have remote root holes accessible via network, let alone local privilege escalation exploits in Java.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
...that are inserted by their owners.
Always good to remember a venerability is a venerability, but a trojan is a trojan.
- People buying legitimate blu-ray titles are not going to have this issue.
- Even people downloading pirated content are not going to have this issue... as long as they are downloading just video files and not trying to pirate the entire disc with menus.
I suppose not caring works, but it seems like this is a great vector to turn hardware players into Zombies. If I were a criminal, I could think of a lot of things that could be done with even 1% of the world's internet connected players. Do you really want your Blu-Ray player to be part of a botnet sending spam or participating in denial of service attacks?
If for no other reason, think of the impact on your bandwidth and electric bill. I certainly don't want a house full of hackable hardware. When (if) the internet of things arrives without security and 10% of the fridges, air conditioners, electricity meters, washing machines, pet doors, TVs and driers are all hacked because manufacturers couldn't be bothered to secure them, I think you'll probably care. It will bring the interwebs to its knees.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
If you can, have the "computer" that you use for such things not matter if it gets hacked. If your blue ray player has no writable storage or network access and you power it off after every use, there is no danger
I don't think there's a single BD player out there that doesn't allow for either software updates or updates to the BD codes that allow/disallow you to decode disks.
One I have requires a USB key to be present to cache validity information for disks you have already watched - without it, it still works, but requires contacting the mothership through Internet whenever re-inserting any disks newer than the latest firmware update.
BD disks these days even come with extras like links to youtube videos, that play on the BD player. That's an attack vector right there. Do they all use https and check the validity of the cert to avoid MITM attacks, using only name servers with signed entries? I highly doubt it.
If I wanted to hack it, I feel fairly confident that I could do so. I'd start by hooking up to the (convenient) JTAG interface, and learn as much as i could that way, before starting to probe from the outside, i.e. through discs, USB or TCP/IP. But it would be low on my list if things I own that I want to hack. My car is more interesting.
I'll let you in on a little secret. I own lots of Blu-ray discs, but I don't actually own a Blu-ray player. I buy the disc (whatever my thoughts on Copyright, it is the law and the content producers do deserve to be paid), then I download a Blu-ray rip of the movie from a torrent site. Toss the file on my media server, and call it a day. They get their money, I don't have to deal with their forced previews and FBI warnings. I really have to wonder what they're thinking. First they complain about piracy, then they respond by making their products worse for legit customers than for pirates.
If the player has control over the power LED, it can pretend to be off when it really isn't. Few players have physical power switches which really switch power.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Unfortunately, it's not just blu ray: 'BD-J' is their specific variant; but it is based on the so-called 'Globally Executable MHP', a truly horrifying acronym-standard-soup constructed to enable vaguely interoperable java-based UI atrocities for various flavors of set top box associated with DVB-T, DVB-S, and DVB-C(Basically, all digital broadcast and cable activity that isn't ATSC, ISDB, DTMB, or some fully proprietary oddball).
BD-J is North America's main point of contact with this delightful substance; but it enjoys near-total ubiquity in the parts of the world that also use DVB.
> If you watch your movies via streaming, this is not an issue. 2015 people, 2015.
Yes. In 2015 there's still plenty of stuff that's not available via streaming or is only available at a price that most people aren't interested in paying.
Some us actually use this stuff and don't merely talk about it.
A Pirate and a Puritan look the same on a balance sheet.
Most BD players do have storage. BD-Live depends upon it for instance.
> If you watch your movies via streaming, this is not an issue. 2015 people, 2015.
Yes. In 2015 there's still plenty of stuff that's not available via streaming or is only available at a price that most people aren't interested in paying.
Some us actually use this stuff and don't merely talk about it.
The movie I was streaming just flaked out, that's why I came over here to make sure the Internet connection was still up and say hi.
That was exactly my thought. This is exactly how cell phones are jailbroken; I was actually quite disappointed that the article was purely from a security vulnerability standpoint as opposed to how I can root my player and make it allow skipping of the thrice-damned FBI warnings.
"Because Science" is one step from "Because old book". Try "Because of my experiment testing my falsifiable assertion".