Print 28 comment(s) - last by RW.. on Jun 3 at 5:48 PM

AACS loses the keys to its house, quickly changes locks

Efforts that began in December 2006 and continued through February 2007 lead to the discovery of the Processing Key used to encrypt high-definition media with the Advanced Access Content System. The work of a small hacking community created essentially a silver bullet that was able to defeat the copy protection of all HD DVD and Blu-ray Disc media on the market at that time.

The Advanced Access Content System Licensing Administration (AACS LA) acknowledged the effectiveness of the hack and began to enact measures to restore the integrity of its technology. Beginning May 22, which is most notably the release date of the Matrix trilogy on HD DVD, all high-definition titles shipped with Media Key Block (MKB) v3 – a new encryption key version that would render the previously discovered Processing Key obsolete.

Interestingly enough, the AACS’ updated protection measures appeared to be defeated by SlySoft, makers of AnyDVD HD software, before the new MKB versions officially hit streets. The AACS has yet to officially issue a statement and is current investigating the latest attack on the system, according to comments made by Richard E. Doherty, director of technology strategy at Microsoft, who is also actively involved with the AACS.

The initial method used by hackers to snoop the sensitive encryption keys from HD DVD and Blu-ray were accomplished using PC software. More specifically, hackers took advantage of holes in WinDVD to read data straight from the PC’s memory. While such a hack may not have been possible without the existence of software players, the AACS appears unshaken about high-def media on computers.

“Just to clarify, the original attack was on certain software players that proved to be vulnerable, and did not and does not represent a widespread break in the AACS ecosystem ... In the past PC's have typically been a big target for hacking activities, as they are designed to run arbitrary software programs. But the line between PCs and traditional CE devices is clearly blurring – and many of the best PVR systems (in my opinion) are highly customizable and capable of running user-designed software,” explained Doherty, also pointing to how a Windows Media Center box could be strong addition to home theatres.

“Keep in mind, however, that AACS is aware of the history and attack vectors of PC playback systems, and there are several technical measures (such as KCD and the entire proactive renewal system) that are designed specifically to address the particular issues of PC-based protection,” Doherty added.

The uncovering of the Processing Key to HD DVD and Blu-ray happened in February, leaving some to wonder why it wasn’t until months later until the appearance for a new MKB. Doherty provides the answer, “AACS of course has the technical means to revoke overnight. But the current license agreement generally provides for 90 days. This is to allow time for the manufacturer to repair the product and presumably fix the vulnerability, and time to rollout the patches to the affected users.”

The apparent grace period is done in the interest of consumers, as if the key were revoked immediately, legitimate consumers could find themselves with an unplayable disc until a software update. Despite the quick ‘rehack’ of the AACS, the system is designed to avoid another complete defeat like CSS – the technology used to protect DVD.

“You have seen a revocation cycle occur which has required upgrades to certain software players to make them more robust to known styles of attack. The AACS system was designed to deal with these sorts of attacks, and remains intact as a technology. This is in contrast to CSS, which is vulnerable to direct, brute-force attacks,” said Doherty, who then explains it in even simpler terms. “The analogy we sometimes give is: if you lock your house, but leave the keys lying on the street, then there's really nothing wrong with the locks or with the concept of locks in general. If you don't find the keys, you can change the locks if you like.”

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

RE: Analogy
By feelingshorter on 6/2/2007 12:54:45 AM , Rating: 2
I don't think your analogy is as good as the one posted by Fallen Kell. Its not people "watching" where you put your key. If you allow access to your content, they can crack/hack it.

Either you:
1. allow no access, such as sealing a door shut (in which its no longer called a door, just a wall).


2. Let people access it. (regardless of the method)

The movie studios are just tending their symptoms, and not fixing the root of their disease.

Partial access will always be crackable. Even if you let people watch it in theaters, someone will find a way to sneak a video camcorder in there to record it, and again, it will end up on torrent websites. Pirates get it for free, so the quality isn't good but they cannot complain about free.

All the movie studios should just come together, and partner up with ISPs. Eg:

1. All movie studios team up to create one dl service.
2. They partner up with ISPs, to offer it for an added $25/month.
3. Movie studios can then offer downloads, while ISPs can offer speed increases, to supplement the bittorrent distribution. That way, no one feels like they are using the bandwidth they paid for to download stuff they they also paid for.

I'm just dreaming here guys.

RE: Analogy
By BikeDude on 6/3/2007 5:14:28 AM , Rating: 1
But the DVDs won't change and DVDs are bound to survive for at least another decade. If pirates don't complain about movie theater quality, they will surely be satisfied with DVD quality.

The question at hand however, is what to do with HD quality? HD is pretty much all the quality we will need for quite a while (famous last words?), so once a consumer buys a HD-DVD or BRay disc, that consumer will not need a "new and improved" format for a long time, assuming the disc doesn't break... (which leads to the next question: how can the consumer make backups of his collection, in case the disc DO break?)

Personally, I prefer HD content, but I want the freedom to play the content on my computer (where I play all my DVDs today, I have a 30" Apple LCD). I'd also like the freedom to purchase discs the next time I visit the US or Thailand for that matter. And when I get kids, I'd like to take backups of certain discs... In addition, I do not enjoyed all the studio logos, promotional clips and anti-piracy ads that sometimes appear on various DVDs. I want to be able to skip directly to the movie itself.

The studios aren't only trying to stop piracy, they are also trying to decide where we buy discs and force us to watch various promotions before they let us access the main feature. IMO the consumer gets a *better* product by resorting to piracy. I could let myself be convinced that copy protection is a necessary evil, but then the industry has to play absolutely fair. Currently they cheat and steal our time.

Sadly, the game industry is also affected. I bought Flight Simulator X and don't need to keep the disc in the drive. The game immediately shows me the main menu, and I'm flying within a short time. Life was good, and I was a very happy camper. Then I bought "Rainbow Six: Vegas" and until I found an unofficial patch, I was forced to watch the silly studio logos for over a minute before I could get to the action. Not to mention that the copy protection only supports one of my DVD drives. :( The box did not say anything about forced menus and I would've returned it to the store, except I bought it while travelling and threw away the receipt somewhere.

May the studio execs burn in hell. I'll be happy to supply the gasoline.

"Folks that want porn can buy an Android phone." -- Steve Jobs

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki