How BitTorrent is monitored…

Posted on December 5, 2012 by eric

In a recent study, CHOTIA Tom et al., four researchers from the University of Birmingham, attempted to check whether BitTorrent was monitored, how it was, and by whom. They studied the two types of monitoring:

Indirect monitoring where the copyright infringement agency does not participate to the transaction and just collects clues with not extremely convincing evidence
Direct monitoring where the agency is part of the transaction. in that case, the evidence is better.

For the first type of monitoring, they used six heuristics (5 that they collected from the literature and one that they created). The conclusion is clear: many agencies are scouting the swarms. Funnily, they spotted the French INRIA team who was making a similar study. ( see Identifying providers and downloader in bittorrent). Without surprise, this part of the study was conclusive.

For direct monitoring, they tried other heuristics such as checking whether the reported completion progresses or is consistent, or the duration of connection. Once more, they detected monitoring activity.

The study presents also several interesting (but not surprising) conclusions:

The most popular pieces of content are far more monitored than less popular. This is logic as monitoring as a cost and who would pay for the long tail?
When sharing a popular piece of content, the likelihood to be monitored within three hours is high.
The block lists of supposed monitors (which are available for most popular clients) are not complete.

The definition of the heuristics is interesting. It gives a good hint to the agencies on what they should do to become stealthier.

World of Warcraft and watermarking

Posted on October 29, 2012 by eric

An old news, as it started in September. On 8 September 2012, Sendatsu published on the ownedcore a detailed study of the use of watermark within Blizzard’s World of Warcraft (WoW). According to him, it seems that WoW adds an “invisible” watermark to screenshots (at least with JPEG in lower quality). A capture of a screenshot without texture repeatedly produces a pattern similar to this one.

The watermark carries 88 bytes with the account ID, a time stamp and the IP address of the server. Clearly, it does not carry any personal information. It seems that this Digimarc based watermark was in use since 2007 (when screenshots were added).

The aim of this watermark seems obvious to me. There are many illegal WoW servers in the field. Of course, users playing WoW through these non-Blizzard servers do not pay the monthly subscription. This means a loss of revenue for Blizzard. Finding the IP address of such unauthorized servers is a good start to fight piracy back .

Strangely, nobody reported a similar case for other Blizzard MMORPGs such as Diablo III or StarCraft. Is it because nobody looked at, it yet? Or because there is no such watermark (less pirate servers)?

Update (30-oct-12): The allegation that it is a Digimarc solution seems wrong. Thus, currently no clue about the solution provider.

SHA-3 is born

Posted on October 4, 2012 by eric

In 2005, the first serious attacks on the widely use hash function SHA-1 were published. Researchers were able to generate some collisions. The new generation SHA-2 was also prone to these attacks. In 2007, NIST launched a contest to select the future replacing algorithm. At the first round, there were 63 submissions. The second round kept only five algorithms. On Tuesday, NIST published the winner: KECCAK

KECCAK was designed by researchers from STMicroelectronics and NXP. According to NIST, KECCAK won because it was elegantly simple and had higher performance in hardware implementation than the other competitors. As it is foreseen that SHA-3 may be used in many lite weight embedded devices (smart dust, intelligent captors, RFID…) , this was a strong asset. No surprise that its implementation was optimized for hardware; Its four fathers are working for companies designing such chipset. STMicroelectronics is one of the leaders in secure components for smart cards, whereas NXP is the leader in NFC. Another interesting argument is as KECCAK uses totally different principles than SHA-2, attacks that would work on SHA-2, most likely will not work for SHA-3.

On September 24, 2012, Bruce Schneier, one of the five finalists with his Skein algorithm, called for a “no award”. Currently, SHA-512 is still secure for many years. Thus,according to him, there was no need to switch to another algorithm.

In its announcement of the winner, NIST confirmed that

SHA-2 has held up well and NIST considers SHA-2 to be secure and suitable for general use.

Thus, be not afraid when you will still find SHA-2 in designs for the coming years. We’re safe. It will take several years to tame this new algorithm. Nevertheless, NIST estimates that having a successor to SHA-2, if ever it weakens, is a good insurance policy.

ReDigi.com the resale locker

Posted on September 24, 2012 by eric

I must confess that I became aware of this interesting initiative only this summer, although ReDigi operates since October 2011.

ReDigi is a site that allows you either to resell your music songs that you do not want anymore, or purchase music songs that people do not want anymore. In other words, a second-hand market for music.

How does it work, from the user point of view:

Alice user subscribes to the service
ReDigi locates the songs Alice may resell (either purchase with iTunes, or ReDigi)
Alice selects the songs to sell and reDigi stores them in the cloud while wiping out the copies on the computers
As long as the song is not yet sold, Alice can stream it
Once Bob purchased it, she cannot anymore listen to it.
If ever a copy of the sold song appears again on Alice’s device(s), she is notified.

How does it work (partly using the details provided by ReDigi in a court trial, an interview, and my guesses)

She has to install a software called Music Manager
Music Manager explores the directories and spots the iTunes and ReDigi songs. It most probably directly jumps to the FairPlay protected directory to find the licenses. It checks if it is legal (in other words if it can access the key, then meaning that it was bound to the device)
It uploads the file (and probably the license) to the cloud and erases the accessible song. At next sync, all iTunes copies should disappear.
The uploaded copy is marked as such until it is sold
Mark it for somebody else. I would like to know if they rebuild their own license or a new iTunes license.
During phase 3, it extracts a fingerprint of the song. Music Manager scouts the hard drive to find copies. I was not able to find if the fingerprint is a basic crypto hash (md5) or a real audio fingerprint. If it is the second case, then funny things may happen.
Alice purchased Song1 on iTunes. Later she purchase the full album on a CD. Thus, she resells the iTunes song1, and rips her CD. A legit copy of Song1 will reappear on her drive. Music Manager will complain (ReDigi claims that after numerous complaints that would not be obeyed, i.e., the song is erased, the subscription is cancelled)
Obviously, if it is just the hash, then the system can be easily bypassed.

The interesting question is not if the system can be bypassed. I am sure that the readers of this blog have already guessed at least one or two ways to hack it. It is not complex, and I will not elaborate on it.

The interesting question is to know if it is legal to resell a digital song. There is a US first sale doctrine that allows to resell your own goods, nevertheless the answer may perhaps not be so trivial. See this article. We will soon have a (first) answer. On January 2012, Capitol Records filed a suit against ReDigi. On February 2012, the district court rejected the preliminary injunction. Oral arguments should start on October 5. This article gives a good summary of the legal case.

Nano counterfeiting feature

Posted on August 8, 2012 by eric

The blue morpho butterfly changes the color of iits wings through some special reflective structure. The company nanotech security uses a “similar” trick for its NOtES (Nano Optic Technology for Enhanced Security). Using nano holes smaller than the light wave, it creates a kind of light-amplification that generates a similar effect.

Thus, by embossing paper or plastic, it can create bright images through reflection. The holes are about a few hundred nanometers. How does it fit with security? According to them, it could replace holograms used against counterfeiting (the kind of holograms that you find on microsoft official disks). This technology seems to have some advantages:

It is extremely cost effective. Once the master stamping build, it is just stamping the target, thus cheap and fast in production.
Easily identifiable by human
As it works infrared or UV, the pattern could be analyzed by machines using the right wave length (a kind of watermark)

The security relies on the difficulty for the counterfeiters to reproduce the stamping. It seems that it relies mainly on a high barrier entry cost (class 1 clean room) and know how of the company to design the pattern and the stamping tool. Clearly, it would require a funded organization to make it (as holograms today). Nevertheless, I would be interested to see if it would be not possible to reverse engineer the pattern by careful examination through electronic microscope. Another question is how does it degrade with time?

When will we have the first shiny bank notes?

If your power adapter could recover your lost password?

Posted on July 26, 2012 by wunderbarb

This is the idea that Apple protected by a patent. The basic idea is that a familiar peripheral could serve as a vault for the recovery process of lost credentials.

Claim 1: A method of storing a password recovery secret on a power adapter, the method comprising:

receiving a password recovery secret associated with a computing device at an electrical power adapter via an interface with the computing device; and

storing the password recovery secret on a memory in the electrical power.

The peripheral would store the memorized password encrypted with a identifier unique to the main device. This means that there is a pairing between the device and the peripheral. In other words, it is useless to steal the peripheral to try to extract the stored password. The claims specifically cites electrical power adapter and non-transitory computer-readable storage medium.

To recover the lost password, you will have to start a procedure of recovery. The recovery procedure returns the encrypted password that can be decrypted if recovered by the proper device. It can also share the secret between the peripheral and a remote server.

You may already have spotted the tricky part of the game: how do you trigger the recovery procedure? The patent does not tackle this issue. If Alice is able to trigger it only because she has access to both the portable and the power adapter, then of course game over. Steal both of them, then you can get access to the computer by recovering the secret and changing the password. It would make the system even weaker than before. If Alice needs a secret to trigger it, then we’re back to the starting point. The likelihood that she forgot this recovery secret is even higher than forgetting the day to day password! By the way, this is always one of the difficult parts of every recovery system.

Will we see that in one of the next MacBook generations?

The blog of content protection

A site managed by Eric Diehl

Category Archives: Technology