Slashdot Log In
Vista DRM Cracked by Security Researcher
Posted by
ScuttleMonkey
on Mon Jan 29, 2007 02:16 PM
from the only-a-matter-of-time dept.
from the only-a-matter-of-time dept.
An anonymous reader writes "Security researcher Alex Ionescu claims to have successfully bypassed the much discussed DRM protection in Windows Vista, called 'Protected Media Path' (PMP), which is designed to seriously degrade the playback quality of any video and audio running on systems with hardware components not explicitly approved by Microsoft. The bypass of the DRM protection was in turn performed by breaking the Driver Signing / PatchGuard protection in the new operating system. Alex is now quite nervous about what an army of lawyers backed by draconian copyright laws could do to him if he released the details, but he claims to be currently looking into the details of safely releasing his details about this at the moment though."
Related Stories
[+]
Vista Protected Processes Bypassed 221 comments
Anonymous Hero writes "Security Researcher Alex Ionescu strikes again, this time with a proof of concept program that will arbitrarily enable and foremost disable the protection of so-called 'protected processes' in Windows Vista. Not only threatening Vista DRM and friends, it's also another step towards hardened and even more annoying malware. Normally, only specially signed processes made by special companies (decided by Microsoft) can be protected, but now the bad guys can protect any evil process they want, including the latest version of their own keylogger, spambot, or worm, as well as unprotect any 'good' one."
This discussion has been archived.
No new comments can be posted.
Vista DRM Cracked by Security Researcher
|
Log In/Create an Account
| Top
| 379 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
very fitting (Score:5, Funny)
Re:very fitting (Score:5, Funny)
(http://www.atomjax.com/)
Re:very fitting (Score:5, Funny)
Or 'It's hard out here for a PMP'
Re:very fitting (Score:5, Funny)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
I don't know what you heard about me
But you can't get your video out of me
High quality video you can't see
Because I've got uncracked PMP [azlyrics.com].
Re:very fitting (Score:5, Funny)
Re:very fitting (Score:5, Funny)
As a user of the Windows Home Operating Rights Environment, I must state for the record that all of my transactions with said system are completely clean, and take place using the most effective protection available. If you truly feel that some of your Media exchanges are tainted, I'd suggest it's probably because you didn't pay the requisite PMP fees.
1st thing is to get a good lawyer (Score:3, Funny)
Re:1st thing is to get a good lawyer (Score:5, Informative)
Re:1st thing is to get a good lawyer (Score:5, Informative)
He [Alex] is currently studying at Concordia University in Montreal, Canada"
So does the DMCA apply?
Re:1st thing is to get a good lawyer (Score:4, Insightful)
that depends, does he travel to or through the US?
Re:1st thing is to get a good lawyer (Score:5, Interesting)
(http://www.victors.ca/)
"Government for the corporations, by the corporations, for the benefit of all corporations..." or something to that effect.
Thank god for the primary process!!! (Score:4, Funny)
(http://youtube.com/watch?v=FCDJ0jhWKno | Last Journal: Tuesday November 14 2006, @01:31PM)
*stabs self in eyes with thumbs*
JAZZ HANDS!
Re:1st thing is to get a good lawyer (Score:5, Funny)
Re:1st thing is to get a good lawyer (Score:5, Informative)
(http://www.misalpina.net/ghost3k/)
"He is also a Microsoft Student Ambassador and is representing the company on campus as a Technical Rep."
1st is to realize credit is overrated. (Score:5, Insightful)
(http://kadin.sdf-us.org/ | Last Journal: Tuesday October 16, @01:46PM)
Here's the problem: there's virtually no way to get in trouble, if you just release an exploit anonymously. (By definition, if it's truly anonymous, they can't catch you; there are lots of ways to basically ensure your anonymity today.) Where you start to get in trouble is when you want to release an exploit that's going to ruin somebody's day and take credit for it.
This comes up with regards to other, less-politically-sensitive bugs. When you step forward and take credit for something that you've released, you're basically holding up a big "come and get me!" sign. It's a lot easier to sling mud at a person, than it is at some anonymous entity on the Internet.
It's really taking credit that burns people, not releasing the bug/hack/exploit. It would have been trivial for this guy to release his code, anonymously or even pseudonymously, and keep it firewalled from his real-world identity. If he had done that, there might have been some attempts to uncover who he really was, but I doubt anyone would try that hard -- it's harder to go after someone that's anonymous, than an actual person. With a person, you have something to put in your mind under 'enemy,' that you just don't have with some vaporous person or persons on the Internet. Being anonymous diffuses a lot of the hatred, because it's harder to hate someone that might not exist. By standing up and taking credit, you're accepting everything.
Personally, if I were to discover something like this, there's no way I'd publicly admit it. I live a happy enough life without becoming some sort of hacker/security icon; the downsides of becoming the next Dimitry Sklyarov seem far greater than the possible benefits. Release the code somewhere in public, maybe signed with a private key that you have stashed away (so, decades down the line, you'd be able to claim it, if you wanted to and if the statute of limitations had run out), and only communicate via Usenet dead-drops and anonymous remailers. The tools to remain completely hidden are all there -- heck, you could probably do interviews in Wired under a psuedonym, the only absolute would be keeping the Clark-Kent-esque secret of your true identity hidden, and I'm not sure if some people would be able to swallow their pride enough to do that.
Pro Bono Security Attorneys (Score:4, Interesting)
(http://www.adambha.com/)
Re:Pro Bono Security Attorneys (Score:5, Informative)
Re:Pro Bono Security Attorneys (Score:4, Funny)
(http://www.keirstead.org/)
I mean sure, The Joshua Tree was great, but they've been going downhill for awhile....
Moving to Redmond? (Score:3, Interesting)
Re:Moving to Redmond? (Score:4, Funny)
"He is currently studying at Concordia University in Montreal, Canada, and is in his first year of obtaining a bachelor's degree in Software Engineering. He is also a Microsoft Student Ambassador and is representing the company on campus as a Technical Rep."
Uh oh.
Re:Moving to Redmond? (Score:4, Interesting)
(http://www.sigsegv.cx/)
You make enough stink on a non-moderated list like FD with the sole purpose to get hired and you get hired. There are pimps that follow FD, BUGTRAQ and the like for "fresh talent".
It's all in the details. (Score:4, Funny)
Re:It's all in the details. (Score:4, Funny)
Re:It's all in the details. (Score:5, Funny)
(http://fxaffinity.com/)
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo. [wikipedia.org]
/me watches the skies over Montreal... (Score:1)
I have a brilliant crack of the Vista DRM too... (Score:5, Funny)
In future news... (Score:4, Funny)
Too bad this didn't come out 3-6 months from now (Score:1)
(Last Journal: Saturday May 12 2007, @04:18AM)
Post the details on MySpace (Score:5, Funny)
What a revelation! (Score:2)
Yeah, right. They'll just keep up with their usual approach, one akin to installing a governor on your car to deter theft.
just release it (Score:3, Funny)
(http://www.devinmoore.com/ | Last Journal: Thursday May 24, @06:16AM)
He won't need to ... (Score:5, Insightful)
(http://slashdot.org/ | Last Journal: Saturday February 05 2005, @03:50AM)
Re:He won't need to ... (Score:5, Interesting)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
One wonders if the harassment of people who are not breaking US law in their own jurisdiction when they come to the US will have a chilling effect on technology in the USA. Certainly, some very smart people would be very stupid to visit here...
Seems that the cat is already out of the bag... (Score:5, Informative)
And what he did, if I understand correctly, is have some of his own code run as kernel without it being in a "test signed" driver. That seems to be the essense of his approach. Once you figure out how to do that, you can basically do anything, and Microsoft can't stop you.
Alex is also re-implementing the win32 kernel (Score:5, Interesting)
Although ReactOS can share a lot of work with the WINE project for the win32 userland, it could still use any developers that are familiar with win32 development and would like to see a truly free operating system capable of using windows drivers/software.
Why bother even having DRM? (Score:4, Insightful)
Re:Why bother even having DRM? (Score:5, Insightful)
Re:Why bother even having DRM? (Score:4, Insightful)
(http://www.wavenger.com/)
The goal is not to make a secure system. The idea of securing a system from its owner (who has physical access) while maintaining usability is absurd and approaches impossiblity. They just want to make a system which 99.9% of users cannot crack, make it so that the crack cannot be generalized across different systems, and prosecute the remaining 0.1%.
Really, the only way to defeat DRM is to prove to companies that they will make more money without DRM than with, or, failing that, make the preceding true via strikes and public awareness.
What with (Score:3, Funny)
What with HD-DVD and Blu-Ray being cracked already, and now this, combined with all the hate and general unity by consumers against the big movie and music industry, how much more signal do they need that DRM is pointless and unwanted and to finally stop trying to force it on us?
Its a shame (Score:3, Interesting)
Re: It's a shame (Score:5, Insightful)
It's a shame that things have come to a point where developers/security researchers have to worry about releasing findings like this, perhaps *even* when they are not under US law.
Is it illegal for me to have someone check safety? (Score:4, Interesting)
So if I use windows
I'll do it... (Score:2)
(http://205.205.253.95/Crackster | Last Journal: Wednesday September 22 2004, @09:57PM)
Re:I'll do it... (Score:5, Funny)
And... (Score:1)
Crushing of Freedom of Speech (Score:4, Insightful)
(http://bumpylight.com/ | Last Journal: Friday January 09 2004, @12:36AM)
Yes, I know it's been said very many times before, but I'm moved to say it again. It's simply obscene that runaway copyright law provisions should be used to casually stomp on this kind of freedom of speech, especially in the U.S.A., where allegedly there is a First Amendment guaranteeing freedom of speech. I would very much like to see a full-out legal confrontation between these terroristic laws as they stand, and the Constitution. The alleged and artificial "right" of the smirking lawyers at commercial companies to keep their nasty little secrets does not in any sense abrogate the innate, natural right of the people to talk to each other about any damn thing they want, particularly complex subjects, and in any way they wish, including via carrier pigeons and Morse code, let alone in plain English (or whatever language) on the Web.
It's really a shame that other countries such as Sweden actually surpass the U.S.A. in this area.
Frankly, this pisses me off enough that I'm very strongly tempted once my finances improve enough for the expensive legalities, to spit in the eyes of these jerkoffs with a direct, blunt and extremely widespread explanation (possibly on a Russian server to further annoy and frustrate them) of whatever it is that they absolutely are frantic to not have explained, along with the text of the Constitution with the First Amendment highlighted in red. I think a well-crafted attack on this crap would gather quite a lot of support, moral and otherwise.
Honest question (Score:4, Interesting)
(http://www.ping972.com/)
"*Any* video and audio"? (Score:3, Interesting)
Norwegians, I'm ashamed of you (Score:5, Funny)
Someone in America cracked this first.
Re:Norwegians, I'm ashamed of you (Score:5, Funny)
-Eric
Sorry 'bout that (Score:4, Funny)
Didn't read TFA, but when I saw this in the blurb:
draconian copyright laws
...I just assumed it was us.
Yay! (Score:2, Funny)
(http://www.chrisllorca.com/)
Thats the problem with 3rd party drivers (Score:1)
Although I wouldn't be supprised if in the future Microsoft does in fact lock down its operating system and write all drivers for third party itself, requiring the hardware maker pay them to do so.
Details? (Score:5, Funny)
(http://timjoh.com/)
DRM is overcome as a community, not individually (Score:2, Insightful)
(http://www.edodo.org/ | Last Journal: Tuesday January 10 2006, @11:10AM)
All the effort MS is putting into this will not make the studios happy, and will not make the customers happy. I think they made a bad choice.
Temporary At Best (Score:2, Redundant)
(http://www.friendwich.com/ | Last Journal: Thursday November 09 2006, @12:05PM)
2. No doubt there are *lots* of exploits waiting to be found. This is a Microsoft OS after all. Microsoft's core strength is Marketing and general amoral anything-goes business practices certainly not operating systems.
3. This is all very temporary. As Tivo's smart card/signed OS has shown Microsoft the way to maintaining their artificially high price for an operating system and subsequent inflated hardware prices.
It makes me so sad to see stories like this tagged with "haha." There is such a small number of people that understand the implications of DRM and the ultimate harm to all that they are simply marginalized as "nut jobs/OSS holy warriors."
The last laugh absolutely, positively, is Microsoft's and the broader special interests they serve.
Since this is the slashdot echo chamber, go about your business being morally outraged and doing nothing.
Misleading story (Score:3, Informative)
(http://slashdot.org/ | Last Journal: Wednesday November 07, @10:21PM)
1). It doesn't work out of the Box.
That being said, it turns out the code I've written does not work out of the box on a Vista RTM system.
2). It uses a method provided by Microsoft.
As part of the Protected Media Path, (PMP), Windows Vista sets up a number of requirements for A/V software and drivers in order to ensure it complies with the demandes of the media companies.
3). It hasn't been tested.
Although used on its own, this POC doesn't do anything or go anywhere near the PMP (I don't even have Protected Media, HDMI, HD-DVD, nor do I know where PMP lives or how someone can intercept decrypted steams),
4). Author is more afraid of the DMCA than of violating Microsofts EULA terms.
a particularly nasty group of lawyers could still somehow associate the DMCA to it, so I'm not going to take any chances.
This isn't a story. Its pre-mature speculation.
Enjoy,
Re:Misleading story (Score:5, Interesting)
(http://www.alex-ionescu.com/)
Yes, it requires a reboot, which is why it's only useful for bypassing DRM, not for open source apps (which will have to bother the user to reboot).
2). It uses a method provided by Microsoft.
Erm, no, PMP is provided by Microsoft. This method bypasses it.
3). It hasn't been tested.
It works fine, the actual PMP-disabling code hasn't been tested because I don't want to touch that. But my code ran in kernel-mode, which means it's possible. Read up a bit on computer architecture and you'll see that as long as you have access to the kernel, you're God on the machine (Apart from hypervisor machines and/or additional hardware -- which PMP doesn't currently employ).
4). Author is more afraid of the DMCA than of violating Microsofts EULA terms.
Author is a student and doesn't want to be sued out of existence because this method could be used to "circumvent a technological measure primarly destined for copyright protection".
Re:Misleading story (Score:5, Informative)
(http://www.alex-ionescu.com/)
Re:Misleading story (Score:5, Informative)
(http://www.alex-ionescu.com/)
Not using a driver, RTFM.
Microsoft knows that 3rd party driver certificates are going to be stolen/compromised. Microsoft hasn't even provided a method to reject unsigned drivers yet (per MSDN it will be in Vista SP1).
Which is why this isn't using a stolen/3rd party driver or unsigned driver, nor actually loading a driver.
Did you happen to hook one of the kernel functions PatchGuard is monitoring? Try to patch CI.DLL and see what happens. You can disable driver signing. You cannot disable PatchGuard.
There's about a dozen ways to disable PatchGuard, and I was able to patch CI.DLL, disable PatchGuard, as well as turn off code signing. I don't want to sound condescending, but you don't seem to know what you're talking about, or you're being deliberately misleading with your PatchGuard comment.
I'm not saying that you can't bypass Microsofts DRM restrictions. I just don't think you have and the burden of proof is on you.
I'm not going to commit legal suicide by proving it. The point of my blog entry was never to say I broke DRM, but that I've found a way which can break it, which people are free to explore on their own.
Sometimes . . . (Score:3, Insightful)
Obligatory attempt at poor humor... (Score:5, Funny)
(http://elektronkind.org/)
"It's time to un-PMP ze audio"
Wouldn't Be A Slashdot Article (Score:4, Informative)
'Protected Media Path' (PMP), which is designed to seriously degrade the playback quality of any video and audio running on systems with hardware components not explicitly approved by Microsoft..
No. It doesn't. It does it for specific DRM content.
These restrictions only apply to DRM content, such as HD DVD or Blu-ray. User's standard unprotected content will not be faced with these restrictions.
http://en.wikipedia.org/wiki/Protected_Video_Path [wikipedia.org]
He didn't "Break" PatchGuard (Score:1, Troll)
He turned it off then installed an unsigned driver.
Re:He didn't "Break" PatchGuard (Score:5, Informative)
(http://www.alex-ionescu.com/)
There's no way to turn off PatchGuard off, only Driver Signing, which watermarks your desktop and disables PMP. Ways to break Patchguard 2.0 were published recently by "Skywing" on uninformed.org
"... bypassed ... Vista ..." (Score:3, Insightful)
No one ever said we have to upgrade to Vista.
Thank You!!!! (Score:1)
No, the cat does not "got my tongue." (Score:1)
(Last Journal: Friday January 05 2007, @12:57PM)
This includes, and especially applies to things the government does not want you to say.
Might not be a DMCA violation (Score:2)
(http://www.biglumber.com/ | Last Journal: Tuesday September 18, @12:25PM)
Is there any content actually on the market right now, that uses Vista's DRM?
If not, then this is perfectly legal. There's nobody to sue you. If there aren't any works that use Vista's "technological measure that limits access," then 1201 wasn't violated. Maybe later there will be, but a violation can't be retroactive. That's like firing a bullet into the ground, and an hour later someone comes over to your bullet sitting on the ground, kneels down, bangs their head on the bullet, and then claims you shot them.
Dissecting Windows (Score:1)
(Last Journal: Saturday November 10, @01:52PM)
Start up a few MS-Word docs and begin recursively copying and pasting text, start with an initial block at least 512 bytes long. Try to fill up at least one MS-Word document to the point where the error message indicates that one has reached the maximum number of pages for an MS-Word document. At this point the contents of the buffer should be sufficiently large to keep all future processes well occupied.
Open a few more MS-Word documents and keep pasting.
Open a few PP presentations and keep pasting the contents of the (eventually enormous) buffer anywhere possible.
Make liberal use of the Windows and alt-tab to switch between processes and check to see which ones are alive. Try to single out a Word or PP presentation which are locked and give them an alt-f4 while switching to a (technically) still good process and issuing a few ctrl+n strikes.
Eventually you'll be able to get an onscreen benchmark of how much memory a process currently has protected because, under heavy buffer (copy/paste) load, Windows doesn't draw onscreen all that well anymore.
Alex Ionescu to speak at SCALE 5x (Score:1)
second class (Score:1)
just shows you how Microsoft feels about software vendors, and the consumer. By giving them second class software, or no means to run their own software business high class to the consumers.
And... So sweet of someone to crack DRM open for the so called second class citizens everywhere.
*Weebit moons Microsoft*
Weebit curtsies Alex Ionescu
You did crack it right? (insert grin here)Alex should release it anonymosly. (Score:1)
DRM is difficult. (Score:3, Interesting)
(http://www.bitwizard.nl/)
DRM is difficult: You have to give the end user the keys, and then trust that only the uses that you've prescribed are allowed. Giving the keys to the end user is stupid, so the keys are given ONLY to a trusted module inside the end users machine. That trusted module is supposed to A) keep the keys secret, and B) enforce the rules that accompany the key. (e.g. you rented this for a week and a week has gone by).
If you have a general purpose computer, it's very difficult to have a trusted software module that can't be cracked somewhere inside.
In the backup-hddvd case, examining the core of the userspace program revealed volume and title keys. But the "master keys" are still somewhere inside.
In this case the operating systems trusted platform that should prevent that kind of tricks has been broken. Now you can insert your own debugger into the trusted core, and examine other stuff inside the trusted platform. Or you can claim to be a trusted driver, who has to have access to the unencrypted HD content.
In any case, as long as there is no hardware trusted module, it is always possible to run a good enough simulation, and run the DRM software under the simulation in a virtual machine.
And even if you DO have a hardare DRM module, I don't think it's possible to get right if you have a passive element on one side. For example a HDDVD is passive. So it can't verify the other side, and only give up the keys if it has confirmed the other side to be a trusted DRM module.
The BIG Question?!?!?!?!!? (Score:1)
Re:Let's learn English (Score:5, Funny)
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo. [wikipedia.org]
(Also, that "sentence" I quoted is a fragment. And you didn't capitalize "i" in the previous sentence, which is actually a run-on.)
Re:Manna from heaven. (Score:3, Interesting)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
I don't think so. Businesses don't care; this will not affect them. Home users don't care; they don't want Vista. It's the lack of a compelling reason to purchase Vista that's stopping people from purchasing Vista. Windows 95 was a major upgrade. Windows XP was a major upgrade. They both got major attention. Windows Vista is a minor upgrade. It adds eye candy and some features that only business users typically need (like whole-disk encryption, which is a recipe for disaster in the hands of home users.)
The bottom line is that home users will be the major adopters of Vista because they will get the machine with Vista and they will run it with Vista. Corporate users who get new machines in with Vista will probably, if they have a volume license, run Windows XP on them instead, for the foreseeable future, not least because Vista has a brand-spanking-new TCP/IP stack which at least in the beta was known to be vulnerable to a whole laundry-list of otherwise-outdated attacks, things Windows hasn't been vulnerable to since the late nineties. Personally my biggest concern about vista on the corporate desktop (luckily not a decision I have to make) is that the network stack will be a vector of attack into the network, one that our firewall has no power to stop since users are continually opening outgoing connections.
Re:Fight the power! (Score:3, Insightful)
Suppose my current hardware is fast enough and has enough resources to run even the most demanding of applications.
Suppose my current monitor can handle the resolutions required.
Suppose I did have a hd-dvd drive and some movies.
Imagine how pissed I would be if I couldn't watch them at native resolution because according to Microsoft I had the wrong connector.
I want an Operating system, not a restricted system.
"Draconian" (Score:2, Insightful)
Re:He can crack DRM... (Score:1)
Re:Manna from heaven. (Score:2)
It seems to me that Microsoft needs someone to publish this sort of exploit. Vista would appear to be going nowhere in the market with the DRM mill-stone around its neck.
What makes you say that ? Outside of hysterical, mostly ill-informed posters on Slashdot (and their ilk), the knowledge of - let alone concern about - DRM in Vista is vanishingly small.