Managing Rights Management

Amazon and HP DRM Patents

On Tuesdays the UPSTO issues new patents. Both of today's Spotlight Patents concern aspects of digital rights management.  Assigned to Amazon, the first patent addresses techniques for controlling use of computing-related resources by multiple independent parties. Assigned to HP, the second patent addresses techniques for secure loading, integrity checking of the runtime image and control over the runtime execution of applications.

Affine Systems and Navy Fingerprinting Patent Applications

On Thursdays the USPTO publishes new pending patent applications. Both of today's Spotlight Applications concern aspects of digital fingerprinting. Assigned to Affine Systems, the first application discloses techniques for matching an advertisement to a video. Assigned to the Secretary of the Navy, the second application discloses for radio-frequency fingerprinting as a security layer in RFID devices.

Apple and McAfee Software Obfuscation-related Patent Applications

On Thursdays the USPTO publishes new pending patent applications. Both of todays Spotlight Applications concern aspects of software obsfucation as a security technique. Assigned to Apple, the first application discloses techniques for software data reference obfuscation. Assigned to McAfee, the second application discloses techniques for obfuscated malware detection.

Intertrust and Nokia DRM Patents

On Tuesdays the USPTO publishes new patents. Both of today's Spotlight Patents address aspects of DRM and information security. Assigned to Intertrust, the first patent concerns techniques that use cryptography to protect secure and insecure computing environments. Assigned to Nokia, the second patent concerns techniques for sharing of content protected by digital rights management.

Three DRM-Related Patents From InterTrust Technologies

Tuesdays the USPTO issues new patents. Three InterTrust DRM-related patents issued today, and rather than choosing two of them, today's Spotlight Patents note all three. The first concerns techniques for software self-checking. The second concerns techniques for using cryptography to protect secure computing environments. The third concerns techniques for managing the distribution of electronic content.

Vanishing Act

The NYTimes article on reports on the work of University of Washington computer scientists on "self-destructing messages."

Vanish uses a key-based encryption system in a different way, making it possible for a decrypted message to be automatically re-encrypted at a specified point in the future without fear that a third party will be able to gain access to the key needed to read the message.

The pieces of the key, small numbers, tend to “erode” over time as they gradually fall out of use. To make keys erode, or timeout, Vanish takes advantage of the structure of a peer-to-peer file system. Such networks are based on millions of personal computers whose Internet addresses change as they come and go from the network. This would make it exceedingly difficult for an eavesdropper or spy to reassemble the pieces of the key because the key is never held in a single location. The Vanish technology is applicable to more than just e-mail or other electronic messages. Tadayoshi Kohno, a University of Washington assistant professor who is one of Vanish’s designers, said Vanish makes it possible to control the “lifetime” of any type of data stored in the cloud, including information on Facebook, Google documents or blogs. In addition to Mr. Kohno, the authors of the paper, "Vanish: Increasing Data Privacy with Self-Destructing Data," include Roxana Geambasu, Amit A. Levy and Henry M. Levy.

In a posting on Dave Farber's Interesting Persons list, Ed Garek observes:

Congratulations on the NYT article. However, the significant point of using a trust model that does not depend on the integrity of third parties is not new, while relying on a peer-to-peer network for "key hiding" is by itself an unsolved problem today (both technically and commercially). The free "Zmail Basic" listed in "Ten Free Services To Send Self-Destructing Emails Which Expire/Disappear Automatically After Specified Time Interval" ... also uses a trust model that does not depend on the integrity of third parties but the novelty there is that keys are not stored anywhere (each dialogue party holds a part of it), and uses a system of "minority control" to allow independent destruction of the capability to reassemble the entire key.

The BD+ Cat and Mouse Game: Advantage BD+

The programmable security technology used by Fox and more recently Paramount to protect theatrically released films on Blu-ray discs represents an important step forward over previous security technologies, such as the quickly broken CSS for DVDs and AACS encryption key management used on the now dead HD-DVD and on Blu-ray. Although no security technology is perfect, BD+ is an important advance because the programming can be modified in response to successfull cracks. 

There has always been a cat and mouse game between security technologies of all kinds and those who seek to break them. Each side learns from the others successes and failures and improves their defense and offense accordingly. Postings on Slashdot  and the Slysoft website report that there are now at least 19 Blu-ray releases that have not yet been broken.

It appears that the least powerful forms of BD+ were used first in order to determine how crackers / hackers would attack the security system. Having been through several iterations, it seems that the level of security has been upgraded on the newer offerings.

AACS-LA Changes Licensing Terms

As noted earlier, the International Digital Media Alliance (nee the DVD Association)  have been lobbying the AACS licensing authority to reduce fees to accommodate smaller companies. Now the H-Security site reports that AACSLA has reduced fees.

 The Advanced Access Content System Licensing Administrator (AACS LA) has reduced the licence fees for its mandatory AACS copy protection for Blu-ray Discs. The new scale of charges is primarily intended to benefit small studios and pressing companies that have yet to release any Blu-ray versions of their films due to the high cost.

Licensees no longer need to make a one-off payment of $3,000 for a Provider Agreement. Instead they pay $500 annually and can terminate their contract with the AACS LA at any time. The licence fee for a glass master used for producing a film disc has also been reduced from $1,300 to $500.

AACS Interim License Agreement Expiring?

Tyler Pruitt points out that the AACS-LA interim licensing agreement expires on February 27th. AACS is one of the security standards used in Blu-ray discs and players (and in the now defunct HD-DVD format).

The thing that makes this important is the much lauded “Managed Copy” technology specifications are set to be finalized in the AACS Final Licensing Agreement. Managed Copy on Blu-ray will enable users to keep a HD quality copy of their movies on a central home server type device. This feature could be a killer app for the Windows Home Server market.

So will the market demand "Managed Copy"? Will the MPAA studios insistent on "Managed Copy"?

Stay tuned.

Macrovision (MSVN), Blu-ray, and BD+

Macrovision held it's quarterly earnings call for analysts and investors on Tuesday. Here are a few selected excerpts from different parts of the transcript that deal with BD+ security for Blu-ray discs and players and the uptake of Blu-ray players in the marketplace.

In other category, while we expect to see fairly linear growth, we do expect the fourth quarter will be the strongest, assuming we are successful at broadening our licensing of BD Plus to the MPA studios. Adding it all up, we expect approximately 53% to 55% of our 2009 annual revenue coming in the second half, similar to our adjusted pro forma revenue weightings in 2007 and 2008....

BD+ Broken Yet Again

As many news outlets (e.g., CDRInfo, ) have noted, the latest version of BD+, the virtual machine based software that protects movies and games on Blu-ray discs.  The cat and mouse game continues.

Blu-ray BD+ Resealed, At Least For A While

Slashdot, Engadget, and others are reporting that there are now at least 16 Blu-ray titles that cannot be cracked by SlySoft because of updated / upgraded BD+ programming on the optical disc. The Engadget article also presents a useful BD+ architecture drawing.

As I've noted earlier, the BD+ VM-based programmable security technology can be adapted to particular attacks. I would not surprise me if the weakest implementation was put out there originally as a kind of "honey pot" to see the kinds of attacks pirates used. Having done that, it's not surprising that BD+ has been resealed. This "cat and mouse game" will go on indefinetely.

Blu-ray Piracy

The WSJ is reporting (subscription require) that pirates in Asia are providing high-quality copies of films released on Blu-ray discs.

Pirates are taking advantage of the fact that many viewers can't tell the difference
between Hollywood's new high-definition, higher-priced Blu-ray movie format
and a bootleg format -- called AVCHD -- that's a grade lower: AVCHD uses 720
horizontal lines of resolution instead of Blu-ray's 1,080, but still offers a sharper
picture than an ordinary DVD on high-definition television sets.

What Does AACS Teach Us About the DMCA?

My Google Alerts filter found a blogicle on the DMCA penned by Zach Powell, a third year law student at the University of Richmond (VA) School of Law (posted semi-anonymously, I have his permission to use his name).  Written for Prof. Chris Cotropia's copyright law class blog, Powell posted a longish note regarding the AACS encryption scheme for Blu-ray discs (and previously for HD-DVD before its demise).

After providing a decent review of the brief history of AACS and the DMCA, including takedown notices under the latter, Powell concludes as follows:

BD+ Broken Again

CDRInfo and numerous other sites are reporting that the programmable security component of Blu-ray, BD+, has been broken again. In addition to software company Slysoft, a group of independent hackers have claimed success:

Slysoft is not the only company famous for its copy protection circumventions. According to some threads in forums like Doom9, there ios also another tool that bypasses the BD+ protection. A Doom9 member named 'Oopho2ei' discovered the way to bypass the BD+ code while it is running in a Java-VM. "I am glad to announce the first successful restoration of the BD+ protected movie "The Day After Tomorrow" in linux," the user wrote in a forum thread. "It was done using a Blu-ray drive with patched firmware (to get the volume id), DumpHD to decrypt the contents according to the AACS specification and the BDVM debugger from this thread to generate the conversion table. The conversion table is the key information to successfully repair all the broken parts in m2ts files to restore the original video content," the used added.

On Tuesdays the USPTO issues new patents. Today's Spotlight Patents concern rights management. Assigned to Sony, the first patent concerns techniques for encoding copyright management on a CD-ROM. Assigned to Intarsia Software, the second patent concerns techniques for controlling database copyrights.

ATI and Samsung Copy Protection Issued Patents

On Tuesdays the USPTO issues new patents. Today's Spotlight Patents deal with aspects of video copy protection in analog and analog/digital video. Assigned to ATI Technologies, the first patent concerns the detection of copy protection indicators or redistribution control indicators in an analog video signal. Assigned to Samsung, the second patent concerns A/D conversion without eliminating copy protection signals.

Intel Added to List of Blu-ray BD+ Developers

The Blu-ray BD+ licensing authority maintains a list of BD+ adopters. BD+ is the virtual machine-based programmable security component of the Blu-ray security architecture.

Since I last checked, four companies have been added to the list of adopters: Intel, Lite-On IT Corp., MIT Technology, and Quatius Ltd. have been added to the list of BD+ adopters. One company has apparently been deleted: Cheertek Inc.

Fox remains the only studio publicly listed as a content participant.

The Ins and Outs of Blu-ray Disc Replication and Licensing

eMediaLive has another great posting on the economics of Blu-ray licensing fees, this time written by Hugh Bennett. The topics covered include manufacturing costs and licensing fees for the two security and copy protection technologies: AACS renewable encryption and the BD+ programmable security, which is summarized in Bennett's table:

 

Two Issued Patents From Intertrust

On Tuesdays the USPTO issues new patents. Both of today's Spotlight Patents are assigned to Intertrust and address various aspects of security. The first patent concerns software self-defense systems and methods. The inventors include computer science stars such as Bob Tarjan. The second patent concerns a hardware secure processing unit (SPU).

Macrovision Conference Call: BD+ Security

Macrovision's quarterly earnings call was held last Thursday afternoon. In the Q/A following the standard presentation of results and management's comments, Sasa Zorovic, who covers Macrovision for Goldman Sachs, asked about BD+ security for Blu-ray.

Here's a rough transcript of that portion of the call. "2C" refers to the BD+ licensing authority, BDPlusLLC. ECD refers to an "Elgible Code Developer" license (tracked most recently here).

Q (from Sasa Zorovic, Goldman): …and could you give us an update regarding BD+ and what your expectations are as we’re going into the 4th quarter with it?

A (CEO Fred Amoroso): Sure. So, BD+, or SPDC, there’s a couple of nuances, and I’ll apologize now if I get a little more detailed than maybe you’ve asked for, Sasha, but let me describe it. We’re seeing increasing progress on the ability to have Blu-ray adopted as a DVD medium Hi-Def. Secondly, we’re seeing signs that there will be lower cost Blu-ray players in the market by the Christmas shopping season, so that will improve consumer take-up. If you look at NetFlix, for example, while Netflix has over 100,000 DVDs, they’ve increased fairly substantially—still small numbers—but increased fairly substantially the percentage of Blu-ray DVDs that they have. I think they have over 700 now. So we’re generally seeing positive industry trends on a macro level.

What's Up With CH DVD, Blu-Ray, BD+

Writing on FormatWarCentral, Mehar Gill has a useful article on the Chinese DVD format, CH DVD and a potential battle with Blu-ray. Drawing in part on a ZDNET China article, Gill says:

[The ZDNet article takes] the opportunity to talk about Blu-ray and BD+ by stating it may slow down the physical portion of piracy but not the online portion. If history “repeats” itself I guess pirates will start downloading Blu-ray/HD DVD/CBHD rips and burn them to said discs. CBHD corporation is also giving people the ability to download and burn the discs themselves, they do this buying ordering the copy of the movie through a special “line” and burning the file to a CBHD.

Backdooring Skype

[tip o' the hat to Dave Farber's IP list] Speculation abounds that Skype has incorporated backdoors so that national security agencies can listen in on Skype calls. So much for privacy.

An article posted by Daniel AJ Sokolov on the heise security site says in part:

At a meeting with representatives of ISPs and the Austrian regulator on lawful interception of IP based services held on 25th June, high-ranking officials at the Austrian interior ministry revealed that it is not a problem for them to listen in on Skype conversations.

Another Layer of Security for Blu-ray?

AfterDawn has noticed a June 9th announcement on the site of the DVD Association regarding another layer of security for Blu-ray discs from German DRM firm X-PROTECT. Augmenting AACS renewable encryption and BD+ programmable security,

X-PROTECT blueTM is of no impact to the end- consumer and works on both HDMV and BD-J Blu-ray Discs. One of the key advantages is the high flexibility of the solution, as it can be easily and frequently updated to stop new piracy attacks in its tracks. It supports all Blu-ray profiles, as well all existing and future stand-alone Blu-ray players, PC players and Playstation 3, securing the quality of the material and compatibility.

Since it's unlikely that hardware manufacturers would agree to support a third party security layer if modifications to player firmware were required, it would seem that X-PROTECT blue is leveraging the player's Java interpreter to accomplish its goals. As of a few minutes ago, there is no mention of x-protect on either the  Blu-ray or BD+ sites.

Nate Lawson (BD+, CRI) Interview On Reverse Engineers

SecurityFocus has a good interview with Root Labs' Nate Lawson, who worked on BD+ while at CRI and who was quoted in these pages back in April of this year. Commenting on Blu-ray BD+ programmable security, Lawson says:

When we designed BD+, our goal was to let studios spend the money developing the security on a per-disc basis. All the player manufacturers had to do was provide a simple, compatible VM environment. That way if a studio cares more about protecting a particular title, they can put more effort behind its software protection. They are in the best position to measure if the DRM impacts their sales and decide how much to spend on it in the future.

That's the exciting thing for me about BD+. It's really the first time these principles have been brought into play in the mass market. It's an opportunity to prove if common memes about DRM are true or not. How much more money does a title make if it's not available on pirate networks for a few months after release? That's a question you can't ask with DVD since there is no example to use.

This year should be very interesting.

Barcode Ticket Security - DRM Not

Masabi's Ben Whitaker wrote a most interesting article on Barcode security. Even those readers who don't usually care about such things should have a look; lots of interesting ideas there. Whitaker addresses security and DRM:

Anti-copying using DRM (Digital Rights Management)
However you deliver a barcode, it has to be presented in a scannable format, which means that an adversary can always scan the ticket, and if they want to, change some details on the barcode and create multiple copies without DRM. People that have barcode delivery systems that use or rely on "forward lock" or DRM to prevent the barcode image being sent from one person to another are being blind to the availability of barcode scanners to beat all of their software. Also consider that OMA DRM for forward locking images downloaded to phones places laughably little protection against an assailant armed with such exotic tools as a web-browser and a text editor.

Nate Lawson on Designing and Breaking DRM

Nate Lawson is a co-creator of the BD+ security layer on Blu-ray. He gave a talk at the recent RSA conference.that covers techniques for attacking DRM. His slides are posted here and are worth reviewing. Lawson writes:

Of course, people in glass houses should not throw rocks. As someone who had a part in developing BD+, I am biased toward thinking a different approach than mere broadcast encryption [e.g. AACS] is the only thing that has a chance of success in this rough world. The first BD+ discs were cracked in mid-March, and it remains to be seen how effective future updates will be. Unfortunately, I can’t comment on any details here. We’ll just have to watch and see how things work out the rest of this year.

2008 will prove whether a widely deployed scheme based on software protection is ultimately better or equivalent to the AACS approach. I have a high degree of confidence it will survive in the long run....

EXCLUSIVE - Macrovision's Eric Rodli Comments On Slysoft's Claimed Break of BD+

As noted here yesterday, Slysoft claims that it's AnyDVD (HD) 6.4.0.0 software will remove the BD+ security component of Blu-ray HiDef optical discs. When asked for a comment, Eric Rodli, Macrovision's Executive Vice President & General Manager of Entertainment, had this to say via email:

“Macrovision does not comment on specific techniques or procedures that may directly impact the BD+ security technology.  BD+ is a security response system designed to react to security attacks, not prevent them entirely.  As part of this system, updated BD+ security code is continuously developed so that BD+ customers obtain ongoing value from the use of this technology.”

One of the major benefits of BD+ is that it is programmable security. Thus the cat and mouse game between those who apparently encourage piracy and the major studios and their technology partners remains intact.

SlySoft Busts Blu-ray BD+ Security - Again

SlySoft is again claiming that it's AnyDVD (HD) 6.4.0.0 software will remove the BD+ security component of Blu-ray. So far no comment from Sony, Macrovision who acquired the BD+ technology late last year from CRI, or the bdplusllc licensing authority. I've asked Macrovision to comment,  but so far no response.

As I noted back in November, it's entirely possible that the strongest versions of BD+ have not yet been deployed in order to gather information regarding the kinds of attacks that can be successful. This "honey pot" strategy might be a useful defensive tactic against hackers / crackers / pirates.

Wired: BD+ Helped Blu-ray Win The Format War

Wired has a good story on the contribution of BD+ to Blu-ray's besting HD-DVD in the HiDef optical disc format wars.

Sony's victory in the DVD format wars was largely due to its embrace and Toshiba's rejection of a sophisticated anti-copying scheme that promises to be relockable should it be cracked at some point in the future....

Paul Kocher, Cryptography Research's president and chief scientist, thinks HD DVD's decision not to adopt his technology eventually tipped the battle to Blu-ray.

"I don't want to pretend that security was the only thing that drove the content war," Kocher said. "But from a content perspective, I think security is the biggest overhang over the future of the studios and I think they realize that and they are doing what they can to deal with that."

HD-DVD: RIP.

QuckTime DRM Disables Adobe Video Editing

The Register (UK), among others, reports that users who upgrade to QT 7.4 are then unable to edit protected video files using Adobe's Premier and After Effects editing tools.

The error is the result of periodic checks QuickTime carries out on video files for piracy violations. Videos created using Adobe products don't supply the needed headers until the movies are rendered, prompting the overly protective QuickTime to conclude they are contraband that should be barred.

Another example of how not to do DRM. Sigh....

Are Blu-ray and BD+ Gaining Momentum Post Macrovision Acqusition of SPDC Technology?

The BD+ licensing authority web site lists three new Asian companies supporting BD+ as adopters. The three were added since last Sunday. This appears to be the single largest addition to the adopter list in several months. The number of movie studios remains one: Fox.

The three new additions are China's Dongguan Contel Electronics Co., Ltd., Hong Kong's Tonic Digital Products Limited, and Japan's VideACE, Inc.  

Macrovision Says SPDC (BD+) Important to Its Integrated Services

As has been widely noted, Macrovision is acquiring Gemstar TV Guide. In Friday's conference call to explain the logic of the merger, Macrovision addressed the future role of Self Protecting Digital Content (SPDC) technologies recently acquired from CRI. In the Blu-ray context, SPDC is implemented as BD+.

SPDC is fundamental to empowering our Hollywood studio customers to distribute content securely across a multitude of devices and is complementary to Macrovision's historical businesses. With SPDC we envision the capability of unique security code traveling with each piece of content and interacting with virtual machines on a playback side allowing rightsholders to distribute in various different formats but maintaining economic control and security. While it is applied to Blu-ray today via BD+, we see a future where SPDC is applied to other forms of digitally distributed content, not just physical formats.

However, in response to an analyst question concerning deals in which Macrovision bundles various of its technologies:

As I've said in the past, I'm not particularly interested in bundling BD+ into those bundled relationships because BD+ is such an emerging part of the marketplace for Blu-ray that I don't want to diminish the value proposition and the effectiveness associated with BD+.

Seems like the business situation regarding BD+ is fluid.

MPAA, ISPs, and Content Filtering

[tip o' the hat to Lauren Weinstein's post on the Net Neutrality Squad list]. Nate Anderson writes in Ars Technica that the MPAA expects ISPs to reduce piracy by implementing content filtering technologies (e.g., deep packet inspection and/or fingerprinting-based filtering).

Case in point: AT&T and its publicly-stated plan to implement some sort of filtering system on its network. No technical details of such a system have yet been revealed, but the announcement has warmed the cold cockles of the MPAA's heart and has garnered support from companies like NBC Universal.

Glickman also held out the hope that filtering technology would quickly be adopted by many more ISPs. "The ISP community is going to be at the forefront of this in the future because they have everything to lose and nothing to gain by not seeing that the content is being properly protected," he said, "and I think that's a great opportunity." It's not the first time he's asked ISPs to do more.

So much for net neutrality and privacy.

 

Adobe's Security Matters Blog

Adobe's  Security Matters blog is worth following. Two recent articles address Enterprise Rights Management and the history of Adobe's involvement in content protection, including their LiveCycle Rights Management.

Macrovison Says BD+ Not Hacked

In today's conference call regarding the acquisition of BD+ technology from CRI, Macrovision says that BD+ has not been hacked:

"So first of all let me provide a clarifying comment. BD+ has not been hacked. There was a software player that did not have the correct implementation of the specification, and as a result, it did not have the same effectiveness for controlling and understanding the BD+ spec. So it wasn't that BD+ was hacked. BD+ actually wasn't hacked. And since we had heard about that, there were conversations between CRI [the developer of BD+] and the software player manufacturer and developer at which point in time they corrected the specification and the hole was closed. So to the best of our [Macrovision's] knowledge, BD+ has not been hacked yet and its been several months that its already been out there."

Macrovision Conference Call Tidbits

As noted earlier, Macrovision is acquiring the BD+ technology from Cryptographic Research Inc. They did a conference call with a brief intro followed by Q/A from Wall Street analysts who follow the Macrovision stock. Some selected (and quasi-random) points made  by Macrovision during the call:

• Annual royalties from CE manufacturers; per disc royalties from content providers (studios);
• High margin business;
• All technologies will be hacked; BD+ is no different;
• The level of royalty from the content provider depends on which BD+ features they want to implement on a title by title basis:
  • Basic BD+ protection
  • forensic watermarking;
  • Added countermeasures to specific hacks;
• Intend to extend BD+ beyond Blu-ray to embed it across Macrovision's DRM middleware solutions;
• Bridges Macrovision to HD, HiDef;
• 4-5 $million revenue in 2008, accelerating in the outyears;
• May be used to compete with OMA2 (mobile DRM standard) given the pricing points Intertrust has requested;

Macrovision Buys Developer of BD+

Macrovision says it's acquiring BD+ technology from Cryptographic Research, Inc.

“We are a research organization dedicated to solving difficult cryptography problems,“ commented Paul Kocher, President and Chief Scientist of Cryptography Research Inc. “We developed SPDC to enable consumers to experience content across a broad range of devices while simultaneously providing content owners with the control to manage the security of content in this dynamic environment. Macrovision shares this goal and now that SPDC has entered commercialization, we are confident Macrovision will take it to the next level.”

Unlike previous DVD security technologies, a critical advantage of BD+ is its ability to respond dynamically to security threats. Similar to Macrovision’s ACP technology, BD+ resides both in devices and on the media. Title-specific security code is embedded in each BD+ protected disc. On the device side, BD+ utilizes an embedded virtual machine and APIs that are integrated directly into the media player, which communicate with the code from the discs. As a result, new titles can carry unique security code to address emerging threats, thus providing content producers the ability to respond to security breaches without impacting legitimate consumers.

Is BD+ Using A "Honey Pot" Strategy Against Hackers?

So the blogosphere is mostly jumping up and down enthusiastically over SlySoft's apparent compromise of BD+, the Blu-ray only virtual machine based security layer on top of AACS encryption key management. A more balanced view is Scott Fulton's blogicle on BetaNews.

The beta of version 6.1.9.6 is apparently not without problems or exceptions, as indicated by a check of manufacturer SlySoft's forums today. Users reported problems copying Fantastic Four, Live Free or Die Hard, Sunshine, The Hills Have Eyes, and Spiderman 3 - which collectively constitute the bulk of all BD+ titles currently available.... Exactly how BD+ equipped content knows it's being decrypted by a validated BD+ VM, though, is a little mystery.

I have no inside knowledge. Period. However, if I were the BD+ licensing folks or the consultants who developed BD+, I might not put my best version of the technology out there immediately. I might hold back some capabilities to see how pirates attack my security system. I might make several small improvements in order to get a better picture. I can then evolve my threat analysis and implement appropriate countermeasures while working my way toward the best implementation.

Then again, BD+ might never work. The Cat and Mouse game continues.

SlySoft Busts Blu-ray BD+ Security - Updated

Engadget and numerous other sites confirm that the SlySoft's AnyDVD 6.1.9.6 beta circumvents Blu-ray BD+ security. No comment yet from the BDPlus licensing authority.

The SlySoft claim is here.

Will BD+ Be Hacked In The Near Future? Slysoft Says Yes

The blogosphere is alive with the songs of BD+ being hacked by Slysoft. This noncommital note from Engadget's Darren Murph is an example of reasonable "wait and see." Others are more enthusiastic about Slysoft's comments, for example this posting on CDFreaks.com, which quotes Slysoft as follows:

To prove them right and to take on the challenge, SlySoft has just released the latest AnyDVD version which beats the latest 4th generation HD-DVD and BluRay copy protection MKBv4, which was expected to be unbreakable.

All that AACS-LA has to offer now is BD+, but even that is on the verge of being circumvented and a release is expected by the end of this year.
James Wong, Head of development at SlySoft: "We already found a way to crack BD+ and we have just turned to fine-tuning. I should really think about hiring a bodyguard now, since this product won't please everybody."

There are a couple of things wrong with this. First, if they have cracked the AACS Media Key Block, no one expected this to be unbreakable. Rather, AACS was created as a renewable key management technology. So the MKB will be changed as planned.

More serious, perhaps, is that AACS-LA (the licensing authority) has nothing to do with BD+. Instead, BD+ is made available through its own, distinct licensing authority, BD+ Technologies LLC.

Even if it has been hacked, BD+ was designed to provide programmable security which includes the ability to detect compromised players. So we'll see if Slysoft can deliver on its claims.

Microsoft blocks FairUse4WM v2

So says George Ou:

Just over a year ago when hacker “Viodentia” wrote FairUse4WM and broke Microsoft’s Windows Media DRM scheme wide open, Microsoft responded with record urgency in a mere 3 days.  But when Viodentia came back as “Divine Tao” and wrote a second major revision of FairUse4WM this July and broke Microsoft’s Windows DRM scheme wide open again, Microsoft didn’t seem to be as concerned and spent their usual 3 months to patch the issue. As of the last patch Tuesday, the current version of FairUse4WM no longer works so the ball is in the hacker’s court again to break Microsoft’s latest DRM revision.

The cat and mouse game continues.

Forworld Electronics Co., Ltd. Added To BD+ Adopters List

Taiwan-based Forworld Electronics Co., Ltd. has been added to the list of companies who have signed the BD+ System Adopter Agreement with the BD+ licensing entity. BD+ is a second security layer (in addition to AACS) for Blu-ray discs.

AACS Key Changes, BD+ Confirmed - Sorta

An article in yesterday's WSJ all but confirmed that that latest Fox releases are protected by BD+, a second, virtual machine based security layer used by Blu-ray and not HD-DVD discs.

The WSJ article also noted that the AACS licensing authority has released a new key for AACS, the renewable encryption and authentication technology on both Blu-ray and HD-DVD discs. However, no press release has yet been posted on the AACS LA web site and neither Google News nor Yahoo could locate it elsewhere.

With respect to BD+, the WSJ article said:

Steve Feldstein, a spokesman for Twentieth Century Fox Home Entertainment, said both HD-DVD and Blu-ray players occasionally have needed updates to play new discs, and urged customers to monitor manufacturer Web sites that distribute the fixes, known as firmware updates. "When these sort of glitches happen, they're resolved in...a week or two, once people realize they do need to use the firmware upgrades," he said.

Mr. Feldstein declined to confirm that BD+ was on the new discs, saying doing so would be an open invitation to hackers. He also said BD+ wasn't the cause of the playback problems.

Wink Wink.

 

Has Fox Launched Blu-ray Discs with BD+?

BD+ is a Blu-ray security technology that has been championed especially by Fox.  Now High-Def Digest reports that Fox's 'Fantastic Four: Rise of the Silver Surfer' and 'Day After Tomorrow' have created playback problems on certain players. The most severe problems have been experienced on Samsung's BDP-1200 and LG's BH100 players. According to High-Def Digest, both manufacturers are aware of the problem and will provide firmware updates.

It has been widely speculated that these issues stem from the use of BD+ copy protection on the two discs. We contacted Fox for comment, but so far there's no official word from the studio. 

Apple Updates iPhone Frustrating Hackers

Apple provided updates to its popular iPhone that frustrates those who have hacked the phone in order to be able to use a network other than AT&T and/or to run unapproved applications. The NYTimes' Saul Hansell writes:

David Pogue, our technology reviewer, received a cautionary message last night from a person familiar with Apple’s plans after he posted a video showing some unofficial, but entertaining, applications that can be installed on the iPhone. Take those applications off your phones now, David was warned, or a software update scheduled for Thursday afternoon could turn your phone into a brick.

On Monday, Apple had issued a press release warning of “irreparable damage” to iPhones that have been modified or unlocked from the AT&T network. It also threatened users that “the permanent inability to use an iPhone due to installing unlocking software is not covered under the iPhone’s warranty.”

Podcast with Jan Samzelius, CEO of ByteShield

I spoke recently with Jan Samzelius, Chairman and CEO of ByteShield, which provides anti-piracy technologies and services to business and game software markets. An earlier blogicle described how the ByteShield solution works.

Here's the Podcast file (7:11 Minutes, MP3):

Download jan_samzelius_ceo_byteshield_podcast_91907.mp3

Index:

0:00 Introductions
0:11 Overview of ByteShield, brief history
0:40 The work factor or effort required to break copy protection
1:19 What's different about the ByteShield technology
2:38 Business model
3:11 Broad range of consumer licensing models supported
3:43 Advantages
4:40 Current customers, partners
5:34 Technology and services provider
6:05 Solving the piracy problem
6:55 Close

Porn, Piracy, and DRM

Earlier in September, AVN columnist Mark Kernes published a detailed account of an industry meeting called to discuss the adult video business and piracy. According to Kernes, the meeting was attended by "about 65 content producers, attorneys and other interested parties." Attorney Greg Piccionelli, a speaker at the meeting, is quoted by Kernes:

"At the present time, if you were to take all of the content that is produced by the adult business," Piccionelli stated, "the legitimate sales currently account for no more than 15% to 20% of the actual numbers of copies that are out there, and the lack of enforcement over the years has left the pirates and consumers with the impression that copying and stealing adult content is something that has absolutely no punitive consequence associated with it whatsoever, and so the industry has really sort of dug its own grave to this degree."

Uncrackable Watermarking - Another View Of The Microsoft Patent

A PC World article by IDG News' Elizabeth Montalbano gets the story right regarding Microsoft's recently issued watermarking patent.

Forensic digital watermarking technology, like the technology Microsoft has patented, doesn't encrypt files the way DRM technology does or prevent people from unauthorized use. However, it can be used to prove who owns the content of the digital file by encoding a file with a unique digital signature. That means illegally traded songs could be tracked back to the original purchaser, allowing authorities to identify illegal sharers and serving as a deterrent.

The technology could also be used to track files for royalty distribution.

InformationWeek - Coupon-Gate

in an Information Week article says that security researcher Ben Edelman has accused online coupon site Coupons.com of deceptive business practices for using digital rights management (DRM) techniques.