Presented at
33C3 (2016),
Dec. 27, 2016, 12:45 p.m.
(60 minutes).
Follow the steps taken to crack a conditional access and scrambling system used in millions of TV set-top-boxes across North America. From circuit board to chemical decapsulation, optical ROM extraction, glitching, and reverse engineering custom hardware cryptographic features. This talk describes the techniques used to breach the security of satellite and cable TV systems that have remained secure after 15+ years in use.
Analysis of, and low-cost attack techniques against, a conditional access and scrambling system used in tens of millions of TV set-top-boxes in North America. A case study of the low-cost techniques used by an individual hacker to successfully crack a major pay TV system.<br/>
<br/>
Topics include:
<ul>
<li> chemical decapsulation and delayering of ICs in acids,
<li> microphotography and optical bit extraction of ROM,
<li> binary analysis using IDA and homebrew CPU simulators,
<li> datalogging and injection of SPI and serial TS data,
<li> designing and using a voltage glitcher,
<li> extracting secret keys from RAM of a battery-backed IC,
<li> analyzing hardware-based crypto customizations,
<li> studying undocumented hardware peripherals,
<li> MPEG transport streams and non-DVB-standards,
<li> QPSK demodulation, interleaving, randomization, FEC of OOB (out-of-band) cable data.
</ul>
The result is knowledge of the transport stream scrambling modes and knowledge of the conditional access system used to deliver keys. Strong and weak points are identified, advanced security features implemented nearly 20 years ago are compared to modern security designs. A softcam is designed and tested using free software, working for cable and satellite TV.
Presenters:
-
Chris Gerlinsky
Chris Gerlinsky is a Canadian hacker whose interest in computers led to his introduction to pay TV security systems twenty years ago. From bulletin boards and analog TV scrambling to smartcards and SOCs, Chris wants to disassemble it all to see how it works.
Links:
Similar Presentations: