Slashdot Mirror
Why DVD Encryption Crack was a Cinch
Devastator writes " Wired has a good article how how the DVD encryption was cracked. The DVD industry is scared speechless about the news." Its actually an interesting little summary of the situation. I wonder what it means for the DVD industry.
A chain is only as strong as its weakest link. This is a good example.
But then again, I do believe this will spur the Industry to do a better job, which will inspire more creative hacking, which will inspire better security... Benefits for all.
The DVD encryption crap is simply yet another example of the Cathedral / Bazaar scenario which continues to manifest itself throughout the industry. The fact of the matter is that while majot corporation stuggle to keep up with the open-source community currently, this is not the way the industry was, say, five years ago. A form of economic or societal Darwinism has emerged in the computing industry, by which major corporations and the coding public work at furious rates just to stay even with each other. The DVD crack is one of the more and more common cases where the Linux community has outstretched "Big Business".
- Dave "It's better to be a pirate than to join the Navy" - Steve Jobs
5 Bytes? And they call this secure? 5 Bytes is 40 bits, which means there are 2^40 possible keys. Although I don't know how much CPU is required to test a key, I tend to think a good computer could probably sniff them all out in a matter of days.
On another note... I wouldn't like to be Xing/Real Networks right now. I think the MPIA could make a really good case for them being libel for a massive amount of money due to their negligence.
-- Slashdot sucks.
Another "wow, I'm *totally* shocked.. NOT!" story. You mean somebody was sloppy in how they implemented their encryption? And that led to exploiting a design flaw? WOW... :)
In all seriousness, I have no problem with copy-protecting DVD's. All the new-age zealotry regarding IP aside, as it stands moviemakers and DVD producers have the right to profit from their efforts. If they stop profiting, they stop making movies, and poof! no more "Matrix"-quality films.
OTOH, kudos to the hackers (in the traditional sense) who broke it. This is a rare case of white-hat hacking being beneficial. The original designers should probably be held liable somehow, and future efforts in this regard will be MUCH more careful.
"You can never have too many elephants on your team."
This case is lamentable because it was defeated so easily, in a way that shouldn't have been allowed to happen.
Encryption isn't all its cracked up to be.
"I would expect it could also delay the advent of recordable DVD, because it'll give people a medium to write these hacked video files."
too late?
I'll have the fries, please....
'We will fight against the illegal software, ...'. This is soooo pathetic!
blah blah blah
The fact is that very small percentage of the
users would be doing 'illegal copying', but those
surely would go to the furthest possible extent
to break through all the locks. The entertainment
industry is both paranoid and stupid.
Now I've been reading of digital watermarks on
DVD-Audio, which, in fact, are not entirely
transparent and somewhat degrade the quality of
sound. Don't you think the future of DVD-Audio
is sort of written on a wall?
Grunt. Oink, oink.
After using such a weak encryption method in the DVD format, the Japanese company responded by attacking the people responsible for breaking it and threatening lawsuits (good luck, since the "crackers" responsible remain anonymous).
Kind of reminds one of the revent security hole in Hotmail, where instead of admiting any responsibility, Microsoft attacked the horrible people who discovered the problem.
I think the concept of blaming the people who break security and pointing all the fingers at them is on it's way out, I believe the people who create the encryption and security methods should be held more accountable for weak security. Come on, without these "crackers" who break into things, we would still be XORing bytes and considering that the ultimate security.
Finkployd
Of course you're ignoring the fact that we had CD audio media for many years before CD-R drives became commonly available and affordable. The infrastructure was committed to CD audio long before it became trivial to steal and duplicate the content.
DVD is still new. I personally don't know of anybody who has a DVD player. This stuff could kill it as a mainstream format.
Ever heard of 12" laser videodisks?
1) True but...US law has a way of becomming
the law in other countries. Remember, we are
the last Super Bully
2) Unconstitutional? when has that stopped them
before?
Hell there is legislation being considered (its
passed the house and in the senate) to make
a certain drug illegal. Technically...it would
make the posession or sale of Red Meat illegal
in the US (since it contains it in small quantity)
(yea I know they wont enforce it in that manner
but...its just to illistrate the silliness of it..
technically...your brain is already illegal
to posess due to other chemicals it makes)
"I opened my eyes, and everything went dark again"
> So now that some folks have figured out how to STEAL DvD data, what next?
I, and many others, figured out how to STEAL dvds a long time ago. All you do is walk up to your local video store with a sledgehammer, break the glass, walk in and grab an armfull, and then run.
What these guys have done is taken the first step that will allow me to play dvds on my box.
I am happy. I am not stupid. I won't be wasting my valuable time copying and distributing dvds. It's MUCH easier and less expensive if you include the cost of your personal time to just go to the store and buy another disk rather than buy blanks, copy something onto them, find customers that will be willing to buy at a discounted price, sell, make sure that I'm not going to get stung by the law enforcers, etc. etc. etc.
To put it simply, pirating dvds will not be profitable for a long, long time.
The "old fashioned" method I described above is much more profitable than disk copying and a much greater risk to, and currently a greater drag on, the profits of the "dvd industry".
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
The only reason this was cracked is that the
technology was made available only to Windows
users.
The smartest people on the planet do not use
Windows, so you combine high intelligence with
a strong motive to crack DVD...
If they had made Linux-based DVD players it would
never have been cracked.
Mark
Here's the link. http://www.nico-soft.de/DVD1/home1.html I'm going to pick up a DVD-ROM this weekend to try it. Should be neat.
Remember MKUltra? The top secret project in which the gov't was able to brainwash people into committing violent acts? I'm sure you've seen it at work today, what w/ all the school shootings and such. As for those who survive, they make it into college and M$ pays them a visit (w/ bags of yummy cash).
"In the future, the laboratories will be more actively conducting strict surveillance and take counter measures against illegal, inappropriate software and hardware in the market. Moreover, we believe that, based on the recent legislation, legal measures and steps will be taken by copyright holders against such violation of intellectual properties," Mikura wrote.
If you can't solve a problem technologically, do it with legislation. Since encrypting DVDs didn't work it looks like they'll move to the next step, prosecuting the hell out of everyone they catch. Which will most likely be a bunch of kids trading the latest releases. Nothing like harassing kids for good PR.
Sorry, but the Internet makes the control of digital media IMPOSSIBLE. This is a fact, if you want to make big money with digital media you have to understand this fact and move from there. No major media companies have yet acknowledged this and they will fight it until they die or give in. Goes to show you, you can't teach an old dog how to use the Internet.
+&x
can't really work in the real world? I disagree. as a matter of fact, the more times things like this happen -- the more information that starts off as billion dollar top secret encrypted info and then becomes nothing more than a little bit of code embedded in a widely distributed application -- the more its going to become obvious that free information can work very well.
your medical records, my civil court records, their credit records, the movie industry's precious DVD keys... all this information is going to become publicly available, and there's really no way to stop it - the best we can hope to do is figure out how to live best with the fact that information is very hard to contain.
The "immorality" of copying DVDs is right up there with the "immorality" of copying a magazine article. The truth is that the invention of the Xerox machine did not destroy the publishing business. Even though is is possible to copy all the interesting articles in a magazine for less than the cost of an issue, the magazine business is rolling along better than ever. Why? Is it possible that the people running the movie studios are insanely greedy?
The entire home video industry is gravy for the movie industry. Worst case, they'll have to go back to making their money off the the theatrical showing of their films instead of counting making as much again off the home video rights.
"How perfectly Goddamn delightful it all is, to be sure" Charles Crumb
Seems to me that if you can defeat the DIVX scheme, you then get even cheaper movies that you don't have to pay to view at all, compared to DVD!
(I don't use DVD or DIVX, by the way.)
Practice random senselessness and act kind of beautiful.
If it [is] going [be a problem to produce DVDs now], nobody would be producing audio or data CDs. We have had CD-R drives for what, 6 years now?
I have to wonder if that's part of the reason for DVD Audio-- to make the public switch from CD to DVD for music. I'm sure the recording industry would much rather have a format with security like DVD's rather than the weak "security" of CDs.
This reminds me-- I've got to get a CD-R drive soon. I suppose you all know what I'm going to use it for. All I can say is, if the industry doesn't take steps to protect what's theirs (their intellectual property), they'll get exactly what they deserve.
Don't call the movie studios and record labels "victims" of some "communist pirate pig-dogs." (Well, I suppose people who copy this stuff are "communist pirate pig-dogs," but that's not the point.) If the industry doesn't properly protect itself, it deserves to lose everything. I have no sympathy at all for them.
Think of it like this: you leave your front door unlocked everyday while you're away at work, and one day, a thief breaks in and steals everything. Will your neighbours feel sorry for you? Should they?
Then they could redo the security of it, and expect results. Some extra features wouldn't hurt, but overall, all they'd really need to do is make the play. In the most ideal situation a partnership of two huge companies would be required: one to produce DVD2k players with backwards compatibility, and the other to make DVD2K discs out of all the new content they could lay hands on.
However, I don't think we are anywhere near that kind of situation. The cost-of-duplication argument aside (because it's silly; I heard that one when CD-R was just starting), to circumvent the clusterfuck they've invented would destroy the DVD market as it exists now. And it isn't firmly enough embedded for a changover.
IP is just rude.
Is there any torture so subl
I mean, come on. Do the math. The Matrix on DVD costs $25 at Tower, $19 at AbbyRoad, $17.45 at DVD Empire, and $20 at BigStar. (Verify this at http://shopping.yahoo.com/shop?cf=1&d=v&id=1086960 )
= 16139&l=16093&qc=%22DVD%22*+AND+%22MEDIA %22*&CiCodePage=Windows-)
The 5.2 GB DVD RAM disk costs $25. (http://queen.pricewatch.com/search/search.idq?ne
It costs more to copy the thing than to buy the DVD. Sure, you can make VCD's out of it, but then you throw out a huge portion of the features in a DVD. And whatcha gonna do when games come out on DVD and they're all 5 gigs in size (thanks to all the movies, textures, maps, etc.) and the cost of copying them is easily half the price of the game? Trust me, DVD is in no immediate danger of being consumed by piracy, as long as the DVD-RAM media and players/writers are all so expensive, as they will be for quite a long time. Now DVD based music, on the other hand........... ====== I'm posting as an AC but you can contact me as Steve Chaney at gunhed@earthlink.net
Do you feel good now that you've pointlessly flamed somedbody - and sounded condescending and like a complete snob in the process? Quite pathetic aren't you?
You might not have liked it, or thought it was a quality film, but don't bash others who did. Everybody enjoys different things. One of my favourite films this year was "Eyes Wide Shut", but that got really hammered some people. So what?
Express your opinion, but it's not necessary to put somebody else down in the process. I happen to think that it was a quality film. I also think that Hong Kong turns out far more crappy action films than good.
"The circulation through the Internet of the illegal and inappropriate software is against the stream of copyright protection.
The vicious hiss of a toothless kitten.
How can breaking a trade secret be illegal? Keeping trade secrets is risky by nature. Ya want security and suability? Patent your design! But then the design becomes a matter of public record. If companies choose not to protect their inventions, then they have no right to bitch when details are leaked. Besides, the DVD consortium was sloppy. Look at the formula for coke and pepsi. They're still secret after 100 years. But if someone posts it to the 'net and everyone starts producing their own cola. Coca-Cola has ZERO legal recourse.
At AES last year I went to a Dobly demo room, where they remixed different types of music for 5:1. Musically, I can't say it added anything to the experience for me.
Now, for movies and video games its different, placement around the space has meaning in the context of the story, but there's a long tradition of musicians all being in one place -- on a stage -- and people sitting in front of them, which is a good match for stereo placement.
Ok I have 2 notes here as more than a couple
of people have said that "Dissassembly isn't
illegal"
A) The Crackers were NOT in the US. Therefore
they are not under US law. This argument thus
means nothing.
B) Sony is not a US company (they are Japanese)
thus only their offices in the US are under US
law. Again...this statement means nothing.
C) The statment itself is also useless, since
the Crackers were not in Japan. So even if it is
illegal under Japanese law, it may not be illegal
where they are.
D) The statment was probably written by someone in
some PR department. Regardless of legality, they
want to make these actions SOUND illegal and "Bad"
E) People in PR departments may not be experts in
copyright law...international or not.
"I opened my eyes, and everything went dark again"
Anyone have a copy of the source? The original msg has been removed. :|
/. article, but it apparently didnt survive.
Some kind person tried putting it in a
Wanna e-mail it to me so I can plop it on a nice little box for all to see?
paulmezz AT mail DOT rit DOT edu
(I actually am not an AC, I just forgot my password and i'm at work)
thx
MentlFlos
The primary reason it was hacked is that there
was no way to view DVD's on Linux...
What is immoral about wanting to play DVD's on
your computer??
If people copy the raw data, that is immoral...
just like copying copyrighted MP3's is immoral.
> Do any of you out there even CARE? Or like I
> figure, none of you understand how you get paid
> (many of you are students ANYWAY!) and how lost
> profits affect you.
Well, I assume the archival law still applies here (you can make a backup copy for storage). Not only that, but I know of a real-world, legitimate use for this...
My friend has a lot of DVDs, and he travels often for work, but he can't yet afford a portable DVD-playing device (be it DVD-ROM or one of those spiffy mini players). He asked me if there was something to extract them, because he has a laptop (without a DVD-ROM), and wanted to know if there was a way to convert them to VCDs so he can watch them on the road.
This has been said on Slashdot many times in other contexts, but... just because it's been cracked doesn't mean it was done maliciously. There *are* real-world, legitimate uses for this (DVD-playing for Linux? Archived VCDs?), just as there are illegitimate uses.
Granted, maybe more people will use it for Evil than will use it for Good (TM), we have yet to see.
WWJD? JWRTFM!!!
They're the fuching morons who are trying to prevent the export of encryption because of "foreign" threats (yeah, right, the real threats are the idiots already past our borders). The (h/cr)ackers responsible for this shouldn't be blamed since they've enlightened us with the knowledge that what we do can easily backfire on us.
http://www.wired.com/news/technology/0,1282,32263, 00.html
They have removed it, yes?
Please moderate this up.
Networks when the MPAA gets there guidos working on this. Makes you think...I don't wish any "ill" towards either company, but it wouldn't surprise me if either of them "disappeared". Youse knows what I mean?
(Close-up of Neo - Look of agog on his face - Said in a half-whisper)"Whoa!"
and it was a subsidiary of RealNetworks that failed to encrypt thier key.
hahahahahahah
DVD-r is already too late. My harddrive is already 17 GB (which is actually quite modest these days), which is the maximum size definedby the DVD standard, though dvd-r is probably way below that. So I don't think the relief a dvd-r provides above normal cd-r will last long.
So I hope there will be something more advanced soon.
Jilles
Ummm... Have you tried copying a DVD to VHS?
However, since you don't "own" the content you "have" on all that media you insist on posessing, the license to view/listen to the content on the media, while somewhat non-revokable, does not grant you ownership of the content.
Yep, you've "got" it alright. But with attitudes like yours, not a lot more will be stored on media you can keep indefinitely.
Storing the raw DVD video/audio data is foolish, yes. But the DVD video is of such high quality that it is feasible to downgrade it to, say, 400x300 or 512x384 pixels in truecolor and MPEG-1 it at a reasonable bitrate. That'll still result in higher quality video than what has been previously available to the w4r3z-keepers.
The rest of the world signed the Berne convention on copyright in the 1887-1920 period. The US held out until 1976.
Security through obscurity is more like hiding a copy of your front door key under the little gnome statue in your rock garden, then hoping that no one thinks to look there. Of course, that's the first place a professional thief is going to look.
Bottom line: It would've been cracked anyway eventually. Xing just hastened the process.
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
I'd rather see more efficient compression algorithms...
Well, who knows... maybe Windows 2010 will take 10gb of hard drive space...
Your argument is valid, today.
But the pace of smaller, faster, cheaper, better has show no sign of slowing. Disk space in $/Gig falls by a factor of 2 approximately every year. DVD-ROM readers will undoubtably go from 4X (or whatever) to 30X+, like CD-ROM did.
Will you arguments still be valid when it is cheap and fast (a few minutes) to copy a DVD on to a (small part of a 200 gig) hard drive?
I wonder if a movie studio would ever do something like what you suggested. I don't remember if Sony was in the music business back during the Beta/VHS wars, but would they have released a heavily promoted video on VHS and Beta simultaneously? (Would they have ever released it on VHS?
(A little historical cross-industry comparison, for those so inclined.) In 19th century New York City, among other places, taverns were owned by breweries. One ploy was to give away salty snacks and sandwiches at lunchtime; workers would then buy lots of beer to wash it down. Nowadays most places still give away pretzels for the same reason. [Maybe we should start referring to free pretzels, along with free speech and free beer...]
But then, assuming the distributors of keys for DVD players had criminal intentions is rather silly too. Personally, I like the fact that I can now play the discs on my Linux system (Which does not have Windows on it) and may actually end up buying a player now. This also enables other aspects of "Fair Use" which phrase Hollywood would like to stamp out in exchage for "Pay Per View."
Frankly I find the greed of Hollywood and the RIAA to be disgusting and would like to give economic preference to independent artists who do aren't in bed with that lot. Is there a web site with links to music and films (Old or upcoming) which aren't associated with those groups?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
"free everything" idealism works so long as /everyone/ does it for /everything/. The transition from the opposite state is the difficult bit.
Exactly! If I want to use my PC (my only DVD-player) to watch my admittedly modest DVD collection, I must boot 98.
DVD playing is one of the last few items left which is saving my 98 partition from final destruction.
Doug
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!
That may be true, but whats the point? People have DVDs because of the quality of picture and sound.. If you just crunch those down for transmission what have you gained? Even on a cable modem, it takes forever to get a movie off a warez site. Let alone finding the warez site with what you want in the first place...
Its easier (and cheaper, since time IS money) to go to blockbuster and rent the flick. And to those movies that are on the net but not released on tape yet, again, why bother? Do you really want to waste your time on a camcorder from the back of the theatre reproduction?
Think about it. If the manufacturers would have provided DVD drivers as loadable kernel modules for the Linux community, there would be far less attention given to the decryption of the DVD's CSS encryption scheme. We simply want to play movies from an excellent media (in comparison to what is currently available...VHS or huge MPEG files) on the Operating System of our choice.
Of course, someone will always pick up the challenge from statements like, "The Copyrights are guaranteed because we've encrypted the data on the disks," and ,"no one will break the cypher." Some recreational hacker or perhaps the evil black market dealer.
Who cares?!! We just want to watch our movies...
assert(expired(knowledge));
A few years down the road at least. Fatter pipes are coming, bigger drives are here. Even with my setup I can dedicate 5 gigs pretty easy, start a download and wait a day, voila Blockbuster go boom (no, I'm not on a school LAN).
The movie industry is in serious need of a housecleaning anyway. Whoa, look 3 new crappy movies, yippee!! (repeat every week). Personally I think this is poetic justice for the music/movie industries, they screw consumers when production costs go down and prices stay the same (but promotion costs seem to keep going up, maybe to offset the quality of the product..), we screw them when price and reproduction costs both move to zero. Serves them right for making me watch COMMERCIALS when I PAY to see a movie.
They will still have the box office and sales (a permanent physical backup for critical info is always a good idea) but I see no place for the present day rental system in the next millenium.
+&x
How much of this re-buying the same movie is just becuase the munchkins wore out by constant re-watching (or spilled grape juice on) their video of the Little Mermaid? You know kids and fragile electronics don't mix.
I was going to say you won't see this re-buying happening when everything is DVD which doesn't wear out, but then it occured to me that DVD's are easier to wreck than videotape. I have already ruined my DVD of the Matrix, and that was even before I even watched it! (dumbass me didn't have the disc centered in my tray and the disc got caught and scratched on the edge...)
Kids are gonna be MURDER on DVDs. There would have to be some kind of kid-proof cartridge for these things if they ever catch on.
So your basic point is absolutely correct, the way to combat piracy is to inovate, and market, and make people NOT WANT to buy the pirate copy. As to whether hollywood and big business are up to that challenge is an exercise for the reader...
Yeah, I'm a Mac programmer. You got a problem with that?
Naw. That's your problem, not mine.
it is illegal but completely moral to use the crack to copy DVDs.
there is no "right to profit", but there are right ways to profit. hollywood is in no danger, they are just too greedy and shortsighted to see how they can make money without copyright (ie, in a free market).
information is free.
the only question is:
Scott Draves
CSS prevents me from making digital copies to another for of media that I can use (cd, hdd, tape.) And macrovision prevents me from recording it without signal filtering hardware.
-sw
I agree with you here, but I have a feeling that as bandwidth becomes more plentiful and more content is put online, people may start shifting away from the need to have that box or shiny disc in their hand to represent what they spent their money on. I personally never buy movies. I don't see the value in having this pretty box containing a movie I may watch twice ever. Better to spend the money and take the wife to see it on the big screen once. If I absolutely had to spend $1.50 or $2 to watch it once online later, that seems OK. Better than spending $15 - $20 on a tape (or $20 - $30 on DVD).
This is sort of how the current cable pay-per-view model works. Image and sound is superior to VHS and it really doesn't cost any more than renting. I think DIVX was shooting for this sort of model but with superior sound/picture quality as an advantage. They just didn't market very well and got a little greedy with the pricing. :)
DIVX did suck though. It seemed more like they were duping people into thinking they were actually buying the movie. Oh well... RIP DIVX. May your successor be less lame.
It seems to me encrypting the key used by a software player would have been close to pointless anyway. If you have a copy of the software, you have the key used to decrypt the key that's on the DVD.
go here for the linux instructions/code.
Perhaps I don't understand correctly,
but if DVD is a method of storing data,
couldn't the data simply be copied from one
DVD to another (given appropriate hardware)?
It seems to me the only time the decryption
would be needed is when one was actually
_playing_ the video.
If not, could someone explain? It this key
locking the DVD drive at a hardware level?
If the keys are only needed for decryption into a mpeg stream, how does this crack have any impact at all on pirateing DVD? A digital copy is the same as the original, and a key shouldn't enter into it. What gives?
-Slackergod
perl is like a pit bull: it may be ugly,
but it's damn good at what it does.
Toshiba et al could have easily told the movie industry, "No, you're not going to get encryption or regional lockouts. Because it doesn't matter. Our manufacturing process costs less than one-fifth of the one you're using now. Once your shareholders find out there's a process that will cut your costs and increase profits and product quality, they'll rake you over the coals until you adopt it."
The problem is that the movie industry will then start crying and whining and creating mountains of bad PR about this open format because it will allow their "life-blood" (as the RIAA put it) to be sucked out of them by the pirates. It doesn't even matter if costs them 5 to produce 5000 DVDs which they then sell at $25 each. If they're not comfortable with the format, they will throw negative PR at it. Remember all the mud-slinging Hilary Rosen (from the RIAA) did about MP3?
Either that, or they will complain and whine and lobby the U.S. Congress to legislate some form of compulsory copy-protection (for DAT).
You're talking about people with billions of dollars in the bank. They didn't get that rich by giving things away.
assuming of course you found a way to circumvent the macrovision circuits. my SV-09 is not only a killer DVD player, it doesn't output Macrovision and it ignores regional codes. I just wanted to be able to watch foreign movies without buying multiple DVD players, and I wanted to avoid the picture degradation inherent with macrovision.
Commercial pirates aren't affected by much of anything so I think the movie industry should realize that most of us BUY our movies even when we can download them. I want to support the artists involved in the production of my entertainment. They earned the money.
Occasionally, I just feel the need to scream. Cant do that at work, so I'll post something
Heh, I feel this way a lot.
You are so right. Damn it annoys me that _I_ get blamed if I try to steal a car. Just what are those car manufacturers thinking by not putting in better car alarms? Its all their fault.
Interesting point, but I don't think it is the correct analogy.
The true hackers are the ones that discover the problem, not those that exploit it all over. It is not that you shouldn't get blamed for trying to steal a car, however you shouldn't be blamed for pointing out that the car company built a car that lets anyone in if they tap just right on the door. The car manufacturer _should_ be held to a certain level of competence, and in the US is.
>just keep deluding yourself with the belief that hackers are heroes
ok, and you can continue deluding yourself thinking that for every person that makes public a security problem, there isn't 100 bad guys already exploiting the problem.
Whats the quote? "If ignorance is bliss, I hope I'm never happy."
-chris (gandalf@darkcorner.net)
If DVD encryption was over 56 bits the players and authoring software would be illegal to export from the US (where most movies come from) due to anal US regulations on crypto. I suppose this is one of the few good results of these regs.
Now hollywood can't even "fix" DVD protections sinde all future discs MUST stay backward compatible with all pre-existing players. Forcing all consumers to upgrade is not an option.
- DVDs are cheaper to produce than video tapes.
This would be true, if there were no menus, no chapters, no extras and static encryption rate. Unfortunately, mastering a DVD is very expensive. The costs can reach >$100k before a single disc is produced.
Sounds like an excellent new project for distributed.net... they've been doing distributed brute force encryption cracking for how long, with how much computing power ?
230 left to go....
I wonder if the entertainment industry will lose a lot of money if (when?) they reject DVD...
Or will Joe Blow (hypothetical name) who just invested in a lot of DVD producing equipment to lease to Hollywood distributors lose a lot of money?
This isn't like CD Audio, where there was almost a decade of content out in the market before CD-R drives became common and affordable.
The major problem is that they are going after the wrong source, the people who sell the DVD duplication equipment. They make it seem like it's us, but that's just the publicity engine.
The people with the duplication equipment are the ones that can create thousands of DVD's. They can make Pirate DVD's of rencent movies.
Many times, these duplicators are doing duplication for the major movie studios.
The movie industry should have just made sure that only they had access to the duplication equipment. Instead, they went cheap. They let anyone with a duplicator bid for the duplication contract.
Think how many "Pirate" CPU's would exist if Intel contracted out the production of all of it's CPU's to other companies for production (and they charged $1000 for a celeron).
That'd be great, but the publicity of the thing is that you report it and They ignore you.
If you are lucky, they ignore you. If you are not lucky, they take legal action against you for discovering their bug.
I've seen it happen. Publicity and/or anonymity are necessary to project yourself!
Back when I was on the DIVX project at Zenith, (and yes, I know DIVX was *evil*) DIVX was the encryption method that was competing with the current method. The flaws of the current method were well-known to the crypto people at DIVX/Circuit City, and when they went out to sell DIVX to the "content providers", they let them know exactly what those weaknesses were. I don't fault them for not choosing DIVX, but I do fault them for putting any reliance on a known weak system.
Dog is my co-pilot.
or is that for software, not movies? regardless, i bet the company feels rather stupid right now eh
But then again somebody may torch the house, but would you leave the door unlocked for them to do it? Or have the door jammed shut with a chair? With gasoline sitting next to the door too? When you knew damn well there was an ex-convict who just got out after serving a sentence of 25 years for arson living down the street.
I know I'd have the deadbolt on the door. Would you?
"Everyone be cool or nobody gets to ride in the Bonneville"
For one thing, the industry can't afford to "try another format". For another, the computer software industry isn't losing ANY money -- try reading the sales figures instead of the SPA propaganda.
The oft lamented "potential" loss of sales can't be proven (otherwise the software companies would be able to get insurance for these losses). The industry groups whine on and on about the "billions" in "losses" while the industry shows greater profits every year -- including the years that CD-RW drives dropped to and below $300.
Heh... first the jukebox debacle, then they are implicated in leaving the gates unlocked and letting the unwashed hoards pillage the sacred city of DVD... not a good PR week for these guys.
Makes it seem like the folks over there aren't really on the ball.
Telling others about the weakness is not immoral. Maybe illegal with all those laws banning security cracking out there, but it is not immoral.
As for what this could be used for in a moral way, would be:
1) Allow viewing of DVD's on alternative OS's (i.e., FreeBSD).
2) Allow viewing of DVD's from different regions. If I want to buy (quite moral) a DVD from a different country, why should I not be allowed to play it in my DVD player or computer (both of which I purchased legally and morally)? Some movies may not even be available in the U.S.. Any moral reason I should not be able to view them?
immoral as any, but sad that the industry will now try another format.
I doubt the industry will try another format. Too many recalls would have to be done to fix the millions--I only know there were over a million players in December 1998--of players out there in the world.
You are onnly being naive. ANYONE with a TV output card can output the picture to his TV and record it on VHS and case closed. What your arew saying has no base. These people actually helped the industry by alerting them to the problem. As for reverse engineering all i have to say is: ANYTHING that can be ENGINEERED CAN ALSO BE REVERSE ENGINERED. Pretty simple concept.....
If I go out and pay $15-$20 for a DVD, and use this so I can actually watch it on my system, that's "immoral?"
If I watch this disk under an operating system other than Windows - that's "immoral?"
If I demonstrate, with examples, to the public how an encryption scheme is weak - that's "immoral?"
You have some interesting ideas about morality. If you're worried about moral decline, I think there are better issues on which to focus.
Certainly scratches are a big problem for optical media, but I think it's no less a problem than fragile tapes that have been wound/rewound several dozen times by the time your VCR gets them. And when DVDs are treated properly, the picture quality will be identical to the first viewing.
In a perfect world, we wouldn't have to put up with rental media at all. Simply get movies with digital quality on demand, watch once, and get on with our lives (probably with better cared-for DVD-type media for the movies we want to own).
I feel your rental pain, but think also that your DVD player was unaffected even by a crapped-out poorly cared-for disc. That's worth something too.
Ita erat quando hic adveni.
Because eventually sound must be audiable to the ears and moving pictures must be visible to the eyes. This is the weak point in any copy protection scheme. Must drive hollywood execs nuts! Nyaaaa!! Nee-ner-nee-ner-neeeeeeee-ner!! Muahahahahah!!!! Tee-hee!!!!
Thanks to these laws, no one in any foregn country can have any encryption too strong for the NSA to crack. I mean, as an example, these two guys, with their abilities were from Europe. We've stopped the encryption technology from leaving our shore, even if it has crippled busisness. What do you mean Eurpoe not between Texas and Oklahoma.....
Once one of the licensee keys was found, it was possible to perform a plaintext attack against all of the other licensee keys. If just one licensee key was broken, DVD encryption could still stand because new DVDs could remove that one licensee from their table. But since the encryption was so weak, all of the other licensee keys are exposed now too, and any change to the system would break every DVD player in existance. Let's hope the DVD consortium doesn't feel the need to go that far.
There is always debate about this sort of thing, but the consensus is that once the attacker has control of the entire system (running an app on a machine he controls or having the hard/software under his control) the system can no longer be considered secure, because you no longer control it. The attacker does and can throw all his resources at it. Step through every instruction and follow all the hw logic if he is determined enough. You can't protect against that. Period.
So what if the key has been cracked? Does anyone think it makes a blind bit of difference to commercial pirates whether the stream is encrypted or not? I mean, either way the disk copies and plays. What cracking the decryption really means is that the ludicrous regional encoding no longer stops a disc purchased in the US from playing in Europe.
This reminds me -- I've got to get a CD-R drive soon. I suppose you all know what I'm going to use it for. All I can say is, if the industry doesn't take steps to protect what's theirs (their intellectual property), they'll get exactly what they deserve.
This is so totally the wrong attitude. The studios will never be able to totally protect their IP with technology. Look at the cold war, or the last 10 years (at least) of software publishing, you can't beet technology with technology. As it becomes more and more obvious that it is impossible to long-term protect your IP, I think we are going to see a few shifts in the way society thinks.
Think of it like this: you leave your front door unlocked everyday while you're away at work, and one day, a thief breaks in and steals everything. Will your neighbours feel sorry for you? Should they?
I would sure hope they would feel sorry for me. I shouldn't have to lock my doors everyday to be safe, and in many places in the world I still don't.
don't let society change you for the worst, change society for the better.
-chris (gandalf@darkcorner.net)
I'm impressed. I haven't seen anyone use argument fallacies since I was in university some 3 years ago.
"they" don't use anything, "they" are just discs full of data. the question is, can players be exported from the US?
A good read.
Having a non-smoking section in a resturant is like having a non-shitting section in a movie theatre.
1. Yes, it seems to be some stupid LFSR scheme, and despite the supposed 40-bit strength, because of the way the encryption was used (encrypting the same disk key with different player keys) once a single player key was found there was a simple known-plaintext attack which only required 2^16 attempts per key to find all of the other player keys. Dumb, dumb, absolutely amazingly dumb.
2. Yes. A number of commercial disks were released unencrypted.
(snip)--: I believe the people who create the encryption and security methods should be held more accountable for weak security.
You are so right. Damn it annoys me that _I_ get blamed if I try to steal a car. Just what are those car manufacturers thinking by not putting in better car alarms? Its all their fault.
Tell me, what is so wrong about 'XORing bytes and considering that the ultimate security'? Better security wouldn't be needed if people wouldn't try to 'crack' software.
When somebody torches your house, ruins your family, gets you fired from your job and tosses you in a homeless shelter, and you _DONT_ press charges, simpy saying "Thank you for showing me how stupid I was for not having a security system that could keep you away from my house.", get back on here and let me know. Until then, just keep deluding yourself with the belief that hackers are heroes.
> You all who "pioneered" DVD by buying early DVD players can, ummm, park those puppies in the
> closet next to your Uncle's 8-Track player.
You don't get out much, do you? Or watch much television.
For if you did even a bit of either: you'd know that DVD has taken off phenomenally in recent
weeks. In fact: ever since DIVX died. I think it unlikely that even the studios would risk mucking
with it now.
Hell, even Circuit City and Disney are pushing DVD big-time recently. And they were two of DIVX's
biggest backers. They've already switched mid-stream once. You really think they can afford
to do so again?
Face it: DIVX is a short footnote in history. A *very* short footnote.
People should know that there was a security flaw, even if they only hear about it after it's been fixed. You could even say that it's *more* important to spread the word about a company's feeble security measures than it is to plug the hole because it decreases the chances that people will trust the company in the future and if this happens a lot, people shouldn't trust the comany. If reports about the hole only come out after it's fixed, then there aren't any sensational news items and there isn't any public outcry against and mockery of the company involved. This means that a compny that may well deserve to look bad avoids much of the fallout.
That is, you could say that if it hadn't been shown over and over again that laughable security practices never really hurt the company responsible even when they are exposed.
--
Fuck the system? Nah, you might catch something.
Amphigory's question is a good one!
...
There is a presumption in the post to which he responded that in fact CD-Rs have made a significant dent in software profits. I see two reasons that make me doubt they have, with the possible exception of MS operating systems.
1) Software makers make the big money by selling software to businesses, including universities. Businesses (esp. ones that are over 4 or 5 people big) can't afford piracy, long term. Does it go on? Sure, but CD-R only makes this process easier, it isn't the start of it. Businesses like support, and docs
2)People like documentation and accountability. That the accountability may be illusory for most users, the documentation is not. And it's considerably more inconvenient to make high-quality copies of documentation to accompany software. Folks will no doubt continue to exchange software, but the software industry will continue to sell boxed software for the advantages it offers. Note how well even boxed Linux distib.s sell! That's software which is free -- so someone could download it without even the risk / discomfort of illegality.
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5
What can you run off of DVD drives except for movies?
What are you talking about you can get the most valuable piece of software ever cobbled together on DVD -- The MSDN Library!
DVD piracy is a non-issue for several reasons...
1) DVD's are HUGE.
DVD-9 (single sided, dual layer) holds approximately 8GB of data. These are the most popular discs. Do you really thing that someone is going to download 4-8 GB of data to watch a movie? What about the storage cost on disks? Yeah, hard drives are getting cheaper but as far as I know you can't get a 8 gig drive for less than $20 (the cost of a DVD movie).
Some new movies are even coming on DVD-18 (dual sided, dual layered). That's up to 16 gigs!
2) You'd have to play them from your computer's hard drive. There is DVD-RAM available but as far as I know it cannot burn dual layers which most new DVDs need. Also, I doubt that DVD players can read DVD-RAM anyhow (only a select few can read CD-R/W).
3) DVD's are cheap. Hmmm. Lemme see. Should I go buy the real movie at Reel.com for $10-15 or should I waste my time downloading it from the net, storing it on my hard drive, and being limited to playing it on my computer? (forget taking it to a friends house to watch).
Not only are they cheap to buy, but the studios are making money hand over fist with these things. They are much cheaper to produce than VHS tapes, but do they pass the savings on to the consumers? Hell no.
The low cost of DVD's are making CD's look like the ripoff that they are. What would you rather have for $15? A 74 minute CD that is just audio, or a 90+ minute movie, with audio and video, and tons of special features?
I think that if DVD's were cheaper (say $14.99 retail) then everyone would buy more of them, and it would be completely insane to want to buy/download a pirated copy instead of the original. If I were the studios, I'd rather sell 100,000 DVDs at $14.99 a pop, than 30,000 at $24.99 a pop (the current retail for most DVDs).
All in all, I hate copy protection on everything. It always ends up inconveniencing the legitimate users. SCMS for digital audio sucks! Why oh why can't I make perfect digital copies of my MiniDiscs? It's my damn music on them! Thankfully there are SCMS defeaters.
Macrovision for video sucks! Why can't I make copies of my VHS tapes for personal use (like having one copy for the house and another for an RV [hypothetical, I don't have an RV]). When you buy any kind of media you are usually paying for the rights to view the tape for personal exhibition, not for the actual media that you purchase. Therefore you should be able to freely copy the media as you wish as long as you're the one viewing it and you retain ownership of your copies (don't sell them).
But I digress. The industry will never listen. They will keep on using copy protection, knowing full well that it WILL be circumvented eventually, and that it ends up inconveniencing the legitimate users the most.
*sigh*
Ben
Actually, I think they should have waited to release the program after low-cost means of copying the resulting file became available. A very likely outcome of this whole thing will be some kind of restrictions or something on DVD recorders (tech or price wise)...
Reason is the Path to God - Anon
There are a number of good encryption schemes out there and, in fact, CSS didn't have any problems with it. It was the fact that the coders left the key unencrypted that was the glaring hole. Don't blame the mathematicians for a coders mistake :)
-----------
"You can't shake the Devil's hand and say you're only kidding."
The film industry really should do an unbiased and intelligent analysis of the impact of emerging technologies on their product, if they want to actually protect their interests in a constructive and effective manner. Some points which should be considered.
- consumers have had the capability of recording and copying movies to their hearts' content since the advent of the VCR. Videophile and audiophiles may not be happy with the quality, but as far as the average consumer is concerned the quality is "close enough" to perfect. Despite this, movie makers have been selling and renting movies like hotcakes. Being able to copy DVDs will not change this at all
- commercial pirates, for whome the "infinite perfect copy" does make a difference, could already do this by using $5,000 DVD-Rs or buying their own DVD production equipment. One analog copy, reconverted to digital format, and they could produce an infinite supply of nearly perfect DVD copies for sale on the black market. This is a problem, but one which the cracking of the pathetically week css algorithm will not significantly affect.
- high-end consumers do not like having their technology "messed with." The destruction of DAT is an example of consumers refusing to buy into crippled technology. Likewise, DVD playback which is limited to Windows, or by region, is not only an invitation to hack, but worse, creates unnecessary bad relations between the seller and the consumer.
- finally, unlike the RIAA member companies, movie studios are not parasitical entities acting as a paid go-between between artists and their customers. They provide the capital, resources, and equipment for shooting films and play a very necessary role of the art form. Contrast this to the music industry, whose contribution to the art form, beyond providing a distribution channel they happen to enjoy a monopoly on, and perhaps a place to record and master (which any technically savvy musician can do in their own home), is negligable at best and quite often destructive. This suggests that the movie studios aren't nearly as vulnerable to artists switching to an internet medium and cutting them out of the loop as the RIAA member companies are, and have a lot less to fear from open internet standards and distribution channels than their record company counterparts.
Even with copyable DVDs the film industry has little to fear. The target they should be most worried about -- the professional "industrial strength" pirates -- is the group least affected by these developments. The fear that the grassroots mp3 warez phenominon will happen with DVDs is unwarrented, not only because of bandwidth and storage limitations, but also because of a difference in consumer habits, and a fundamental difference in the relationship of the affected artists and consumers with the movie studios vs. the music industry.
The Future of Human Evolution: Autonomy
10^12 / 1400kkey/sec / 60sec / 60min / 24 hr ~=8 days
Sony doesn't need Warner Bros. Sony makes films and players.
The technique that the CSS group used to keep the keys secret is they make the employees sign for
the keys personally (not the company) so in the event that 'sh*t' happens, the employee could be
held personally responsible...
I feel sorry for the programmer who signed his/her life over for the key that got broken since no
doubt, his/her life is probably about to become a living hell because of this "crack"... I imagine
it would have taken a pretty big bribe to convince someone to inflict this kind of self-punishment...
My $.02 worth...
Hackers are not criminals simply because they have the knowledge of how to infiltrate someones computer.
But the DVD makers CAN'T FIX their faulty protection scheme once a crack is revealed to the world. There are millions of DVD players already out there and future DVD discs MUST BE ABLE to play on ALL EXISTING DVD PLAYERS or you'll have consumer riots on you haves sufficient to lay waste to whole companies bottom line. The consumer video market isn't the PC merket. You can't just say "upgrade or don't run new stuff". That kind of shit won't fly with consumers.
But the way I see it, this won't be any bigger deal than VHS. I mean, people can copy tapes, no? But they don't because it's dumb, boring and essentially pointless. Now, if you could copy Playstation II games...
The film industry really should do an unbiased and intelligent analysis of the impact of emerging technologies on their product, if they want to actually protect their interests in a constructive and effective manner. Some points which should be considered.
- consumers have had the capability of recording and copying movies to their hearts' content since the advent of the VCR. Videophile and audiophiles may not be happy with the quality, but as far as the average consumer is concerned the quality is "close enough" to perfect. Despite this, movie makers have been selling and renting movies like hotcakes. Being able to copy DVDs will not change this at all
- commercial pirates, for whome the "infinite perfect copy" does make a difference, could already do this by using $5,000 DVD-Rs or buying their own DVD production equipment. One analog copy, reconverted to digital format, and they could produce an infinite supply of nearly perfect DVD copies for sale on the black market. This is a problem, but one which the cracking of the pathetically week css algorithm will not significantly affect.
- high-end consumers do not like having their technology "messed with." The destruction of DAT is an example of consumers refusing to buy into crippled technology. Likewise, DVD playback which is limited to Windows, or by region, is not only an invitation to hack, but worse, creates unnecessary bad relations between the seller and the consumer.
- finally, unlike the RIAA member companies, movie studios are not parasitical entities acting as a paid go-between between artists and their customers. They provide the capital, resources, and equipment for shooting films and play a very necessary role as part of the art form. Contrast this to the music industry, whose contribution to the art form, beyond providing a distribution channel they happen to enjoy a monopoly on, and perhaps a place to record and master (which any technically savvy musician can do in their own home), is negligable at best and quite often destructive. This suggests that the movie studios aren't nearly as vulnerable to artists switching to an internet medium and cutting them out of the loop as the RIAA member companies are, and have a lot less to fear from open internet standards and distribution channels than their record company counterparts.
Even with copyable DVDs the film industry has little to fear. The target they should be most worried about -- the professional "industrial strength" pirates -- is the group least affected by these developments. The fear that the grassroots mp3 warez phenominon will happen with DVDs is unwarrented, not only because of bandwidth and storage limitations, but also because of a difference in consumer habits, and a fundamental difference in the relationship of the affected artists and consumers with the movie studios vs. the music industry.
The Future of Human Evolution: Autonomy
Yes the technology to rip off DVD's wholesale will come. The way I see it, DVD's as far as customer acceptance goes, is still young. This leads me to believe that the industry will see abandoning the technology as a viable solution to DVD theft. I wouldn't be at all suprised if the number of movies that come out on DVDs slowly falls off and there is an introduction of a new replacement technology. Now is the time to do it, before DVD's become mainstream.
The fact always remains. If the computer can read the disc, the computer can copy the disk. If the file is encrypted, it can be decrypted with the key. If the key is stored permanently in the computer, then it can be extracted. if XingDVD *had* necrypted their decryption key, so what? Then the key for THAT encryption would have to be there.. sheesh..
Makes sense to me. Now there's a bit more of an incentive for DIVX, in the eyes of the distributors.
If Hollywood says "no more" to the DVD drive manufacturers, you can bet there will be, um... firmware updates made in formerly unprotected drives.
You all who "pioneered" DVD by buying early DVD players can, ummm, park those puppies in the closet next to your Uncle's 8-Track player.
Why?
As it's been well-explained above, the economic realities of the situation make consumer pirating in lieu of purchase unfeasible. Equally, it does little to aid commercial DVD pirates.
However, it opens access by a technologically savvy, notoriously stubborn group of people with a higher-than-normal percentage of disposable income (Us. The Linux community.) to their product.
Unfortunately, they will likely do something very reactionary and stupid, and will sell more DVDs regardless.
Don Negro
Don Negro
Perl 6 will give you the big knob. -- Larry Wall
Think of it like this: you leave your front door unlocked everyday while you're away at work, and one day, a thief breaks in and steals everything. Will your neighbours feel sorry for you? Should they?
So... why not tell me where you live then? It wouldn't be my fault for breaking in if, say, you were stupid enough to have windows in your house, would it? I mean, everyone knows that glass shatters incredibly easily, and therefore anyone with glass windows is just asking for it, right?
The industry followed what they thought was their best option. They used 40-bit crypto so as to not have to have a US edition and international edition. What would the point be to using 128 bit crypto when you can still pump the DVD's output into a video capture card? You don't get all the neato things (multiple aspect ratios, etc...) but the point is the movie has been copied.
And no matter what, no one is going to be able to market a DVD recorder with a key cracker in it, so the 40-bit crypto pretty much stop 95% of the copies that could be made otherwise.
You can also browse through the LiVid archives:
http://livid.on.openprojects.net/pipermail/livid-d ev
Don't worry, pretty soon they're be a new DVD format, with new keys, and probably a new cipher, put together by a new company. And they won't forget to encrypt the key this time.
Maybe that will be cracked too... who knows. But this really wasn't a matter of closed standards or obfuscation. It was encrypted using a private key mechanism. Even if you had the specs for the decryption routine (which the hackers had) you'd still need the key.
-----------
"You can't shake the Devil's hand and say you're only kidding."
My thoughts on this...
I. I don't understand how this scheme works?
(or was suposed to). If I have a DVD...I make
a binary copy of it...throw it on another DVD
(or if im on a real OS...connect it to a loopback
device)...what stops me from using this copy in
my DVD player...afterall...ALL of the data should
be identical.
Decrypting an exact duplicate of original data
should work just like the original.
II. There really is no way this could have been
secure. Copy protection can't work. It shouldn't be hard to do a copy by reading and capturing
directly from video memory. Then a nice un-encrypted copy.
III. I have to wonder what algorythm they used.
Was it something that could be easily attacked?
a simple capture from memory could get the
unencrypted movie...and lead to a known-plaintext
attack.
The simple problem is this...they want their
data to be safe...only "Authorized" (ie people
who paid for it) people see it. However, its
possible for those people to control the hardware
that does the encoding. (and the software to some
extent)
Basically...copying would happen one way or
another. Its not stoppable. encryption is really
good for transport of data from "end to end"
to and to keep out unauthorized people in between.
"I opened my eyes, and everything went dark again"
yeah.
i have a dvd player _and_ a laserdisc player.
You mean "guanara" as the caffeine-like substance in Ballz soda -- or do you mean "guano" as in poopee?
"In the future, the laboratories will be more actively conducting strict surveillance and take counter measures against illegal, inappropriate software and hardware in the market. Moreover, we believe that, based on the recent legislation, legal measures and steps will be taken by copyright holders against such violation of intellectual properties,"
'The laboratories' will be 'conducting strict surveilance?' So a private company thinks they can monitor _my_ computer. Pull that in America, corporate-boy, and I'll be able to retire for life off your salary, and spend your pension fund on hats.
An ounce of prevention is a pound of cure. Coming up with a 40-bit encryption method, and then billing it as 'unbreakable', isn't just stupid, it's deceptive. The engineers who came up with this scheme should be ridiculed, and the bosses whose instructions they followed should be fired.
This code would have been broken, even if a key wasn't 'accidentally' unencoded. The fact that decryption keys were being -guessed- at once a working key was found is proof of that. At least it was done by a relatively nonmalicious group, instead of someone who kept it a secret and made millions in pirate DVDs next year.
And why on earth were there 170(!?!?!?) working keys. That seems a remarkable oversight.
Dongle? naw. Just implant a chip on the disk itself, in the unused portion by the spindle (and a counterweight on the opposite side of the spindle). The chip contains the key, and is hard-coded per disk - the chip can use the same technology as these smartcards. A different disk won't have the same key. The additional production costs should be minimal.
I wish I had a nickel for every time someone said "Information wants to be free".
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
Okay, we're being asked to believe that the Xing encryption key was compromised because it was not stored encrypted. This is asinine. If they had stored the key encrypted, that means that the decryption key for that would be somewhere in the clear. This would only be simplistic obfuscation that should be easily subverted. -core
The Wired article states that the DVD copy protection was easily cracked because Xing had inadvertently neglected to encrypt its decryption key.
I may be completely mistaken about this (in which case, please don't hesitate to set me straight), but I just don't see why it's so important to encrypt the decryption key in the first place.
I mean, at some point during the DVD player software's execution, the decryption key is going to have to be decrypted anyway (so that it can be applied to the ciphertext). A hacker need only load the player into a debugger and trace it up to this critical point, and then simply capture the naked decryption key from memory as soon as it surfaces.
Thus, encrypting the decryption key serves as only a minor annoyance, making it only incrementally more difficult for a competent hacker to retrieve the key. Such "protection by obfuscation" is widely known to be one of the worst ways to "encrypt" or otherwise protect one's data.
In this light, how much more difficult would it have been to "hack" any of the other software DVD players out there, by simply debugging them and waiting for the player to decrypt (and expose) its own decryption key for all to see? I'd wager: not much more difficult at all.
begin 644
First off, you don't need player keys anymore. The alg is so weak that you can guess the tile keys as long as you have >64megs of ram for a massive table. This takes about 20sec on PIII450. Once you've done that you can generate all the other possible keys on the disk. I'm sitting on the output from an analysis of over 100 dvds. Amazingly, there are only 4 keys common to all of them, I think perhaps we have some misunderstanding of how CSS works.
Still, I think my point stands... The industry was certainly not hurt by everyone and their brother copying VHS cassettes. It's insane to say they're losing so much money because of piracy.
Did you ever hear of someone running an "illegally copied VHS ring"? I sure didn't. Yet up until now (as you point out), copying a VHS movie was standard.
And once you own it, you should damn well be able to copy it, sides.
"Knowledge = Power = Energy = Mass"
I haven't taken a look at the program, so this might be wrong, but... It isn't really covered the same as a tape deck, cd-burner, or VCR are. It's a piece of software that allows you to take data off of an encrypted DVD, breaking the copyright. It isn't needed for burning info to a DVD, recording to a tape, etc., it's only used for breaking the copyright. However, arn't people allowed to make cross-platform copies of movies, CDs, etc? I seem to remember something in US where it was deemed legal to make a copy of a CD on a tape, to listen to it in the car.
Yes, but when you're talking about counterfeiting in commercially significant quantities, the encryption scheme doesn't enter into it. All the encryption scheme accomplishes is to prevent people from turning the MPEG datastream into plaintext. But a high-volume counterfeiter doesn't duplicate at that level; they duplicate the raw bits coming off the read head.
The DVD player in your living room has no way of knowing whether the disc you're playing was legitimately stamped by the studio, or whether it's a precise bit-for-bit copy stamped in Malasia. So it's fairly easy to demonstrate the encryption scheme fails at its stated purpose.
So what's the encryption really there for?
Schwab
Editor, A1-AAA AmeriCaptions
Without the unlock key (which was the first step necessary to get around to breaking CSS) DVD-ROM drives will not deliver data from encrypted movies.
So at a minimum you still need to activate the unlock system in the DVD-ROM before you can make a disk-disk copy. But that came before the DeCSS showed up anyway.
-sw
Security through obscurity most certainly does work!
Did you know that the lock on the doors of your house and your car are pretty darn easy to break? Did you know that that info is "obscured" through the process of bonding locksmiths?
It works, too. That and a vigorous police force, neighbors who look out for each other, etc. It's called "a community" for those of you who don't venture out away from your keyboard-n-monitor very often.
Take your time to figure it out. You've got a few more years before you need to move out of that dorm room.
I want to play DVD movies that I buy. But I couldn't until CSS was broken. I think it is supremely obnoxious that I couldn't even buy a DVD player and DVD media and use it on my computer!
Why be so cocky when regarding your customers? Aren't you already making me watch commercials at the theatre and at the beginning of tapes/DVD that I actually pay for?
Disney only licenses the product. If the media fails, I still have the license, so they should replace the media, right? Some SW companies were very good about that, but I haven't tried lately.
having never taken a shit in the movies i wouldnt know
Actually, DVD writers are NOT expensive. I bought a Toshiba 2x DVD-RAM/DVD-R writer for under $500. That's pretty cheap, especially since I saved myself the purchase of a tape drive.
It only does 2.6/5.2 Gig, but with only 2x compression, you could get a 4.7gig movie on it.
One thing, though - blank DVD's are more expensive (in small quantities) than DVD movies. A blank DVD is about 25-35 dollars, whereas most movies are less than 25 dollars. So it's not really cost effective, at the moment, to copy DVD's. Now converting them to VCD format and putting them on an 87 cent blank CD would be feasible, with a slight loss in quality.
--- "So THAT's what an invisible barrier looks like!" - Time Bandits
Aye, I have a copy of DeCSS, even made a short clip of Pi into mpeg1 last night to check out the quality. Word of warning, it takes a LONG time to rip a movie, and at least on my dvd drive (I have a Creative Labs 5x drive) the dvd and drive were both rather hot after the ripping. Make sure you have a lot of hard drive space too ;)
As to where to get it? Look around on the net, I found it in about 5 minutes using good ol' search engines.
Demona's Law - "User data expands to exceed available bandwidth." ("User data" being pr0n, mp3's, vob's,
Of he wouldn't do it this way, putting that key unencrypted on the disc.
But secretly writing it down as a zipcode or a phonenumber in his Palmpilot, which will be read by Agent X in restaurant Y.
Etc. etc.
>movie industry really has nothing to worry about >from unauthorized copying.
What they do have to do is make a reasonble effort to protect their property. Its like not even having a lock on a door, no matter how weak the lock is. This would be effective in courts of law.
>Writable DVDs will only slightly change the playfield
Actually, one of the links in the article has a how-to on converting a DVD to a reduced quality VCD (which can be produced using Writeable CDRoms)
>the hardware companies haven't figured out that >they're in the driver's seat.
I think that software companies are more in control. What can you run off of DVD drives except for movies? Not too many programs/applications out there.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
hehe you missed one - "people will never need more than 640Kb of RAM"... now who said that....?
I think it was a little premature to have the CSS encryption cracked. The movie industries will likely be a lot more reluctant to release a movie on DVD. Just when I thought DVD was finally taking off, something like this happens and puts us two steps back. I have to wonder if Star Wars will ever be released on DVD now.
Umm...I usually go to those rooms called 'Bathrooms', but perhaps they build theatres differently up here in Canada :)
I pronounce my judgments thus:
:)
:)
1) Cracking DVD encryption key: Not Immoral. (c'mon folks, it's computer science, not crime)
2) Copying DVD movies for personal use, trading with friends, etc.: a Little Immoral (Immoral but still within my personal comfort zone.
3) Sale of pirated material for personal gain: Damnably Immoral!
Furthermore, the motion picture industry should not worry about me, nor others like me, because:
My home theater setup is better-sounding than my computer speakers. My television is larger than my computer monitor. My sofa is more comfortable than my office chair, and does not require mastery of yoga to fit me and my wife on. I enjoy the DVD format for it's sound quality and for the picture quality. I also always buy movies that I really like. I have tons of movies on VHS that I've copied, but i never watch them. The ones I watch most often are ones I've bought, because I can't afford a professional dubbing deck, and the quality of the recording is better on the store-bought ones. When a kick-ass new movie comes out, I want to see it on a huge screen in a movie theater. When something I REALLY want to see comes out, like The Matrix (huzzah!) or Episode I (Argh!), I ESPECAILLY want to see it in a theater FIRST. Besides, since I don't have numerous spare 9 GB drives lying around, and I don't have a T3 to my house, acquiring these pirated movies would be a pain in the ass. So I can pay $24.95 at retail for a movie I really like, and watch it on my home theater, or I can pay, what, 10 buck less for a pirated one, and watch it on my computer. Er, I think I'll take the $24.95, and the self-rightoeous moral superiority.
I think you're forgetting something. The timeframe. VCR tapes have been around for how long? 20 years? In that 20 years, the "size" of 1 gigabyte will chage tremendously.
I remember when I first downloaded Linux it was about a hundred megs and I was using a 2400 bps connection. I just let it run for 12+ hours.
How long before someone with a fast connection decides it's worth 12 hours to download the 6 gig Matrix DVD?
The cost of DVD writers is only a short term barrier too. Sure, they're expensive now, but do you really think that in 10 years, it will be expensive to get 10 Gig of removeable storage?
In less than 10 years, the hard drive my computer uses has undergone a 100 fold increase in size. The bandwith of my internet connection has undergone a nearly 1000 fold increase in size. But during that time my VCR hasn't changed, and DVDs were supposed to last that long too.
ARGH!!!
Sorry for the double post -- netscape crashed mid-submit. Still not sure why that would commit it twice, though -- once with a correction and once without...
The Future of Human Evolution: Autonomy
I didn't create DeCSS. I'm not distributing it to anyone. I only downloaded it and am using it for archival purposes only. All nice and legal according to above legal snippet.
What's more is that I downloaded the software from Norway where the "Digital Millennium Copyright Act" means what again?
DVDs are encrypted to both stop piracy, and to protect Hollywood's incremental release dates.
A film is usually released in its country of origin first. Some months later, other countries may see it. This is done to save on film printing costs. The DVD zone system--which forms a large component of DVD "encryption" is designed to ensure that a people in Australia don't order a US-imprinted DVD instead of viewing the film in theaters.
Of course, this system ends up shafting the foriegn film buff. Many Japanese films simply don't make it into the US market/zone, and thus are inaccessible to the most import savvy viewers. Of course, one could always buy a Japanese-encoded DVD player, but that's rather expensive.
One oddity with the zone system is that China forms its own zone. Of course, China is home to many a pirate, but this also allows the government of the PRC to essentially control film imports more effectively.
The whole incremental release system will be obsoleted by digital distribution systems, anyway. Bravo for the crackers!
Well, Bill Gates said "640K ought to be enough for anybody." That other quote, who knows who said that...
Avoid using quotes unless you are quoting.
Massive corporations want you to buy their stuff. They spend money on advertising. The cost of advertizing is included in the cost you pay for their product. When you buy a can of Coca-Cola, part of what you pay goes to Coke's advertising budget; Coke buys advertising on UPN; UPN makes another season of Voyager. So you don't get to ogle Seven Of Nine(TM)[1]'s tits for free[2], no no no; you pay for it with every can of Coke, every Gateway computer, every new Toyota, whatever you see advertised.
There's also the fact that you are paying by allowing these companies to attempt to influence your buying decisions, but that's a more subtle topic.
([1] Yes, "TM", according to the Star Trek website. Bleh.
[2] No disrespect intended to Jeri Ryan. Much disrespect intended to whoever decided her character should dress like that.)
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
FINALLY someone who understands. For the record i have a small sister(12 right now). I am 26. I own ALL (and i DO MEAN ALL) the Disney cartoons on VHS.I have been collecting them since i was 11 years old. And ya know what ? I started collecting the DVD's now. YES the movies i allready OWN i buy as DVD's. Why should i be restricted to copy my DVD on VHS ? Why should i not be able to buy a DVD movie in heathrow's (UK)duty free shop and not be able to play at home in .ca ? That is why copying will never stop and that is EXACTLY why as more "hard" protections come out more and more movies/software/music will be copied. People don't like to be controlled by the industrie's best interest. They always have THEIR best interest in mind. Not SONY's or DISNEY's or anyone else's. When you put too much restriction on someone that someone will naturally react.It's a simple fact of human nature and nature in overall. Newton's third law of physics if anyone is interested. The more pressure companies put on the consumers the more the consumers will react.
I support that. I come from an Asian country and we had just 2-5 BIG music cos that put out tapes. They also had lobbied the govt. to keep taxes high on blank tapes so it did not make sense to copy. Then along came a new music co and he undercut everybody with such "inexpensive" original tapes that it made no sense to copy them. e.g. original tape price 20 blank tape (after tax) price 18-20. guess what - he is a millionaire 200 times over and the other music cos HAD TO LOWER THEIR PRICES!!!!!!!
So can we have a DVD MOvie player for Linux which can use these hacked keys to decrypt the content?
No matter how cheap it is, it won't be cheaper than vhs tape. Are you trying to tell me that the 200gig harddrive you are describing is going to be cheaper than compatable 40 2-hour vedio tape (assume 1 movie=5 gig) that cost 40 bucks? And nobody pivates movie with vhs that's already out on video, you can only buy shaky-cam theatrical release.
I agree zero impact in U.S. Hong Kong movie industry is suffer a big deal aleady though. 50% of the time people by good advertisement campaign, or promotion. This is one thing pivate can never provide.
(btw, who can justify a 50-dollar Russ Meyer video, I'm going to buy the pirate from ebay. I don't care what you say.)
Nuke 'em from orbit. It's the only way to be sure.
:)
I think the reason they worry about the piracy issue with DVD over VCR is the quality of the copy versus the cost to make that copy. With VCRs you get generational defects, and even master copies ware out. Once you get your master copy of a DVD you can make perfect copies every time.
Now I really think the entertainment industry is run by lawyers who don't understand the issue here. If I'm a pirate, I'll just bit copy the media (DVD in this case), and press disks. If I don't have the keys I can then just copy the encrupted data and the copy protection. If I do have the keys I can change the content before copying, but pirates don't want that.
Before anyone works on digital IP rights issues they should be forced to read, and understand, the record player example in Godel Escher Bach. Then if they start claiming they have the ultimate meta record player we know for a fact they are idiots.
I have been converting a few of my DVD's to VCDs for the past 2 months.
I can only watch VCD's on my laptop. Home theater system is DVD/VHS. (DVD player plays VCDs also...)
Only problem is it takes 2 days to rip/convert a DVD to VCD. So I own the same movie on 3 formats, VHS,DVD and VCD...
If anyone is interested, check out http://www.dvdsoft.se for ripping/encoding/converting DVDs.
If you want to buy Original VCDS check out http://www.coolvcd.com - They have matrix on VCD!
The movie industry has made money off me......
But isn't DIVX at least as dependent on some kind of copy-protection scheme as DVD?
Yes it is, and IIRC there was a small device you could build/buy that would allow you to watch a DIVX movie without paying for it. Copy protection is a waste of time either way.
-chris (gandalf@darkcorner.net)
Your observation that "consumer piracy" is likely to be insignificant is very well noted.
The thing is, the commercially significant piracy that takes place under the DVD regime is likely to be, as it is now, a result of "mass piracy" on the part of folks in the "gray market."
Unfortunately, they will benefit from the cheapness of producing DVDs, and while it may become more expensive to become a "commercial DVD pirate" than it is to become a "commercial VHS pirate," that goes along with the benefits of:
If the big sellers of DVDs can maintain rigid control over the manufacturers of DVD mastering units, that might make it hard to "clone" DVDs from masters.
Unfortunately, that's liable to have the same flaws as DAT did. With DAT, there were special codes encoded into tape headers that would let the units forbid copying. That was part of why DAT never took off.
If you're not part of the solution, you're part of the precipitate.
Even if they'd have done that, that old, crackable system is still burned onto millions of discs, and they're all available at your friendly neighborhood content provider, the video store. That's a lot of Disney flicks to steal.
Second, your premise assumes that MoRE should be interested in helping the nice multi-national megaconglomerates [who presumably represent the people]. That doesn't strike me as realistic.
In fact, I'd tend to think that groups such as this exist to subvert the profit of companies they perceive as evil (not that anyone in this community would know anything about that, based on their dealings with the Open Source Software movement). I don't gather from the article that MoRE is setting up to become your one-stop shopping center for bootleg Meg Ryan flicks. They hacked DVD, probably (if I had to guess) mostly for it's own sake.
Turn the argument around for a second, like this: OK, I know the analogy breaks down somewhat, but the kernel is this: the same mindset from which MoRE came to hack DVD, probably prevents them from acting in the manner you described as correct.
_____
_____
The antidote to bad speech is not censorship, but more speech.
It's hard to protect -everything-, since something has to be visible to the hardware for it to be able to start decryption. The outer layer -must- be visible, even if it's in hardware. At which point, all you need do is read the outermost key, and you get to exactly the same point these guys did.
Anything the player can see, you can see. There's nothing magical about a machine, even when it's based on a Japanese design.
The question was never "whether" DVD encryption would be busted, but when. Actually, I'm amazed it took so long.
Sooner or later, manufacturers, movie industry bosses, etc, are going to have to come to the same conclusion computer software houses did years ago. Copy protection -doesn't work-! It's a fundamentally flawed concept. There was only one scheme that even came close to working, and that was confiscated by the MOD in England, and classified. Even then, it was probably fairly easy to break. The whole concept is fundamentally flawed.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Sure it's a one-time shot. No problem if all your movie studio makes is blockbusters...
"Hollywood is a victim, and Hong Kong's film industry, once dubbed Hollywood East, has been devastated by piracy. The industry will cut only about 80 movies this year, down from 200 a few years ago, according to Woody Tsung, chief executive of Hong Kong's Motion Picture Industry Association. "Many film projects were aborted because of piracy," says Tsung. "The technology is more and more affordable. The pirates are energetic entrepreneurs." "
Just go run a search on VCD's and Asia. The Asian CINEMA market has been devasted by VCD piracy. The movie going audience is down 40%.
Movies are bootlegged with a camcorder almost IMMEDIATELY on feature release, and many times, even before due to preview audiences. The VCD of the movie is in everyone's hands about a week later.
I don't know about you, but I want Hollywood to rake in enough money to make great movies like The Matrix, Titantic, Saving Private Ryan, Toy Story, etc.
And I want threaters to rake it in so they can continue building better multiplexes with better audio and video (like the near-future move to digital projection technology)
I love Hong Kong movies. Jet Li, Chow Yun Fat, et al, but very often, they have inferior sound, and inferior camera quality, and inferior film stock. Maybe the lack of profits in "Hollywood East" is the problem.
If DVD copying becomes wide-spread and entrenced, one of more things might happen:
1) Hollywood takes a big monetary hit and won't fund movies like Matrix 2 if they don't think they'll recoup in the Video release. (revenues = cinema release + foreign release + home video)
2) DVDs are produced with lower quality. No more directors cuts, behind-the-scenes, multilanguage, no letterbox versions, etc. Just slap the movie on the DVD and ship it like VHS.
3) the number of movies converted to DVD will fall.
However, this might not happen. Asia is different than the US. *Fortunately*, US culture has a more healthy respect for IP and copyright, and a government that enforces it. Western cultures are also better off economically and able to afford the "luxury" of going to the theatre vs staying at home and watching it on a TV.
The problem is, widespread distribution of home theater systems, DVD, Dolby Digital, etc in the future may lead to a more "stay at home" audience, and there, DVD piracy could have a huge impact.
Oh, no, they used a weak, 40-bit encryption scheme with 200 different keys lying around, and it bit them in the ass, you say? I'm sorry, but if out of 200 different companies there wasn't one who would say "Hey, look, this encryption system is as solid as swiss cheese!" before creating the standard, then they're responsible for what's coming to them.
It's as if someone discovered that every door lock and ignition lock on General Motors' cars could be disabled with a refrigerator magnet. Too bad for GM.
Simply speaking, copy protection schemes just don't work. If you allow access to the data to anyone for any reason, someone is going to find a crack for it. I don't care how good your copy protection scheme is.
There's one exception to this, and that's if the company goes out of business before anyone has the time or interest to hack their copy protection. i.e. DIVX.
The difference between useful encryption (like pgp,ssh,ssl, etc.) and DVD/copy protection type things is that you HAVE the private keys, you just have to look for them (inside your DVD player or software) Copy protection will always suffer from the problem that for the data to be useful, it has to be extracted into a viewer-friendly format, like a raw audio stream. Even if, say a new secure audio format was developed, you could just modify your soundcard driver to save the stream to a file while playing it (same for video, albeit more expensive). Then you could recompress the stream. Even DIVX would be doomed to fail if it didn't kill itself first. Remember ATT's Clipper phones? The LEAF (Law enforcement access field) could be forged by using the output of one phone with another (see Applied Cryptography)
>DVDs are cheaper to produce than video tapes.
:)
I've often wondered about this. It seems like it would be cheaper to produce a cd than a cassette tape for the same reasons, yet here we are 10 years or so into the cd revolution and cd's are still more expensive than tapes.
(And if I remember correctly tapes/records were normally pretty close to the same price)
Also reminds me of a speech I saw from a well known games developer. He was very excited about the proliferation of cdrom drives, as cd's were going to save his company a ton of money over shipping floppies. When someone asked if that meant his games would be cheaper, he just smiled from ear to ear...
It really amazes me how clueless the entire entertainment industry is. Consider the amount of time, money and effort that is going into creating these encryption schemes on digital media, and for what? As several people have already pointed out, you can't stop people from copying! If your media ever has to be 'unencrypted' for someone to view it, then that is the point where it can be duplicated, be it by 'catching' the data as it goes to your monitor and sound card or by using a video camera aimed at your monitor. It is painfully obvious that there is NOTHING and I mean NOTHING that can be done to stop copying of media. People aren't even going to be slowed down. How long is it going to take them to catch on to that? This seems so obvious to me, and yet entire industries are all fighting to do... do what? Make another easily bypassed copy protection scheme... in short, not a damned thing.
All wasted effort.
Sigs are awesome huh?
I was unaware that Bill Clinton and Al Gore were Republicans. Thanks for enlightening me.
Berlin-- http://www.berlin-consortium.org
DNA just wants to be free...
Personally, my income is hurt by closed source old world ways of distributing software and media. I work in computers doing custom development of software for corporations. The software I right is really only useful in a specific context for a company so piracy doesn't effect the work I do. However, having to pay for operating systems, database software and development tools does effect my bottom line in a big way.
I will admit to the fact that deciding as a society that intellectual property isn't something you can own will hurt a lot of companies who have built their empires on that assumption. But in the long run I believe we will be better off for it. In addition I think their are better ways for these companies to make money.
Rather than producing a CD and depending on the distribution of the music to make money, why not make money off concerts instead. Give away the music to hook people and then do major concert tours. Sell experiences that cannot be duplicated and pressed and mass distributed. Sell things that are unique once of a lifetime events.
I can get a DVD of a movie, but yet I still go and see it in the theatres. Why do I do this? Because it is a unique experience that I cannot reproduce in my home. Their is value in that experience. I have a nice home theater system, but it is never the same, so I shell out my money and see it on the big screen with big sound and a large crowd of people to share the experience with.
Really the whole intellectual property thing is, I think, a sign of inefficiency in the mechanisms of distribution more than it is a legitimate form of business. Books, CD's, Videotapes, DVD's, all have a certain cost in duplication and distribution which must be recovered. With the rise of the digital, and the ability to make infinite perfect copies it seems wholely ridiculous to charge me money for it.
Do I believe that copying a DVD is illegal, yes. Do I believe that it is immoral, no. I believe that to charge more than the cost of distribution for the DVD is immoral.
---
This sig has been temporarily disconnected or is no longer in service
The only time I've gotten copied articles was in an educational setting and I was definetely never solicitied to purchase copied articles. That's why the magazine industry wasn't/isn't hurt by Xerox.
Wrong! You do not have a 'right' to copy legally obtained content for your own use; you only have the opinion of the Courts that home copying is immune from prosecution.
It will speed up technological progress again, which has been stalled for the last some years, arguing about region codes.
DVD-R will be sold in millions, next year or in 2 years.
And who would have won then? East Asia again, not Hollywood. And why? Because you have too strong lawyers and too weak coders.
But wait. UP is in Sony's hands. What now?
Was this a trap, they fell in themselves?
If you want to talk about morality artists getting hurt, why don't you mention the different continent codes that DVD's/players have, courtesy of the DVD people. This little scheme is quite immoral. Basically, if you have a DVD you bought in Europe, it won't work on a DVD player in the U.S., and vice-versa. Or if you bought your player in Australia, you can't play DVD's you bought in china This is *damned* immoral because it bars people in one country from watching some great films produced in countries other than their own. Sure, a lot of films will get ported back and forth between continents, but not all of them, especially in the case of independant film. We see this phennomena with game consoles, where the playstation you bought in america might not run some awesome games you can only find in Japan. Same thing. This immoral practice hurts some very talented artists in other countries who have yet to be discovered. Hopefully the DVD crack will end this.
Give the current price of pre-recorded DVDs, the vast majority of people will find it much simpler to buy a legitimate copy of their DVDs, rather than try to obtain a pirate copy.
If the DVD makers decide to be dumb and raise the prices of their movies, well...
You forgot to critisize the acting -- Keanu Reaves really sucks. Although I agree with you on all other counts.
And yet, somehow, I still enjoyed the movie a lot. Go figure.
The mere fact that software-only DVD players could exist is sufficient to ensure that the scheme was crackable, 40-bits or 2048. Why? Because obviously the software player could decode the stream in order to play it. They key has to be either on the disc, or in the player; there's no way around that. A hardware-assisted solution could have at least hidden the keys in a chip somewhere, but a software one is all out in the open, requiring only patience before it falls.
The article says the codebreakers reversed the XingDVD player. It was easy because someone didn't encrypt their CSS code. I thought the article was unclear on who exactly it was, but on a second reading it appears that Xing themselves were the culprits. If so, this probably opens them up for a slew of lawsuits from the people who claimed this format was secure.
Anybody else think it's possible they did it on purpose? I mean, you don't screw up an industry standard that bad on _accident_. Could have been a disgruntled employee, maybe, I dunno.
Communication is only possible between equals
I'm sure the DVD Forum was well aware this weak as all hell pseudo-crypto was going to be broken in record time. Anyone who knows anything about cryptography knows the CSS system is a joke -- the only way it can be close to secure is by hiding it's simplicty behind an NDA.
:-(
There's nothing to suggest the forum cannot (will not) change the keys. After all, it's simply one sector of the disk. No PC DVD-ROM will care what's in that sector any more than any set-top box will. This will break every software player and every DVD decoder card that handles CSS directly. The set-top boxes are questionable...
As I understand it, CSS merely prevents access to the sectors of the DVD; it's not actually munging the data in that sector. If that's the case, then the DVD forum can fill that sector full of random garbage and break every PC DVD-ROM in the world while not bothering the set-top boxes that don't give a rats ass about CSS -- the decoder hardware is closely coupled to the read head. It wouldn't take long before manufacturers would be offering new firmware to remove CSS once and for all. That'd be _GREAT_, therefore, I must be wrong
Of course, for all I know, the DVD-ROM drive itself could be the one doing the scambling. All I know is that the drive is not supposed to give you access to the protected sector(s) without proper CSS handshaking and key exchange.
If someone had the ability to press a dvd that was a duplicate of another, wouldn't that dvd play just the same as the original?
It would be very bad for the DVD industry if the Film makers stop producing DVD's. At the moment it is not such a problem as you can not feasibly copy a dvd movie across the internet, as it is about 4gb.
DVD's are so much better than any video could ever be that the film industry has got to keep producing them. besides they are probably cheaper to produce than videos, as it is a relatiuvely simple pressing process.
I am not an expert on this tech., and I have been half reading/half skimming all of this today, but if I understand it correctly, the encrypted key on the DVD's was for authentication purposes, not for providing a way to decrypt the the DVD.
The guys from M.o.R.E., that made DeCSS are totally immature and irresponsible. Cracking the DVD encryption is not neccesarily the bad thing, the bad thing is that they made this program and distributed it. That ruins DVD for everyone. Now the movie industry is going to have to retaliate and put some alternate protection on DVD's which could even possibly require all of us to purchase new DVD players or something of the sort.
M.o.R.E. should have quietly reported the problem to the Xing and whatever the main company that handles DVD technology is and helped them solve it, not just totally fuck them over, as well as the rest of us.
DVD technology is a really great deal: you get digital quality video and audio and a bunch of extra scenes on one small CD-sized disc, all for about the cost of the movie on video. Why ruin a good thing? I must say that it was also stupid and irresponsible for Xing to not encrypt the key, but two wrongs do not make a right.
Shame on MoRE.
SuPz.orG
2) It killed the CDA pretty well dead in its tracks.
2.5) I'd like to see it pass, and then everyone can go out, buy a steak at the supermarket and then go to the police and confess to possession of the drug.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
DVD's and CD's you buy today will most likely NOT work 50 years from now, this is because the aluminum will loose the encoded pits after a few years. I remember reading that the max lifespan on a cd was around 9 years, though it may have improved. I also remember reading that some company (or more) was developing archival quality cd media, that would not degenerate over time.
Just a few interesting bits for all us info hungry slashdotters =]
AC
If your computer can use the key to decrypt the stream in software, you can watch it decrypt its own code in Softice or something similar, and get the key. The encyrpted code just made things more difficult. Without some kind of tamper-proof hardware there is NO WAY to do 100% secure digital media distribution.
Everyone NEEDS to be able to backup. Unless they are going to give me new copies for my scratched or broken ones.
If you do decide to join western culture again you may want to consider spending a bit of time with the Matrix....it is worth it.
Your logic fails for the same reason DIVX failed.
A movie studio is going to make the money if it comes out with a movie that plays on all players.
In order to make DVD2 to work, they need buy in from the current DVD market.
In order to get buy in, they need technical advantages over the old standard.
Real technical advance most likely means a 20-100 gig disk and more resolution.
That technology is 3 years away.
In the meantime, everything goes to DVD.
40 bits is fairly breakable, and since key transmission is a critical problem in building crypto systems, and DVD systems often represent embedded systems, they have a few keys vulnerable to brute-force attacks.
There is no question but that DVD encryption would be quite vulnerable to brute force attacks.
It appears that the result of this "exploit" is that the decryption keys for all DVDs have been exposed as a result of them being accidentally published.
This is the sort of thing that organizations like the NSA reportedly are acutely sensitive to when they are trying to crack systems.
In order to keep such systems secure, it is absolutely necessary to be extremely careful with how critical data like encryption keys are dealt with. Apparently these keys were released to people upon whom it was not carefully enough impressed that they needed to be "billions-of-dollars-riding-on-this" worth of careful.
Oops.
If you're not part of the solution, you're part of the precipitate.
Everyone wants something for nothing. Some people are consumed by the desire.
I thought the point of cracking DVD was so we (Linux users) could watch DVD.
An interesting point to note is the fact that when you make a copy of a VHS tape, you lose a certain amount of quality on each copy. So if you have a "fifth-generation" copy of a movie on VHS then there will be a noticeable loss in quality. On the other hand, with DVD there is no loss of quality whatsoever even for a "hundredth-generation" copy since it is all digital. Thus a copy will be exactly the same as the original.
:wq
First you get the encrypted DVD. Put it in your computer and play it. Get a scan converter and record it to VHS. Play it back and record it to an MPEG, VCD, DVD or whatever. This will work with anything CD's, Encrypted/Copyrighted/watermarked music, anything that can be transilated into an analog signal and back again. You will lose some quality, but, to save a few bucks it might be worth it.
In this sense no matter how strong the encryption is, it can always we worked around. If you record it to a DAT (music) or another high quality Video recorder you woln't lose much quality and you don't even have to crack a encryption scheme.
If software was only this easy to pirate.
Disclaimer: I don't suggest you do any of the things stated above and I'm not responsible for anything that might happen to you beacuse of your use of said ideas.
That's my $(2^4*3+1/7%3*2/100)
--Justin Mitchell
"2nd Place is a fancy word for losing" --Bender (Futurama)
Forcing the millions of DVD player owners to upgrade would be mass suicide by electronics makers and the movie industry. Remember what a horrific and spectacular failure DIVX was? So since all future DVDs must play on existing players, they will now and forever remain copyable by us evil consumers.
Without getting too deeply into the idealism of the subject, they really should have expected this.
:)
Simply speaking, copy protection schemes just don't work. If you allow access to the data to anyone for any reason, someone is going to find a crack for it. I don't care how good your copy protection scheme is. I don't care what kind of information you're trying to protect, or what kind of media it's on, be it CD, DVD, casette, diskette, whatever. Information wants to be free.
They've tried so many tricks and schemes over the years. Remember the "What is the second word on page 153 of the manual" ones? Or what about software that would only let you install it twice.
I still use numbers like 123-1234-1234567 for Micros~1 product keys even when I have the legit numbers. Always good for a chuckle.
The way they accomplished the crack was hilarious 'though. RealNetworks (or whatever subsidiary that was) must be pretty embarassed right now... forgot to encrypt their decryption key. Morons
Anthony
^X^X
Segmentation fault (core dumped)
"I think any time you expose vulnerabilities it's a good thing." -Attorney General Janet Reno
I expect it works like this: The files on the dvd are encrpted. The key to this encryption is then encrypted 500 different ways (ie: 500 differnet keys) These 500 keys are the keys from which keys are assigned to various players. So.. Xing is given one of these keys. So.. any player has to a) Using it's unlock key, it decrypts the decryptoin key for the actual file. This way, the keys for each individual DVD can be totally differnet, while the players can keep their keys.
The problem is that engineers need to learn how to do good 5.1 mixing. The mixes are designed to for the user to face the center speaker, it's not as non-directional as stereo configurations. Speaker position is programmed into surround sound set-ups to make it seem like the sound is coming from one direction.
There are a few great music tracks on movie dvds. Turn off the TV, and you've got great sound.
The talking heads Stop making sense has two great 5.1 mixes. One puts you in the front row, and the second is the "soundboard" mix, and what I would expect to be on a dvd audio disk. The music surrounds you.
The Aretha franklin scene is blues brothers is another great mix. The background singers are in the surround speakers.
And you can see how the mixes get better as an engineer gets more experience by listening to Fleetwood Mac The Dance DVD. The surrond speakers come alive in the last few songs.
First the privacy snafu, now this. The question, though, is who will get the blame for this.. Xing for failure to encrypt, or Real for not catching it? Who gets their ass tossed out the front door?
*snicker*
So, what to do now? Firmware updates? SuperMassive recall? (unlikely) An excuse to change the spec/format? At the least, all codes will^H^H^Hshould be strengthened, changed, etc.. I guess the overall question is...
How will the average consumer get bent over in this one?
-fester
Windows NT encountered the following error: The operation completed successfully.
-'fester
Yep, you've "got" it alright. But with attitudes like yours, not a lot more will be stored on media you can keep indefinitely.
Perhaps. But my "attitude" is the norm among consumers. License, schmicense. When the average buyer comes home with a movie, they know they don't have the right to duplicate it and sell copies but they own the copy they bought. Tell them "you can't use what you just bought because we changed our minds", and they'll laugh at you. Try to enforce it, and people will ignore you. Make media that doesn't let them ignore you, and it'll sell as well as DIVX.
Sure, that's what "color correctors" are for.
The article raises an interesting point: there could definitely be a move to restrict DVD-R technology in the US following this chain of events. It seems an absolute outrage to me that the potential of DVD-R could go unrealized, at least in the short term.
CD-R is great, but a more and more packages are too big to fit on a single disc. DVD's offer a convenient way around this. There's nothing wrong with the technology--don't punish it and the people who want to use it for legal purposes.
Of course, it wouldn't be the first time the recording industry imposed its will on the American public. As I recall, they almost killed DAT. In fact, it never did catch on much for home use.
-bbqBrain
One of the reasons that I became a lawyer was to avoid ever having to hire one. -SPYvSPY
I agree with you for the most part. The only problem I have is your example. Distributed.net is using a different method to break RC5-64 than what the CSS hackers used. They didn't attempt to brute force attack CSS, instead they found a kind of security hole in Xing/Real Network's security
If somebody found a glaring security hole in RC5-64, it too would be brought down.
- Most disks have their video data encrypted with a random 40-bit key (called a "title key"?). Each disk has a different title key.
- 409 copies of the title key are made, each encrypted with a different manufacturer's key (also 40 bits each). Those encrypted keys are written to the disk.
- A given manufacturer, when they get their DVD license, gets one of those 40-bit manufacturer's keys and a note that says "use key number 12".
- The player looks at the disk, extracts the 12th of those 409 encrypted keys, uses its manufacturer key to decrypt it, giving it the title key. That title key is used to decrypt the video material. It ends up with the same title key as any other player would have gotten on that same disk.
- The manufacturer key would be held in ROM or encrypted in a software player of some sort. To discourage manufacturers from doing that badly, the following threat is put in the license agreement: If someone figures out your manufacturer key, you pay us a lot of money, and in addition we stop including your key in the 409 used on new disks. Now all the newest movies won't play on your player, and you go out of business.
So it's like the usual hybrid PGP scheme with multiple recipients (where a per-message random symmetric key is public-key-encrypted to each of the recipients), except CSS uses symmetric encryption everywhere, and the disks are usually encrypted to the same 409 recipients all of the time, and only a few dozen of the recipient keys are actually known by real users (players), the rest being kept in a vault for new licensees.The problem was that the encryption was really poor. There are two attacks:
- For any given disk, brute force the title key. I think this would take a day or two per movie. Then assemble a web database of some sort where you could look up the title keys for your disk.
- Once you've figured out the title key for a given movie (say, by discovering one of the manufacturer keys, doesn't matter which), look at those other 408 encrypted keys. For each one, brute-force the related manufacturer key. (because of massive flaws in the crypto, this takes about a tenth of a second for each one). Now you have 409 manufacturer keys. You don't care which one is which. Publish them all.
The latter has happened. Hundreds of keys are now public knowledge. Many of them are probably in use by big-name manufacturers (you now have the key of every player that could have played that disk, which is all of the current ones and most of the future ones). And it is practically impossible to change the keys in a useful way. They would have to drop all of the keys in use by the current players from new titles, making them unplayable on current hardware. If even one key remained from the set that are now known, the same attack could be made to get all of the new ones.Note that if they had planned for this, they could conceivably have put several keys into each player, and the response to having all of the current keys published would be to switch everything to Set 2 (instead of using FooCo's first manufacturing key on the disk, they use FooCo's second key). The current players that had multiple keys would still play new movies, but the published keys would not work. However, learning any one of the new keys (perhaps from a poorly protected software player that had multiple keys too) would allow the whole attack all over again. And brute-forcing a title key would allow the whole attack over again. The net result is that CSS is completely and utterly dead.
There is an extra layer on top of this, the authentication phase, which I don't know much about. From what I can tell it seems to be designed to keep someone from snooping the bus traffic and reading the decrypted video from there. The DVD drive will refuse to read certain sectors from the disk (the encrypted keys) until you've negotiated something with the drive. There may be more to it than that, but the technical issues have been solved for quite a while.. the necessary ioctls are already in the linux kernel.
And, as noted by others, this is independent of the copyright issues on DVD movies. CSS was a scheme to restrict use of the video data, and had the effect of preventing the development of open-source players on Linux and other platforms. Now they can be written (and mostly have been, although doing both audio and video at once is beyond the capacity of most processors).
-Brian
The real problem comes from both sides of the aisle.
I'm quite sure the encryption opponents are quite relieved that anyone who might otherwise oppose them is too busy blaming whatever group he or she is not a part of, be it the Democrats or the Republicans, the Liberals or the Conservatives.
Berlin-- http://www.berlin-consortium.org
DNA just wants to be free...
I don't know about the film industry, but I certainly expected this. I was making bets on it with some friends. When I heard there will be software implementations I gave the DVD format 6 months before it's reverse-engineered. I lost... it took a little longer.
----
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
When I first heard of DVD encryption, I jokingly made bets on how many days it would take someone to crack it. I guessed 10 days. So I was a bit off, but "I told you so." I wonder when these people will realize that all copy-protection schemes can be cracked. What they have to do is provide more than just the movie in thier "official" versions. They should learn some lesson's from Rob Young's famous Linux - Ketchup speech. :)
The big market for home movies is in rentals. However, my friends and I once rented Tron from Blockbuster to watch on a new DVD player. Something like seven of the twelve acts were garbled beyond viewing ability. The Tron videotape's only problem was that the bastard who rented it prior to us didn't rewind it. The first problem ended up with a wasted evening plan. The latter ended up with merely a waste of ten minutes' rewinding time.
--
I noticed
--
I noticed
It's getting about time to leave everywhere
So why are stores that sell VHS tapes still in business? Yes, people like to rent before they buy. Yes, they like being able to get things they only want to watch once cheaply. But if they find something they want to watch repeatedly they go buy it, and in numbers large enough to keep the video department at Media Play, and stores like Sun Coast, open.
Why are you afraid of "free everything"? Free everything is the best thing that could happen to the world. Is free food for hungry people evil? How do you feel about ATM fees? I suggest you click on The Hunger Site and try giving something for free. Then come back and tell us how much it affected your morgtage or car loan or whatever.
The problem is, most DVD's have been macrovisioned. They mess up the video signal so that there's "minimal" loss in quality, but it wreaks havoc with the AGC of a VCR. VHS tapes are being macrovisioned now, too. 13th Floor, for example.
I went there and all this stuff is for windoze. Any source floating around? Or LINUX support?
I dont know where you are buying your harddrives but you are getting ripped off. I just bought a few 27 gig harddrives for 135 shipped.
There is no such thing as tamper proof hardware.
(See various discussions on the net about smart cards and the like)
Whats the story with this? I saw some DVD writers at Frys last night..is that for data only? Whats the magic cookie to differentiate to the player between data & video?
What gets me is that no matter how hard they try encryption just gets blown away. I still find it rather tiring to keep reading this stuff. The guys coming up with this encryption stuff are either lawyers or marketing drones, so of course it does not stand up for very long!
3 9489139584959 7980465063
Of course once it gets cracked then it becomes "hey! they cheated! they are illegal underground punks! they worship the devil!" and a host of other things - just look at what the Brittish recording industry put out recently - after all anyone who listens to MP3s are nothing but a bunch of pot smoking pedophiles, right?
To me breaking encryption is just the geek way of thumbing our noses at idiots. Here's to more beautiful hacks!
94141592651829395028512312356878594818483935819
8012456989047663620151201231566801865112556408748
The honest customer gets the VERY REAL and TANGIBLE benefit of not having to worry about Feds busting down his door and confiscating his computer, and locking him away.
The pirate may convince himself it's not going to happen. But there's always that possibility.
When you pirate, you get the software.
When you purchase, you get legitimacy. (personally, I think that MS probably hides GUIDs with your VC++ license # in the binaries it compiles, so virus writers can be tracked down, just like MS Word (UP) encodes GUIDs in Word documents).
I wish I had a nickel for every time someone said "Information wants to be free".
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
If, as you say in your post, "DIVX was *evil*," why did you work on it? Why did you help to create something you knew no one would want, and which you yourself didn't want to have?
I'm not trying to be hostile. It's just that I learned my lesson on issues like this a long time ago, and I've made it clear to myself (and my employers) that I will not work on projects with which I personally disagree. Perhaps I'm in a better position than most (and I also don't put myself in the way of such projects), but I've never fully understood why someone would spend their precious creative energy on something they personally felt was pointless, wrong, or ethically bankrupt.
This is just me talking,
Schwab
Editor, A1-AAA AmeriCaptions
So now that some folks have figured out how to
STEAL DvD data, what next? Much like the huge
cd-r explosion will dvd-r's hurt the MPIA as
much as cd-rs have cut into the software industries profits?
Do any of you out there even CARE? Or like I
figure, none of you understand how you get
paid (many of you are students ANYWAY!) and
how lost profits affect you.
da fly'
immoral as any, but sad that the industry
will now try another format.
I love good ads, and if having to put up with them means that the next hike in ticket prices gets delayed another year or so, who am I to complain?
As a pioneer in the industry to develop DVD-ROM, I can tell you first hand that DVD is dead. The only clients for it have been people with video (movies) to transfer. Even the most non-technical feel that all video will be available over the net soon, so why bother buying DVD's and DVD players? Internet II, digital TV and a host of other high speed connections will render putting the video on a disk silly, except maybe for storage.
|>"Computer FX will never get better than Tron"
|>"Apple is dead."
|>"The world market for computers is 5"
|>"DAT will replace tapes and CDs"
|
|I'm with you on the last three, but come on....
|
| Tron rules!
Yeah! Especially because of those nifty costumes!!!
--
Dildo Spandex - Maintainer of the Sensuously Spandex-Clad Men Website
http://dispan.tripod.com/
If they did limit the keys to 40 bits because of export restrictions, maybe this will convince businesses to help fight those restrictions.
They stand to lose a lot of money not being able to secure dvd's. And when there is money behind something, you can bet they will act.
This sig is false.
The GEB example is a good one. With, one slight flaw though. However, instead of the Tortoise being the one to outwit the Crab it is the store that sells the record players to the Crab. =) If they keep changing the medium, we are going to keep getting screwed royally to buy new players.
Personally, I hope that the record companies understood that there was a 99.999999% chance that the encryption was going to broken. I bet they have some fail-safe plans. I believe some people have mentioned as such before that they still have some tricks up their sleeves.
But, to see the encryption fail soooooo stupidly, it has to hurt DVD's chances on the whole. Didn't Xing THINK that someone would reverse engineer their buggy software? Hell, maybe that was their idea (one little programmer not encrypting the code brings down DVD - hahaha).
Later,
Justin
Mu. P.S. The address you see is real. =)
This is true for the most part, however more and more films are being made as independant productions & only distributed by the major studios.
This is a trend I expect to continue. With the increasing costs of movie production it shifts the risk from a single entity which can be bankrupted by a bad film onto a smallar company which can take bigger risks.
There is no such thing as tamper proof hardware.
He didn't say there was.
I was re-reading the Digital Millennium Copyright Act of 1998, which was made law a year ago (october 1998). One of its provisions is that defeating copy protection (unless you're a specifically exempt institution or can demonstrate a valid need to make backups) will be illegal two years to the day after the passage of the act, which makes it effective in october 2000. any comments on this, preferably from someone who understands the legal ramifications of this?
Now converting [DVDs] to VCD format and putting them on an 87 cent blank CD would be feasible, with a slight loss in quality.
"Slight" loss in quality? Ha ha ha, don't make me laugh.
Really cheap DVD copies are only a couple of years away. Save your $0.87 for then.
Um... sort of off topic, but bandwidth related and to the downloading of DVDs. While you demonstrate your patience, assuming it takes between 6 and 10 (we'll assume 6) minutes to download 100k at 2400 speeds (in my experience, it DOES, also calculated assuming 2.4 kilobits/sec, or 300 *bytes* per second), that means it takes about 100 hours (one megabyte per hour) to complete a one megabyte download of your 100 megabyte linux distribution. I'm not patient enough to wait 100 hours for a DVD movie to download, so your comparison is a bit off, methinks. ;)
You'll eat it and you'll like it.
Maybe this will give Hollywood types a more realistic perspective so productions like Hackers and that MTV portrayal are more accurate in the future.
They needed a clue and got one they will definitely listen to this time.
Someone on the livid-dev mailing list pointed out that he told the author this but he said he had already decided his slant on the story and wouldn't change it. Alax Cox then responded that that was sadly typical of Wired "reporters".
This is going to give the studios an excuse to roll out DIVX 2.
don't they use guano as one of their
ingridients?
Grunt. Oink, oink.
If it was going to, nobody would be producing audio or data CDs. We have had CD-R drives for what, 6 years now?3 9489139584959 7980465063
94141592651829395028512312356878594818483935819
8012456989047663620151201231566801865112556408748
OK, so there are lots of keys on the disc, and the player has one key. If the player's key is not on the disc, it can't play it, right?
Does this mean that if you buy a new player, it may be unable to play old DVDs?
"Information" doesn't want to be anything... it's greedy malcontents that want something for nothing.
I find it very surprising that the DVD encryption only used a 40-bit scheme. The problem is that anyone with a decently fast DESKTOP computer (e.g., Pentium III 550 MHz or Athlon 500 MHz minimum) could break the 40-bit scheme pretty quickly.
I think what will happen is that the DVD standards people will probably modify the encryption scheme to 128 bits, and believe me, to break 128-bit encryption you'll need hardware that is WAY, WAY beyond the expense of 99% of computer users nowadays. We're talking a multi-million dollar supercomputer or a HUGE Beowulf cluster (maybe over 600 machines in the cluster, and we're talking ones using the Alpha CPU) just to even consider breaking 128-bit encryption.
I won't be surprised that the modification of CSS to 128-bit encryption happens in the next year or so.
Raymond in Mountain View, CA
no sympathy from me
Resistance is futile, you shall be duplicated.
But not all the companies who make DVD players are american.
As a fact, very few.
So this wouldn't have been much of a problem...
/.Mattsson - My native language is not English, so please don't whine over linguistic errors. (That's lame anyway...)
It will be interesting to see what the industry can do to fix "lost" activation keys. And that probably depends on if all discovered keys are in software or hardware players...
Contrast this to the music industry, whose contribution to the art form, beyond providing a distribution channel they happen to enjoy a monopoly on, and perhaps a place to record and master (which any technically savvy musician can do in their own home), is negligable at best and quite often destructive.
I'm against the stranglehold that the Big Five have on media distribution, but I don't think that your statement holds water. It takes quite a bit of equipment just to make decent-sounding stereo recordings at home from a linear or non-linear multitrack system. Most of the big studios are not owned by record companies anyways. Don't even try to tell me that an album with the production quality of Dream Theater's Scenes From a Memory could be made in even 1% of home studios.
---- Politics: Kissing ass and pointing blames.
The dvd licensing requires that the software companies encrypt the CSS code on disk and only decrypt it in memory, the general idea being that you can't just run a disassembler on the object file, instead you must run the program and then trap/trace it when it does CSS - which makes it a little harder, but not much.
I think the hackers figured that they'd have to trace the program execution, and were surprised that they could just disassemble the code without running it, so it turned out to be easier than they thought it would be.
A moderator probably hasn't seen it yet...the default for Anonymous posts is Score=0, so it hasn't been moderated up or down yet. It is a pretty good comment, so hopefully a moderator will come along and boost it's score.
Its their own fault
Essentially, the two European hackers who developed the DeCSS utility that copies a DVD movie disc were able to break the code because one of the product's licensees inadvertently neglected to encrypt the decryption key.
Thats kind of funny...
Good old Wired -- they invariably wring every storey for the most emotional value they can, even when they have to downplay an obvious truth to do so.
If the four-hundred-some messages on this board are any indication so far, the overwhelming reaction to this isn't "Great, now I can pirate DVDs", it's "Great! Linux drivers!" Which, of course, means MORE dvd sales, not less.
I don't typically believe in cosmic justice, but a little part of me is glad to see Real in the hotseat after this week's Real Jukebox Trojan Horse debacle.
Yes. But consumer DVD readers (including DVD-ROM drives) will not deliver data without first receiving the requisite decryption key via the established protocol. If you have a DVD-ROM drive, you can verify this by trying to copy one of the large (1GB) .VOB files to your hard disk; you'll get an error message as soon as you hit encrypted data within the file, since you haven't obtained "authorized" access to the data.
So the protection ("lock") is indeed done in hardware; the key to this lock, however, exists in software, which of course is the weak link in the chain.
When the DVD standard was being developed, I don't know if they failed to foresee that DVD decoders would eventually be implemented in software, or if they did foresee it, and simply accepted the eventual "cracking" of the protection as an inevitable reality. If I were they, I would have fought against allowing software DVD decoders to be produced at all -- at least it would have further delayed the inevitable.
begin 644
What a load of crap. We need open source players? Why, on God's Green Earth, do we need open source players? I don't think the movie industry should get all these pet laws they push for, but they do have the right to charge for their product and to make it difficult to copy their property. I have no problem with DVD encryption being broken, just means someone was lazy or stupid in creating it and they're paying the price. Probably this won't be a big problem for them - but maybe next time they'll plan a little more carefully.
I don't understand.
Is it illegal to export encrypted data from the US?
I thought it only touched algorithms and encryption software.
Otherwise everyone in the US who's communicating with someone outside the US with a non-US encryption or the scanned PGP are breaking the law!
Otherwise there's no problem since very few dvd-players are manufactured in USA.
Most of them come from asia...
/.Mattsson - My native language is not English, so please don't whine over linguistic errors. (That's lame anyway...)
Nope. The mass market consumer public is slow to adopt new formats and even slower to abandon them for new formats. This is why we have 10 yr old VCRs and 30 yr old TVs still in operation. In the home audio/video market, people won't accept having to upgrade every few years like in the PC world.
It's funny you've mentioned it. I've recently visited the seminar on xDSL technologies, and one of the topics was VDSL (very high speed DSL) suitable for movie distribution. Since distance limitations are rather serious, the idea is to put the aggregation point (sort of DSLAM) somewhere into the basement of a large appartment building, or appartment complex, or campus types of environment, and from there distribute the material over the existing phone wires. It is being implemented on vary large scale in Hong-Kong
... Eventually DVD will be superceeded by HDVD but this won't happen for at least 2-3 years, may be more.
(and I forgot where else)
Yet I do not believe DVD is dead. Some people like network-based distribution, some like to have a small collection, or rent, it all depends
Grunt. Oink, oink.
I believe cBS broadcast all of their prime time shows in HDTV now.
You're also talking about HD-DVD
http://www.geocities.com/jblackbu/decss.zip
a;dgkljnsd;ag
"the motion picture industry is reeled" Who else noticed it? Come on!
You mix up terms.
There is no such thing as 'breaking the copyright'.
Either you are in violation of Copyright law, or you aren't.
THe Movie itself has the protection of copyright law.
Realize, copyright law does not deal specifically with exactly what a 'copy' is, but what those copies are used for.
Fair use is acceptable in most jurisdictions.
So. Me copying segments of my DVD videos into one big collage for my own enjoyment is most CERTAINLY allowed.
Me copying them to give/sell to people who don't want to buy the real thing, that would constitute illegal distribution of copyrighted works.
Thanks!
Wow, really sucks to be Real right now. After the escapade (what, 2 days ago?) with their realplayer sending out personal info, now they seriously fsck up in not encrypting their DVD player...
Does anyone else here smell lawsuits?
::sniff sniff::
Bonz..
"A crust of bread is better than nothing. Nothing is better than love. Therefore, by the transitive property, a crust
So few consumers can afford DVD right now they'll lose nothing by burying the cracked format and starting over.
Where the hell do you live? Ethiopia?
Good DVD players can be had for about $250 which is no more than any other piece of mass market consumer electronics. Factor in that it plays CDs too and now you don't have to drop another $100 on a CD player. Joe Sixpack working for minimum wage at Wal-Mart can afford a DVD player for gods sake!
Movies are about $15 online and about $20 at retail stores. That's no more than the cost of a CD (but I guess few consumers can afford CDs either huh?).
Then again, maybe you're just disillusioned and still use cassette tapes and VHS!
I will admit to knowing not much about "DVD-2" but I don't really care. DVD as we now know it is here to stay. Millions of standalone players have been sold (several million) and nearly every new PC has a DVD-ROM drive. There's no reason to chuck it in favor of a new format. With current DVD there is a disc version called DVD-18 that is dual sided and dual layered. You can fit over 6 hours of film on one disc! For instance the first DVD-18, released recently, is Stephen King's The Stand all on one disc! How is that not good enough?
I really don't see what needs to be improved in DVD. Anyway, it really doesn't matter because so many players have been sold, so many movies pressed, that there's no way a rival format could take hold at this point, imho.
Ben
The circulation through the Internet of the illegal and inappropriate software is against the stream of copyright protection
- ---------------------
Is this true? I thought that it was not illegal to have software that was capable of breaking copy-protection, but merely that using it to pirate copyrighted materials was illegal. This is dubious logic because you can pirate recordings with a tape deck and you can record movies from pay-per-view to your VCR, but that doesn't make those machines illegal. WTF? Anyone know the legal precedence?
------------------------------------
Anyone else?
Perhaps the issue isn't whether or not DVD copy protection can be cracked at all, but whether or not it's easy for MOST people to do it...
I'd say that if it were that easy to crack CSS, then perhaps it was meant to be no more effective than Macrovision... a stumbling block too big for those not interested enough in overcoming it. While it's pretty obvious that both it's now easier to crack DVDs and it's still unfeasible to copy them in massive numbers, what's not really thought of here is whether or not such a development will dictate the future effectiveness of the copy protections on DVDs.
The development of MP3+CDR is an entirely different story, as digital audio was an entrenched standard that was already effective for the music industry. On the other hand, DVD is still rather new and it's rather easy to predict that in five years it WILL be feasible to pass around cracked movies on the Net for many people. Just how many people are willing to do that is another issue entirely.
I suppose that fixed storage, recordable media, and available bandwidth will all be large enough in a few years to allow DVDs to be copied easily. Still, it will take a lot of one person's time to do extensive trading, and the availability of that kind of equipment to the general public will be limited. The interesting facts and issues of the situation are:
1. People who buy DVDs usually have all the other nice little gadgets too. Hence the current target market for DVDs will probably be enabled best to trade them illegally.
2. DVD is a premium high-quality format for an extremely popular medium, which means that unlike CDs (which would be more of a standard format) trading DVDs would be preferrable to any other kind of bootlegging.
3. The movie studios do have the option of pulling DVDs and sticking with VHS... for most releases. Or, perhaps a greater control and limited availablity on DVDs would prevent DVDs from becoming a mass-consumer product, hence eliminating the possiblity of mass-pirating.
4. On the contrary, the movie studios can make a huge push of DVD into the consumer market so that it does become a mass-consumer product, not only strengthening their margins above those of the already mass-pirated, more expensive, and lower-quality VHS, but also to eliminate the possiblity that a large part of the DVD market would pirate them. Add more to the market that won't be copying them and you minimize the copying problem. CDs currently enjoy this position, as there are many people who copy them but there's a massive amount of people who can't, don't, and won't, therefore making the CD-copying problem negligible on the bottom line.
5. Finally, the industry has time to combat the problem with a variety of solutions before copying becomes feasible. They don't have to pull off any drastic moves right now, which means that if DVD business is brisk I doubt they'll be scaling back on it anytime soon. They may switch formats (a DVD2), they might try to keep DVD-RWs and all similar DVD writable formats from becoming widespread, or they might ignore the problem altogether. It's not like what happened to the music industry, where one day the tools became available and people started ripping/encoding/copying CDs like crazy as the industry helplessly watched.
Right now, however, it's just a big embarassment for the movie industry and a new opportunity for the elite piraters. If I had the opportunity to advise the movie industry how to handle the situation, I would probably suggest that right now they should take a "good faith" position and trust the current market to not do what they pretty much could have done anyway. In the future, I'd suggest that perhaps they take either one of two paths: They start planning a format change RIGHT now for a rollout in 10 years and make the new DVD-Video format a self-standing component with closed specifications rather than a multi-component open standard, as this would prevent anyone from easily pirating movies (in other words, a DVD drive is like a standalone DVD player and you just overlay it, which shouldn't be too much to ask in 10 years) or getting any undesirable use out of the video. Or, they make DVDs an entrenched standard and a mass-market industry with even a bigger push than they are today, with the understanding that they hold the advantage of being the honest, legal, simple, and not-too-expensive solution for DVD purchasing. In other words, who cares about pirating when you're going to make gadzillions of dollars selling legit DVDs and, for most people, that's the best or only option now and for a long time. It's like if you own a candy store and little kids keep eating the candy... you can put the candy on a higher shelf, or you can put a small basket of free candy by the door. You DON'T stop selling candy (or only sell stale candy)...
Encryption is dead, will always be dead, and will always fail. Why? For the simple reason that a vast number of common hackers grok what goes into encryption technology, and no special corporate giant is going to be able to keep anything secret that is - simply put - built into the nature of things.
On the other hand, if governments and corporations want to protect information from ordinary citizens they have only to dumb down the educational system, and kill (or indoctrinate) everyone with an IQ over 130. Maybe it's just a matter of time before this occurs. Maybe it already is happening.
Vive la revolution!
--------
Yeah, I'm a Mac programmer. You got a problem with that?
-- thinkyhead software and media
CDs are bad enough -- esp. from bad mass-production houses. My win95 CD, in absolute pristine condition, has been difficult to read from day one due to the low quality, high speed method of production (I think they were a little low on silver that day :-))
Given this and the density of information on a DVD, I wish they would be securely encased. 3.5" floppies are better protected than DVDs. (I've always been a strong backer of CD caddies. It's unfortunate that high speed drives _have_ to be tray loaded due to balance concerns -- would you trust a caddy loaded CD spinning at 9000 RPM?)
I'd love it if DVDs were encased like MO disks. They are basically a CD in a secured housing that has a caddy-like door on both sides so they fit alot like a tray loaded CD. There is a recessed latch to keep the "door" from opening by accident. This may be how the DVD-RAM carts are done, but I've never seen one nor does the movie industry use such things (they'd much rather you buy a new 30$ DVD.)
Next year DVD-2 will come out with a 1024 bit encription incompatible with existing DVD players. So few consumers can afford DVD right now they'll lose nothing by burying the cracked format and starting over. It's not good enough for college geniouses to crack stuff other people have developed. In order to solve these intellectual property wars, college geniouses have to start developing the stuff themselves.
I wouldn't be surprised if the lousy, five byte encryption on these things came down to making them US Export-Legal.... Even with the "new, improved" fast-track licencing, I believe each individual export has to be at least notified, and the paperwork overhead of tracking each batch of DVD players to the end user would have been astronomical. ;+)
And there, you thought the US government's export ban had no positive aspects
--
-=DaveHowe=-
The whole idea that someone can "encrypt" something that is supposed to be seen by user/consumer and have "secret" programs/keys/whatever running on equipment controlled by user that can "decrypt" it and show the result, is entirely based on the assumption that user is incapable of reverse-engineering running program, or at least effort necessary outweights the benefit. While one can argue that it can work for some games (and yet I don't think, it stopped anyone), it definitely not so for movies on DVD, especially considering regions and other "features" that users perceive as sabotage. Even the most perfectly "protected" program can be reverse-engineered if user can run it in some controlled environment, so in the case ov DVD encryption this model simply couldn't work -- once something is out, it's out, and to prevent someone from reproducing a process one shouldn't perform that process when someone is watching in the first place.
Contrary to the popular belief, there indeed is no God.
If there's any liability, I would think it would be simply due to a breach of contract, and no more. How can MPIA ever show that this will result in damages? The damages may even be negative since this will almost certainly result in increased DVD sales. :-)
I'm not saying Xing/Real won't lose money -- they might chicken out and settle out of court. Or maybe there's a contractual provision that spells out a monetary penalty for disclosing keys.
But let's get realistic: there simply are no damages, and if this ever got into a court then MPIA's case would be pretty iffy.
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Cool.
You've listed all three reasons to buy into surround sound.
Except everything I listen to sounds fine with two speakers.
If I had five ears, having five speakers would make more sense, possibly.
But I'm specifically curious if the same keys are used from title to title, or does each title have its own key?
And can the standard be "upgraded?" To a 128-bit key, for instance?
I can see the fnords!
We are in a good position now.
The Movie intustry would loose a tremendous amount of money if they did not sell DVD's.
I don't care to copy DVD's myself.
I want a open copyable specification because:
- We need open source players.
- I want to be able to copy my movies to the next medium.(Think back to a time of copy protected disk games that you could'nt copy to your hard drive and run)
>"Apple is dead."
>"The world market for computers is 5"
>"DAT will replace tapes and CDs"
I'm with you on the last three, but come on....
Tron rules!
The last movie I rented was Battlestar Galactica, and no, I'm not kidding.
I call this a victory against obfuscation and closed standards.
I hope the keys - and all the relevant details - were widely published, and I hope this means we'll have Linux software that reads DVD's soon.
As a matter of fact, XORing bits with a one-time pad _is_ the ultimate security. Completely unbreakable, as long as you have a completely random one-time pad, and as long as you only use each one-time pad once. Just thought I'd bring that to your attention.
Both the music industry and the movie industry charge more for the shiny silver platter because they can. Customers feel that they are getting a better product than the one that comes on magnetic tape. The cost of duplication has no impact on thes pricing decisions.
yeah, that's a one-time shot... then they can press as many as they want for a dollar a piece. Did you ever notice that VHS tapes when they first come out cost about 100 bucks, and after a few months drop down to reasonable prices? This is because of the time required to make a vhs tape. As someone already posted, it takes about 45 minutes. Take that against about 30 seconds to make a dvd.... hmm, looks like DVD is a little more efficient.
I was talking to a friend who works for one of the big Japanese electronic firms. He said that it has been possible to produce digital camcorders with durable disks (not tapes) for years now. The recording quality is supposedly not be as good as DVD, but it is still far superior to the quality of the VHS-C and Hi-8 tapes. Also, the disks are far more durable (supposedly, they can last for decades without degradation, like those shown in the movie "Rising Sun".)
However, they won't produce them because they don't want to piss off the big Hollywood studios. Also, they won't make digital camcorders with digital outputs; once you record stuff, it comes out as analog. All because the studios are scared that the camcorder will become a medium of distribution for pirated movies.
Consider what this means. If I videotape my daughter, there is no way that recording will be around when she is 50. And not because we don't have the technology to make it happen.
Would you not say that due to the DVD crack that now Hollywood would be more weary of producing a DVD movie? But on the other hand VHS copying is was a big deal back in the 80's and continues today to be a big deal. I really do not think that it makes a difference what medium Hollywood uses it is going to be decrypted and copied and ultimately sold or served off of a server somewhere. The encryption just bought some time and money for the industry.
The entire concept of what is good, evil, right and wrong is merely this: an action or situation that either benefits or harms an individual or institution; and respectively is considered right or wrong. Society attempts to gain objective leverage by making a large group of cattle-er-humans believe in a subjective perception of right and wrong relative to what is beneficial to society and what is not. As far as I'm concerned, if one steals from the DVD industry, there are two perceptions involved. One of the DVD industry's, who ia being harmed by the action, and thus considers it wrong; and the person who steals the information, who benefits by not having to pay for it, and considers it right. There is but one imaginary difference between the two perceptions that many believe: merely because society backs the DVD industry in its belief that this action is immoral, it is. Come now, how foolish.
I can tell you first hand that DVD is dead
Right.
"Computer FX will never get better than Tron"
"Apple is dead."
"The world market for computers is 5"
"DAT will replace tapes and CDs"
OK enough of the "X is dead" predictions.
Anyone making such grand statements, especially in the computer field, has obviously not read any history.
I am not particularly impressed by Video on Demand demos.
I will always prefer to own the atoms of the movies I love, same with records.
I like having liner notes, cover art, etc.
All those bits have to be stored somewhere and I'd rather have the option of getting at them anywherem anytime I damn well like, and not have anyone else know about it.
Look what happened to DIVX!
Buy once, listen/watch many is my motto.
ppoe
Pope
It doesn't mean much now, it's built for the future.
First off as a former software hacker (only cracked software protection schemes, never other people's computers), it's clear that the decryption routine is the weakest link and there's absolutly no way around it as long as it's being decrypted on hardware they don't control. Even if their encryption was totally uncrackable, which it's certainly not, DVD protection is futile since any half-decent hacker can just intercept the data going to their monitor/sound card...and any idiot can just aim a camcorder at their computer screen and make a medicre but quite viewable analog copy.
Secondly, consumers should have the *same rights* with DVDs as they do with other media such as *copying for personal use*, *playability anywhere* (no regional restrictions), and *no tracking*; DIVX was an obvious example, but there's a push for more subtle schemes of tracking individual DVD consumers.
I bet within a few years, the movie industry in particular will give up their futile fight and realize that copying is a good thing just like has been for movies on video; and anyways there's no way to stop copying so why bother...just undercut the pirates and use more creative marketing...I mean Disney's marketing of the same movies in different packaging, etc is brilliant and shows that it's even possible to sell people the same movies they already OWN!!
Anyone who has legally purchased a DVD is perfectly entitled to make a backup copy against the possiblity of the original being damaged.
Get this through your head: EVERY advance in recording technology has vastly increased the revenues of the music and motion-picture industries, and despite this fact, those boneheads still fight tooth and nail against *every* new home-recording technology.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Again, big business has failed to grasp the ingenuity and resourcefulness of the hacker community. Good work, fellas! :) And even better, well done for publishing your work this early. Less scrupulous people would have kept this to themselves, and have a car boot sale industry in pirate DVD's booming by now.
Why does big business seem to think copy protection is the magic bullet? Whatever can be engineered, can be reengineered. Even if they'd not a) hardcoded keys onto the media and b) not used a kitten weak security model, what on earth prompted the designers to think that people wouldn't try and break it, just for the sheer hell of it? Even if they'd used massive keys, I'd bet a pound to a penny there'd be an underground "CrackDVD@Home" distributed project running somewhere... And they're bound to get lucky sometime or other.
And why should it impinge on recordable DVD's? Existing video media are a doddle to rip off (not that I am advocating this). In 10 years time, yes, DVD's will be the defacto standard in western countries for video data. But protecting your copyright for this media must either be uncrackable (_very_ hard in this scenario, without considerable overhead for the user - imagine having to plug in a different dongle per disc, type in a security key, or whatever before being able to watch the film...), or the video industry must lobby international support for piracy crackdowns to be more thorough.
Just expecting technology to be the easy answer in this instance is foolish at best, and dangerous at worst. Until the price of the products the industry is hawking drops, and the penalty for illegal copies is made severe, piracy will still continue. But industry is too short sighted to see this, and will continue overcharging whilst whining about the pirate industry it is fuelling.
Strong data typing is for those with weak minds.
I got a chuckle out of the article when they called them "anonymous developers" (to make them sound more dangerous and shady??) and then proceeded to quote one Jon Johansen, the founder of MoRE :)
Dana
So maybe now that it's Hollywood getting caught on the short end of the stick, we'll start seeing laws being re-written in a way not so favorable to manufacturers of crappy software.
On the other hand, this fight's a little like they used to say about the Iran-Iraq war: Whay can't both sides lose?
-cwk.
DVD protection schemes hurt sales of player hardware because there are loads of hardheaded idiot consumers out there with lots of disposable income like me who'll refuse to buy any player that doesn't play everything. (I live in R1 and import R2 DVDs so my player must at least play R1 and R2 discs or I won't buy.) I bought a Pioneer 505 and not an RCA. Why? Because I could modify the Pioneer to be multi-region but could not modify the RCA. Electronics makers KNOW this and want their players sell rather than the competitors. The ONLY reason electronics makers put region coding, crypto, and macrovision into DVD hardware was so that the Hollywood movie industry would support the format. It was as simple as "No protection and we'll release no movies on your new format". So electronics makers cane up with a rudimentary "protection" scheme to appease Hollywood execs into supporting the format. Some, like Disney, wanted more restrictions (DIVX), but suffered the effects of horrific customer backlash. Anyway, the DVD format is now entrenched and too far accepted by the public for Hollywood to reneg now and abandon DVD. Now CSS encryption cracks are mysteriously leaked. Electronics makers can now sell more hardware and not have sales hindered by protection schemes. DVD-R burners and discs will get cheaper now (In 1991, 1X CDR burners were close to $10K with blank [63-min] CDRs at $20 each!]) and this whole protection scheme will become as laughable as what is now called the "bozo bit" in the Mac filesystem. (History lesson! The 'bozo bit' was once called the 'no copy' flag and was supposed to be respected by copy programs and not copy files with the bit set. Everything under the sun ignored it, including all of apple's own OS and tools, hence it's nickname of 'bozo bit')
..because of the high encryption they use? I mean, the distributed.net team's focus was partially to show that we needed to up the limits on export regulations. People are obviously going to find some way around any 'weak' encryption method out there. The industry will push for more complicated encryption until it's so complex that they can't export it.
If the movie industry can't export their movies, we're gonna have an even bigger force pushing for less-strict export laws on encryption. Or am I missing something here?
"Please don't sigh like that, maam"
I. Key is stored in what is called the "lead-in" area of the disk. Special HW in the DVD drive
extracts this key and uses it. If you duplicate all the data sectors, you don't get the lead in
area which means you don't get the key...
Without getting too technical, a disk track is just a sequence of 1's and 0's... The lead-in
part of a track is usually just a special sequence of bits that says "hey the first bit is here!"
The key for a disk is interleaved into this bit pattern is a way to not harm the synchronization
properties, but be invisible in normal operation. (BTW, DVD+-RW have fixed lead-in areas so you
can't just write a special lead-in at home)
So you can't just copy the disk, you actually have to "crack" the DVD to copy it (i.e. figure out the
key, descramble it, fiddle with bits in the header to say the sector is now unscrambled, write out
the whole thing unscramble and record it into the a blank DVD which is now unscrambled...)
II. The data is uncompressed when it's in video memory... Copying from video memory is a pain
because the data rate is too high there. If you re-compress the data it looks crappy (worse than
VHS)...
III. The algorithms was pretty simple because it had to put only a minimal load on the CPU and
chip manufactures don't like putting lots of circuits on the chip to do silly decryption.
The compressed bitstream was encrypted so by the time it got out to the frame buffer it was
uncompressed. Figuring out the original bitstream from the video is -very- hard so known-plaintext
attack is hard (it usually only exists compressed in the processor registers for a short time before
it was decoded).
As with most things, the decryption wasn't broken, but a side channel was discovered (via the disassembler)...
It wasn't impossible to break this scheme (obviously), but they weren't that stupid since
it seems that they could have fooled you...;-)
Interestingly, one of the big sells that DIVX had with the content industry was that DVD encryption was crap and would be easily broken. This was dismissed as FUD in some corners, but was enough to get a few studios to commit to DIVX over DVD early on.
DIVX hasn't been turned off yet - it would be interesting to see if a modified version is brought back to life. It's the only starting point they've got right now.
(Of course, they would have to sort out the pricing, quality, and retail channels issues that killed DIVX in the first place.)
--
Business. Numbers. Money. People. Computer World.
Don't even try to tell me that an album with the production quality of Dream Theater's Scenes From a Memory could be made in even 1% of home studios.
;-p
Well never having heard it I can't address the issue.
Could you post the MP3 somewhere. I'll listen to it and let you know
---CONFLICT!!---
Don't you think the CSS group kept the list of who got what key? All they have to do is download
DeCSS.cpp and they know who's key was broke and that programmer is sunk...
etc. etc.
Does anyone have the link to DeCSS? In all seriousness, I want to copy Matrix to my HD to see if I can run it any better from the HD than from the dvd.
Returned Peace Corps IT Volunteer
Most quality TVs on the market have macrovision stablizers. My 13 year old Sony TV (it's actually a monitor with a TV decoder in it) has a macrovision stablizer in it -- and I have the full schematics for that TV :-) [FWIW, that TV also has a video signal stablizer in it that effectively puts the sync signals -- in fact, the entire VBI -- back in... who needs a cable descrambler :-) And no, it's not designed to be a descrambler, Sony just put some damned good hardware in there.]
:-))
:-) I used to work on TVs and VCRs back before they became single-chip, disposable toys.
Macrovision does not mess with the active video portions of the signal. It sticks a "super white" high-frequency spike in the vertical blanking interval (VBI) to mess up the automatic gain control (AGC) circuitry intended to correct the white level -- exactly what voltage is "white" and "black" -- for broadcast signals that can (and usually do) have slight changes in the peak-to-peak waveform. Basically, the AGC is there to prevent the picture from fading in and out when you're watching it.
TV's have very slow "averaging AGC's" simply because it doesn't have to react rapidly to what is usually very slight voltage changes. And since the TV is only displaying the image and the designers know the retenative properties of the phosphor and the average human eye, it doesn't make sense to have rapid changes in the AGC. A dip in signal would be smoothed by the glow of the phosphor and the image retention of your eyes. Like wise, boosting the signal for a transient spike would not be good -- it would take a noticable fraction of a second for the image to return to normal.
VCRs are a totally different problem. They have rapidly adjusting AGCs because they have to. They're job is to record the video signal to a magnetic tape. The tape heads can only handle a specific range of voltage for the video signal. Too much could bleed into the other tracks and end up erasing the tape instead of recording or actually generate too much voltage and damage the VCR during playback. Too little would end up not recording any signal at all. The VCR needs every frame that it's recording to tape to have the exact same peak-to-peak white level or it would run the risk of recording too little video signal to be able to play back a fully synchronized video signal.
Alot of VCRs will have no trouble at all playing back a macrovision signal recorded onto the tape, but even ignoring the AGC, most VCRs cannot record a signal with that voltage level -- the circuitry cannot recover fast enough from such a high voltage, high frequency spike. I used to have such a VCR... the rotary transformers would get slightly messed up and and not record a clean signal for the rest of the VBI and sometimes on into the active (displayed) video portion. (I may not have recorded anything I could playback, but it did a better job deguesing the heads than the tool designed to do that
Disclaimer: Macrovision is not new and I'm not a child
That's B A W L S...
It's an interesting drink. I have one setting here on my desk.
DeCSS certainly works great, but those DVD files are huge! Someone need to come up with a new compression codec for those monsters. (Like MP3 to a CD) Then, it might be feasable to rip a DVD. Until then, I dont see the point of ripping a DVD to your hard drive, although I do agree that as consumers, we should all have the option of copying the data, whether it be video or audio, because of ever-changing formats. (I sure wish there was a way to copy all my old VHS videos to DVD!)
Well, you know that the ubiquitous "they" have been working on a new dvd that will support HDTV (1920 x 1080) resolution. I think that this is a good thing, since new releases will likely be released in the newer format rather that sticking with dvd resolution (whatever it currently is). HDTV broadcasts are still quite a bit away, so I won't be buying one anytime soon for broadcast reception... but if I can watch all my favorite movies that way, then I will certainly consider buying one. I don't see any reason why hdtv manufacturers won't be jumping on this like a whore on a congressman.
"simplistic obfuscation" can be _very_ powerful if exercised properly.
Please take a look at any Netrek client source code. "Blessed" binaries use a 128bit RSAREF public key system to verify the client as authentic (as opposed to a hacked up "borg" client that tends to play itself.) The key and relevant code is broken up into a minimum of 15 files (I think the max is 40) and then the binary is linked in random order so the key processing is scattered all over the rather huge binary.
Despite the "small" key size and the relative ease of recovering the secret key by factoring, I've never heard of anyone recovering one of the keys for a blessed binary. And if they did, I'm sure it was not by disassembling the binary.
*spends half an hour trying to get to a page on Robert Fripp's website, curses* ;) :)
Well anyway- Fripp put it better than I will, funnier, but he made his website badly enough that it's impossible to deal with. So I'll just paraphrase.
The record companies impose a number of historical charges in the form of percentages on the cost of the albums. So if the artist is getting 5% royalty on sales, that is 5% after a 20% wastage charge, j.random other charge, and (I am NOT making this up) a charge on typical breakage of the SHELLAC the music is recorded on. I am NOT making this up.
"But CDs are not made out of shellac!". As Fripp said in his lost article, "Now you're getting clever."
Basically, we're looking at corporate pork barrel, bigtime. The artists, perhaps even the movie studios do not get _that_ much money out of these huge industries. It's the corporations taking more and more. Of course they are not passing savings on to the consumer. That would be capitalism and a desire to compete on the basis of price. Of course they are not passing vastly increased earnings on to the artists. Why should they when they can charge a percentage of CD sales to broken _shellac_ and deny it to the artist? Of course they are earning exponentially more than they were. Where do you think they get the money to bribe the government and attempt to get antipiracy legislation passed?
The industry does not DESERVE protection. Whether it's the music industry (slamdunk of an argument to anyone who knows anything about how bad it is) or the film industry (Blair Witch Project, anyone? All you 3DSMax artists ever wondered exactly why you can't just make a movie and start trying to sell it?), it is so corrupt it's disgusting, and needs to be put down for its own good. It's not capitalism. The barriers for entry are too high, and they aren't all legal barriers (remember 'payola' of the 1950s?) These days there are ever more interesting ways to do that. It's out of control, and the consumer is powerless to stop it.
The only sensible attack is the judo-like approach that has so often worked in the computer industry- it's time to start proliferating record companies and _film_ companies, all indy, all guerrilla businesses with low overhead and depending on the fact that, what with the big industries being the way they are, it'd actually be _more_ profitable for artists to go with an indie- even with the albums/DVDfilms/whatever being sold at fscking _bookstores_ (did you know that independent bookstores are also being choked to death by heavy corporate shifts to online selling and the constant mergers and consolidations into ever-larger corporations?).
I think that's the way the future is heading. Could result in the mainstream being very glossy, very trivial, and very empty- with not many customers left to cheat. All that's required is that the actual media (CDs, DVDs) can be produced by indies in formats that work with the hardware generated for the consumers. That's all that's necessary. You don't need to _lead_ the curve, only be on it somewhere.
Anyway, my two cents
You may be right that many parts of the Digital Millenium Copyright Act are unconstitutional. I wonder tho, what part of it is? Publishing information about how to copy a DVD would be protected as free speech (1st amendment). Modifying a player in your own home should not be subject to federal juristiction so that ought to be legal, although they could probably ban selling of modded players under the interstate commerce clause and have it stand up in court. hmm... Any comments from lawyer-type people?
First of all, it's a 40bit encryption. That's too less anyway.
So, every licensee gets a unique encryption key. Instead of cracking (or in this case, _reading_) the encrypion key, why not offer some employee at Real (or any licensee) some money (or free pizza, whatever the person falls for) and get the key.
If this whole DVD system is based on the fact that licensees should keep their keys secure, this encryption is bound to fall, either through bribe or the employee in question just gives the key to a couple of his closest friends, which give it to... well, you get the point.
My two E0,02 (two eurocents)
The movie industry is completely naive if they thought they had a system which was impervious to being copied. I'm too young to remember, but I can only assume the same thing happened with VHS when that was finally able to be copied/written at home. It was only a matter of time, effort, and curiousity.
-- From my Best Friend (Written to me over ICQ): "i was gonna go to a party...but i had to reinstall windows"
I think someone needs some basic lessons on cryptography. If the
key to the DVD is encrypted then how can the player use it? Does
it have a key to decrypt this key? Is that key encrypted? Maybe
you can see the problem here.
The player must be able to decode the DVD. If people have access
to the player then they can reverse engineer it and find out how it works.
IMHO, any copy protection scheme like this is doomed to fail. If
you can play something then you can copy it. It really is as
simple as that.
Physician, heal thyself! Reread your first paragraph. Calling someone "pathetic" doesn't seem too helpful to me.
1. key to read disk is in the player
;-)
2. key to descramble data is on the disk (each disk has it's own key)
3. they stop publishing disks that respond to the player key so that player can't read new disks
(i.e., yes they will black-list, I'll bet new disks mastered as of today don't have the broken
key enabled on them)
This would have worked as expected, but the keys were only 40 bits and the encryption algorithm
was weak... (if you read their spec, they seemed to expect it would have been broken within 6
months). The problem now is that now one was broke, people know how to break new 40bit keys
quickly since the keys are short and the algorithm is weak...
The key exchange and distributed secret scheme that they used was reasonably standard, but it's
not that you know what to do, what's really important is that you know how to do it right
Nope. The reason that VHS tapes cost around $100.00 when they come out is because they are selling primarily to video stores. A video store is willing to pay $100.00 for a tape, because they are going to rent it out over and over. A few months later, when the video stores are no longer buying copies, the studios lower the price to a level that appeals to individual consumers. It works. Lots of people will rent a movie when it comes out, then buy a copy six months later when the price drops down.
You'll notice that some trashy blockbuster movies are being initially priced at sell-through prices. It's all a matter of the studios maximizing their income. If they think that no one is going to care about "Godzilla" six months from now, then it's in their best interests to sell as many copies as they can now. It's just marketing.
If a DVD is encrypted, where does the key come from to decrypt it? If the user doesn't supply it at playback time, it must be embedded in the player. That means you only have to get one key, and you have access to everything. They can't change the encryption scheme without breaking all existing players, and can't blacklist the cracked key for the same reason. It's just security through obscurity, which has been proven ineffective time and time again.
"The invisible and the non-existent look very much alike." -- Delos B. McKown
Clue by four!!!!
We need open source players because the bozos that make DVD stuff won't provide the software for Linux!
We can't buy something that they won't make available.
As several people have commented, the quality of what the studios are now producing makes this a moot point, anyway.
I'm not a luddite, but I haven't been to a movie in the movie theater in over a year and haven't rented a video in probably three or so. I won't be buying a DVD player until I need one for the computer, and I'm unlikely to ever buy an HDTV converter box.
You know, after the last few turkeys I suffered through, I don't even miss the movies anymore, either.
Maybe if they start producing something worth watching, and quit trying to make a media circus out of every pile of dung that rolls out the door, I'll watch something again. Star Wars is the only thing I've even been moderately interested in watching, but I don't feel that my life is any less rich for having not seen it. In fact, it may be better, since I didn't have to see or hear Jar-Jar...
The amazing thing is that they've poisoned the water hole, and now are trying to make sure no one can drink for free - go figure.
I buy DVD and CD-roms (audio and game) because they are more permenent. PERIOD. As media go they will last longer for me after multilple playing than say a magnetic tape/LP. I will hear no pop's, jitters etc. when I am using media in a digital format. I think that CD-ROM based tech is rated at about 30 year shelf life. Compare that to a magentic tape which maybe will last 6 months under hard usage. (I know this because I have lost games because of megnetic decay) On another note I think at last count I had over 300 video/DVD's, ~100 audio CD's/tapes, and over 100 games in my library. That represents over 1.5 TERABYTES of data. I _WISH_ I had that kind of spere hard drive space. The truth of the whole thing is this. I pay for movie, I want to keep movie and not rebuy move every 2 years because of decay/storage problems. The movie industry as well as the audio industry need to wake up. We are loosing good movies/soundtracks now at a terrifying rate. This frantic paranoia about somebody copying your stuff needs to put to better use.
make Linux, not Microsoft. sin(beast) = -0.809016994374947424102293417182819
That's because the ripper puts the drive into player mode so it plays it just like normal, in other words ripping a 2-hour movie would take 2 hours.
But not all the companies who make DVD players are american. As a fact, very few.
So this wouldn't have been much of a problem...
nbsp; Possibly not - but a lot of the recordings seem to be from the US, so I suspect they had a big say in the definition of the standard.
Non-US members could have defined a standard without them, of course, but would then run the risk of being the Betamax players in a VHS market....
--
-=DaveHowe=-
You can get The Phantom Menace on DVD from China, or get MPEGs from the internet. If they don't sell legit TPM DVDs then they will just be giving all those profits away to the pirates...but then again, some movie studios are actually stupid enough to do that.
Why is the above comment moderated at zero? This was the single most useful and interesting comment in the whole thread.
Just what we need, evidence that (like we all knew) the format would be broken. But you can be sure that the movie producers aren't going to treat this with logic ("Oh, so it can be copied. Big deal, they can do the same thing with video tapes").
No, instead we're going to see a flight from DVDs. Like Star Wars was ever REALLY going to come out. Gotta love the paranoia among the studios that'll be setting in about now.
At least this came out AFTER Divx died, otherwise it would just prolong it's life.
On the upside, if they kill the DVD format for fear of copying, maybe they'll release the specs so I can play the DVDs I do own under Linux with full interactivity!
-- I'm omnipotent, I just don't care.
-- IANAEG - I am not an elder god.
I'm pretty sure this means the end of DVD-or at the very least, delaying the latest titles. I guess it's VHS forever
---
Witness the number of people in the 80's who spent time and trouble reverse-engineering copy protection. Witness the number of copy-guard "picture quality enhancers" on the market. Witness how many mods there are for game consoles (Doctor 64, anyone?) Wherever there is a media to be hacked, there will be someone hacking it. Yes, the industry might lose money on it, but on the same token, there should be no discernable effect on their bottom line. People will still buy DVDs at Best Buy in the same number that they did before. If the Motion Picture industry is really that paranoid this will encourage piracy on the internet, they need to stop making a home-based media for people to watch it. (And that would be just plain absurd.) The MPAA needs to get a reality check. There is always a way around copy protection and encryption.
I've thought about this a lot, and I've come to the conclusion that the movie industry really has nothing to worry about from unauthorized copying. The facts, simply, are these:
A lot of manual intervention is required in the mass duplication of video tapes. Basically, you have a wall of VCRs which record at 2x normal speed. So it takes about 45 minutes to make a batch of 200 or so tapes. These machines are frequently attended by a human operator (who costs money). DVDs, on the other hand, are pressed like CDs in an entirely automated process. Thousands can be stamped out in an afternoon. The manufacturing costs for DVDs is less than one-fifth that of video tapes, a savings which, of course, is not passed on to the consumer. So, while their PR department whines shrilly about "piracy" (a term used more for its emotional overtones than its accuracy), the studio is raking in even more money than before.
The number of people who are going to A) spend hours downloading a 5 gigabyte file, and B) spend 5 gigabytes of hard disk space to store it (at a cost of $20/gig) is statistically insignificant. Yes, you'll probably have a college dormitory sharing movies over their 100Mbit LAN. This represents -- what? -- 0.001% of the total market? I'm surprised the studio's accounting department hasn't killed these anti-copying campaigns as an unbelievable waste of money.
The fact is that DVD writers are expensive and are likely to remain that way for the forseeable future. Beyond that? I think we can take a lesson from what happened to the music industry with the proliferation of CD writers and MP3 files: Those companies are as strong as they ever were, and there is no proof they are suffering financially (despite our fervent desires to the contrary).
What I find particularly puzzling is that the hardware companies haven't figured out that they're in the driver's seat. Toshiba et al could have easily told the movie industry, "No, you're not going to get encryption or regional lockouts. Because it doesn't matter. Our manufacturing process costs less than one-fifth of the one you're using now. Once your shareholders find out there's a process that will cut your costs and increase profits and product quality (and we'll make sure they do find out), they'll rake you over the coals until you adopt it. You will use our open, unencrypted platform, and you'll like it. The financial reality leaves you no choice."
The argument really is that simple.
Schwab
Editor, A1-AAA AmeriCaptions
Yes, they will. I have many discs which are not encrypted with CSS.
----
Life if possible, art at any cost.
note the article states that there are 400 individual keys pressed into every dvd. this reduces the 40 bit security down to a little more than 35 bits.
that might stand up for an hour on a brute force attack by a pentium 90. if they were lucky.
MUCH more likely, a valid key would be hit early in the attack, after all, there are 400 to choose from.
The difference between Theory and Practice is greater in Practice than in Theory.
The founder of MoRE is 15 years old.
Kingpin
Unable to read configuration file '/bigassraid/htdig//conf/14229.conf'
Geocrawler error message.
Let assume c is the ciphertext and p the plaintext. Simply run the algorithm to decipher c, then dump the plaintext p unto another medium. Repeat for every c.
In simple words: run the DVD, and copy it on a VHS. You'll lose these fancy functions, but the essence of the DVD is still there: a copyrighted movie.
The point is: it's silly to try to prevent the copying of a film or music, whether it's in DVD, MP3 or CD format. Who the hell cares? Copyright laws are in place, and they're supposed to prevent anyone from making money illegally off of them. However, it's not illegal per se to copy a film or a song, once you bought them legally and are doing so for personal use.
So, breaking the DVD Encryption scheme is akin to figuring out how to copy VHS to VHS. The fact that this data can be transfered over the Internet is, I think, irrevelant. The industry needs to grow up; I certainly don't see a reason to stop producing DVDs because of this.
The rule of copy-protection scheme is: sooner or later, it's gonna get broken. Surely they realised that.
"Knowledge = Power = Energy = Mass"
1. Is the encryption algorithm known?
2. Will consumer decks play unencrypted disks?
If the answers to these are 'No', then this isn't really too important, for the time being. And while it's theoretically impossible to prevent people from determining the decryption algorithm if you ever sell software players, it should be possible to build an encryption system that can be kept a secret.
thad
I love Mondays. On a Monday, anything is possible.
The other 95% of the world can't tell the difference between a CD track and an mp3 rip of it. I love mp3's.. makes it easy to keep a huge archive and then burn custom audio cd's based on what I want to hear. I wouldn't be able to do that if I was storing 50+ meg tracks. Of course, you're probably one of those wackos who says that direct digital transfers of cd tracks to a hard drive decreases their quality. Yea right, the same thing happens when I copy my redhat iso images around. Seems to lose bits here and there. NOT.
Can somebody please explain in detail how the whole DVD encryption works?
Can't you just duplicate the encrypted DVD data using a DVD-R? You'd be able to get the exact replica of the original, and play it in any DVD player, without the need to decrypt it first. Or am I wrong?
___
If you think big enough, you'll never have to do it.
Well, according to this article (in norwegian), it was a 15-year old guy named Jon Johansen from Thor Heyerdahl high school, in Vestfold, Norway, who cracked it (He's a member of the group MoRE (Masters of Reverse Engineering), mentioned in the Wired article).
Not at all that anonymous if you ask me :)
---
Ilmari
© ilmari. All rights reserved, all wrongs reversed
Well, you know what this means. Your expensive DVD players will be worth less because DVD2 will come out, not be compitable with current plays. New movies on DVD2.. Higher price to combat piracy.
I am disappointed that Wired emphasized the word "piracy" throughout the article. They imply that the only purpose of the CSS code could be for shady people to go against the will of the copyright owners.
This simply isn't the case. They didn't bother to print the obvious fact that blank media costs significantly more than DVD movies to begin with, making unauthorized copying a waste of time and money! (Not to mention the fact that equipment to record DVDs playable in consumer DVD players is around $15,000)
I also didn't see anyone mention that copyright law does not restrict people from making backup copies of material that they own. Even the copy protection in consumer DAT machines allows this, unlike the broken CSS scheme. (Suppose I want to make sure that the DVD movie I just bought will still work 50 years from now, even if the original gets scratched or destroyed)
They missed the most important fact of all-- as long as CSS remained secret, computer users were forced to use Microsoft Windows or Mac OS to play back DVDs. Only the release of CSS to the public will make playing back DVDs on other operating systems possible. Many people have _wanted_ to go out and buy a DVD decoder card and movies, but have not because there was no support for this hardware in Linux or their operating system of choice. Hardware drivers have become available for some DVD decoder cards, but without CSS code the drivers are relatively useless.
Now, we will not have to wait much longer to watch DVDs on our machines.
correction: "this reduces the 40 bit security down to a little more than 35 bits."
should read: "this reduces the 40 bit security down to a little more than 31 bits."
The difference between Theory and Practice is greater in Practice than in Theory.
And if one studio quit producing, another will pop up and take their place so fast your head will spin. Look at software. Piracy is orders of magnitude more rampant than in the movie or record industry. And yet all of these industries seem to be more profitable than ever. "Leaking info on how to break protection schemes will destroy DVD!" It's NOT gonna happen.
Currently, there is a war going on between Sony and mod-chippers over encryption. You see, a while ago I got a mod chip installed in my Playstation purely so I could play one disk (Samurai Spirits 1 & 2, a legitimate import version, not available in the US region.) Even though I chipped my Playstation to play games which were coded for outside my region, that same chip works for copied games too. Recently, Sony became aware of the encryption crack, and has started coding some of its disks (such as Dino Crisis from Capcom) so they will detect the chip and fail to play. Of course, now there are people coming out with new ways to get around the new encryption, including new hacked pirate disks and GameShark codes. I wonder if DVD companies will attempt something similar.
All the creatures will die, And all the things will be broken. That's the law of samurai. (Jubai, 1605)
Think of it as cosmic justice. I remember when Toshiba sold the Russians the machine tools they needed to make their nuclear submarines' propellers a zillion times quieter.
This is also a cautionary tale for cryptologists that every cryptanalyst knows by heart.
Cryptologists will often be deluded into thinking their systems are far more secure than they really are. Cryptanalysts stay in business because of this.
Everyone is so concerned about the financial issue that they miss the real point. The actual strategy being played out here is one of fear induction. You (the public) are supposed to fear the pirate, the terrorist, the different thinker, the one that looks different or acts different. The Establishment has always thrived on the irrational fears of the public and so has attempted to control those fears -- not control as in eradicate, but control as in be the source of those fears or the fear inducing announcements. Power and control. Soon, you'll beg for internet regulation. Then you'll beg for reproduction regulation. Then you'll suffer an eternity in your very own Hell.
Come in and join the fun