ReDigi.com the resale locker

Posted on September 24, 2012 by eric

I must confess that I became aware of this interesting initiative only this summer, although ReDigi operates since October 2011.

ReDigi is a site that allows you either to resell your music songs that you do not want anymore, or purchase music songs that people do not want anymore. In other words, a second-hand market for music.

How does it work, from the user point of view:

Alice user subscribes to the service
ReDigi locates the songs Alice may resell (either purchase with iTunes, or ReDigi)
Alice selects the songs to sell and reDigi stores them in the cloud while wiping out the copies on the computers
As long as the song is not yet sold, Alice can stream it
Once Bob purchased it, she cannot anymore listen to it.
If ever a copy of the sold song appears again on Alice’s device(s), she is notified.

How does it work (partly using the details provided by ReDigi in a court trial, an interview, and my guesses)

She has to install a software called Music Manager
Music Manager explores the directories and spots the iTunes and ReDigi songs. It most probably directly jumps to the FairPlay protected directory to find the licenses. It checks if it is legal (in other words if it can access the key, then meaning that it was bound to the device)
It uploads the file (and probably the license) to the cloud and erases the accessible song. At next sync, all iTunes copies should disappear.
The uploaded copy is marked as such until it is sold
Mark it for somebody else. I would like to know if they rebuild their own license or a new iTunes license.
During phase 3, it extracts a fingerprint of the song. Music Manager scouts the hard drive to find copies. I was not able to find if the fingerprint is a basic crypto hash (md5) or a real audio fingerprint. If it is the second case, then funny things may happen.
Alice purchased Song1 on iTunes. Later she purchase the full album on a CD. Thus, she resells the iTunes song1, and rips her CD. A legit copy of Song1 will reappear on her drive. Music Manager will complain (ReDigi claims that after numerous complaints that would not be obeyed, i.e., the song is erased, the subscription is cancelled)
Obviously, if it is just the hash, then the system can be easily bypassed.

The interesting question is not if the system can be bypassed. I am sure that the readers of this blog have already guessed at least one or two ways to hack it. It is not complex, and I will not elaborate on it.

The interesting question is to know if it is legal to resell a digital song. There is a US first sale doctrine that allows to resell your own goods, nevertheless the answer may perhaps not be so trivial. See this article. We will soon have a (first) answer. On January 2012, Capitol Records filed a suit against ReDigi. On February 2012, the district court rejected the preliminary injunction. Oral arguments should start on October 5. This article gives a good summary of the legal case.

Nano counterfeiting feature

Posted on August 8, 2012 by eric

The blue morpho butterfly changes the color of iits wings through some special reflective structure. The company nanotech security uses a “similar” trick for its NOtES (Nano Optic Technology for Enhanced Security). Using nano holes smaller than the light wave, it creates a kind of light-amplification that generates a similar effect.

Thus, by embossing paper or plastic, it can create bright images through reflection. The holes are about a few hundred nanometers. How does it fit with security? According to them, it could replace holograms used against counterfeiting (the kind of holograms that you find on microsoft official disks). This technology seems to have some advantages:

It is extremely cost effective. Once the master stamping build, it is just stamping the target, thus cheap and fast in production.
Easily identifiable by human
As it works infrared or UV, the pattern could be analyzed by machines using the right wave length (a kind of watermark)

The security relies on the difficulty for the counterfeiters to reproduce the stamping. It seems that it relies mainly on a high barrier entry cost (class 1 clean room) and know how of the company to design the pattern and the stamping tool. Clearly, it would require a funded organization to make it (as holograms today). Nevertheless, I would be interested to see if it would be not possible to reverse engineer the pattern by careful examination through electronic microscope. Another question is how does it degrade with time?

When will we have the first shiny bank notes?

If your power adapter could recover your lost password?

Posted on July 26, 2012 by wunderbarb

This is the idea that Apple protected by a patent. The basic idea is that a familiar peripheral could serve as a vault for the recovery process of lost credentials.

Claim 1: A method of storing a password recovery secret on a power adapter, the method comprising:

receiving a password recovery secret associated with a computing device at an electrical power adapter via an interface with the computing device; and

storing the password recovery secret on a memory in the electrical power.

The peripheral would store the memorized password encrypted with a identifier unique to the main device. This means that there is a pairing between the device and the peripheral. In other words, it is useless to steal the peripheral to try to extract the stored password. The claims specifically cites electrical power adapter and non-transitory computer-readable storage medium.

To recover the lost password, you will have to start a procedure of recovery. The recovery procedure returns the encrypted password that can be decrypted if recovered by the proper device. It can also share the secret between the peripheral and a remote server.

You may already have spotted the tricky part of the game: how do you trigger the recovery procedure? The patent does not tackle this issue. If Alice is able to trigger it only because she has access to both the portable and the power adapter, then of course game over. Steal both of them, then you can get access to the computer by recovering the secret and changing the password. It would make the system even weaker than before. If Alice needs a secret to trigger it, then we’re back to the starting point. The likelihood that she forgot this recovery secret is even higher than forgetting the day to day password! By the way, this is always one of the difficult parts of every recovery system.

Will we see that in one of the next MacBook generations?

IRDETO becomes a key actor of B2C content protection

Posted on October 27, 2011 by wunderbarb

On 24th october, IRDETO announced that it acquired BayTSP (who was founded by Marc ISHIKAWA). BayTSP is one of the few companies that are scouting the Net, on behalf of the content owners, to identify illegal copies of content. IRDETO was initially a Conditional Access solution providers. For several years, IRDETO has been acquiring some companies to enlarge its offer while staying focused on distributing securely content.

Recently, IRDETO purchased Cloakware, a company specialized in Tamper Resistant Software. This acquisition allowed IRDETO to promote a more robust software-based solution (card less). Cloakware would take care of the protection of the software which is the usual weakness point of card less solutions. More recently, IRDETO acquired the division of Rovi in charge of SPDC. SPDC is the system that may implement applets to bring additional secuity in BD+. Rovi acquired this division from Paul Kocher’s CRI (Cryptography Research Inc).

Now with BayTSP, IRDETO can offer, in addition to its protection; a service of investigation. Nice move. Is the offer complete? I would tend to believe that there is a missing piece: forensic watermark. Next acquisition?

Thanks to Gwen for the pointer.

Degate

Posted on October 17, 2011 by wunderbarb

Martin Schobert has designed an open source software, called Degate, to help reverse-engineering hardware components. The process is the following:

You must first take pictures of the layout of the depassivated hip
Degate will attempt to recognize standard cells image pattern matching.
Degate attempts also to reconstruct the netlist of wires and vias (vias are electronic connection between different layers).
Then, it can build the full or partial logical layout.

Of course, the better the quality of the initial pictures (for instance using a Focussed Ion Bean (FIB)), the easier (and better) the automated result.

Degate will not do all the job. It is a software aid to reverse engineer. In any case, at the end, you will have to understand what the logic layout does. Degate is not a tool for script kiddies. It requires a good knowledge of micro electronics. You’re working at the transistor/cell level.

The site provides also an interesting repository of documentation related to IC reverse-engineering.

Lesson: As for software obfuscation, the less reused patterns in the design of the chip, the more robust to reverse-engineering.

NuCaptcha: moving letters

Posted on October 11, 2011 by wunderbarb

A funny technology where the cat and mouse game is extremely active is the field of Captcha. Captcha stands for Completely Automated Public Turing test to tell Computers and Humans Apart. In other words, the objective is to make a test that should differentiate a human operator from a computer. It is the test of scrambled letters that you have to type to proof that you’re not a robot. For instance, if you want to add a comment on my blog, you’ll have to answer a captcha.

Captcha initially started with a few letters. OCR solved too easily the problem. Then, the fonts were distorted, twisted, scratched… And the attackers refine their detection algorithms.

This summer, NuCaptcha, proposed a new challenge: you had to identify letters of a given color within a moving text on top of a background. It combined three challenges: identify the color (which may change for each challenge. Thus, you have to identify where the color to detect is defined), extract the text from the background, and then extract the proper letters. In some case, the background may be animated like a clip. Thus, it seems an interesting challenge.

Interestingly, since August, they added a few new solutions which were branded, or advertisement driven. Unfortunately, although they may bring some revenues, these versions have seriously impaired the difficulty of the challenges (have a look at the demo page, and make your own opinion). Would you like to use NuCaptcha, I would recommend avoiding the branded or ads versions. Most of the benefits have vanished (at least as they are presented in the demo)

Nevertheless, Captcha is an interesting tradeoff between security and usability.

To pay, show me your credit card

Posted on September 6, 2011 by wunderbarb

The company Jumio proposes a new system to pay on line: netSwipe. It uses the usual credit card for payment. Rather than entering your credit card number, your name, and the expiration date, the netSwipe applet asks to present your credit card to the webcam. The system is supposed to extract the data by visually scanning the image. The process is remotely done. The applet should securely stream the output of the webcam to the remote server.

You still have to dial in the CV2, i.e. the 3 digits at the back of the card, or the 4 digits in the case of AMEX).

Impact for the merchant:

The fee is 2.75% of the transaction.
The usual PCI-DSS security requirements

Note: Security Requirements

Using Netswipe Scanning or Netswipe Recycle Swipe to capture credit card data means that you will be capturing, transmitting and possibly storing card data. The Card Schemes, Visa and MasterCard, have never permitted the storage of sensitive data (track data and/or CVV2) post-authorization, and it is prohibited under ‘Requirement 3′ of the Payment Card Industry Data Security Standard (PCI DSS). Merchants who store Sensitive Authentication Data (SAD) are being fined by the Card Schemes.

Consequently, if you use Netswipe Scanning or Netswipe Recycle Swipe you will need to demonstrate that your system can handle this data securely and that you are taking full responsibility for your PCI DSS compliance. One part of this is the need for us to see a clean Vulnerability scan being made on your systems.

There are two interesting questions:

Is it more user-friendly than the current method? If the recognition is accurate, probably yes.
Is it more secure than the current method? Depending on what the scanning method actually detects, it may increase the security. Imagine that the system does not only extract the three semantic data but would also validate the hologram, and check whether the graphical layout of the credit card is the one expected for this customer (and that it is also a plastic card). Then, the system would near an approximation of proving the presence of the actual card. I was not able to find the corresponding patent.
Nevertheless, at the end the “ultimate” defense is the CV2.
As a conclusion, provided that the streaming is secure, which may be tested, then it is probably not less secure than usual manual acquisition.

The blog of content protection

A site managed by Eric Diehl

Category Archives: Products