256 lines
12 KiB
Plaintext
256 lines
12 KiB
Plaintext
Syndicated Hack Watch 08:93
|
||
|
||
The Start Of The War
|
||
|
||
Sky had suffered its most devastating hack to date. Its security
|
||
was demolished and the MultiChannels package was about to be
|
||
introduced. They had to do something fast or it would all slip
|
||
away.
|
||
|
||
The Blackbox industry was beginning to move the pirate cards for
|
||
Sky in volume. There were talks of quantities of ten thousand
|
||
being sold. Cards were beginning to filter into the UK. At this
|
||
stage Sky had no option but to move. The pirates were attacking on
|
||
the home front. This was economic war and Sky was losing.
|
||
|
||
The Grey Market piracy of a card for a card was an essential
|
||
factor in Sky's growth. As long as it wasn't too overt then it did
|
||
not seem to matter. Sky were benefiting from the arrangement as
|
||
was the other channels such as FilmNet.
|
||
|
||
With the advent of the Ho Lee Fook hack the Grey Piracy market
|
||
took a bit of knock. The Ho Lee Fook card and chip allowed access
|
||
to all VideoCrypt scrambled channels. The prices varied but the
|
||
lowest quoted figure was œ99.00. Considerably less than what Sky
|
||
were charging for the whole package.
|
||
|
||
As if by some miracle, Sky and News Datacom came up with a fix for
|
||
the hack. Yes it was not really Sky's responsibility to fix the
|
||
hack. News Datacom, the designers of the security architecture had
|
||
to try and stop the Ho Lee Fook hack. It seemed that the had found
|
||
a solution.
|
||
|
||
As with all events in the Blackbox industry, it has been assigned
|
||
a catchy name. The name of solution is the "Zombie Fix". No, this
|
||
is not the name for the continual brainwashing adverts on Sky
|
||
One. The reason for the name is that old cards have recently
|
||
started to work again on this 3.5 Second on - 3.5 Second off
|
||
cycle. Cards that have been authorised for Sky's movie channels
|
||
are working on TV Asia. Other cards such as those for the Adult
|
||
Channel are working on the same basis on the Sky channels.
|
||
|
||
The Blue card that I had received started to act funny. At first
|
||
it happened on only Sky Movies and The Movie Channel. Sky Gold and
|
||
TV Asia were unaffected. It could have been a problem on the Sky
|
||
channels but experience and instinct proved otherwise. It was a
|
||
countermeasure. After a few days, the same sort of effect occurred
|
||
on TV Asia and Sky Gold. The upgrade to VideoCrypt was complete.
|
||
|
||
The program in the Ho Lee Fook card and chip apparently contained
|
||
enough to decode the scrambled channel but not enough to respond
|
||
to the over the air switch off codes. This limited implementation
|
||
meant that the hack was a very powerful one. It was not possible
|
||
for Sky and News Datacom to actually send out a command for the
|
||
card to switch off. What this implies is that the card had enough
|
||
information and data to decode the channels. The hack had
|
||
separated the access control from the decryption aspect.
|
||
|
||
Of course the fact that the Ho Lee Fook hack was not a full
|
||
implementation may well have provided a weak spot for Sky and
|
||
News Datacom.
|
||
|
||
This is the point at which the hack was attacked. The datastream
|
||
on the VideoCrypt system appears to have been altered. The
|
||
alteration did not affect the official Sky cards but the pirate
|
||
cards and chips started to malfunction.
|
||
|
||
Essentially the Zombie Fix caused the pirate card to return a
|
||
fixed key every second time. This is the standard response when a
|
||
bad card is inserted. The card cannot match the challenge and it
|
||
jumps to a sub-routine that returns a fixed key.
|
||
|
||
The standard response to the wrong card being inserted is hidden
|
||
from the viewer. Ordinarily when the wrong card is inserted the
|
||
on-screen graphics will make the fact clear. Sky and News Datacom
|
||
were a little clever here.
|
||
|
||
The data for "Wrong Card Inserted" may well be passed to the on
|
||
screen graphic display chip. A signal is being sent out over the
|
||
air to this chip to switch it off during this operation. One of
|
||
the effects of the countermeasure is that the channel identifier
|
||
message does not come up on the screen either.
|
||
|
||
|
||
ECM Meets Electronic Counter Counter Measure
|
||
|
||
At this stage the war between the pirates and Sky is growing
|
||
complex. The Zombie Fix has been met with a new card and chip
|
||
issue. The new card and chip work on the Sky channels and the
|
||
other VideoCrypt scrambled channels.
|
||
|
||
According to sources the hackers only took ten minutes to come up
|
||
with the solution to the Zombie Fix. It was, apparently, a rather
|
||
simple one but it did require the replacement and upgrading of all
|
||
the pirate cards and chips on the market. It appeared that Sky had
|
||
hit the pirates.
|
||
|
||
The problem for Sky and News Datacom is that they are not dealing
|
||
with a FilmNet type situation. When FilmNet's analogue SatPac
|
||
system was being pirated, the market was at its most expanded.
|
||
Every Tom Dick and Harry was involved and there was very little
|
||
organisation. The current pirate market is better organised and
|
||
the buy in price is high financially and technologically.
|
||
|
||
The main problem of getting the updated hack into the market now
|
||
seems to have been solved. Some dealers in Holland were promising
|
||
a one week turn around on the chips and cards. From information
|
||
received this time schedule has been followed.
|
||
|
||
The Blackbox Industry has recovered from the Zombie Fix at a rate
|
||
that has alarmed Sky and News Datacom. The recovery appears to be
|
||
just in time for the introduction of the Sky MultiChannel package.
|
||
|
||
|
||
The Next Move
|
||
|
||
With the imminent introduction of Sky MultiChannels, a compromised
|
||
VideoCrypt is a very big problem. It remains to be seen what will
|
||
happen. Sky and News Datacom will have to make a move on the
|
||
situation soon.
|
||
|
||
Assuming they have another fix up their sleeves they can wait
|
||
until the market is saturated with pirate cards and then
|
||
introduce the electronic counter measure (ECM). It would naturally
|
||
have the most effect as it would deter a larger number.
|
||
|
||
However pressure from other users of the VideoCrypt system may
|
||
force the situation. There are two options here: the immediate
|
||
introduction of the ECM or the introduction of a new card series.
|
||
Both options hinge on availability. If there is no ECM now or
|
||
likely within the next few months, Sky and News Datacom will be
|
||
forced into bringing the 08 series of cards. Again if there is not
|
||
a sufficient number of the 08 cards available they will have to
|
||
maintain the 07 issue and with it the pirate market.
|
||
|
||
Normally the smart cards are changed in the Spring or Autumn.
|
||
Introducing the 08 issue card over the next few months would
|
||
conform to the pattern but the logic is flawed. The Sky
|
||
Multichannels is coming into operation over the same time period.
|
||
The subscriptions and card administration will place a strain on
|
||
Sky's operation and the hassle from new cards would only
|
||
complicate things.
|
||
|
||
If Sky do introduce a new card issue then it may occur anytime
|
||
from October onwards. Some sources favour April 1994 for the new
|
||
issue.
|
||
|
||
The question of Pay Per View still remains unanswered. The 07 card
|
||
issue was to have handled this facility. The P000 T000 was the
|
||
indication. With the Ho Lee Fook hack it would seem that the idea
|
||
was stalled for the moment. Hypothetically the Sky Gold
|
||
transponder might be the ideal path for a PPV service. Of course
|
||
if the hack is as dangerous as everyone thinks then it is possible
|
||
that the PPV routines will have been compromised as well.
|
||
|
||
A hack on the PPV routines would in some senses be more severe
|
||
than the hack on the VideoCrypt system. The PPV channel would be
|
||
carrying premium programming and would be far more costly than the
|
||
movie or sports channels. Therefore a pirate card that would give
|
||
infinite tokens or credits would be extremely valuable.
|
||
|
||
|
||
|
||
Hi-Tech's Card Trick
|
||
|
||
The Hi-Tech Card Tricks card is a reality and it works. The card
|
||
is black and uses a PIC processor. When tested it worked on
|
||
FilmNet. It seems that once again FilmNet are in trouble. The
|
||
EuroCrypt-M system is now compromised.
|
||
|
||
The reason that the card handles only FilmNet is the legality of
|
||
the situation. If the card actually decoded the TV3/Tv1000
|
||
channels then it would be just as illegal in the UK as a pirate
|
||
Sky card.
|
||
|
||
The problem has to do with the uplink or origination of
|
||
TV3/TV1000. Since it is being uplinked from the UK it is
|
||
technically a UK originated channel and is therefore protected by
|
||
the UK Copyrights Patents And Designs Act - just like Sky. The
|
||
tricky question of the porn is neatly sidestepped. They uplink
|
||
that from outside the UK.
|
||
|
||
The cost of the card is œ150 and it is available from Hi-Tech. It
|
||
is the only card that descrambles D2-MAC EuroCrypt-M signals at
|
||
the moment.
|
||
|
||
|
||
|
||
Active Logic - Cannot Recommend A Purchase - Yet
|
||
|
||
A company called Active Logic has been advertising heavily in What
|
||
Satellite and claiming to supply pirate smart cards for D2-MAC
|
||
channels such as FilmNet. The advert is cause for concern as it
|
||
promises a lot but is too cleverly worded to make coherent sense.
|
||
It assures the reader that the cards are Unique Clone Designs.
|
||
This is a bit of a contradiction in terms. Other factors such as
|
||
the wording of the advertisement have given brought back memories
|
||
of PR Technology's brash style. Now they may be totally
|
||
unconnected.
|
||
|
||
The hints at the cards for other D2-MAC channels being available
|
||
are decidedly dodgy. If they have pirate cards for TV3/TV1000,
|
||
then they are in violation of the Copyright Patents And Designs
|
||
Act. The advert also mentions that there is a German address. If
|
||
they are clever then they may try to use the German address to
|
||
ship these cards from. Even so it would still put the UK operation
|
||
in trouble as they would be supplying information and a product in
|
||
breach of the act.
|
||
|
||
|
||
Red Hot Television To Make A Comeback
|
||
|
||
It appears that despite the rumours floating about, Red Hot
|
||
Television is not dead yet. What appears to have happened was that
|
||
the operation in Denmark was closed down but not the channel
|
||
itself. The channel was busy arranging alternative finance.
|
||
|
||
According to some reports they have arranged the new financing and
|
||
will be back on Eutelsat 2-F1 within the next few weeks. The test
|
||
bar transmissions on the same Eutelsat transponder (11.181 GHz
|
||
Horizontal) are scheduled to start on August 24th with a full
|
||
service resuming on August 29th.
|
||
|
||
The scrambling system that they will use for the next few weeks
|
||
will be the SAVE system. This means that the present array of SAVE
|
||
descramblers will not have to be upgraded just yet.
|
||
|
||
The tests of the Enigma-1 system just before the channel went off-
|
||
air were successful and it is believed that the smart card for the
|
||
channel was into the prototype stage.
|
||
|
||
The hack on the VideoCrypt system threw up an unexpected problem
|
||
in that the JSTV smart card actually descrambled the Enigma-1
|
||
scrambled signal. There were no doubt a lot of happy JSTV viewers
|
||
except that there was a "Wrong Card Inserted" graphic over a
|
||
rather strategic part of the screen. Both the new and old JSTV
|
||
cards appeared to work on the system. Of course the channel will
|
||
eventually, according to the information received, switch to
|
||
Enigma-1.
|
||
|
||
There are other porn channels who claim to be starting up soon.
|
||
TV69 apparently has the backing of some ex-Red Hot Television
|
||
people and VTO. It will, so the claim, use VideoCrypt with cards
|
||
supplied via the Adult Channel. This is only one of a few channels
|
||
that may or may not start transmitting over the next few months.
|
||
After 12 Europe is also one of those mooted. It remains to be seen
|
||
which will actually start transmitting.
|
||
|
||
******************************************************************
|
||
Syndicated Hack Watch - Copyright (c) 1993 All Rights Reserved
|
||
|
||
MC2 Publications Division
|
||
22 Viewmount, Waterford,
|
||
Ireland
|
||
|
||
|
||
|