Hacker News Reader

Comment by jakogut | Hacker News Reader

There's always an analog loophole. Even if the OS is unable to access the memory storing the decrypted data, you could always just plug the output of the machine into a capture card and capture the decrypted stream that way.

I suppose some monitors and TVs have "features" to cryptographically handshake with the GPU and ensure a secure link, but at some point the data must be decrypted and decoded to be displayed. This doesn't seem like much more than a speed bump for a motivated individual.

View on HN

The end goal is DRM all the way to the screen. No capture cards will be allowed.

It's a cat and mouse game, but I wouldn't discount these efforts as a mere speed bump. Screen enforced DRM will make things much harder. A motivated individual with the right tools and hardware hacking know how may be able to jailbreak a screen to record stuff, but that's going to make things out of reach for most people.

With how good modern screens are, and how good cameras are (and how easy both are to hack), you could always play back the video and capture the photons through the air.

There was something called Macrovision back in the VHS/DVD days that tried to defeat digital/analog conversion, and I'm sure visual techniques could be devised...

But I imagine someone with a good OLED and a good mirrorless camera (or even a cell phone nowadays) could make a pretty good 4K replication of any media that displays.

Especially when you add HDR to the mix, I think it's still extremely difficult to get a high quality screen recording, if only because it's so hard to get the exposure right.

You could record multiple exposures and merge them after the fact

(and I agree the result would likely be subpar, but better than it's ever been at any previous point in time)

Yeah, I guess it really depends on what your standards are. It's certainly getting better but I have trouble imagining anyone would consider this a good solution. At minimum, if this was what pirates had to resort to, then I would think the DRM has done it's job, in that it very significantly degraded video quality for the pirates.

Modern dedicated cameras have far more dynamic range than any HDR TV in practice. The movies have to be recorded somehow :)

> The movies have to be recorded somehow :)

I'd imagine they do this via huge (non-consumer level) cameras as well as by professional editors and graders who spend countless hours on the process.

But that doesn't really contradict your point. I don't know. I've never seen a good screen recording but I don't download pirated films so perhaps I've never seen an instance of someone really trying to get it right.

The cameras you can buy used for a couple thousand dollars have essentially the same sensors as huge cinema cameras, if not better in this application assuming you'll take stills.

Professional editors and color graders have to lower the dynamic range, because there is basically nothing that can get as bright as, say, the sun, and because basically no display can sustain peak brightness over the screen, which introduces an EOTF transfer curves, reducing the peak brightness and thus dynamic range.

You're right about pirated films, but that's because they're typically recorded in a run of the mill cinema while it's playing, not in controlled conditions in front of a carefully calibrated screen-camera combination taking a photograph of every frame.

My A7C II ($2000-class mirrorless) has a sensor with far more range than any monitor I've ever been able to afford.

You'd think so, but I've already run into a situation where DRM broke our screen capture for a live talk recording and I simply set up a camera to record the screen.

With a little bit of work (display a few calibration targets and build a quick and dirty LUT to match your display) you can get really convincing results.

It was good enough for the moon landing. The video feed from Apollo 11 was some special format that was specially decoded onto a particular monitor. There was a camera pointed at the screen to rebroadcast the feed globally.

Once upon a time, this was how all video-to-film transfers worked.

https://en.m.wikipedia.org/wiki/Kinescope

Also called Telecine (or at least, a very related process), as in: https://en.wikipedia.org/wiki/Telecine_(copying)#Piracy

Probably would be better carefully tap into the signal lines to the LCD panel, and record and decode that data to then make a video. However if we assume that even the cable going to the panel is encrypted and the board on the panel is decrypting it. (although I have never messed with a panel like that). However it still has to got to drive the rows and columns of the display, so then data to column and row drivers is still in the open.

If we were to even assume the Column/Row drivers chips only accepted encrypted data they still have the individual traces coming out of them. The pitch of the traces is super tiny, but still possible to tap, but would be a massive pain, but still do able.

Although you can get devices that strip the encryption from an HDMI signal these days so it's kinda moot. So it's not exactly something anyone would need to do these days.

This works for me! Nobody needs more than 480i anyhow.

Except Cinavia, which worked on audio level, exists: https://en.wikipedia.org/wiki/Cinavia

Although it can only trip on certain devices or media players (mainly Blu-ray players, including PS3 onwards), I did read an idea that suggested Cinavia being placed inside an OS's kernel in a secure enclave to make it system-wide.

There are many USB capture dongles with chips that ignore DRM, easily available for cheap at popular online stores. Nobody has to go as far as jailbreaking screens.

In this case the piracy model might change into something like the software cracking scene where groups with specialized skills and equipment would be the ones doing the uploading. Regular people wouldn't be able to make copies with a capture card to send to their friends but popular films and shows would definitely still be released by those groups.

Or I just split the raw pixel values from the monitors t-con board.

It doesn't matter at all how out of reach it is for most people. As long as one kid in Russia can do it, the torrent is available for everyone in the world just as soon.

This has already been shown with videogame DRM like Denuvo. It's so hard to crack that only a handful of people know how, and yet they end up racing eachother so eagerly every time a new game comes out that it's usually done in under 24 hours. Unless you can beat "so secure that only a handful of people in the world can crack it" the situation will always be the same.

Denuvo has pulled back into the lead lately, it's taking a very long time for cracks to appear, if they ever do. For example Dragons Dogma 2 came out in March and still hasn't been cracked. Avatar: Frontiers of Pandora hasn't been cracked for a full year.

Active player counts:

  Minecraft: ~185,000,000
  World of Warcraft: ~7,250,000
  Dragons Dogma 2: ~4000

This seems more along the lines of nobody bothers to crack games nobody wants to play.

DD2 is a single player game, those generally don't maintain their active player counts forever. It peaked at 228,285 concurrent (not total) Steam players which are pretty good numbers.

The peak was the release, after which it promptly cratered. It was below half that within a month and below 14k the next month.

This obsession with concurrent player counts, especially for single player games, is just obtuse. It's not actually telling what you want to believe.

Even if we do go by concurrent players, Black Myth Wukong had one of the biggest launches in Steams history with a peak concurrent of 2.4 million players, and that hasn't been cracked either after five months.

there's only one person releasing cracks for modern denuvo and their last release was a year ago, and they're crazy

Apparently the people doing this kind of work have been disproportionately in Eastern Europe and what's going on in Ukraine has so disrupted that part of the world that they currently have bigger problems.

So then you're waiting for either that region to stabilize or demand for cracks to cause people somewhere else to get into the game, and in the interim you effectively have a temporary supply chain issue.

But it's hard to give credit for the ravages of war to the DRM pushers and it's not at all obvious that they've secured any kind of permanent advantage.

Who was cracking denuvo on a regular basis back in say, 2021, before the war started? Basically no one. So I'm not sure that's true.

There is an ocean of difference between "basically no one" and "actually no one" when you only need one person in the world to do it.

> This has already been shown with videogame DRM like Denuvo.

No it hasn’t.

> Everytime a new game comes out that it’s usable done in under 24 hours

This is not even remotely true and is not based in any kind of reality.

Back in the day when piracy was quite literally just copy and paste it was a very active scene.

But cracking Denuvo takes real skill- and there's no financial reward in it. Back in the 90s bootleg DVDs and CD-ROMs had organised crime making money from it.

Exactly.

Cracking Denuvo as a hobby is not something a sane person would do, and the downsides if caught are higher when one is fully employed.

At least to me, a decade has passed since I left college and had spare time and energy to tackle such projects just for cred.

I took a cursory look at breaking it and it seems rather trivial in retrospect, just annoying at best since you have to rebuild the executable’s imports, relocations and section headers, along with removing the giant bloat sections that they add (seriously, when the main .text section of a game is 4MB, and then their extra obfuscation sections end up being over 250MB, something is ridiculously wrong.)

Not quite. The problem is that when you involve hardware, things are exponentially harder. When you tie it with content streaming, it's essentially a losing battle.

Hardware: makes cracking much much harder and out of reach for a lot of people. Even the people that can do it are going to be drastically slowed down due to this.

Streaming: means you can block specific device keys once you know they are compromised (the hacker managed to mod the TV to be able to record from it).

Denuvo is winning, for better or worse. You can see some of the lead times for cracking these games[1][2]. It's, you know, often months+.

[1]: https://www.reddit.com/r/CrackWatch/comments/1hqd4p3/crack_w...

[2]: https://www.reddit.com/r/CrackWatch/comments/ieo7u4/crack_wa...

> The end goal is DRM all the way to the screen. No capture cards will be allowed.

Sure, but the closer you get to the eye ball, the bigger the loophole is.

It's not common anymore, but _way_ back in the day, some releases were made *in the projection booth* with a semi-pro camera on a tripod pointed at the screen. (look for old NFO files with `TS` or `TeleSync` in them to get an idea of when this was common-ish)

The analogue loophole will remain open until there's a HDMI to optical nerve technology that we're all forced to get at birth.

> The analogue loophole will remain open until there's a HDMI to optical nerve technology that we're all forced to get at birth.

This is kind of a pointless tangent, but you might not have to go that far. It's probably hard to get a recording of the Apple Vision Pro for instance.

> It's probably hard to get a recording of the Apple Vision Pro for instance.

I hadn't actually thought about that! For 99.995% of my time on this earth, "screen" meant "flat, glass, viewed from some distance". I guess it's time to spend some time thinking about what new ways to exploit the analogue loophole are...

I wonder which part would be harder: designing something to fool the "am I on a head? Where are the eye balls looking?" bits or the optics needed to re-combine the stereo?

Likely not an issue. Convincing consumers to strap a brick to their face has proven to be a persistent challenge, which even Apple has not been able to overcome. However, there is also a nontrivial percentage of the population who medically cannot use VR/AR. This population is large enough that there is a market for "2D Glasses" for removing 3D effects from movies in cinemas. Releasing a title as a VR exclusive means excluding this population from your sales figures entirely.

Yes, this is why I called it "kind of a pointless tangent". :)

However, the reason I think it's only "kind of" pointless... it is in fact true that as far as I know, there is no way to pirate any of the "immersive" TV shows Apple has released. You can't watch them on any other VR headset, or even watch some 2D version on a flat screen.

Which means there are videos out there in the world right now which are immune from the analog loophole, at least as far as I know. It's a very small subset of all the content that has been produced, and it will stay that way, but it does exist.

And no one I know was ever happy about accidentally downloading a telesync release. They were at best a stopgap for the FOMO crowd before a proper dvdrip inevtiably took their spot on the trackers. Yes you can make an actually high quality analog hole rip but it takes much more effort.

I can always just not consume the media. I will never pay for that hot garbage anyhow.

DRM won't make me pay, it'll only take your trash out of my mindspace... which is probably a blessing anyway.

There is no analogue loophole, that's like 15 years behind the curve. Cinavia closed that a long time ago and meant that licensed devices like Bluray players, even TVs, can detect cammed recordings even those cammed in movie theatres.

Of course you can try to play them with hardware that doesn't follow the rules. But there's a finite number of vendors, so that isn't necessarily easy.

I’m confused, you’re saying the TV can tell if someone is pointing a camera at it? That seems highly doubtful.

It doesn't detect the act of recording live, it detects that a piece of media was obtained via recording. So, you can still point a camera at the screen and obtain a video file without any disruption to the original signal. However, that file won't play properly on Cinavia-enabled devices.

Any computer or phone can play it back I’m sure. It’s just an MP4 file. And with Airplay or an HDMI cable your TV can too?

It's not clear to me how widely Cinavia is actually deployed. The Wikipedia article hasn't really been updated in over a decade, and that's where I'm getting my info from.

However, the detection and enforcement can theoretically be done by any device or software that has access to the audio signal. The monitor, the GPU, the playback software, the operating system, etc. could each individually decide not to play the file, making it not work. Some of those can be bypassed in various ways, some can't. But instead of computers, there are smartphones, commercial media players/receivers, and televisions/projectors, which seem the most likely places to target for enforcement, and those would affect most people.

Nevertheless, I do wonder how real this actually is. Again from the decade-old Wikipedia article, it seems like Cinavia was meant to target both recording devices and playback devices. However, the Aurora theater shooting happened not long before the article stopped getting meaningful updates, and I wonder if public safety concerns stalled its deployment. Also, the article mentions that people were finding ways to remove or neuter the signal. I also didn't encounter any problems with what I assume to be protected media (a 4K movie and a 1080p TV show), either recording my screen with my Android phone, nor with playing it back on that phone and with VLC on my Windows computer with an nVidia graphics card.

In practice, only licensed Blu-ray players (hardware and software) implement Cinavia. While there was an idea/fear that an OS can implement Cinavia system-wide, that did not happen (yet).

Depends who makes your computer, phone or TV and the licensing etc. The tech is perfectly capable of stopping that. The device detects the Cinavia watermark and simply silences the audio after a few minutes.

I don't know whether streamers use it but it was widely deployed in the era when movie piracy revolved around making pirated Blurays. For instance the PS3 would silence the audio on a burned Bluray that had a theatre or TV cammed title protected by Cinavia on it.

A lot of this is about catching the fat head though. People who play videos using some hacked up VLC on Linux don't bother the studios, they're long tail and don't make a revenue impact. They're after the ordinary people who want to watch pirated stuff on a regular home cinema system.

Yeah, but pirate groups are getting the original streaming service's compression without re-encoding (so-called "WEB-DL"), even of 4k content. There's a weaker link somewhere.

WV L1 Keys/ PR SL 3000 keys require breaking into the TEE to steal those decryption keys.

Ever wondered why netflix 4k web-dls take a while for less popular shows?

Netfliy monitors these more tightly apparently and blacklist keys that are used to download. Then the group needs to buy some new device, the old one is burned.

It's true that known-compromised keys get revoked, but it's possible to avoid them knowing you've compromised a particular device.

I think there's some kind of watermarking going on, so once a rip is released to the public they can trace it back to which device keys were used to decrypt it.

Watermarking would require a separate version of each encoded file for each target device, which is not amenable to efficient CDN-ing.

It's quite easy to grab the encrypted media files, as they go over the wire - do this from two devices and compare what you get. (you don't need to strip the DRM to see if the two files are identical)

They wouldn't necessarily need to serve different data to each client when they control the whole playback stack, they could get clever by including duplicate frame data with subtle differences and making each device key only able to decrypt one of the variants. Repeat that throughout a show to add additional bits to the signature until it's uniquely identifiable.

But they don't control the playback stack, once the attacker has the keys. The attacker brings their own stack, decrypting the data with their own software.

That doesn't help the attacker if their key can only decrypt the subset of frames which Netflix wants them to be able to decrypt.

Watermarking was a problem when Widevine L1 was first introduced. Pirates seem to have found a way to scrub the watermark from their releases. Either that or someone is burning a _lot_ of cash on playback hardware judging from the rate of 4K WEB-DL releases.

It doesn't need to be a lot - just replaced in the same cadence as the latency from initial broadcast to key revocation. Even if it's all in-house in Netflix and the watermark sufficient to identify the specific device key not all releases are made instantly after being made available on the platform, it still has to be downloaded, verified, watermark extracted before the key can be revoked.

If that's just a total of a single day, 365 cheap netflix devices per year certainly isn't out of the question, especially with the number of people involved in the many ripping groups.

Depending on the bit size of a watermark, device-based watermarking should be easy to defeat using a quorum of devices to agree on bit values. It should only take around log2(n) attackers to remove an n-bit watermark.

Interesting, I hadn't heard about that. But this knowledge is obscure by design I suppose.

Reply on news.ycombinator.com