582 lines
26 KiB
Plaintext
582 lines
26 KiB
Plaintext
|
||
|
||
ﾜﾛﾛﾛﾛﾛﾛﾛﾜ THIS FILE WAS LEECHED FROM...
|
||
ﾛﾛﾛﾛﾛﾛﾛﾛﾛ
|
||
ﾛﾛﾛﾝ ﾞﾛﾛﾛ
|
||
ﾛﾛﾛ ﾛﾛﾛ
|
||
ﾛﾛﾛ ﾟ ﾜ ﾜﾜ ﾜﾜ ﾜ ﾜ ﾜ
|
||
ﾛﾛﾛﾛﾛﾛﾛﾛﾜ ﾛﾛﾛ ﾜﾛﾛﾛﾛﾜﾛﾛﾛﾛﾜ ｱｱｱｱｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ
|
||
ﾛﾛﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾞﾛﾛﾛ ﾛﾛﾛﾝ
|
||
ﾟﾛﾛﾛﾛﾛﾛﾛﾛ ﾟ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾞﾛﾛﾛ ﾛﾛﾛﾝ
|
||
ﾜ ﾛﾛﾛ ﾛﾜﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾞﾛﾛﾛ ﾛﾛﾛﾝ
|
||
ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛﾝﾞﾛﾛﾛ
|
||
ﾛﾛﾛﾝ ﾞﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱｱｱｱｱ ﾛﾛﾛ ﾟﾛﾛﾛﾛﾛﾛﾟ
|
||
ﾛﾛﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾟ ﾛﾛﾛ ｱｱｱ ﾛﾛﾛﾛﾛﾛﾛﾝ ﾟﾛﾛﾟ
|
||
ﾟﾛﾛﾛﾛﾛﾛﾛﾟ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛ
|
||
ﾟ ﾟ ﾟ ﾞﾛ
|
||
ﾜ ﾜ ｱｱｱｱｱｱ ﾜ ﾜ ﾛ ﾜﾜ ﾜﾜ ﾜ ﾜ
|
||
R ﾜﾛﾛﾛﾛﾛﾜ ﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾜﾞﾞﾛ ﾛﾛﾛﾛﾜﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ
|
||
E O ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾟﾛ ﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ
|
||
A F ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ
|
||
L ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾝﾞﾛﾛﾛ
|
||
M ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾜ ｱｱｱ ｱｱｱ ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾟﾛﾛﾛﾛﾛﾛﾟ
|
||
S ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛ ｱｱｱ ｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾜﾛ ﾛﾛﾛ ﾟ ﾛﾛﾛ ﾟﾛﾛﾟ
|
||
ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛ ｱｱｱｱｱｱ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛﾛﾛﾛﾛ ﾛﾛﾛ ﾛﾛﾛ ﾛﾛ
|
||
ﾟ ﾟ ﾟﾟﾟﾟﾟ ﾟ ﾟ ﾟﾟﾟﾟﾟ ﾟ ﾟ ﾞﾛ
|
||
ﾟﾛﾛﾛﾛﾛﾛﾛﾛﾟ ﾛ
|
||
ﾜﾛﾛﾜ ﾛﾝ ﾛ ﾞﾛﾝ ﾛﾛﾝ ﾛﾛﾛ ﾞﾛﾝﾞﾛﾝ ﾜﾛ ﾜﾟﾟ ﾜﾛﾛﾜ ﾛ ﾛ ﾛﾛﾜ ﾞ
|
||
ﾟ ﾜﾛ ﾛﾛ ﾛ ﾛ ﾛ ﾛﾞﾛ ﾛ ﾛ ﾛ ﾛ ﾛﾛﾛﾜ ﾛ ﾛ ﾛﾞﾛ ﾛ ﾛ
|
||
ﾜﾛﾟ ﾛﾞﾛﾛ ﾛ ﾛ ﾛ ﾛ ﾛﾛﾝ ﾞﾛﾝﾞﾛﾝ ﾛ ﾛ ﾛ ﾞﾛﾛﾝ ﾛﾛﾝ ﾛ ﾛ ﾜ
|
||
ﾞﾛﾟﾞ ﾛ ﾞﾛ ﾛ ﾛ ﾛﾞﾛ ﾛ ﾜﾛﾛﾛﾛﾛﾛﾛﾛﾜ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛﾞﾛ ﾛ ﾛ ﾜﾛ
|
||
ﾛﾛﾛﾛ ﾛ ﾛ ﾞﾛﾝ ﾛﾛﾝ ﾛﾛﾛﾝ ﾛﾛﾛ ﾟﾛﾛﾟ ﾛ ﾟﾛﾛﾟ ﾛ ﾛ ﾛﾛﾟﾜﾛ
|
||
24 HOURS ﾜﾛ ﾜﾛﾜ
|
||
ﾛ ﾛ ﾟ
|
||
ﾛ ﾛ ﾛ ﾛ ｱ ﾜﾛﾛﾜ ﾛ ｱ ﾜﾛﾛﾜ ﾛ ﾛ ﾛﾛﾛ ﾛ ﾛ ﾛﾛﾛ ﾛﾛﾜ ﾜﾛﾛﾜ ﾟﾛﾜ
|
||
ｱ ﾛ ﾛ ﾛ ﾛ ｱ ﾛ ﾛ ﾛ ｱ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛ ﾜ ﾛ
|
||
ｱﾛｱ ﾛﾛﾛ ﾛﾛﾛ ｱ ﾞﾛﾛﾝ ﾛ ｱ ﾞﾛﾛﾝ ﾛﾛﾛ ﾛﾛﾜ ﾛﾛﾛ ﾛﾟ ﾛﾟ ﾞﾛﾛﾝ ﾟﾛﾟ
|
||
ｱ ﾛ ﾛ ｱ ﾛ ﾛ ﾛ ｱ ﾛ ﾛ ﾛ ﾛ ﾛ ﾛﾟ ﾛﾟ ﾛ ﾛ
|
||
ﾛ ﾛ ｱ ﾟﾛﾛﾟ ﾛ ｱ ﾟﾛﾛﾟ ﾛ ﾛﾛﾟ ﾛ ﾛ ﾛﾛﾛ ﾟﾛﾛﾟﾛ
|
||
Inflating: skycard.txt
|
||
|
||
|
||
*** The Videocrypt System ***
|
||
|
||
An Overview
|
||
|
||
Researched and written by Darren Ingram, author of Satnews
|
||
|
||
- Satnews.. the latest and non-Commercial satellite news -
|
||
|
||
|
||
Version 1.31 - 06.05.91
|
||
|
||
|
||
Introduction
|
||
|
||
Videocrypt is a pay-tv scrambling system jointly developed by Thom-
|
||
son Consumer Electronics and News Datacom. Over one million users
|
||
receive Videocrypt encrypted signals and this system, has to date,
|
||
remained secure from illicit decoder manufacturers, protecting the
|
||
revenue of Videocrypted television channels.
|
||
|
||
Requirements
|
||
|
||
|
||
Videocrypt is a multi-standard encryption system which is suitable
|
||
for PAL, NTSC and SECAM transmissions. Language is no barrier for
|
||
Videocrypt with its capacity for multi-lingual transmissions and
|
||
broadcasts utilising a comprehensive on-screen instruction menu.
|
||
|
||
Features and applications
|
||
|
||
A smart card is the central key to the Videocrypt system, and the
|
||
card can be used for a variety of diverse applications. The card
|
||
is pre-coded to determine a users requirements and it can subse-
|
||
quently be addressed utilising the decoders logic to amend the users
|
||
services at the broadcasters will.
|
||
|
||
There are a number of broadcasting modes which the smart card can be
|
||
used within including:
|
||
|
||
Clear Mode
|
||
Signals sent in the clear are recognised by the decoder and
|
||
passed to the display without further processing.
|
||
|
||
Free Access
|
||
Pictures transmitted with an encryption key are delivered
|
||
directly to the display through the decoder.
|
||
|
||
|
||
Controlled Access
|
||
Access to encrypted pictures is determined by the level
|
||
of access authorised to the users smart card. No signals
|
||
will be transmitted in an unencrypted state without prior
|
||
authorisation.
|
||
|
||
Programmes can be tailored to usage with the Videocrypt system and
|
||
the system offers a flexible way for pay-tv operators. There are a
|
||
number of operations mode offered as standard including:
|
||
|
||
* Single or multiple subscriptions with many tier levels in one
|
||
channel
|
||
|
||
* Pay Per View (PPV) and impulse purchasing
|
||
|
||
* Thematic selection (enable all arts programming)
|
||
|
||
* Geographic limitation (restrict to a country/area)
|
||
|
||
* Single-event (throwaway cards)
|
||
|
||
* Parental Control (reception with card only)
|
||
|
||
* Pre-determined time period
|
||
|
||
Videocrypt enables smart cards to be pre-programmed to suit the
|
||
specific programming requirements.
|
||
|
||
Smart card - providing the revenue security
|
||
|
||
Security can be addressed on a multitude of levels when using the
|
||
smart card. These include:
|
||
|
||
Chaining
|
||
|
||
An existing customer would receive a new card which contains part of
|
||
the new code, the remainder of the code would be transmitted when
|
||
the card is inserted into the decoder and the subscriber compiles
|
||
with the instructions contained within the on-screen graphics.
|
||
|
||
Over-the-air addressing
|
||
|
||
Systems operators can now address individual subscribers, which is a
|
||
vast improvement over other scrambling systems. The operator can
|
||
provide additional services, reduce service entitlements, send
|
||
individual messages, blacklist and/or whitelist viewers.
|
||
|
||
Cloning
|
||
|
||
A number of steps have been taken to stop smart cards being copied
|
||
or cloned. A physical deterrent is the first line of defence, and
|
||
the integrated circuit contained within the card makes "probing"
|
||
very difficult as the IC is likely to become damaged in the process.
|
||
|
||
Cost is a second factor which is likely to deter manufacturers of
|
||
illegal decoders. A considerable amount of time, trouble and
|
||
expensive resources would be required to clone the card.
|
||
|
||
The manufacturers of Videocrypt recommend that the cards are re-
|
||
placed every six months, and each time this is done a "secret en-
|
||
crypting algorithm" will be changed. Any pirate decoders manufac-
|
||
tured during this time would be relatively useless.
|
||
|
||
And should a pirate decoder be manufactured, it will contain a
|
||
unique security code, which could be blacklisted by the systems
|
||
operator once the code has been discovered - leading to calls of
|
||
complaint by angry customers.
|
||
|
||
Video taping
|
||
|
||
Videocrypt offers an simple method of tracking down pirates who
|
||
video high-value programming and then distribute it.
|
||
|
||
The customers unique number can be displayed on the unencoded screen
|
||
for reference and future litigation. Although an on-the-screen
|
||
code can be generated for signals piracy in a public place, the
|
||
codes can be hidden in the picture - and retrieved by a technician
|
||
at a later stage.
|
||
|
||
Videocrypt-your flexible friend?
|
||
|
||
Videocrypt can be used in a number of applications other than tv
|
||
signals protection. They include:
|
||
|
||
Messaging, messages can be transmitted to individual subscribers or
|
||
to a group, so target messaging is now a potential. Messages like:
|
||
"Satellite owners in LONDON call 081 XXX XXXX now for a great bar-
|
||
gain".
|
||
|
||
Selling, sales over the air can be utilised with the unique identity
|
||
number which verifies an owner and their registered address. Data
|
||
can be matrixed with a user personality during ad-breaks to tailor-
|
||
make the advertisement.
|
||
|
||
A unique transaction alphanumeric can be displayed on the TV screen,
|
||
and the subscriber will telephone a given number and quote the
|
||
alphanumeric - and the deal can then be completed in total security.
|
||
|
||
Scrambling
|
||
|
||
The majority of scrambling systems currently on the market are
|
||
dependent on analogue processing circuitry, and it is a hard task to
|
||
get a secure system without picture deterioration.
|
||
|
||
Videocrypt can encode and decode a picture without degradation.
|
||
|
||
The crux of the scrambling system evolves around a patented develop-
|
||
ment of Active Line Rotation (Cut and Rotate principle).
|
||
|
||
Every line of the signal is cut at a number or points along its
|
||
length, and this is chosen at random by a 60 bit psuedo random
|
||
binary sequence generator (PRBS). As each cut point differs from
|
||
the next the signal has no viewing value to an unauthorised recipi-
|
||
ent, but authorised recipients decoders recode the picture so that
|
||
the true state of the unscrambled line is always first out for
|
||
display.
|
||
|
||
The PRBS is re-seeded at times too, to enhance the security of the
|
||
system even more.
|
||
|
||
Before this ALR process can take place, the decoder needs to be
|
||
aware of the cut point on each of the transmitted lines, this is
|
||
provided within the encryption process. Each decoder utilises an
|
||
PRBS which reflects the characteristics of the system so that the
|
||
two halfs can be synchronised and a viewable picture displayed.
|
||
|
||
Data is transmitted in a series of over-the-air packets, which looks
|
||
like:
|
||
|
||
SYSTEM-----SMART or BLACKLIST
|
||
|
||
The system comprises of system data included Flat-Shamir identifica-
|
||
tion information, on-screen display messages, fingerprinting and
|
||
blacklisting data.
|
||
|
||
The smart card packet comprises of:
|
||
|
||
HEADER-----ENCRYPTED DATA-----CHECKSUM
|
||
|
||
The Videocrypt encryption system is based around a tightly-guarded
|
||
secret which has defeated system hackers throughout the world. A
|
||
final control algorithm is central to the systems security and this
|
||
can be changed at will if the system has been hacked.
|
||
|
||
Complex calculations are performed within the system in order not to
|
||
compromise its security.
|
||
|
||
But hackers who have attempted to hack the decoder will be disap-
|
||
pointed - as there are no secrets held within the system.
|
||
|
||
Smart Cards
|
||
The smart card offers great flexibility to the programme controller
|
||
and the viewer alike, and is the key to the Videocrypt system.
|
||
|
||
The Integrated circuits incorporated within the smart card have a
|
||
lot of power and contain EPROM elements which are partially burned
|
||
during their manufacture. The ICs are buried within the design to
|
||
make the system harder to penetrate.
|
||
|
||
Smart card block diagram
|
||
|
||
|
||
------- ------- -------
|
||
VCC -> - RAM - - ROM - -EPROM-
|
||
------- ------- -------
|
||
^ ^ ^
|
||
TO AND FROM
|
||
-------------------------------
|
||
GND -> - INTERNAL BUS -
|
||
-------------------------------
|
||
TO AND FROM
|
||
------- ------- -------
|
||
-8 BIT- -ANTI - -S/WRE-
|
||
RST -> -CPU - -FRAUD- -CNTRL-
|
||
- - -DVCES- -I/FCE-
|
||
------- ------- -------
|
||
|
||
|
||
CLK VPP I/O
|
||
|
||
Over the air addressing
|
||
|
||
Algorithmic information is transmitted to the viewer over the air,
|
||
encrypted within the Videocrypt system.
|
||
|
||
This data is transmitted within the Vertical Blanking Interval (VBI)
|
||
and four lines are employed for active data and two others, one
|
||
white and one black (for test purposes).
|
||
|
||
An application of Non Return To Zero (NRZ) with an constant energy
|
||
spectrum maximises the systems characteristics.
|
||
|
||
Four picture-sustaining techniques are used to ensure a high quality
|
||
picture. Bit interleaving, hamming codes, quadruple repetition and
|
||
check sums are used within the process.
|
||
|
||
The system can cope with fringe reception areas and will still
|
||
function correctly with high levels of noise.
|
||
|
||
Picture quality
|
||
|
||
Picture quality is paramount for any scrambling system and due to
|
||
the standard being of a digital origin, integrity of the signal is
|
||
maintained throughout the encryption and de-encryption process.
|
||
Amplitude sampling is conducted by the decoder and a 14MHz internal
|
||
clock ensures jitter-free pictures and unstable framing. A digi-
|
||
tally derived Automatic Gain Control (AGC) is also included within
|
||
the receiver.
|
||
|
||
Scrambling Sound
|
||
|
||
Videocrypt also has the capability of encrypting sound sources to
|
||
enhance the security of premium events. To date this level of
|
||
security has not been utilised by broadcasters.
|
||
|
||
The system of spectrum inversion renders the sounds received without
|
||
authorisation worthless. Videocrypt transposes the frequencies
|
||
transmitted and this in turn removed distortion of the sound.
|
||
|
||
Technical Data
|
||
(supplied by Thomson Consumer Electronics, 1991- subject to change)
|
||
|
||
VIDEOCRYPT BASEBAND DECODER
|
||
* Stand alone video decoder
|
||
* On screen display
|
||
* De emphasis switch
|
||
* Authorise button
|
||
* Integrated smart card reader
|
||
* Power indicator
|
||
|
||
PAL MODEL
|
||
Video input level IV +/- 3dB flat and clamped
|
||
Baseband input level 250 mV +/- 3dB, unclamped level
|
||
measured at pre-emphasised transition
|
||
frequency
|
||
Suitable de-emphasis CCIR 405-1
|
||
Video output level IV p.p. into 75 ohms
|
||
Video bandwith 50Hz - 4.8 Mhz -3dB typical
|
||
Line tilt <_ 1% typical
|
||
Luma/Chroma Delay +/- 50nS typical
|
||
S/N ratio: 50dB typical weighted
|
||
|
||
CONNECTIONS
|
||
AV Peritel (Scart)
|
||
Audio loopthrough Left and right
|
||
Pin 8 High with scrambled video input
|
||
Low with clear video input
|
||
Pin 16 5v 50mA maximum for external
|
||
modulator (OPTION)
|
||
|
||
MISCELLANEOUS
|
||
Standards Designed to IEC 65
|
||
Operating Temperature Range 5-40 C
|
||
Mains Input 216-255 V AC 50 Hz
|
||
Power Consumption 15W
|
||
Weight 2.5Kg
|
||
|
||
VIDEOCRYPT ENCODER (PAL/SECAM/NTSC)
|
||
* 19" rack mounting
|
||
* Active line cut and rotate
|
||
* Twin or single scrambler
|
||
* Separate power supply
|
||
* Integrated cooling unit
|
||
* Data for control access in the VBI
|
||
* RS232 interface
|
||
|
||
Video input level IV 75 ohm
|
||
Video output level IV peak to peak +/- 2% 75 ohm
|
||
Line tilt 0.5% typical
|
||
Base line distortion 0.5% typical
|
||
Chrominance to luminance 3% typical
|
||
2T/Bar ratio 2% typical
|
||
Synchro level 1% typical
|
||
S/n ratio RMS weighted >_ 67dB
|
||
Chrominance luminance:
|
||
intermodulation <_ 2%
|
||
differential gain 1% typical
|
||
differential phase 1" typical
|
||
luminance non-linearity 1% typical
|
||
chrominance/luminance delay +/- 10nS typical
|
||
video bandwith at 3dB >_ 5.8 Mhz
|
||
Output DC level 300 mV +/- 50 mV
|
||
Sampling frequency rejection >- 50dB at 14 Mhz
|
||
Number of bits per sample 10
|
||
|
||
CONNECTIONS
|
||
Connections to security comp RS232
|
||
Local VT100 terminal ditto
|
||
Video in BNC 75 ohm
|
||
Scrambled video out BNC 75 ohm
|
||
|
||
MISC
|
||
Local terminal functions are to
|
||
show working parameters
|
||
give warnings
|
||
control local
|
||
remote
|
||
autonomous
|
||
Select scrambling mode
|
||
clear
|
||
free access
|
||
control access
|
||
|
||
Mains input low pass filtering
|
||
Audio scrambling using spectrum
|
||
inversion 0dB/600 ohm (optional)
|
||
|
||
ENDS
|
||
|
||
|
||
**** Sky card hacking info 26/06/1993 ***
|
||
|
||
|
||
|
||
|
||
When the VideoCrypt system was launched, the press releases
|
||
claimed that it was the most pirateproof system yet devised. Some
|
||
of the people involved in the design of the system claimed that it
|
||
would take billions of years to break the codes used by the
|
||
system. The usual media journalists swallowed this hook line and
|
||
sinker. The hackers knew otherwise.
|
||
|
||
The VideoCrypt system is the mainstay of the BSkyB satellite
|
||
television empire. It is the means by which BSkyB makes its money
|
||
from the subscribers. The basic theory is that they pay a
|
||
subscription for the premium channels and they receive a smart
|
||
card. This smart card, when inserted into the VideoCrypt decoder
|
||
will allow the decoder to descramble the channels paid for. It is
|
||
also possible for BSkyB to turn off the cards of those subscribers
|
||
who have not paid.
|
||
|
||
Hacking scrambling systems such as VideoCrypt is a multi-million
|
||
pound industry. Due to the present legal situation it is perfectly
|
||
legal to hack a channel that originates outside the UK. However
|
||
for someone in the UK to hack a UK originated channel is illegal.
|
||
Such mere facts as illegality have never bothered pirates.
|
||
|
||
In the last few weeks the impossible has happened. The VideoCrypt
|
||
system has been conclusively hacked. It is now possible to
|
||
purchase a pirate smart card or chip which will allow the viewer
|
||
to descramble Sky Movies Plus, The Movie Channel, Sky Gold, Sky
|
||
Sports and TV Asia. The cost of this pirate card is <20>99. The price
|
||
in itself is lower than the subscription for the channels.
|
||
|
||
Other channels using the VideoCrypt system. Are worried. According
|
||
to the latest reports, The Adult Channel and JSTV have been
|
||
compromised as well. This means that all of the channels currently
|
||
using the VideoCrypt system as a fee gathering system have just
|
||
lost control of the market. It is now, well for the moment anyway.
|
||
a pirate's market.
|
||
|
||
This hack is, like all hacks, colourfully named. It is known as
|
||
the "Ho Lee Fook" hack. The joke being that this is generally the
|
||
exclamation uttered by people when told of the hack. There are two
|
||
forms of the hack; a card and a chip.
|
||
|
||
The card version of the hack is about sixteen millimetres longer
|
||
than the official BSkyB card. Essentially it is a single chip
|
||
mounted on a printed circuit board that plugs directly into the
|
||
VideoCrypt decoder's card socket. This is the more user-friendly
|
||
version as it does not require any modification to the decoder.
|
||
|
||
The chip version does require some modification to the decoder.
|
||
The official VideoCrypt name for the chip in the decoder is "The
|
||
Verifier". This chip has to be removed and replaced with the
|
||
pirate chip. The decoder will then decode the scrambled channels
|
||
without the need for the BSkyB smart card.
|
||
|
||
The pirate cards and the chips are on sale. It is believed that
|
||
a number of them are already in the UK. Indeed I received one, in
|
||
a brown paper envelope, on June the eighth. It is still working.
|
||
|
||
The problem for BSkyB and other users of the VideoCrypt system is
|
||
not one of containment. Things have progressed too far for that.
|
||
The problem is more serious. Unless they can come up with a quick
|
||
fix for the system that will render the Ho Lee Fook hack inactive,
|
||
they have to replace the smart cards.
|
||
|
||
BSkyB initially set out to replace their smart cards every three
|
||
months. This continual update was, so the theory went, meant to
|
||
deter hackers from trying to hack the system. Fiscal reality has a
|
||
crushing effect of such business school theories.
|
||
|
||
VideoCrypt suffered its first real disaster when someone
|
||
discovered that by limiting the programming voltage to the card,
|
||
it was possible to stop the card being switched off. This hack was
|
||
known as the "Infinite Lives" hack. It was an old computer term
|
||
for a modification to a games program that gave the player
|
||
unlimited lives. Since BSkyB could not turn off the cards it
|
||
seemed an apt name. This hack was followed by a new issue or batch
|
||
of cards. The "Infinite Lives" hack did not work on the new cards
|
||
but a new hack did.
|
||
|
||
The KENtucky Fried Chip upped the ante. It was the first time that
|
||
the actual internal operation of the VideoCrypt decoder was
|
||
interfered with. It was a rewritten "Verifier" chip that was
|
||
programmed to stop the cards being turned off. It did not work at
|
||
full efficiency so it was not marketed by the pirates. After this
|
||
hack, BSkyB issued a new batch of cards which was more resilient
|
||
to this hack.
|
||
|
||
The current card issue is issue 07. The Ho Lee Fook hack is
|
||
working on this batch. If BSkyB introduce issue 08 cards, then
|
||
there is the possibility of the hack ceasing to work. At this
|
||
stage there is the terrible spectre of the hack being updated to
|
||
work with the 08 cards. It is the thing of which BSkyB's
|
||
nightmares are made of.
|
||
|
||
The issue of new card batches occurs mainly in Spring or Autumn. A
|
||
Summer launch of the new 08 cards would be unusual. As VideoCrypt
|
||
will be going to a tiered channel structure in the Autumn, it
|
||
would seem that they have planned an Autumn update. The Ho Lee
|
||
Fook hack may force them to bring their plans forward by some
|
||
three months or so.
|
||
|
||
The confidence in a system is not based on how well a system
|
||
repels hacks but rather on how well a system recovers from hacks.
|
||
This will be a true test of the VideoCrypt system and its smart
|
||
card based philosophy. The philosophy is that of the detachable
|
||
secure controller. Basically what this means is that if the system
|
||
is hacked then all that needs to be done to stop the hack is to
|
||
issue a new card.
|
||
|
||
The effects on the confidence of present and prospective users of
|
||
VideoCrypt is more difficult to gauge. The smart card is the core
|
||
of the VideoCrypt system. Seeing it replaced by a pirate smart
|
||
card contradicts every claim made in favour of VideoCrypt. It was
|
||
not supposed to be possible. One thing is certain, channels will
|
||
now have to look at a scrambling system as only being a temporary
|
||
form of protection that has to be frequently updated. Failure to
|
||
do so will be fatal.
|
||
|
||
John McCormac
|
||
Author of "European Scrambling Systems 3" ISBN 1-873556-02-0
|
||
Editor of Hack Watch News.---
|
||
|
||
*** Latest ***
|
||
|
||
|
||
There is no such thing as coincidence - or is there? On the day that
|
||
the film "Sneakers" was released on video, I received an actual working
|
||
hack for the scrambled Sky channels. The film "Sneakers" is about
|
||
events surrounding a piece of equipment that can hack any cryptosystem.
|
||
The piece of equipment that I received is essentially a chip that can
|
||
hack the Sky VideoCrypt channels.
|
||
This latest hack on the VideoCrypt system has been labelled the "Ho
|
||
Lee Fook" hack. The reason for this name is more to do with people's
|
||
reaction to the hack rather than its origin, which incidentally is
|
||
Central Europe.
|
||
This is perhaps the most dangerous hack to have occurred on VideoCrypt
|
||
- it replaces the smart card. In effect it is a new smart card that
|
||
gives access to all the Sky channels. Of course the problem for Sky is
|
||
that it is not a genuine Sky card.
|
||
|
||
The card is approximately sixteen millimetres longer than the official
|
||
Sky card. It is a blue printed circuit with a single surface mount
|
||
chip, and five connector pads. The identification numbers on the chip
|
||
have been scrubbed.
|
||
The standard check for a card of this nature is to look for a wafer
|
||
from an official smart card. In the early days, a fairly common scam
|
||
was to take the chip and connector pad from a valid Sky card, trim away
|
||
the plastic and then put the chip in a DIL header. The DIL header would
|
||
then be blobbed in a lump of black resin so that it looked like an IC.
|
||
The decoder would then have its card reader replaced with an ordinary
|
||
DIL IC socket. Then the decoder and chip would be shown or sold to some
|
||
unsuspecting, if greedy, punter.
|
||
The chip appeared to be real, with no wafer underneath the body of the
|
||
chip. The actual stubs of the chip die were just visible at the end of
|
||
the chip. It was a genuine chip.
|
||
|
||
It has been working steadily for the last few days and there appears
|
||
to have been no kill messages sent to it. If it had been a direct
|
||
clone, Sky would have been able to kill it over the air - or would
|
||
they?
|
||
Since the people who developed this hack obviously understand the
|
||
operation of the over the air addressing, they may well have designed a
|
||
filter to stop the kill message from having any effect of the pirate
|
||
card. There are of course more devastating implications here. The card
|
||
itself may only contain the data and algorithms necessary to descramble
|
||
the signals.
|
||
The chip version of this hack is based on the 8752. This Ho Lee Fook
|
||
chip will replace the official 8052 in the decoder. A selling price of
|
||
ninety nine pounds has been mentioned in Germany.
|
||
|
||
Nobody is sure what the people in News Datacom are doing about this
|
||
hack. Sky are more than likely very upset that someone has hacked their
|
||
pirateproof system yet again. This is the fifth hack and the image of a
|
||
pirateproof system now only exists in the minds of PR people.
|
||
|
||
|
||
|
||
*** -=Y_HS=- all (c)'s acknowledged ***
|