Feeds

DirecTV attacks hacked smart cards

Electronic warfare for the private sector

  • alert
  • submit to reddit

High performance access to file storage

Satellite television behemoth DirecTV struck a decisive blow against signal pirates Sunday night, when it transmitted a carefully-crafted electronic signal from its orbiting satellites and destroyed thousands of hacked smart cards, which for the last four years allowed pirates to gain free access to hundreds of channels of programming.

According to sources in the satellite TV underground, the vast majority of illicitly reprogrammed DirecTV access cards, which once had a street value of several hundred dollars each, were wiped out on what hackers are calling "Black Sunday."

"It turned all these cards into ice scrapers," says a California pirate.

A spokesman for California-based DirecTV says company policy prevents him from confirming a specific cyber-strike. "But I will tell you that we do, from time to time, use electronic countermeasures," says spokesman Robert Mercer. "Obviously, we want only authorized people to receive our service."

DirecTV has been grist for pirates almost since inception, primarily due to well-funded research efforts in Canada, where the company is not licensed to provide service, and selling hacked access cards and equipment is not a crime.

"It's certainly a problem," says Mercer. "But we have an Office of Signal Integrity, a group of former FBI agents, dedicated to this issue."

The company reportedly acquired the ability to launch the electronic countermeasure (ECM) against pirates in November of last year, but held off on using it until Sunday. The massive counter-hack comes amid negotiations between DirecTV's parent company, General Motors, and media mogul Rupert Murdoch, who's considered acquiring DirecTV for an estimated $40 billion.

Logic Bomb

DirecTV controls access to their signal through smart cards shipped with every system. Each plastic card resembles a credit card, but is in fact a completely self contained microcomputer with its own embedded software and memory. In normal operation, a subscriber inserts the card into a slot in the DirectTV receiver, and a satellite signal from the company tells the receiver which channels, if any, the subscriber is allowed to watch, based on the unique identification number coded into each card.

Sunday's ECM was aimed at hacked 'H' series smart cards. The H cards were shipped with receivers sold from late 1996 to early 1999, and later became valuable commodities among TV pirates as the technology to hack them plummeted in price, and the techniques became publicly known online. Card programming devices were sold through Canadian dealers, and hacker-authored software for the H card that allowed complete access to all programming -- including movie channels, sports and pay-per-view events -- was easily found on the Internet.

By most estimates, thousands of hacked H cards are circulating in the US alone. They all became useless Sunday night, when DirecTV detonated a devilishly clever logic bomb the company planted in the access cards last year.

According to sources in the TV piracy underground, the counter strike was the capstone to four years of electronic warfare over the H card.

DirecTV's system gives them the ability to reprogram smart cards remotely, through the set top receivers. In the 90's, the company used that capability in their initial response to the proliferation of hacked cards by broadcasting a search-and-destroy program to all the H cards that would look for hacked code, and damage the software in any cards that had it.

To counter that technique, hackers developed a method of making the cards "read only" after hacking them, so that DirecTV could no longer put their search-and-destroy programs onto the cards.

But DirecTV reacted to that wrinkle over a year ago, by taking advantage of their ability to remotely reprogram the set top satellite receivers, as well as the cards. The company sent a few specific bytes of data to all the H cards, while simultaneously reprogramming the satellite receivers to reject cards that didn't reflect the change. This forced hackers to update the cards manually with the new data, or to make the cards writable again.

Through the following months, DirecTV continued to add more data using this tactic. By the time they stopped in November, the company had made a total of sixty-three updates to the H cards.

By then, the hackers realized that the data was not arbitrarily chosen: DirecTV was actually sending a computer program to the H cards, a few bytes at a time. After analysis, the hackers predicted that the program would make it possible for the company to permanently disable the pirated cards on command.

DirecTV finally issued that command on Sunday, and used it to inject an endless loop into a "write once" section of the H cards' memory, which cannot be modified a second time, according to an analysis on one satellite TV hacking site.

"Why they didn't do it back in November is a big mystery," says the California pirate.

While "Black Sunday" was a devastating blow to pirates, it's not likely to end the electronic arms race between DirecTV and hackers.

The company's current generation of smart cards, the so-called 'HU' card, has proven more resistant to tampering than its predecessor, but hacked versions are now turning up on the commercial grey market. Another technique, in which a pirate uses a PC to emulate an access card, was reportedly unaffected by the Sunday blast.

Smart cards are used for a variety of applications, including electronic customer identification for wireless GSM phones in Europe, and as new credit card offerings from Visa and American Express. "Smart cards are considered highly tamper resistant," says Don Davis, editor of Card Technology magazine. "There have been incidents where people have been able to attack them and tamper with them, but not very many that have proven to have commercial impact, like the problem DirectTV has had."

© 2001 SecurityFocus.com, all rights reserved.

High performance access to file storage

More from The Register

next story
Sorry London, Europe's top tech city is Munich
New 'Atlas of ICT Activity' finds innovation isn't happening at Silicon Roundabout
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.