Slashdot Log In
Blu-ray BD+ Cracked
Posted by
kdawson
on Fri Mar 21, 2008 07:55 AM
from the bigger-they-come dept.
from the bigger-they-come dept.
An anonymous reader writes "In July 2007, Richard Doherty of the Envisioneering Group (BD+ Standards Board) declared: 'BD+, unlike AACS which suffered a partial hack last year, won't likely be breached for 10 years.' Only eight months have passed since that bold statement, and Slysoft has done it again. According to the press release,
the latest version of their flagship product AnyDVD HD can automatically remove BD+ protection and allows you to back-up any Blu-ray title on the market."
Related Stories
[+]
Analyst Says Blu-ray DRM Safe For 10 Years 493 comments
Mike writes to let us know that a poster on the AVS forum says that the latest issue of HMM magazine (no link given) contains a quote from Richard Doherty, a media analyst with Envisioneering Group, extolling the strength of the DRM in Blu-ray discs, called BD+. Doherty reportedly said, "BD+, unlike AACS, which suffered a partial hack last year, won't likely be breached for 10 years." He added that if it were broken, "the damage would affect one film and one player." As one comment on AVS noted, I'll wait for the Doom9 guys to weigh in.
[+]
IT: Doom9 Researchers Break BD+ 345 comments
An anonymous reader writes "BD+, the Blu-ray copy protection system that was supposed to last 10 years, has now been solidly broken by a group of doom9 researchers. Earlier, BD+ had been broken by the commercial company SlySoft." Someone from SlySoft posts a hint early in the thread, but then backs off for fear of getting fired. The break is announced on page 15.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Re: BD+ Cracked (Score:5, Insightful)
Re: BD+ Cracked (Score:5, Insightful)
Parent
Re: BD+ Cracked (Score:5, Insightful)
"...just sufficiently hard that the cat and mouse game is too much effort for the pirates."
Except the pirate have the time, and the skills, and the same computer power as the companies. Add to that they don't have an arbitrary budget and they get an Ego boost from doing it? do you really think these snake oil salesmen have a chance?
What next, a scheme for hiding porn magazines in your house from teenagers?
At least more and more media companies are beginning to realize the futility of these scheme, hopefully they will go away. Really, I want to buy by disk, put it on my computer and call it up when ever I want. That's the future, that is what consumers want and expect.
"You can't hide secrets from the future with math." - MS Frontalot.
Parent
Re: BD+ Cracked (Score:5, Interesting)
Parent
Re: BD+ Cracked (Score:5, Informative)
Just to be clear, pirates aren't the ones playing that cat and mouse game. When you see a street vendor selling pirated copies of Star Wars, he's selling actual Blu-ray discs. He made bit-for-bit copies and he didn't need to decrypt anything to do it. The fact that Blu-ray is encrypted didn't do anything to prevent the pirate from stealing the content.
Decryption is needed by people who want to *gasp* watch the discs they legally purchased at BestBuy.
Parent
Re: BD+ Cracked (Score:5, Interesting)
Virtually every satellite TV encryption system available has been broken, often many times over. These range from simple hardware hacks, such as subscribing to all channels then sticking a resistor in the decoder to prevent the card's EEPROM from being changed then unsubscribing again, through complete reverse-engineering of the cards. Cards were routinely modified to recieve all channels, card details were copied onto deactivated cards, and some were even re-implemented from scratch using a PIC soldered onto a PCB, or even using programmable cards.
These systems relied on security through obscurity - the pirates didn't know how the cards worked, so there was no way they could compromise them. Yeah, right...
This continued until very recently. Most newer encryption systems follow the pattern that BSkyB used with their analog and digital encryption systems. BSkyB's analog system relied on replacing the cards. Each time a revision of the cards was breached, they would issue a new one that fixed the holes in the last, and often fundamentally changed the way the card worked. Sky retired the system before it was fully compromised, but other providers kept using it. They had to face the fact that computing power had advanced so much that it was possible to brute-force decode the signal in real-time with no card.
Most modern cards are programmable, as are the CAMs (the modules that talk to the card, and pass the final decryption keys to the STB). So the current encryption systems change the firmware in both card and CAM periodically. Any breach will only work for a limited time. Even after all these years, the arms race continues - pirates have found all kinds of creative ways around these things, such as sharing a single card across the internet.
It's also possible to buy a PCI satellite card that allows a PC to recieve satellite TV. Combine that with an official card and CAM, which work as normal. You can't change the card, but you can do whatever you like with the decryption keys it generates, or the decrypted TV signals. That includes recording it, and uploading it to the internet. You could even do that in real-time if you wanted to.
The continual update thing is what Sony are trying with BD+. The idea is that the BD+ portion contains code, unique to each disc, which verifies that the player is authentic and hasn't been compromised. Once it's done that, it provides decryption keys to the player.
The general idea is that, while it may be possible to compromise AACS in the same was as CSS, each BluRay disc will contain unique encrpytion code for that disc. The idea is that each disc will need to be cracked individually, just like PC games. And we all know how well that approach works in practice.
This assumes that each BluRay disc will have completely unique BD+ code, and that's just not going to happen - they have to maintain compatibility with existing players, which means the BD+ code has to be extensively tested. Hackers can move much more quickly - even if they did have to crack each batch of BluRay discs individually, they'll be able to update their decryption tools much quicker than Sony can update their BD+ code.
It also assumes that nobody knows how BD+ works (security through obscurity), and that nobody will be able to independently implement a BD+ VM that pretends to be a real player. That's exactly what SlySoft have done. Their VM isn't complete yet - it only implements the portions of BD+ that current discs are actually using. It is known not to work on one disc (Hitman, I believe), simply because it uses parts of the BD+ VM that they've not implemented. Yet.
The point is that the pirates are far more agile than Sony, and have unlimited time in which to devise a solution. There is no such thing as making it too much effort. At least with the satellite TV analogy, you can't keep using a hack once the hole it exploited has been patched, so there is a time factor. There is no time factor with BluR
Parent
Re: BD+ Cracked (Score:5, Interesting)
Nope. 5 months.
According to the link they sat on this for 3 months for strategic reasons, waiting for the format war to end.
-
Parent
Re: BD+ Cracked (Score:5, Insightful)
I'd say if Bluray becomes the dominant media (which isn't certain, I happen to think discs are doomed) we'll see spools of blanks for $20, just like the last two times.
Parent
Re: BD+ Cracked (Score:5, Insightful)
I am also beginning to increasingly believe that if you create a good enough dare, people will take you up on it, just to prove you wrong.
Mother nature likes to join in too sometimes, as one ship has shown us.
Parent
Re: BD+ Cracked (Score:5, Informative)
No, you don't. It's uncompressed, but not "perfect" because it still has the compression artifacts. Then, when you recompress it, it has two sets of compression artifacts. Although it's higher quality than aiming a video camera at the display, it's still more-or-less the same as the "analog hole."
To really count as "cracking," the attacker needs to get access to the decrypted but still encoded stream.
Parent
pwned (Score:5, Insightful)
Re:pwned (Score:5, Interesting)
Parent
Re:pwned (Score:5, Interesting)
Parent
Re:pwned (Score:5, Informative)
There are a variety of reasons HD DVD was better from an end-consumer's standpoint, though not necessarily a studio's:
The only real downside was the lower capacity, and with an HD DVD disk topping out at 30G (there had been a plan to increase that to 50G without increasing the price of the players by adding a third layer), capacity for an ordinary 1080p movie was never really an issue. I hear they had trouble fitting a lossless soundtrack on the Transformers HD DVD, one of the rare occasions the capacity was stretched, and there's some evidence that wasn't true either. My 2001 HD DVD has gorgeous quality, a DolbyHD lossless soundtrack, and a whole bunch of features, all on one single sided double layer disc.
Parent
Re:pwned (Score:5, Funny)
Parent
Re:pwned (Score:5, Insightful)
Parent
Re:pwned (Score:4, Interesting)
The only bad thing about BD+ being cracked is that it didn't happen sooner. A naive faith that it would be secure may have been one of the factors in studios throwing their weight behind Blue-ray instead of HD. Now that HD seems to be going down the pipes, it leaves blue ray in a monopoly position, free to keep their prices high. Okay - it's not quite a monopoly position as they still have to compete with traditional DVDs. But it's a worse situation for the public than if HD were still around. Still, every little crack helps.
Parent
Re:pwned (Score:5, Insightful)
Anyhow, on the topic at hand, is anyone really surprised it got cracked? DRM will eventually die at some point. Right now its just something that we gotta continue fighting until companies realize they lose more money by utilizing it. Music has begun dropping DRM. Some book companies have started releasing straight pdf's of books without any DRM. Video will eventually follow.
Parent
Re:pwned (Score:5, Informative)
DRM locks the data to the disk, requiring you to risk damaging the only copy of the data you bought in order to access said data.
Fair use is copying the data you bought to another device so you can access it from there.
I'm surprised you need it explaining to you, are you a bit dumb ?
Parent
Re:pwned (Score:5, Informative)
The copy protection is meant to prevent you from backing up your only copy of the disk to another device, which falls under fair use. Also, you cannot format-shift because of the copy protection. If you buy an HD movie and want to downsample it for use on your iPod, you can't unless you get past the copy protection.
The studio's line works just fine if you're okay only watching your movies in your Blu-Ray player and only if the keys to the disks are still valid and only if you even still have a blu-ray player years from now. If you buy a movie you should be able to enjoy it howsoever you see fit as long as that doesn't involve charging people money to view it or selling copies you've made from it.
Seriously. You must be new here 'cause I might just be modded redundant people have been over this so many times on Slashdot.
Parent
Barrier to Ownership (Score:4, Insightful)
Re:Barrier to Ownership (Score:5, Insightful)
Parent
Re:Barrier to Ownership (Score:5, Insightful)
Parent
Re:Barrier to Ownership (Score:5, Insightful)
I own a large collection of DVDs and this is a use I do for some of them that watch. I also do this for CDs as well.
Parent
Re:Barrier to Ownership (Score:5, Interesting)
Parent
Re:Barrier to Ownership (Score:5, Informative)
Profile 1.0, otherwise known as the grace period profile, only required 64KB of local storage for key revocation lists.
Profile 1.1, which is the "final standard" profile (though it was only required for players released after 11/1/2007, leaving over a year of BD player production supporting an incomplete featureset) requires 256MB of local storage as well as secondary audio and video decoders to allow for PIP and overlay audio commentary.
Profile 2.0 adds networking and Internet connectivity to the mix and ups the local storage requirement to 1GB. This profile is equivalent to the features that have been mandatory in HD-DVD from day one.
The only upgradable hardware BD player is the PS3, since it already had the hardware for other purposes. Profile 1.1 support was pushed out in a software update soon after it became mandatory in standalone players and profile 2.0 support was announced yesterday and is expected some time next month.
Parent
Not fully broken (Score:5, Informative)
The link is a trap (Score:5, Funny)
Re:The link is a trap (Score:5, Interesting)
Hello, Dr Skwid., Amazon.co.uk has new recommendations for you based on items you purchased or told us you own.
Reversing: Secrets of Reverse Engineering
Buffer Overflow Attacks: Detect, Exploit, Prevent
Rootkits: Subverting the Windows Kernel
The Database Hackers Handbook: Defending Database Servers
Sockets, Shellcode, Porting, and Coding: Reverse Engineering Exploits and Tool Coding for Security Professionals
Professional Rootkits (Programmer to Programmer)
Now that the UK & Germany has outlawed knowledge it's like a trap!
Parent
Bogus claims (Score:5, Interesting)
I'll know it when I see it (Score:5, Informative)
Now I'd like everyone to remember that BD+ is not an `algorithm` per se. It's not a DRM one way function. BD+ is a virtual machine and a blu ray disk is a full fledged program that runs under the VM and can even run native code to patch and upgrade the virtual machine.
This is akin to running a java application that can inspect the java VM.
It's a cat and mouse game for now.
*Wiki: http://en.wikipedia.org/wiki/BD%2B [wikipedia.org]
Re:I'll know it when I see it (Score:5, Funny)
Parent
Re:I'll know it when I see it (Score:4, Funny)
Parent
Re:I'll know it when I see it (Score:5, Funny)
24 Carat Pure Slashdot Gold.
We have a winner.
Parent
I call for a new rule (Score:5, Funny)
24 Carat Pure Slashdot Gold.
We have a winner.
However, asking "... does it run on Linux?" is still fair game.
Parent
"Crack" Has Important Use Unrelated to Ripping (Score:5, Informative)
Re:"Crack" Has Important Use Unrelated to Ripping (Score:5, Informative)
AnyDVDHD Features Blu-Ray
* Same features as regular AnyDVD
* Removes encryption (AACS) from Blu-ray Discs
* Removes region codes from Blu-Ray Discs
* Removes BD+ copy protection from Blu-ray Discs
* Watch movies over digital display connection, without HDCP compliant graphics card and without HDCP compliant display.
* The "must have" utility for the serious home theater enthusiast using a media center / home theater PC.
* Includes a UDF 2.5 file ripper, no need to install 3rd party UDF 2.5 filesystem under Windows XP.
I've been using anydvd to watch HDDVDs and BluRay discs over component for awhile now. However, I haven't tried a BD+ disc yet. I purchased Gattaca yesterday, but I haven't tried to watch it yet. I will give it a go tonight.
Parent
There is always somebody smarter than you are (Score:5, Funny)
We made a boat load of money (Score:5, Insightful)
Parent
Re:unimportant (Score:5, Interesting)
1. It tells that Blu-Ray is already supported enough to buy a player now
2. It allows you to even if Blu-Ray ends up failing, you can rip your Blu-Ray movies to the new format (and don't expect media storage to be made as long as VHS and DVD did anymore...)
3. It will allow various third-party projects to soon take advantage of this (even if right now it only lets you make backups) and add Blu-Ray support to media players on OSes such as Linux.
Parent
Re:unimportant (Score:5, Interesting)
Parent
Re:unimportant (Score:5, Insightful)
Well, I do. Let me tell you why:
I don't own a TV. I *do* however own a computer with a WUXGA display. In its current
config, my computer would not be "MAFIAA certified" to play BD discs, even if I hab a BD drive.
I want to be able to play the content on my computer.
With the OS of my choice. With a display of my choice. Without this HDCP crap.
I own a bunch of DVDs because deCSS has become ubiquitous today, and nearly every
computer with a DVD drive can play them, without any platform or software dependencies.
I'm waiting for the same to happen for BD - until then, no money from me.
Please make it happen soon, HD video looks great.
Parent
Re:unimportant (Score:5, Insightful)
Parent
Re:why? (Score:5, Insightful)
Parent
Re:why? (Score:5, Insightful)
2. Software patents or no, I believe that I should be able to do what I want with something I purchase as long as it's not harming others. Moving my movies from physical disks to my media server is not harming anybody.
3. As others have already said, DRM is fundamentally broken. To view DRM encrypted content you have to have the keys. If you have the keys then the encryption can't be secure. The sooner people (the content industries) realise this the sooner they can stop pissing off their legitimate consumers without actually denting piracy. This is a win for all. EMI have realised this, and I think a couple of other music studios, now it's just a waiting game until the rest of them get it.
Parent
Re:Well.... (Score:4, Funny)
What I want to do is get an HD DVD burner (this is very hard BTW), a lot of blank media, and a Blu-ray drive, and then buy Blu-ray movies and convert them into HD DVDs. That way I'd really be sticking it to the man. Yeah. Wooo! You know it!
Erm. Ok. It's probably the stupidist idea ever, but what the hell.
Parent
Re:Well.... (Score:4, Insightful)
Have you ever thought that your own paid-for movies are just data?
Parent
The power of abstraction (Score:5, Insightful)
I think the GP's point was, he should be able to backup his movies to his computer, because at a low level, Blue Ray movies are just data on the disc. He should be able to backup *any* data on a BD to his computer. Yes, movies are more than data, but they also *are* data too. The power of abstraction is that I can usually treat any two *similar* things similarly, even when they aren't identical.
So that I can drive a Chevy Corvette or a Cavalier, a Ford F-150 pickup truck, or a Toyota Camry all on the same road, because they are all automobiles. Yes, a pickup truck is *more than* a set of wheels, a frame, and a motor, which collectively fit within a certain standardized set of dimensions and under a certain maximum weight, but it *is* also a set of wheels, a frame, and a motor which collectively fit within a certain standardized set of dimensions and under a certain maximum weight, which is why it can drive on the same road as the other vehicles.
I think one of the distinguishing features of most geeks, that sets them apart from the general populace, is the fact that they have the ability to see, when it's useful, that "a book is just a dead tree", and to be able to figure out when that fact is useful. It is the foundational principle of much of engineering and computer science. Most people see the forest, or maybe the trees. A good hacker sees the forest *and* the trees.
Your response to the GP just shows that you just don't get it. It doesn't mean he's any less correct. I hope this post helps you to see that.
Parent
Re:The power of abstraction (Score:5, Insightful)
(1984) (holding that "time-shifting" of copyrighted television shows with VCR's constitutes fair use under the Copyright Act, and thus is not an infringement).
Space shifting [wikipedia.org], or copying a legally purchased copyright material like a DVD, to a computer hard drive for convenience is still being debated in the courts. It should be noted that no case has been decided regarding personal space shifting. Only cases by commercial entities like Diamond Multimedia, MP3.com, Napster, etc.
Why? Because the Audio Home Recording Act [wikipedia.org] of 1992 set nice precedents covering this sort of behavior. Yes, it is specific to audio, but it explicitly gives people the right to make private, non-commercial copies of their stuff. The Senate report defines noncommercial as "not for direct or indirect commercial advantage", offering examples such as making copies for a family member, or copies for use in a car or portable tape player.
That is a very big precedent and the video industry does not want to try and overcome that. This is why they went after DeCSS with vigor and the DMCA was enacted. Their "loophole" is to attack people for decrypting, not for copying.
Uploading, sharing with friends and the like are different stories. But I believe you are firmly within your rights to make personal copies (for you and your household) copy copyright materials that you legally own.
IANAL, but I challenge you to find one U.S. court case concluded after 1992 that says otherwise.
Parent
Re:Well.... (Score:5, Insightful)
Parent