SlySoft announces that it broke BD+

Slysoft, the manufacturer of AnyDVD HD software announced that the new version allows to copy BD+ protected disks. See Press Release
AnyDVD was the first commercial package that allowed to rip AACS protected discs. Successive versions keep the pace with the changes in the revocation of players. For more information about the hacks read Security newsletter 5 and Security newsletter 6

BluRay consortium decided to launch its BD+ protection. BD+ is a layer of additional protections on top of AACS. One of the most interesting feature of BD+ is SPDC (Self Protecting Digital Content). SPDC was developed by CRI, the company of Paul Kocher. Paul Kocher is well known for his devastating side channel attacks on smart cards such ad Differential Power Attack or Differential Timing Attack. Recently, CRI sold the SPDC technology to Macrovision. SPDC allows to append to a BD title a small application that redefines the security mechanism of the player. In other words, it would be possible for reach title to have a different security protection. Renewability is one key element (Law 1).

What does the announcement of SlySoft mean?
Two scenarios are possible.
1- SlySoft has designed a class attack, i.e. an attack that definitively defeats any BD+ implementation for instance by finding a lethal weakness.
2- SlySoft has been able to defeat the current protection of new BD+ titles.
In view of the announcement, scenario 2 is more realistic. SlySoft acknowledges that BD+ is not yet using all the available features. In other words, the current version of anyDVD breaks the current titles. A new SPDC code would require SlySoft to design new circumventing code (Three months in the company Dungeon :Wink:)

BD+ has been designed for renewability. The concept of BD+ acknowledges that hackers will find their way. But BD+ also allows a new race to start.

The question is not too much to know if some BD+ titles could be ripped. It is more how long it will take to find a method to rip them. If the new protection remains secure for enough weeks to preserve the maximum sales, then BD+ will be successful.

I will be provocative. This first BD+ hack is the best justification of the existence of BD+. Dynamic defense is better than static defense. Security is never absolute. It is a compromise.

In any case, we will keep you informed of any news on the AACS front.

Leave a Reply

Your email address will not be published. Required fields are marked *