Feeds

How gizmo maker's hack outflanked copyright trolls

Chumby NeTV: A triumph for mankind

The Power of One Infographic

When the master encryption key locking down millions of Blu-ray players and set-top boxes was mysteriously leaked last year, Hollywood moguls worried their precious high-definition movies would face a new flurry of piracy.

Instead, it spawned the Chumby NeTV, a tiny, Wi-Fi-connected box that sits between a television and a set-top box or DVD player so email alerts, Tweets and other internet content are scrolled across the bottom of the screen – all without interrupting the flow of the video.

Making the NeTV break into the encrypted video stream passing through an HDMI cable required the elite hacking skills of Bunnie Huang, an engineer and co-founder of Chumby, the maker of net-connected alarm clocks that display weather forecasts, news headlines, and other internet content. Using the leaked master key at the heart of the HDCP, or high-bandwidth digital content protection, encryption scheme to modify the content was clever enough. Doing it without violating draconian copyright laws was nothing short of brilliant.

picture of Chumby NeTV

The Chumby NeTV in all its glory

That's because HDCP was created by Intel for the express purpose of thwarting piracy by restricting access to video passing between set-top boxes and TVs. It establishes a secret key that's unique to each pair of devices, creating a barrier for would-be pirates out to capture and copy the high-definition content. Tampering with this scheme runs the risk of violating the Digital Millennium Copyright Act, a law that carries stiff criminal and civil penalties for circumventing technology intended to prevent access to copyrighted material.

Ignorance is bliss

Faced with the challenge of crashing the party that only HDCP-compliant devices can join without running afoul of the DMCA, Huang employed the leaked master key in a way that allows the Chumby NeTV to use the shared secret key to inject Tweets and other content into the encrypted stream without decrypting the restricted video. His device intentionally remains oblivious to the protected work, a distinction he believes keeps it from violating the law's anti-circumvention provisions.

“It's important to note that nowhere in the pipelines is the video data decrypted,” Huang wrote in an email to The Register. “We don't use the master key to break any locks, or circumvent any copyright protection. We use it to enable interoperability and we do so without ever decrypting the source data: encrypted pixels are just replaced with different encrypted pixels.”

Huang's claims have been confirmed by two experts.

“What's interesting here is that although the device does have the keys needed to do decryption, it isn't actually doing that,” Keith Irwin, a professor of computer science at Winston-Salem State University in North Carolina, wrote in an email. “A conceptually simple means of modifying encrypted video would be to have the NeTV decrypt the video signal from the video device, modify it, then re-encrypt it. However, this isn't what the NeTV does.”

Cryptographer Nate Lawson, who heads the Root Labs security consultancy, has analyzed the open-source code that runs the NeTV and provides an analysis here.

Top three mobile application threats

More from The Register

next story
NEW Raspberry Pi B+, NOW with - count them - FOUR USB ports
Composite vid socket binned as GPIO sprouts new pins
Child diagnosed as allergic to iPad
Apple's fondleslab is the tablet dermatitis sufferers won't want to take
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
For Lenovo US, 8-inch Windows tablets are DEAD – long live 8-inch Windows tablets
Reports it's killing off smaller slabs are greatly exaggerated
Seventh-gen SPARC silicon will accelerate Oracle databases
Uncle Larry's mutually-optimised stack to become clearer in August
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.