Xlog

Cory Doctorow has posted an article on BoingBoing discussing the recent news that the processing keys for AACS, the DRM system used by Blu-Ray and HD-DVD have been extracted. This allows the content on EVERY Blu-Ray and HD-DVD to be decrypted. This news builds on the recent news that the volume keys for HD-DVD had been compromised. Quoting from Cory Doctorow:

AACS took years to develop, and it has been broken in weeks. The developers spent billions, the hackers spent pennies.

For DRM to work, it has to be airtight. There can’t be a single mistake. It’s like a balloon that pops with the first prick. That means that every single product from every single vendor has to perfectly hide their keys, perfectly implement their code. There can’t be a single way to get into the guts of the code to retrieve the cleartext or the keys while it’s playing back. All attackers need is a single mistake that they can use to compromise the system.

There is no future in which bits will get harder to copy. Instead of spending billions on technologies that attack paying customers, the studios should be confronting that reality and figuring out how to make a living in a world where copying will get easier and easier. They’re like blacksmiths meeting to figure out how to protect the horseshoe racket by sabotaging railroads.

Arnezami from the Doom9 forum describes the moment:

But then I realized why I first didn’t find the Media Key: it was removed from memory after the Volume ID was retrieved and the VUK calculated. I also saw that in my “corrupt” memdump the VUK, Vol ID, Media Key and the Title Key MAC were all closely clustered in memory: in the first 50kb (of the entire multi megabyte file!) but there were large empty parts around it. Almost as if it was cleaned up. This gave me an idea: what I wanted to do is “record” all changes in this part of memory during startup of the movie. Hopefully I would catch something insteresting. In the end I did something a little more effiecient: I used the hd dvd vuk extractor (thanks ape!) and adapted it to slow down the software player (while scanning its memory continously) and at the very moment the Media Key (which I now knew: my bottom-up approach really paid off here) was detected it halted the player. I then made a memdump with WinHex. I now had the feeling I had something.

And I did. Not suprisingly the very first C-value was a hit. I then checked if everyting was correct, asked for confirmation and here we are.