Author Archives: wunderbarb

Mininova will reach the 5 billions downloads

Posted on by
Reply

Many torrent tracker sites compete. Thus, they publish data such as number of available torrents, of registered users, of seeders and leeches. One of the most important sites, mininova publishes the number of downloaded torrents: 4.918.964.636. At their current pace, mininova will reach the threshold of 5.000.000.000 downloaded torrents in a few days.

I find this figure more interesting than the other ones. For instance, the number of available torrents is not really meaningful. Many torrents are not active (thus the health bar on any site). Mininova publishes other data. The distribution of the type of downloaded contents is interesting. 39% are on TV series, 22% on movies, and 20% for music. The most downloaded torrent is episode 17 of Heroes’s first season. This craze torrents of TV series is extremely interesting and should be carefully analyzed by broadcasters.

In any case, BitTorrent is really the protocol of choice. Many progresses have been done both by the software themselves and by tools allowing search (BitCHe, TorrentFinder toolbar, …), making them easier to use.

The first 256-bit AES protected hard disk

Posted on by
Reply

Fujitsu launched the first AES 256 bits protected hard disk. The processor of the hard disk encrypts and decrypts every stored data. It is announced that the 256-bits never leaves the embedded processor. An interesting feature is the fast secure erasing of the full hard disk in less than 1 second. It seems that it is performed by simply erasing the secret key. Thus, the stored data are useless (if of course the key is securely erased)

The use of AES-256 bits rather than AES 128 bits is only a marketing argument. Seagate offers AES 128 bits protected hard disk. Currently, the cryptographic community estimates that AES 128 is secure for the next 20 years (until we find an attack :Wink:) Is this solution really more secure than software based encryption as claimed in the press release? I have some doubts. It will depend on the way the encryption is activated.

  • If the decryption is automatic at boot without presentation of any passphrase/password, then it is rather useless. The protection of the data then relies on the login of the computer.
  • If the decryption is activated by the presentation of a passphrase/password, then the security relies on this protection. It will not be stronger than the implementation of this checking
  • If the decryption is activated after the control of a pairing with the host computer, then there is a risk to loose every data in case of failure of the host computer.
  • If the description is activated by a remote RFID, as for easy nova hard disk, then the security is the one of the RFID

Unfortunately, the public information does provide no details.

Hacking the pacemaker

Posted on by
Reply

A team of University of Amherst (Massasuchets, USA) studied the security and privacy of commercial pacemaker. They discovered that it was weak. Current pacemakers and implantable cardiac defibrillators have some means to wirelessly communicate with external programmer device. The programmer device can collect patient data and adapt the therapy of the patient. Furthermore, it can generate fibrillations in test mode.

The communication is not protected. Of course, through eavesdropping, the team was able to reverse engineer the protocol. Then, they were able, through simple replay attacks to get patient data, change the therapies of the patient, and even to induce fibrillations. Another attack was a denial power attack where continuous communication diminished the lifetime of the implanted battery.

The hack itself is not extremely interesting (from the technical point of view). Hacking an unprotected wireless link is not a big deal. Is it really dangerous? In any case, any person who would be ready to play with an implanted pacemaker is necessarily murder minded (and then he has other means perhaps more efficient at his disposal)

The problem is more interesting when looking how to secure it. Due to the specific characteristics of the target, there are some important constraints:
– The power consumption is important. Replacing the battery require surgery! Cryptography requires power. Strong cryptography requires even more power. Furthermore, this type of devices is very sensitive to power denial attacks.
– The access to the pacemaker must be easy and fast for every practitioner. He must not have to look through many credentials, and secure database to find the right key in case of emergency.
– It must be reliable.
In this case, there is a tradeoff to find between security and practicability.

With the advent of the wireless interconnected area, this type of challenge will become extremely common. There will be more and more power supplied constrained devices to protect. Low power consumption cryptography: A new field of exploration?

TorrentSpy: second round for studios

Posted on by
Reply

 End of March, under the pressure of studios TorrentSpy ceased to work (see TorrentSpy: first round for studios. A Californian federal judge knocked down for a second time TorrentSpy. The judge ordered TorrentSpy to pay 111M$ (72M€) to MPAA. This high penalty is mostly due the accusation that TorrentSpy destroyed evidences. TorrentSPy refused to gave information about its “customers” and destroyed the corresponding data.

Having ceased any activity, TorrentSpy will not be able to pay MPAA. But the message is a strong warning for tracker sites based in the United States. Will it have any impact on the other tracker sites (for instance The Pirate Bay, or Mininova)?

RIAA forecasts the return of DRM

Posted on by
Reply

At last conference Digital Hollywood, David HUGHES, head of RIAA’s technology division, forecast that DRM will return to protect music. His rationales are simple. He listed 22 ways (or should we say business models) to sell music. Twenty methods require some way to enforce some limitations in consumption, i.e. DRM.

In fact, HUGHES highlighted one characteristics of DRM that is often forgotten. DRM facilitates versioning, i.e., different types of commercialization of the same song. Currently, DRM free songs are sold either as a song, or as a full album. Other ways , for instance as part of a subscription, or pay per listen, may sell this same song at a lower price (but with less freedom of consumption). But, these methods require to limit the consumption to the defined limitations (for instance only once in case of pay per listen). Here comes back DRM.

HUGHES highlighted that DRM should become transparent for consumers. Then, they would not care any more.

Currently, DRM free is the trend in music industry. Four majors sell some songs DRM free. Nevertheless, if they will find new ways to sell songs, HUGHES may be right.

Mashup security

Posted on by
Reply

A new trend in Web design is to add many mashup gadget on Web2.0 sites. Many sites offer huge libraries of such mashups. Adding mashups to sites is extremely simple. Mashups add easily more features, a more professional look, … Unfortunately, they add also potential vulnerabilities.

A mashup is a piece of source code (often java) with Ajax framework . It has a known “documented” set of features. But, are there no hidden features? Potentially, some code could create leakage of data. It is interesting to see that people may be very careful with incoming mails, but totally unaware of mashups and accept anyone as soon as it is good looking. Once more it is a question of trust. Do you trust the developer of the mashup?

IBM has proposed an authentication framework for mashups: SMash. It is an open source project. This is a first step. But that the source is authenticated does not mean that the mashup does not carry a bad payload. The question should be do you know the authenticated entity? do you trust it? Can you examine the code?

Other companies such as MICROSOFT are also working on the topics. No doubt mashup security may become soon a hot topics once the first malware mashups will become mainstream.

Nintendo stroke back the linkers

Posted on by
Reply

The Nintendo DS is heavily hacked through the use of extension cards so called linkers. With these cards, it is possible to play any “ROM” game available. Officially, these linkers are only to allow playing backups rather than the original game. A linker may store several games. Nevertheless, the ROMs of every published games are widely available on the Internet. Interestingly, these linkers do not require any modification of the host console. This is not the case for instance for Nintendo Wii’s hacks that require hardware modifications

Interestingly, Final Fantasy: Cristal Chronicles had a strange behavior when used with some linkers. After 20 minutes, the DS displayed the screen “Thank you for playing” and stopped the game. Only the most widely sold linkers (i.e. M3 and R4) were affected. Linkers using other technologies such as Cycloid or Sunny Flash were not affected.

On the forums, the debate was raging. Two schools were fighting. Some people claimed that it was a bug of the linker. This type of linkers patches the ROM. Some people claimed that it was a new copy protection scheme designed by Nintendo that targeted the two main linkers. The favor was for the second hypothesis. A bug that nicely ends up with a greeting screen is highly unlikely. Whoow I would have dreamed of such nice bugs when I wrote software ;-).

The first response from the linkers’ provider was to distribute a clean patched ROM for Cristal Chronicles. It took them several days. The second riposte was to issue a new release (1.17) of the firmware that solved the problem. It took them several weeks.

Conclusions
It seems that it was a nice strike from Nintendo. Of course, hackers won at the end (this is law 1). Nevertheless, the story raises interesting thoughts and question:
1- The way to counter the linkers was elegant and smart. Rather than stopping brutally the game, it allows to play sometimes as a teaser. This frustrates dishonest users (especially if the game is a good one). Nintendo already used this strategy with the game boy.
2- NINTENDO gained several weeks which is sufficient in the game industry. Most of the sales of a game are performed during the few weeks following the launch. It would be interesting to see if there was a visible impact on the sales (for instance a bounce once the news spread in the forums)?
3- Will NINTENDO be able to reproduce this strike with other games? Like the foreseen strategy of BD+.