Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Technology

CD Copy Stopper 643

CTho9305 writes "Technology Review has an article about a new CD and DVD copy protection system by Doc-Witness, where the disc itself has a smart card on it. The card checks if a request is valid, and then returns a key to decrypt the contents of the disc. It apparently works with standard drives."
This discussion has been archived. No new comments can be posted.

CD Copy Stopper

Comments Filter:
  • so.... (Score:2, Funny)

    by tx_mgm ( 82188 )
    3....2....1....
    ok, wheres the crack for this?
    =)
  • Oh boy (Score:3, Funny)

    by ArmenTanzarian ( 210418 ) on Thursday August 22, 2002 @11:09AM (#4118759) Homepage Journal
    I can't wait for the ridiculously easy fix for this one. All you have to do is spit on it and it not only copies, but increases the quality!
    • by gerf ( 532474 ) on Thursday August 22, 2002 @11:22AM (#4118903) Journal

      It is impracticable to crack since it is hardware based and is based on dynamic protection

      Sorry to say, but hardware has been 'cracked' and hacked before, and will be done again.

      At some point in your computer, the signal must be decoded for regular use. All someone has to do, is find this signal, and use that to copy a CD or DVD (DVD burners are getting out more and more...). I'm sorry, but i really don't think that this, or any technology in general, is going to work perfectly, to a consumer's satisfaction. Problems::

      1. As has happened so many times, the media screws up on Average Joe consumer.

      2. Those who want to copy/crack/hack it, will. They can't stop it.

      Old hardware, like quad-speed CD-roms and the like, won't work. Hardware varies, from year to year, from manufacturer to manufacturer, from country to country, from pc to car audio. Things will not work for someone, and people don't like that. It's just bad karma man!

      • 1. As has happened so many times, the media screws up on Average Joe consumer.

        2. Those who want to copy/crack/hack it, will. They can't stop it.


        The sad thing is, when Average Joe Consumer starts having problems with the latest DMCA-compliant device, he is unable to fix it without spending a fortune to get a new player/decoder/etc, and often he is unwilling to pay. So, in reality, the only people who get to reliably use it are the hackers.

        "Easy to use" and "hacker proof" devices are a lot like child-proof safety caps on medicine bottles. It's trying to make it easy to use for those with lesser abilities, and harder to use for those with greater abilities, which is impossible. That's like trying to come up with a math problem that an elementary student can answer, but a college math professor cannot.

        It ends with alienating the target audience (my grandmother absolutely hates the childproof caps, and takes all the pills out first thing and puts them in a plastic bag...), and are unable to prevent its circumvention (...while every one of her grandchildren can open the bottles without a problem).
  • by swaic ( 541592 ) on Thursday August 22, 2002 @11:09AM (#4118766)
    Saying it will be defeated within 30 days. Any takers. Also, $25 saying it will be by a Russian.
    • by st0rmshad0w ( 412661 ) on Thursday August 22, 2002 @11:12AM (#4118797)
      Heh.

      More like within 30 minutes. And it'll be a high school kid.
    • Re:I bet $20... (Score:3, Interesting)

      by ivan256 ( 17499 )
      Try an hour. This uses standard readers. Spoof a ligitamate read and you've got the key. Sniff the IDE bus and you've got the key. The decryption algorithm has to be unencrypted and easily disassembleable on the disk for this to work in a standard reader.

      Don't invest in this company.

    • Well the truth is (Score:5, Insightful)

      by dnoyeb ( 547705 ) on Thursday August 22, 2002 @12:02PM (#4119293) Homepage Journal
      The truth of security is that its inversly proportional to the number of people with a desire to circumvent it.

      It will NEVER work in any form for the music industry. For the software industry its just a matter of how popular your software is...
    • Re:I bet $20... (Score:5, Informative)

      by heathm ( 174421 ) on Thursday August 22, 2002 @12:18PM (#4119421) Homepage
      Well that would be a stupid bet.

      A few years ago I worked for a smart card company and we thought about doing this very thing. We realized very quickly, however, that the key securely stored on the smart card has to get passed out of the smart card and into software to be useable. Once the key is in software, it is vulnerable and can be hacked to decrypt the contents of the CD.

      If everything were done in hardware and the key was transferred securely through hardware it would be much more difficult to hack the key, but who cares? After passing the key securely from the smart card to the decryption hardware, the hardware has to put out a stream of unencrypted data to make the content actually usable and the data can be recorded AFTER being unencrypted. What if the hardware outputs the data in analog format? Big deal. It's a high quality stream so we record it again and digitize it and we really haven't lost that much quality wise.

      Adding a smart card to a CD or DVD doesn't really make it more secure. It just makes us jump through more hoops.

      Of course, this whole post is probably illegal anyway due to the DMCA. I would post anonymously but the karma is worth time in prison and $1/2 million fine.
      • Of course, this whole post is probably illegal anyway due to the DMCA. I would post anonymously but the karma is worth time in prison and $1/2 million fine.

        Well at least you have your priorities straight.

      • Re:I bet $20... (Score:3, Insightful)

        by fishbowl ( 7759 )


        "A few years ago I worked for a smart card company and we thought about doing this very thing. We realized very quickly, however, that the key securely stored on the smart card has to get passed out of the smart card and into software to be useable."

        If you'd only patented it, you would now be in a
        position to either quash the development of this
        "technology" or else to collect royalties on all
        media sold with your invention.

  • Attractive? (Score:3, Funny)

    by fiftyLou ( 472705 ) on Thursday August 22, 2002 @11:09AM (#4118768)
    The technology is highly attractive...

    Perhaps, but that website sure isn't.

  • CD Costs (Score:3, Interesting)

    by DavidLeblond ( 267211 ) <me&davidleblond,com> on Thursday August 22, 2002 @11:10AM (#4118780) Homepage
    How will this effect the cost of the CD media? It doesn't sound very cost effective to me, seeing how it would be a matter of minutes before someone wrote a program to crack it. I'm sure the developers know this too.
    • by dcavanaugh ( 248349 ) on Thursday August 22, 2002 @11:27AM (#4118957) Homepage
      I guess this is where we find out if piracy has any real cost associated with it. If piracy really does cause the massive losses that RIAA says it does, then it would be worth their while to try a media-based solution, even if it raises their cost. The retail price of CDs is set by what the market will bear, not by the cost of production. If I can buy a blank for 25 cents, I know the music industry is getting a better deal in bulk.

      If RIAA members still want to get $18 per CD and this hardware/media hybrid protects the ability to do that, then they will absorb the cost. On the other hand, if piracy "problem" is merely a smoke screen to attack low-cost/online/non-RIAA distribution, then this technology is dead-on-arrival. Time will tell.
  • All I see in the pictures is some silk-screen printing ontop of a normal CD. No Hi-Res graphics to actually get a close up look of this smart card CD. Exactly what platforms is this dynamic encryption supposed to work with? Just Windows, or what? I highly doubt my car CD player has enough processing power to play the CD.

  • Usually I say it is trivial to bypass almost any security measure, but after reading the article, it sounds like this one could be tough to crack, as these are not 'normal' off the shelf CDs

    Fortunately for /. type people, I bet these CDs will be expensive enough that they wont be used en masse by CD publishers...
    • They will just use it as an excuse to raise CD prices yet again.

      But cracking this will be easy enough, all you need is a patch cable and a sound card and a PC. Most MP3's are flawed with digital artifacts anyway, so people won't complain too much about the slight loss in quality from this kind of copy. All they will care is, "Does it work in my MP3 player?".
    • Usually I say it is trivial to bypass almost any security measure, but after reading the article, it sounds like this one could be tough to crack, as these are not 'normal' off the shelf CDs

      The way it's operation is described makes it something of a waste of time. You can just copy the data after decryption.
    • I know a foolproof way to protect CDs. It is highly secure and could never be cracked.

      Sell empty cases that have all the pretty cover art and lyric books. Can't rip that music.

      Seriously, I remember my uncle telling me about some new, uncrackable, small satellite dish that the company he was working for was working on. You just attach it to the eave of your house, and point it north. That company was Hughes, and we all know this technology as DirecTV. Turns out it was far from uncrackable.....

      It appears that if someone makes it, it is only a matter of time before someone cracks it. But aren't all William Gibson novels about a conflict between large data companies and a fringe digital underground?

      I predict - maybe I'm wrong, who knows - that this BS with digital rights laws and stuff will bounce around for another 10 years until we actually get politicians in office that know anything about technology. It always seems strange that politicians are generally really old people that are ill-equipped to deal with new technologies. These people will die off or get pushed out of office, and people who are mid-20s to mid-30s now will start to take office. Hopefully, they will have had the chance to get an education in the digital age, and they will educate the remaining dinosaurs of the folly of trying to regulate this stuff. You can't make laws that apply a label of criminal to everyone in the world except for the luddites, it is just a waste of time.

  • what? (Score:4, Insightful)

    by supernova87a ( 532540 ) <kepler1@@@hotmail...com> on Thursday August 22, 2002 @11:12AM (#4118795)
    How can this possibly be claimed to work with standard drives?

    Our dvd players read the optical stream from the disc, and then decode it video out. What is this chip supposed to do -- decrypt on the fly and send a new optical pattern to the read head? I don't think so.

    I think someone is trying to push a new kind of dvd drive that requires the discs to have smart cards...
    • Re:what? (Score:4, Informative)

      by gargle ( 97883 ) on Thursday August 22, 2002 @11:20AM (#4118879) Homepage
      "What is this chip supposed to do -- decrypt on the fly and send a new optical pattern to the read head? I don't think so. "

      Well, yes apparently:

      The technology works by turning an ordinary CD drive into a smart-card reader. A photodetector at the edge of the CD turns the drive's laser light into electrical pulses, which travel to the embedded smart card and request the key. If the card deems the request legitimate, it returns the key as an electronic signal that an onboard light-emitting diode converts into light and beams back to the drive.
      • Re:what? (Score:2, Insightful)

        by fireweaver ( 182346 )
        I am suspecting that the way this works is that there is supplied with the disc a separate authentication key that the user enters into his PC. Software would then modulate the CD-R's laser in a manner similar to a CD writer. The smart card looks for that signal and returns the appropriate response, I.e. the decryption key.

        I think that the fancy CD is just -part- of a total programme here.

        Gut feeling: It will be cracked in a week.

      • Sign me up! (Score:3, Funny)

        by Mirk ( 184717 )
        The technology works by turning an ordinary CD drive into a smart-card reader. A photodetector at the edge of the CD turns the drive's laser light into electrical pulses, which travel to the embedded smart card and request the key. If the card deems the request legitimate, it returns the key as an electronic signal that an onboard light-emitting diode converts into light and beams back to the drive.

        Hell yes! Sign me up today!

        I would be more than willing to pay an additional premium on the CDs I buy if it meant I could have the c00l technology.

    • Re:what? (Score:4, Insightful)

      by Biolo ( 25082 ) on Thursday August 22, 2002 @11:26AM (#4118935)
      You're thinking too linearly. This can't work on audio CD's, but I imagine they are just aiming at
      data CD's (and DVD's coming soon if you believe them).

      There will be a piece of authentication code in the installer (or whatever). This will be responsible for interacting with the smartcard to send it that initial information pulse. It will then ask the drive to re-read the "smartcard area" of the disk until it gets a response (decryption key), and will use that to decrypt the rest of the disk. Since DVD drives can run code also they will be able to use this same scheme there.

      'course all the Warez'ers will have to do is replace the initial installer code once they've accessed the drypt key, so I give new titles a week after they are released before there are cracked versions going about.

      One worrying question - are they getting all the power for the smartcard from that laser pulse? Really? Probably means a battery, so your CD or DVD now has an even more limited lifetime. Tinker with the battery size and Hollywood now has a way to program in obsolescence into that new DVD, forcing you to buy a new copy!

      • Re:what? (Score:3, Insightful)

        by Coplan ( 13643 )
        One worrying question - are they getting all the power for the smartcard from that laser pulse? Really? Probably means a battery, so your CD or DVD now has an even more limited lifetime. Tinker with the battery size and Hollywood now has a way to program in obsolescence into that new DVD, forcing you to buy a new copy!

        It all comes down to a scene in a demoscene demo of years ago. The demo is called "Eden". I can't remember the group that designed it..."Psychic Monks" or something like that. Anyhow...there was a scene where there was an oldskool anti-soviet poster stating "Big Brother is Watching". But instead of Lenin on the poster, it was Elvis. I always thought that was a funny paralelle, as the entertainment industry is always trying to find more ways to charge more for consumers.

        I'm still on the fence about this one. Am I happy that Hollywood/RIAA wants to come up with some sort of encryption system built into their media? No. But I can sorta see where they're coming from. After all, if that were your business, you'd try to figure a way around it as well.

        However, the gaming industry might have realized one minor fact that Hollywood and RIAA have overlooked -- spend all your money on research, and its likely going to get wasted. It doesn't matter what you do, someone will find a way around your "security". The goal of an entertainment industry is literally just to make more gains than losses (profit). I'd be curious to know (if there is a way to measure it) the difference between the net loss relative to piracy and the cost put into research for anti-piracy devices such as this. I wouldn't be surprised if it came close to balancing out.

        The reality of the entertainment industry...with some exceptions, a movie, or a CD or a game or anything of the sort has a life span. It is popular for a certain amount of time, and then people loose interest. They get interested in the next new thing. The industry could take advantage of that.


    • How can this possibly be claimed to work with standard drives?

      It may be compatible with standard drives - meaning you can read data from them (and copy them as well). BUT in order to enforce the encryption you need either a new drive, new firmware, or a new driver. It cannot enforce it's "lock" on current standard drives. To claim to do so is a blatant lie. There would need to be a globally unique serial number on every CD/DVD drive on the planet - AND it would need to be transmitted to the last track of the disc every time it is inserted into a drive. Standard drives do not do this.

  • by McCart42 ( 207315 ) on Thursday August 22, 2002 @11:12AM (#4118798) Homepage
    Granted, Windows XP had nothing this advanced on the disc itself, but the methods of circumventing this new protection device will likely be the same as the ways WinXP's product activation was circumvented. Just reverse engineer the code, find the references to the smart chip, and remove those references. Granted, one won't be able to just "copy the disc", but cracked ISOs can still be theoretically distributed. It'll be interesting to watch.
    • by Erasmus Darwin ( 183180 ) on Thursday August 22, 2002 @11:23AM (#4118910)
      "Granted, one won't be able to just "copy the disc", but cracked ISOs can still be theoretically distributed."

      Sure. But remember that copy protection doesn't have to completely prevent copying to be effective. Instead, it merely has to make the legal purchase more attractive than the copyright infriged copy, at least to some consumers.

      In this case, it sounds like each and every DVD would have to be cracked by someone with a good deal of skill and possibly some special equipment. Compare that to "cracking" CDs, where you can get pre-made tools that handle all the effort of ripping CDs, encoding them as mp3s, and even naming the files to match the CD info.

      • I don't know about you, but this kind of BS makes the legal purchase a whole lot LESS attractive in my eyes.
        • when i get a new cd, the first thing i do is convert it to mp3. then i stick the original in a cd case never to be seen again. if i cannot do this, then i'm not going to purchase the cd. if i get a cd that doesn't allow me to do this, then i will return it.

          if this happened to an artist that i really liked, i would probably send them a letter explaining my position. i would then tell them that i will not purchase the cd in question or any future cd's which have this type of protection.

          if they dont listen, then they dont listen. the cd would end up on irc, p2p networks, netnews, etc. before it's even released. this type of alienation of their fans hardly seems worth it.
    • No, that wouldn't work. The data on the CD is encrypted. The disc decrypts itself if it passes security checks. It would presumably keep track of the systems that it has been installed on, and refuse to decrypt itself if you violate the EULA.

      The glaringly obvious hole, that I see, anyway, is that you could stick it into a valid system, and then copy the contents. It would decrypt the files to give you, the authenticated user, access to the data. Then you could crack and burn. The only thing I see this preventing is 1-to-1 copies, like CloneCD does.
  • by KelsoLundeen ( 454249 ) on Thursday August 22, 2002 @11:12AM (#4118800)
    Maybe it's just me, but does it dawn on no one -- at least no one at the RIAA and perhaps the MPAA (Jack "Maddog ... Grrrrrrr!" Valenti in particular) that they (and by "they" I mean the RIAA and the MPAA) are slowly destroying the promise (so-called, of course) of digital technology?

    All this stuff -- from half-assed watermarking, to government-sanctioned hack attacks on 14 year-old Kazaa users, threatening to throw them in federal high security lockups -- all this stuff is destroying what it's attempting to preserve.
    • by Colz Grigor ( 126123 ) on Thursday August 22, 2002 @11:27AM (#4118955) Homepage
      Would that it were so...

      Remember that the 14-year-old Kazaa users tend to still be significantly more intelligent than the average population.

      Anyone below average scares the crap out of me and, by definition, that's 50% of everyone.

      With Microsoft and Dell making computers that any idiot could buy and use (Jeez... just take a look at Dell's spokesperson!), we'll actually have at least half the population buying these copy-protected CDs without thinking twice about Fair Use.

      So much for voting with out wallets. We're going to actually have to vote with our votes during every upcoming election. Our best course of action is to educate those that are educable and motivate them to cast their votes every time they have a chance.

      It's society's own apathy that's going to wind up allowing ..AA to kill digital content.

      ::Colz Grigor

      • You are so right it scares the crap out of me.

        These things ARE coming to pass because the general population *is* voting with it's wallet. MOst people buying CD players and CDs have no clue what copy protection or digital rights management is. If you try to explain it to them they still don't get it. What they do get is that, I buy this great CD player and these CDs and I can listen to the latest cool tunes. Their not thrilled with the cost of the CDs but, "hey, what are you gonna do?". "Dude, you gotta get the latest Brittney Spears CD it is SO sweat and did you see that shot of here on the back of the cover?"

        Like a dear in the headlights, most people don't even know that they are being screwed, much less care.
      • Actually, this isn't true.
        Anyone below average scares the crap out of me and, by definition, that's 50% of everyone.

        Let's look at a few IQ's- 90, 90, 90, 95, 100, 180.
        With these numbers, the average IQ comes out to be 107.5. This puts 83% of the population to be "Below Average".

        It can also work out the other way.
        20 (vegatable), 50 (retard), 120, 130, 125, 100, 115, 180.
        The average of these numbers comes out to be 105. So that putss 75% of the population above average.

        Now you say, "Well isn't 100 supposed to be the average IQ? Well, yes, but as you can see, it doesn't always work out to be the median number either. Truthfully the average is probably a little higher or lower. But then you have to ask yourself who you consider...
        To make everyone take it you have to factor in language (which many IQ tests factor in), problem solving, etc.. which can all be somewhat screwed up. A dolphin has a pretty high IQ as things should go, but he can't tell me if Cat is to Kitten as Dog is to...
        yea, and then we have to factor in those with mental problems, or mental gifts. Those people throw things off pretty well. Then some people are uncaring or unwilling, which would pull the scores down more. What about people who have a huge problem speaking and dealing with people, but can spit numbers out at you (hmm, Pi...)

        Anyway, 50% of people are not below average, nor are 50% above, even if it all averages out to "average" IQ...

      • Blockquoth the poster:

        we'll actually have at least half the population buying these copy-protected CDs without thinking twice about Fair Use

        The recording industry (and through them, the movie industry) has already lost this fight. They lost it around 1995 or 1996. Everything since then is just a King Canute maneuver. They've lost for the following, single reason: For more than six years -- 1.5 student "lifetimes" -- college students have been getting music for free and getting used to playing it where, when, and how they want. And their younger siblings have been watching them. Game over.


        You're right. Most of them probably don't know or care about "Fair Use" rights or copyright law or the DMCA. But they know MP3. They know timeshifting and spaceshifting. They know what they like to do with their music. And they are, statistically, going to be a demographic the RIAA/MPAA want: For no one is discretionary income so high a ratio to total income as for 20-somethings. The *AAs desparately, desparately want to sink their hooks into this demographic and extract all the cash they can. Yet these people expect free music.


        And it won't get better. Maybe the culture machine will drive people to buy the protected CDs. At least as likely, the teen set will say, "Screw this -- I want my MP3".


        The corpse hasn't stopped moving yet, but no technological fix is going to breathe life back into the old music distribution model. And Holllywood knows it's next... why do you think they combined a crappy protection scheme with the draconian DMCA? Because they know (a) people can draw the line from copying music to copying movies and (b) only a massive legal campaign will have any hope of stopping that, by stigmatizing movie copying before it becomes socially acceptable.


        But they are too late. People can draw the line. And people already accept movie copying... somewhat fringe now, but growing.


        The buggy-whip makers hear the thunder of tomorrow and are scared. Rightfully so.

    • There is nothing magical here that is truely different from any other scheme. I read how this thing is designed, it will work off any standard cd drive. Which means that you can still 'rip' an image of the darn thing. You can try to figure out what a 'legitimate' code is and then just copy the data, or you can let whatever program that they consider 'legitimate' to run properly, but with a custom debugger grabbing the info as the program gets it. Heck, you can make a microcontroller that logs all communication going through the ide pins! Since both standard cd drives and computer ram can be read and hacked, there is no way this will work any better than any other half baked scheme.

      With one exception. Those countermeasures I mentioned above probably won't work on Microsoft's new oh-so-secure upcoming OS (which shields ram and devices from such attacks, supposedly).
    • Yeah, the digital devide of the future is going to include many folks who opt out of the degital device market simply due to any lack of control as to the use of those devices. Frankly, if all this competition (of which lobbying the government is supposedly a part of) and shit is supposed to encourage people to work harder and be innovative, screw that. I had a friend who stopped working on flight sims after he found out they were selling to governments to help them train pilots to bomb their own people. It's an unfair comparison, but its still the same forces at work that would make me question my involvement as an engineer in the development of technologies that are designed to remove the accountability and responsibility of obeying the law from an individual citizen. All this to appease a demonstratibly corrupt industry [ftc.gov]?

      I will not contribute towards technology that does nothing to even the playing field in this plutocracy.
    • by Arcturax ( 454188 ) on Thursday August 22, 2002 @11:38AM (#4119083)
      More like they are doing all they can to stop the inevitable. Their business model fails with today's technology and they know it and are doing whatever they can to squeeze what little they still can from it. Instead of embracing the technology and working the problem of making a new buisiness model around it, they are thrashing to and fro as they slowly die, doing anything to extend their life a little longer.

      Case in point... last weekend I was at Conglomeration (nice mid sized sci-fi con held near Lousiville) and attended a panel by the directors of the home made movie "Rock and Roll Starship". I brought up computer technology and he told me that since the advent of things like iMovie and companies like Adobe and Apple making what was once high end movie software cheap enough for the masses, that the number of people who are interested in starting their own independant movie making groups has skyrocketed. He said that anymore, movie making is going more and more independant and it is only a matter of time before Hollywood loses control to groups of kids who are able to make their own films and put them up on the internet or burn them to DVD and sell them at cons.

      True, the flashiest looking stuff will always come from big budget Hollywood, but independant film makers are going to catch up enough to make some stuff which looks pretty nice on their own. That and some of the independant stuff is pretty damn good story wise, better so than a lot of Hollywood fluff.

      In fact, I was able to see a rough cut of their second movie and comment on it, to influence the final version, which was very cool! Their first movie came out in 1997, had shaky camera work, Dr. Who like special effects and the sound was a bit buzzy.

      This next one, though a rough cut, already looked a lot better. The sound hadn't been cleaned up yet and there were only a few "test" effects, but from what there was in there the new movie will look as professional as something that Hollywood might put out.

      Times are changing and you will see more and more of this as time goes on. Hollywood had better prepare itself, because the computer is going to bring on the age of the independant film, and nothing they do is going to stop it.
  • by PseudoThink ( 576121 ) on Thursday August 22, 2002 @11:12AM (#4118801)
    "Please return your drive to the manufacturer so that we may upgrade it to be compatible with new and exciting technology that has become available! Don't miss your chance to make full use of this new technology, because it really is better!"
  • From Doc Witness's homepage:

    It is impracticable to
    crack since it is hardware based and is
    based on dynamic protection. Unlike
    competition it is not based on passive
    protection (that is easily cracked)
    or remote activation (that is both offensive
    to customer's privacy and easily cracked).


    Uhm. Okay guys. If I was a record producer who was living with (the very real) fear that my job was about to go away because of digital copying, the line above would make me think twice about using your technology.
    • Why is hardware based encryption impractible to crack?

      And "dynamic" -- what does "dynamic" mean in this context? That the CD has a little ethernet connection and requires you to plug it into an internet connection before playing it?

      This reminds me of the organic DVDs promised a couple years ago. Rip the special plastic off the DVD and it begins decaying. After 72 hours, the DVD is unplayable. It was touted as revolutionizing the DVD rental business model.

      Yeah, what a revolution! Wait ... I think I missed that one ...
  • by sirinek ( 41507 ) on Thursday August 22, 2002 @11:14AM (#4118813) Homepage Journal


    new encryption scheme
    baby oops i cracked it again
    more britney copies!

    siri
  • ugh. (Score:3, Informative)

    by garcia ( 6573 ) on Thursday August 22, 2002 @11:14AM (#4118815)
    let's count how many posts say "the crackers will have this fixed in X days."

    I don't understand where my ability to make backups for myself has gone. That's part of my right as an OWNER of a piece of software. I am ALLOWED to make a backup for myself.

    With this, if the disc goes to crap or the "smart card" goes to shit what am I going to do? Can I call up Doc-Witness and say, "hey, send me my money so I can get a new CD?"
  • so how will the smartcard know that you are legitimately trying to reinstall the software after an hd crash? cd rom drives (so far) have no mechanism of transfering data to the disk and telling it the cpuid or whatever other unique id of a computer.
    • so how will the smartcard know that you are legitimately trying to reinstall the software after an hd crash? cd rom drives (so far) have no mechanism of transfering data to the disk and telling it the cpuid or whatever other unique id of a computer.

      How is it going to know if a hard disk has been cloned or if the software has been installed on a shared drive?
    • The smart card, obviously, can be written to as well as read. The software (and/or the uController in the smartcard) will limit the discs usage. Perhaps tying it to a mac address or another device as winxp currently does.

      The communication process should be easy given any cdrom drive. The LED and phototransister are located in place of several tracks each. To send a message the program can tell the cdrom to read that track to send a one, read a different track to send a zero, etc. It'll likely be based on long time constants to slow drives work as well as fast. To receive a message it simply tells it to read the track with the led and decodes the data based on long time constants again.

      Overall it'll be slow, but it'll work for what they're trying to do. It'll increase the cost of the disc only a little as the foil only needs two little holes, and the smart card can be laminated over the foil - no special presses or anything.

      The great difficulty here is that the smart card is exactly that - smart. It won't dispense the encryption key unless the program reading it has presented some form of authentication, ie - Program sends a start auth message, cd sends back an encrypted message, software decrypts it and reencrypts it with another key, cd verifies encryption and message then sends the encrypted key to the software. Using the usual public key methods there is no practical way to override the program because you have to defeat both the smartcard and the program. Since every release is going to have a different set of keys then they would need to be cracked on a cd by cd basis, unlike dvd where you crack one you crack them all.

      The good news is that this sort of long authentication would take 5 minutes or so (I'm guessing), unless they use shorter (weaker) keys, and therefore they will likely start off using dumb cards that require little or no authentication to get the key for the rest of the cd.

      -Adam
  • Craziness! (Score:4, Insightful)

    by case_igl ( 103589 ) on Thursday August 22, 2002 @11:14AM (#4118819) Homepage
    I have the kids that run around my house. They wake up, eat breakfast, and then go outside and collect all manner of nasty goo on their little fingers.

    Then they come in for lunch, "play" computer, and muck up CDs. I'm not talking about my really important stuff that is snuggled away - I'm talking about the games they are alloyed to play...God forbid they get their hands on Warcraft 3!

    I always make burnt copies of CDs for the kids to use, so that when they roll over it with the toy car and crack it I can just make a new one.

    I know piracy is a problem for the industry, but it just sickens me at how legitimate fair use gets slaughtered for people like me!

    And forget the "I won't be buying any of THESE CDs line" -- that only works until Toy Story 17 comes out on DVD....

    Case
    • Re:Craziness! (Score:2, Insightful)

      Hmm, this gadget doesn't seem like something you'd put on a Warcraft CD. Too expensive, and also for the reason you mention (kids getting their dirty mits all over the optical smart card thing, rendering it usless), the customer support would be a potential nightmare for Blizzard.

      It does seem like soemthing that Mircosoft would put on a $279 CD of MS Office, to stop IT staff from making a few extra copies or to stop employees from making a personal copy at home. It might work too, as the support costs for high end packages might justify the cost of the smart card dohickey.

      Hmm, but you'd have to insert a differt CD every time you'd want to start a different program, and if you want to store your Excel spread sheet on a CD-RW, it'd be a two step process, or you'd need two drives.

      Kinda a wash if you ask me. Not suited to low end, and the high end would probably complain too much. Shrug. We'll see I guess.

  • key management (Score:5, Insightful)

    by russcoon ( 34224 ) on Thursday August 22, 2002 @11:14AM (#4118820) Homepage
    How quickly they forget:

    If you are forced to distribute the secret in an insecure way, the game's over. Better yet. it only takes one read to copy the data.

    I guess it's a nice idea that just misses the point.
    • If you are forced to distribute the secret in an insecure way, the game's over.

      You are right, technically. But legally, mentioning or employing this obvious fact turns you into an evil cyber terrorist, as they nowadays use to call us.

  • this is fantastic (Score:5, Insightful)

    by GoatPigSheep ( 525460 ) on Thursday August 22, 2002 @11:17AM (#4118844) Homepage Journal
    (sarcasm)
    YES! This is great news!

    Thanks to this new technology, the price of CD's should plummet, as it will be impossible to rip them!

    Finally, they have solved the problem of piracy and can now lower the price of CD's since they will not be 'losing money' anymore (a slow economy doesn't count)
    (/sarcasm)
    Yeah, right. I bet those greedy pigs will raise the price of cd's even more citing the need to produce 'anti-theft technology'

    • 1. This is nothing more than a CD that carries its own dongle. This might be attractive to companies like Quark and Microsoft, but isn't applicable to music CDs.

      2. The company hasn't said how much this costs. If the price is much higher than what it costs to mass-produce normal CDs/DVDs, then only a few software publishers will bite. Also, not every CD production facility will be willing to invest in new machines.

      3. PR releases tend to hype (and even lie) about how many companies are "interested" in an attempt to lure the others in. We need to shine more light on this subject fast.

  • Not for music (Score:2, Informative)

    by djshaffer ( 595950 )
    It looks like this is for software packages.

    The installer communicates with the smart card to get permission and the decryption key needed to finish the install. So, reverse engineer the installer and run one legitimate install to capture the decryption key and you can make as many installs as you want.

    It's a little more secure if the disk has to be in a drive to run the final software, and it expects to communicate with the smart card to authenticate authorization to run.
    • Yeah, that'll go over *real* well. "Sorry, Mr. computer lab, you have to physically have this CD in the drive to run a program, and to run a different program, you need a different CD in the drive, etc."
  • by LadyGuardian ( 568469 ) on Thursday August 22, 2002 @11:20AM (#4118877) Homepage Journal
    FULLY TRANSPARENT to the consumer (as long as he or she keeps the user agreement).

    This worries me. They even mention down below how static systems are easily cracked and how 'phone-home' is offensve to user privacy and still not solid. Which user agreement will they use? The one that inclides fair use or a new creation that disables any and all attempts to protect our investment?

    I'm not a 'consumer' with gigs and gigs of stolen MP3's, but I am someone with backups of my legitimately bought copies. I have two siberian huskies that seem to love chewing on CD and DVD cases (I'll stop leaving them at the door, I promise) so these backups become invaluable.

    Sadly, people who've read their benefits [doc-witness.com] section will realize that our right (yes, it is a right) to have legitimate back ups are tossed out the window...
  • Their website is not very generous on details on how it work.

    If no special hardware is needed to make it work, then it probably rely on software to do decrypt the disk.

    The key used to descrypt the disk is sent to the computer when a legitimate request is made. Once you have the key, who is going to prevent you from keeping it and reuse it later.

    How can they have dynamic keys if the CD-ROM is encrypted once?

    It would also be probably easy to pose a reading request as legitimate and then decrypt the whole disk and store the cleartext ready to be burn on a new CD.

    This kind of scheme may prevent M Smith from copying the disk, but M Cracker will find a way arround the protection in no time.

    All copy protection scheme inveted as of yet were defeated. This one will go the same way.
  • Ok, they encrypt the data on the CD. Ok, I have to get the key from the smart card with the optical interface (really a cool bit of technology if you think about it). Ok, then I can unencrypt the CD. Now explain to me why I can't just keep this key, or even the unencrypted data around?
    If you are trying to protect an application (say a game), then I could see it require the use of the smart card, but it doesn't seem like it would be to hard to write a device driver wrapper around the CD-ROM driver that exists that will emulate this.
    Overall, very cool technology. In this instance it seems like it will do little more then keep honest people honest. Is that really of value to any publisher?
  • This technology was mentioned in this month's Technology Review. Sadly it only seems that it was in the print version.
  • Title: CD Copy Stopper

    Okay...

    Later: You can copy the CD

    Sounds effective. Then: without the card the software won't run.

    Hmm...okay. So we've copied it to another CD. There isn't a card anymore. Why's the card needed?

    Earlier: A "smart card" embedded in the CD unlocks the disc's encrypted content.

    Oh. So we rip an ISO off the CD, crack the encryption to form an unencrypted ISO, and burn it back to another CD.

    Gee, like that's not gonna happen.
  • by Ride-My-Rocket ( 96935 ) on Thursday August 22, 2002 @11:24AM (#4118920) Homepage
    .... that is able to outmaneuver my Sharpie pen?
  • by Anonymous Canard ( 594978 ) on Thursday August 22, 2002 @11:24AM (#4118924)
    It seems pretty disingenuous to me for them to claim that their technology is compatible with current hardware. Where hardware and firmware are sold as a single entity, I read that expecting to find some sort of protection system that would interact with current firmware, but they clearly need a trusted client on the device to interact with the smart card since they have to rely on that software not giving away the decrypt key. In other words, these may play on the current mechanical hardware, but they certainly won't play on current CD or DVD players without first getting a firmware upgrade. In all this isn't much different from shipping a separate smart card and CD-ROM.

    At least I can't see any way to trust a client once it has been transferred to the general purpose computing platform; at that point the software is open to inspection and its secrets won't remain hidden very long.

  • Insufficient. (Score:2, Insightful)

    by Faile ( 465836 )
    This wont work. It doesnt sound any different from the protections companies employ now where the CD has a magic key or secret uncopyable section on it. Pirates simply copy the part of the CD that is readable and then use a cracked executable distributed on the CD that doesnt bother looking for the secret section or bytes.

    Until it's impossible to copy all the information on a CD this is the way illegal games and applications are distributed. This innovation, however ingenious wont make a dent in the pirate industry.
  • I don't buy it. (Score:5, Interesting)

    by BeBoxer ( 14448 ) on Thursday August 22, 2002 @11:32AM (#4119016)
    A photodetector at the edge of the CD turns the drive's laser light into electrical pulses, which travel to the embedded smart card and request the key.

    I suppose it's conceivable that this might be possible with a CD-RW drive. But with a regular CD-ROM drive? I think that's bullshit, plain and simple. It's not like there is any command for sending data to the laser of a read-only drive. Do they send the request in morse code by turning the drive off and on again?

    I think this is just more snake oil being peddled by folks who know the can make an easy buck off of nervous media executives. My guess is, it'll work fine during the dog and pony sales presentation, it'll cause endless support headaches for paying customers, and be trivially bypassed by the warez folks.

    I swear, I don't know where they finds the folks who sign on to these deals. Have a problem with piracy? Make your product less attractive than the warez version by saddling it with a bunch of flakey 'copy protection' technology. That'll help your market share!
    • that reminds me.. (Score:5, Insightful)

      by gimpboy ( 34912 ) <john,m,harrold&gmail,com> on Thursday August 22, 2002 @12:02PM (#4119297) Homepage
      I swear, I don't know where they finds the folks who sign on to these deals. Have a problem with piracy? Make your product less attractive than the warez version by saddling it with a bunch of flakey 'copy protection' technology. That'll help your market share!

      i had friends who used a program, 3d studio i believe, which used to rquire a hardware dongle. this wasnt really a problem, except they had about 2 or 3 other software packages which required the dongle. finally they started installing the warez versions-even though they had legally purchased the software. it was just easier to deal with the warez version than the big tumor of dongles hanging off the back of their computers.
  • by dinotrac ( 18304 ) on Thursday August 22, 2002 @11:34AM (#4119038) Journal
    Hmmm.

    Suppose we presume that this magic card really, really works.
    Assume it is the fly, cats-pajamas, Golly-Gee-Whiz-Neato, super deluxe, smokin', king of the hill, rad copy protection of all time.
    So perfect it gets canonized in Rome.

    So ---
    It determines what it considers to be legitimate requests?

    How does it tell the difference between a completely legal archive copy and an illegal copy?

    How does it know the difference between a completely legal archive copy (a right protected by federal law, BTW) of an archive copy made because the original disk was destroyed?

    How does it know the difference between an illegal installation on another computer and a legal installation on an upgraded computer? A legal installation on another computer that replaces the first one?

    Is this smart card also a legal scholar, familiar with fair use exceptions?

    Unlike many here, I believe in intellectual property rights and have no problem protecting them.

    I have a big problem, however, with protecting intellectual property rights by taking away my rights and those of everybody else.

    Store owners aren't allowed to protect against robbery by shooting everyone who looks like they might steal something. IP owners shouldn't be able to protect against theft by infringing on the legitimate rights of their potential customers.

    • And what happens when your uncopyable disk gets damaged, and the company is no longer around to provide replacement media? Or decides to charge an arm and a leg for replacement media?

      Or worse yet, REFUSES to provide replacement media, and instead requires that you PURCHASE an upgrade? (I've actually seen this happen with copy-protected software. My client purchased a competing product instead.)

  • "Valid" Request? (Score:3, Interesting)

    by Kwil ( 53679 ) on Thursday August 22, 2002 @11:40AM (#4119096)
    Could somebody tell me what an "invalid" request from a CD is?

    'I want to read this bit, and the next bit, and the one after that..'

    After all, I always thought it was what you did with the bits once they were off the CD and in your 'puter that was the problem.

  • I don't know of any processor that does not require power. They are a little short of info in the article, but what do you do when the battery on the CD dies? It's not like a smart chip that is powered by the socket during the transaction. I can't see this being compatible with the redbook standard in any way providing compatibility with any of my exixting hardware. It looks like another obscure new kid on the block that will have to crack the chicken and egg problem.

  • Any bets this crap works (if it's working at all, and not just a vaporware announcement) only under Windoze?
  • It seems to me the you could
    install the CD into a virtual machine
    and then just copy the entire virtual machine.

    I hate it when companies go out of their way
    to make something not work.

  • by CrystalFalcon ( 233559 ) on Thursday August 22, 2002 @12:21PM (#4119440) Homepage
    Ok, so for all intents and purposes, this is a dongle. It's an active piece of the CD that contains hardware that can be used for challenge/response mechanisms used for copy protection.

    Has anybody ever heard of cracks for dongle-protected software? (insert roaring laughter here).

    Silly fools. Marketing anything as "uncrackable" is going to shoot you in the foot. This is no more secure than SafeDisc, it just requires a patch to the binaries (don't check that disc) and you're good to go.

    If a computer can read it, it can be cracked.
  • by Kynde ( 324134 ) <kynde@[ ].fi ['iki' in gap]> on Thursday August 22, 2002 @01:19PM (#4119920)
    Copy protection is a paradox for one-way media (like CDs/DVDs/TV/Radio/etc... Plain and simple.

    As long as the end-user, i.e. the viewer, cannot be trusted in all circumstances, there is no way on earth to protect it, because at some point along the line from the DVD to the TV electron cannon or LCD crystals the signal must be deciphered.

    There will always be people that will capture that and put it out as an mp3 or DivX.

We are each entitled to our own opinion, but no one is entitled to his own facts. -- Patrick Moynihan

Working...