AACS DRM: Cracked Already?

http://tinyurl.com/ym4xzn

Can it be? Is Hollywood's new DRM posterchild AACS (Advanced Access Content System, see more here) actually quite breakable? According to a post on our favoritest of forums (Doom9) by DRM hacker du jour muslix64, his new BackupHDDVD tool decrypts and dismantles AACS on a Windows PC.

Jerry Jones
http://www.jonesgroup.net

Here's the Doom9 thread:

http://tinyurl.com/yzm6vm

Jerry Jones
http://www.jonesgroup.net

Looks like it. Someone will be passing a large brick through their colon tonight.

http://www.youtube.com/watch?v=_oZGYb92isE

This may seem like a dumb question, but how can you rip a HD-DVD when there's no computer HD-DVD drives even available for sale out there? At least here in Canada, I'm not aware of anywhere where I can purchase one. However, BluRay computer drives have just recently come on sale in Canada.

look at my thread plz. =)

Yes, it has been cracked.. and you can rip the HD-DVD. All you need are the title keys or volume keys for the HD-DVD.

https://forum.videohelp.com/viewtopic.php?t=317738

If you read the post/look at the video he used an Xbox 360 drive. Nice move using one on a PC since I believe they are subsidised by Microsoft.

how do you get the keys off the disc?

No offense, but this looks like a well made fake. (so far)

Without a valid key, this proves nothing.

I have read some Doom9 posts, it seems that the author has released a config file. But according to the posts, there are no keys in it, only hash values to identify some discs.

See above:

http://forum.doom9.org/showthread.php?t=119871

http://club.cdfreaks.com/showthread.php?t=204039&highlight=BackupHDDVD

Thanks

I think this is largely a hoax. He has since updated his software but again provides no direction as to where to find the volume keys or post a key so somebody can verify the claim. Without either I think he's blowing smoke.

no way?

What ever happened to this thing. Was it all a hoax?

Apparently, this muslix64 character still hasn't clearly told everybody how to get the keys needed to make his program do the job.

He gave some vague hints in his last post... on this Doom9 thread page...

http://tinyurl.com/y7ysb4

You can extract keys from any player! Some players are just easier to extract the key from. Being lazy, I prefer to extract keys from an insecure player than a secure one.
And the AACS spec says "Device keys must be protected!" but they did not said that about volume key, fatal mistake!

His last comment:

This may be my last post here. I'm going to have a rest for a while. Take care everyone and wish me good luck!

Hoax?

Or did he actually do it?

I'm not sure if anybody has succeeded in duplicating what he seemed to do in his video (which he posted to YouTube).

Great drama, however.

The factually questionable Wikipedia site is an interesting read on this topic.

http://tinyurl.com/yxenex

On December 26, 2006 a person using the alias "muslix64" posted a utility named BackupHDDVD and its source code for a working AACS exploit on the doom9.org forums. This hack appears to use a similar methodology to the DeCSS hack, exploiting weak player keys. The title keys are located on the disk in encrypted form, but need to be decrypted for content to be played - BackupHDDVD does not do this, but Muslix64 claims that the title keys were found in main memory, and that finding them is not difficult, using the publicly available AACS Guide as a reference.

Also this side note:

It should be noted that even if this exploit proves true, it does not represent any actual hack of the AACS system, but a circumvention based on a weak software implementation.

Jerry Jones
http://www.jonesgroup.net

Nice find!

Excellent article.

Jerry Jones
http://www.jonesgroup.net

Quote from PainKiller's excellent article:

January 09, 2007 (IDG News Service) -- The recent release of software that can be used to decode encrypted HD-DVD and Blu-ray movies is the first step toward making the encryption standard used by these next-generation video players obsolete, Princeton University researchers said Monday.

Late last month, a hacker going by the name Muslix64 released software that could be used to decrypt movies that were encoded using the AACS (Advanced Access Content System) digital rights management specification. AACS is supported by Hollywood and video player manufacturers.

Introduced in April 2005, AACS is the copy protection system for HD-DVD and Blu-ray movies. It is supported by companies such as Microsoft Corp., Matsushita Electric Industrial Co. Ltd. (Panasonic), Sony Corp., Toshiba Corp., The Walt Disney Co. and Warner Bros.

Muslix64's BackupHDDVD software did not crack AACS, but it will make it easier for some technically adept users to decrypt movies, said Alex Halderman, a Princeton computer science student who, along with noted researcher Ed Felten, is calling the software "the first step in the meltdown of AACS."

Jerry Jones
http://www.jonesgroup.net

This is so stupid. The guy didn't actually do anything. The software he released could have been programmed by any one of the coders that hang out on doom9.net, but no one else bothered because it is useless without having the title keys. All he says to explain that he found the keys is that, "its so easy to find them." His supposed proof is a video he posted on youtube that just shows him copying files off the disc onto his hard drive and then playing them. This would be so easy to fake.

Its just a hoax.

Originally Posted by adam

This is so stupid. The guy didn't actually do anything... Its just a hoax.

PC World seems to disagree with your opinion:

http://tinyurl.com/y2qgkj

The recent release of software that can be used to decode encrypted HD DVD and Blu-ray movies is the first step toward making the encryption standard used by these next-generation video players obsolete, Princeton University researchers said Monday.

Jerry Jones
http://www.jonesgroup.net

I'm just speculating (as I don't yet have either a HD-DVD or BD player, burner, recorder, player software or this hack app), but it seems to me that if you:

1. Played a disc (that obviously has the keys on it) in a software Player

then

2. Copied the files to a Hard drive

then

3. Tried to play the files from the hard drive and gotten the "encrypted, No key available" type message

while

4. Checking/saving the states of the memory/cpu registers during each/both times

and

5. Do binary compare to find differences

and then

6. Do a binary/hex search on the disc to find the sequence that matches the difference(s),

you might get somewhere...

Just a thought (I could be completely wrong here).

Scott

>>>>>
edit: Kinda like the anecdote about the sculptor who is questioned about how he created such a lifelike likeness of a bear. He said, "I just chipped away all the sections that weren't like a bear" (or something to that effect)

Or even, "watch it in HD on my iPod?"

Scott

>>>>
edit: maybe if it's chopped up into segments and you make an "iPod Videowall"... 8)

For those who don't want to read a lot of posts at Doom9, basically there is a lot of debate as to whether or not this is a hoax. It appears that nobody has been able to replicate muslix64's YouTube video experience. I think it is fair to state that while this MIGHT be a good starting point, there is no evidence yet to support the view that AACS DRM has been cracked. I would suggest taking anything PC World says with a grain of salt, but maybe some of you are misreading their statement. Princeton University researchers called this software a FIRST STEP (pay attention to that) towards making AACS obsolete. That is a fair statement and to read it as them saying that AACS is obsolete is to read something into it that's not there.

Scott - Similar suggestions to your have been tossed around at Doom9, so I'd say you're probably on the rigth track.

Specialist that article itself even states that nothing was cracked at all but rather the "importance" of this is just that it may inspire others to BEGIN TRYING to crack the protection. PC World will post an article on anything. I also don't know why you bolded Princeton University researchers. Did you look up where the quote came from? It's a princeton professor (and a student apparantly) and it just came from his blog, on which he frequently predicts how all DRM and other protection will ultimately all become obsolete. Here is his blog: http://www.freedom-to-tinker.com/
There is no research being done here. On it he even says that the software itself is useless. All he says is that he thinks the cracking of AACS is invevitable.

Like I said, this is so stupid. I'm not knocking you for linking to the article(s.) Lots of other sites are talking about this too. I just find the whole discussion silly because everything, including the PC World article, is based on nothing more than an anonymous poster whose statements have been suspect to say the least. When repeatedly asked to prove his results all he did was post back saying, "it's easy," followed by, "I'm not going to post anymore."

Originally Posted by lordsmurf

Let's not forget the most important issue here: "Can I copy a HD-DVD to 1 DVD and keep HD quality and play it in my DVD player?"

Well actually you can, but not in its original format. I've converted MPEG2-HD (720p) material to XVID-HD at the same resolution, but at a size that fits onto a single DVD-R disk. You'll lose some quality, but not resolution, and actually it's hard to tell the difference between the two unless you put them side by side.

Of course you'll only be able to play this on a DVD player that is capable of playing hi-def XVID material in HDTV output quality, of which there are a few out there (eg. Avel). An HTPC would work also.

Originally Posted by adam

Like I said, this is so stupid.

Will you insist "this is so stupid" when somebody reports they have duplicated muslix64's claim?

Or is it your opinion that nobody is ever going to duplicate what this muslix64 character claims to have done?

I can't understand why you're so certain that it's a "hoax" -- as you put it.

You don't have any more knowledge than any of the rest of us -- unless you're muslix64.



Jerry Jones
http://www.jonesgroup.net

Originally Posted by Specialist

Will you insist "this is so stupid" when somebody reports they have duplicated muslix64's claim?

When muslix64 or anybody else actually makes any progress towards cracking AACS then it will noteworthy news. No that won't be stupid.

Originally Posted by Specialist

Or is it your opinion that nobody is ever going to duplicate what this muslix64 character claims to have done?

It is my opinion that muslix64 hasn't done anything at all. I actually am doubtful that AACS itself will ever be "cracked" as DeCSS was cracked, but I do believe someone will eventually find a vulnerability somewhere in the chain to effectively bypass the protection.

Originally Posted by Specialist

I can't understand why you're so certain that it's a "hoax" -- as you put it.

I can't see how anyone who read the entire thread on doom9 can believe this is true.

Originally Posted by Specialist

You don't have any more knowledge than any of the rest of us -- unless you're muslix64.

No but then nobody really knows anything about this claim at all. The guy never gave any proof or explanation of what he did except to show a video of it "working." But all he had to do was pause recording of his screen capture and change the letters of his drives, then begin recording again and it would have showed exactly what his video showed. When he was called out on doom9 he replied, "its so easy" and then refused to post anymore.

No I'm definitely not muslix64.

Hey specialist,

Just give it up.