The Videocrypt System

 

                        ***  The Videocrypt System ***

     An Overview

     Researched and written by Darren Ingram, author of Satnews

     - Satnews.. the latest and non-Commercial satellite news -

     Version 1.31 - 06.05.91

     Introduction

     Videocrypt is a pay-tv scrambling system jointly developed by  Thom-

     son Consumer Electronics and News Datacom.   Over one million  users

     receive  Videocrypt encrypted signals and this system, has to  date,

     remained  secure from illicit decoder manufacturers, protecting  the

     revenue of Videocrypted television channels.

     Requirements

     Videocrypt  is a multi-standard encryption system which is  suitable

     for  PAL, NTSC and SECAM transmissions.  Language is no barrier  for

     Videocrypt  with  its capacity for multi-lingual  transmissions  and

     broadcasts utilising a comprehensive on-screen instruction menu.

     Features and applications

     A  smart card is the central key to the Videocrypt system,  and  the

     card  can be used for a variety of diverse applications.   The  card

     is  pre-coded  to determine a users requirements and it  can  subse-

     quently be addressed utilising the decoders logic to amend the users

     services at the broadcasters will.

     There are a number of broadcasting modes which the smart card can be

     used within including:

     Clear Mode

     Signals sent in the clear are recognised by the decoder and

     passed to the display without further processing.

     Free Access

     Pictures transmitted with an encryption key are delivered

     directly to the display through the decoder.

     Controlled Access

     Access to encrypted pictures is determined by the level

     of access authorised to the users smart card.  No signals

     will be transmitted in an unencrypted state without prior

     authorisation.

     Programmes can be tailored to usage with the Videocrypt system and

     the system offers a flexible way for pay-tv operators.  There are  a

     number of operations mode offered as standard including:

     * Single or multiple subscriptions with many tier levels in one

     channel

     * Pay Per View (PPV) and impulse purchasing

     * Thematic selection (enable all arts programming)

     * Geographic limitation (restrict to a country/area)

     * Single-event (throwaway cards)

     * Parental Control (reception with card only)

     * Pre-determined time period

     Videocrypt  enables  smart cards to be pre-programmed  to  suit  the

     specific programming requirements.

     Smart card - providing the revenue security

     Security  can be addressed on a multitude of levels when  using  the

     smart card.  These include:

     Chaining

     An existing customer would receive a new card which contains part of

     the  new code, the remainder of the code would be  transmitted  when

     the  card is inserted into the decoder and the  subscriber  compiles

     with the instructions contained within the on-screen graphics.

     Over-the-air addressing

     Systems operators can now address individual subscribers, which is a

     vast  improvement over other scrambling systems.  The  operator  can

     provide  additional  services,  reduce  service  entitlements,  send

     individual messages, blacklist and/or whitelist viewers.

     Cloning

     A  number of steps have been taken to stop smart cards being  copied

     or cloned.   A physical deterrent is the first line of defence,  and

     the  integrated  circuit contained within the card  makes  "probing"

     very difficult as the IC is likely to become damaged in the process.

     Cost  is a second factor which is likely to deter  manufacturers  of

     illegal  decoders.    A  considerable amount of  time,  trouble  and

     expensive resources would be required to clone the card.

     The  manufacturers  of Videocrypt recommend that the cards  are  re-

     placed  every six months, and each time this is done a  "secret  en-

     crypting  algorithm" will be changed.  Any pirate decoders  manufac-

     tured during this time would be relatively useless.

     And  should  a  pirate decoder be manufactured, it  will  contain  a

     unique  security  code, which could be blacklisted  by  the  systems

     operator  once  the code has been discovered - leading to  calls  of

     complaint by angry customers.

     Video taping

     Videocrypt  offers  an simple method of tracking  down  pirates  who

     video high-value programming and then distribute it.

     The customers unique number can be displayed on the unencoded screen

     for  reference  and future litigation.   Although  an  on-the-screen

     code  can  be generated for signals piracy in a  public  place,  the

     codes  can be hidden in the picture - and retrieved by a  technician

     at a later stage.

     Videocrypt-your flexible friend?

     Videocrypt  can  be used in a number of applications other  than  tv

     signals protection.  They include:

     Messaging, messages can be transmitted to individual subscribers  or

     to a group, so target messaging is now a potential.  Messages  like:

     "Satellite  owners in LONDON call 081 XXX XXXX now for a great  bar-

     gain".

     Selling, sales over the air can be utilised with the unique identity

     number which verifies an owner and their registered address.    Data

     can be matrixed with a user personality during ad-breaks to  tailor-

     make the advertisement.

     A unique transaction alphanumeric can be displayed on the TV screen,

     and  the  subscriber  will telephone a given number  and  quote  the

     alphanumeric - and the deal can then be completed in total security.

     Scrambling

     The  majority  of  scrambling systems currently on  the  market  are

     dependent on analogue processing circuitry, and it is a hard task to

     get a secure system without picture deterioration.

     Videocrypt can encode and decode a picture without degradation.

     The crux of the scrambling system evolves around a patented develop-

     ment of Active Line Rotation (Cut and Rotate principle).

     Every  line  of the signal is cut at a number or  points  along  its

     length,  and  this  is chosen at random by a 60  bit  psuedo  random

     binary  sequence generator (PRBS).   As each cut point differs  from

     the next the signal has no viewing value to an unauthorised  recipi-

     ent,  but authorised recipients decoders recode the picture so  that

     the  true  state  of the unscrambled line is always  first  out  for

     display.

     The  PRBS is re-seeded at times too, to enhance the security of  the

     system even more.

     Before  this  ALR process can take place, the decoder  needs  to  be

     aware  of  the cut point on each of the transmitted lines,  this  is

     provided  within the encryption process.  Each decoder  utilises  an

     PRBS  which reflects the characteristics of the system so  that  the

     two halfs can be synchronised and a viewable picture displayed.

     Data is transmitted in a series of over-the-air packets, which looks

     like:

     SYSTEM-----SMART or BLACKLIST

     The system comprises of system data included Flat-Shamir identifica-

     tion  information,  on-screen display messages,  fingerprinting  and

     blacklisting data.

     The smart card packet comprises of:

     HEADER-----ENCRYPTED DATA-----CHECKSUM

     The  Videocrypt encryption system is based around a  tightly-guarded

     secret  which has defeated system hackers throughout the world.    A

     final control algorithm is central to the systems security and  this

     can be changed at will if the system has been hacked.

     Complex calculations are performed within the system in order not to

     compromise its security.

     But  hackers who have attempted to hack the decoder will  be  disap-

     pointed - as there are no secrets held within the system.

     Smart Cards

     The smart card offers great flexibility to the programme  controller

     and the viewer alike, and is the key to the Videocrypt system.

     The  Integrated circuits incorporated within the smart card  have  a

     lot  of power and contain EPROM elements which are partially  burned

     during their manufacture.   The ICs are buried within the design  to

     make the system harder to penetrate.

     Smart card block diagram

     -------     -------     -------

     VCC  ->       - RAM -     - ROM -     -EPROM-

     -------     -------     -------

     ^           ^           ^

     TO AND FROM

     -------------------------------

 GND ->        -    INTERNAL BUS             -

     -------------------------------

     TO AND FROM

     -------     -------     -------

     -8 BIT-     -ANTI -     -S/WRE-

 RST ->        -CPU  -     -FRAUD-     -CNTRL-

     -     -     -DVCES-     -I/FCE-

     -------     -------     -------

     CLK        VPP           I/O

     Over the air addressing

     Algorithmic  information is transmitted to the viewer over the  air,

     encrypted within the Videocrypt system.

     This data is transmitted within the Vertical Blanking Interval (VBI)

     and  four  lines are employed for active data and  two  others,  one

     white and one black (for test purposes).

     An  application of Non Return To Zero (NRZ) with an constant  energy

     spectrum maximises the systems characteristics.

     Four picture-sustaining techniques are used to ensure a high quality

     picture.  Bit interleaving, hamming codes, quadruple repetition  and

     check sums are used within the process.

     The  system  can  cope with fringe reception areas  and  will  still

     function correctly with high levels of noise.

     Picture quality

     Picture  quality is paramount for any scrambling system and  due  to

     the  standard being of a digital origin, integrity of the signal  is

     maintained  throughout  the encryption  and  de-encryption  process.

     Amplitude sampling is conducted by the decoder and a 14MHz  internal

     clock  ensures jitter-free pictures and unstable framing.   A  digi-

     tally  derived Automatic Gain Control (AGC) is also included  within

     the receiver.

     Scrambling Sound

     Videocrypt  also has the capability of encrypting sound  sources  to

     enhance  the  security  of premium events.  To date  this  level  of

     security has not been utilised by broadcasters.

     The system of spectrum inversion renders the sounds received without

     authorisation  worthless.   Videocrypt  transposes  the  frequencies

     transmitted and this in turn removed distortion of the sound.

     Technical Data

     (supplied by Thomson Consumer Electronics, 1991- subject to change)

     VIDEOCRYPT BASEBAND DECODER

     * Stand alone video decoder

     * On screen display

     * De emphasis switch

     * Authorise button

     * Integrated smart card reader

     * Power indicator

     PAL MODEL

     Video input level             IV +/- 3dB flat and clamped

     Baseband input level          250 mV +/- 3dB, unclamped level

     measured at pre-emphasised transition

     frequency

     Suitable de-emphasis          CCIR 405-1

     Video output level            IV p.p. into 75 ohms

     Video bandwith                50Hz - 4.8 Mhz -3dB typical

     Line tilt                     <_ 1% typical

     Luma/Chroma Delay             +/- 50nS typical

     S/N ratio:                    50dB typical weighted

     CONNECTIONS

     AV Peritel (Scart)

     Audio loopthrough             Left and right

     Pin 8                         High with scrambled video input

     Low with clear video input

     Pin 16                        5v 50mA maximum for external

     modulator (OPTION)

     MISCELLANEOUS

     Standards                     Designed to IEC 65

     Operating Temperature Range   5-40 C

     Mains Input                   216-255 V AC 50 Hz

     Power Consumption             15W

     Weight                        2.5Kg

     VIDEOCRYPT ENCODER (PAL/SECAM/NTSC)

     * 19" rack mounting

     * Active line cut and rotate

     * Twin or single scrambler

     * Separate power supply

     * Integrated cooling unit

     * Data for control access in the VBI

     * RS232 interface

     Video input level             IV 75 ohm

     Video output level            IV peak to peak +/- 2% 75 ohm

     Line tilt                     0.5% typical

     Base line distortion          0.5% typical

     Chrominance to luminance      3% typical

     2T/Bar ratio                  2% typical

     Synchro level                 1% typical

     S/n ratio RMS weighted        >_ 67dB

     Chrominance luminance:

     intermodulation              <_ 2%

     differential gain            1% typical

     differential phase           1" typical

     luminance non-linearity      1% typical

     chrominance/luminance delay  +/- 10nS typical

     video bandwith at 3dB        >_ 5.8 Mhz

     Output DC level               300 mV +/- 50 mV

     Sampling frequency rejection  >- 50dB at 14 Mhz

     Number of bits per sample     10

     CONNECTIONS

     Connections to security comp  RS232

     Local VT100 terminal          ditto

     Video in                      BNC 75 ohm

     Scrambled video out           BNC 75 ohm

     MISC

     Local terminal functions are to

     show working parameters

     give warnings

     control local

     remote

     autonomous

     Select scrambling mode

     clear

     free access

     control access

     Mains input low pass filtering

     Audio scrambling using spectrum

     inversion 0dB/600 ohm (optional)

     ENDS

                **** Sky card hacking info 26/06/1993 ***

 

     When  the  VideoCrypt  system was  launched,  the  press  releases 

     claimed that it was the most pirateproof system yet devised.  Some 

     of the people involved in the design of the system claimed that it 

     would  take  billions  of years to break the  codes  used  by  the 

     system.  The usual media journalists swallowed this hook line  and 

     sinker. The hackers knew otherwise. 

     The  VideoCrypt  system  is the mainstay of  the  BSkyB  satellite 

     television empire. It is the means by which BSkyB makes its  money 

     from  the  subscribers.  The  basic theory  is  that  they  pay  a 

     subscription  for  the premium channels and they receive  a  smart 

     card.  This smart card, when inserted into the VideoCrypt  decoder 

     will allow the decoder to descramble the channels paid for. It  is 

     also possible for BSkyB to turn off the cards of those subscribers 

     who have not paid.

     Hacking  scrambling systems such as VideoCrypt is a  multi-million 

     pound industry. Due to the present legal situation it is perfectly 

     legal  to hack a channel that originates outside the  UK.  However 

     for someone in the UK to hack a UK originated channel is  illegal. 

     Such mere facts as illegality have never bothered pirates.

     In the last few weeks the impossible has happened. The  VideoCrypt 

     system  has  been  conclusively  hacked. It  is  now  possible  to 

     purchase  a pirate smart card or chip which will allow the  viewer 

     to  descramble Sky Movies Plus, The Movie Channel, Sky  Gold,  Sky 

     Sports and TV Asia. The cost of this pirate card is œ99. The price 

     in itself is lower than the subscription for the channels.

     Other channels using the VideoCrypt system. Are worried. According 

     to  the  latest  reports, The Adult Channel  and  JSTV  have  been 

     compromised as well. This means that all of the channels currently 

     using  the VideoCrypt system as a fee gathering system  have  just 

     lost control of the market. It is now, well for the moment anyway. 

     a pirate's market.

     This  hack is, like all hacks, colourfully named. It is  known  as 

     the "Ho Lee Fook" hack. The joke being that this is generally  the 

     exclamation uttered by people when told of the hack. There are two 

     forms of the hack; a card and a chip. 

     The  card version of the hack is about sixteen millimetres  longer 

     than  the  official BSkyB card. Essentially it is  a  single  chip 

     mounted  on a printed circuit board that plugs directly  into  the 

     VideoCrypt  decoder's card socket. This is the more  user-friendly 

     version as it does not require any modification to the decoder.

     The  chip version does require some modification to  the  decoder. 

     The  official VideoCrypt name for the chip in the decoder is  "The 

     Verifier".  This  chip  has to be removed and  replaced  with  the 

     pirate  chip. The decoder will then decode the scrambled  channels 

     without the need for the BSkyB smart card.

     The  pirate cards and the chips are on sale. It is  believed  that 

     a number of them are already in the UK. Indeed I received one,  in 

     a brown paper envelope, on June the eighth. It is still working.

     The problem for BSkyB and other users of the VideoCrypt system  is 

     not  one of containment. Things have progressed too far for  that. 

     The problem is more serious. Unless they can come up with a  quick 

     fix for the system that will render the Ho Lee Fook hack inactive, 

     they have to replace the smart cards.

     BSkyB  initially set out to replace their smart cards every  three 

     months.  This continual update was, so the theory went,  meant  to 

     deter hackers from trying to hack the system. Fiscal reality has a 

     crushing  effect of such business school theories. 

     VideoCrypt   suffered  its  first  real  disaster   when   someone 

     discovered  that by limiting the programming voltage to the  card, 

     it was possible to stop the card being switched off. This hack was 

     known  as the "Infinite Lives" hack. It was an old  computer  term 

     for  a  modification  to  a games program  that  gave  the  player 

     unlimited  lives.  Since  BSkyB could not turn off  the  cards  it 

     seemed an apt name. This hack was followed by a new issue or batch 

     of cards. The "Infinite Lives" hack did not work on the new  cards 

     but a new hack did.

     The KENtucky Fried Chip upped the ante. It was the first time that 

     the  actual  internal  operation of  the  VideoCrypt  decoder  was 

     interfered  with.  It  was a rewritten "Verifier"  chip  that  was 

     programmed to stop the cards being turned off. It did not work  at 

     full efficiency so it was not marketed by the pirates. After  this 

     hack,  BSkyB issued a new batch of cards which was more  resilient 

     to this hack.

     The  current  card  issue is issue 07. The Ho  Lee  Fook  hack  is 

     working  on  this batch. If BSkyB introduce issue 08  cards,  then 

     there  is  the possibility of the hack ceasing to  work.  At  this 

     stage  there is the terrible spectre of the hack being updated  to 

     work  with  the  08  cards.  It is  the  thing  of  which  BSkyB's 

     nightmares are made of.

     The issue of new card batches occurs mainly in Spring or Autumn. A 

     Summer launch of the new 08 cards would be unusual. As  VideoCrypt 

     will  be  going to a tiered channel structure in  the  Autumn,  it 

     would  seem  that they have planned an Autumn update. The  Ho  Lee 

     Fook  hack  may force them to bring their plans  forward  by  some 

     three months or so.

     The  confidence  in  a system is not based on how  well  a  system 

     repels hacks but rather on how well a system recovers from  hacks. 

     This  will be a true test of the VideoCrypt system and  its  smart 

     card  based philosophy. The philosophy is that of  the  detachable 

     secure controller. Basically what this means is that if the system 

     is  hacked then all that needs to be done to stop the hack  is  to 

     issue a new card.

     The effects on the confidence of present and prospective users  of 

     VideoCrypt is more difficult to gauge. The smart card is the  core 

     of  the  VideoCrypt system. Seeing it replaced by a  pirate  smart 

     card contradicts every claim made in favour of VideoCrypt. It  was 

     not  supposed to be possible. One thing is certain, channels  will 

     now have to look at a scrambling system as only being a  temporary 

     form  of protection that has to be frequently updated. Failure  to 

     do so will be fatal.

     John McCormac

     Author of "European Scrambling Systems 3" ISBN 1-873556-02-0

     Editor of Hack Watch News.---

 

                                *** Latest ***

     There is no such thing as coincidence - or is there? On the day that

     the film "Sneakers" was released on video, I received an actual working

     hack for the scrambled Sky channels. The film "Sneakers" is about

     events surrounding a piece of equipment that can hack any cryptosystem.

     The piece of equipment that I received is essentially a chip that can

     hack the Sky VideoCrypt channels. 

     This latest hack on the VideoCrypt system has been labelled the "Ho

     Lee Fook" hack. The reason for this name is more to do with people's

     reaction to the hack rather than its origin, which incidentally is

     Central Europe. 

     This is perhaps the most dangerous hack to have occurred on VideoCrypt

     - it replaces the smart card. In effect it is a new smart card that

     gives access to all the Sky channels. Of course the problem for Sky is

     that it is not a genuine Sky card.

     The card is approximately sixteen millimetres longer than the official

     Sky card. It is a blue printed circuit with a single surface mount

     chip, and five connector pads. The identification numbers on the chip

     have been scrubbed. 

     The standard check for a card of this nature is to look for a wafer

     from an official smart card. In the early days, a fairly common scam

     was to take the chip and connector pad from a valid Sky card, trim away

     the plastic and then put the chip in a DIL header. The DIL header would

     then be blobbed in a lump of black resin so that it looked like an IC.

     The decoder would then have its card reader replaced with an ordinary

     DIL IC socket. Then the decoder and chip would be shown or sold to some

     unsuspecting, if greedy, punter. 

     The chip appeared to be real, with no wafer underneath the body of the

     chip. The actual stubs of the chip die were just visible at the end of

     the chip. It was a genuine chip.

     It has been working steadily for the last few days and there appears

     to have been no kill messages sent to it. If it had been a direct

     clone, Sky would have been able to kill it over the air - or would

     they? 

     Since the people who developed this hack obviously understand the

     operation of the over the air addressing, they may well have designed a

     filter to stop the kill message from having any effect of the pirate

     card. There are of course more devastating implications here. The card

     itself may only contain the data and algorithms necessary to descramble

     the signals. 

     The chip version of this hack is based on the 8752. This Ho Lee Fook

     chip will replace the official 8052 in the decoder. A selling price of

     ninety nine pounds has been mentioned in Germany.

     Nobody is sure what the people in News Datacom are doing about this

     hack. Sky are more than likely very upset that someone has hacked their

     pirateproof system yet again. This is the fifth hack and the image of a

     pirateproof system now only exists in the minds of PR people.

                *** -=Y_HS=- all (c)'s acknowledged ***