PAY-TV channels risk ruin if they continue to use today鈥檚 smartcard technology. Security experts at Cambridge University say that TV smartcards will be wide open to conterfeiting unless the TV companies switch to a new kind of card that automatically destroys secret data if anyone tries to tamper with it.
The issue has been thrown into sharp relief by the high-profile lawsuit filed last week by one digital TV company against another, in which the French company Canal+ is suing NDS, owned by Rupert Murdoch鈥檚 News Corporation, for $1 billion in damages. Canal+ claims NDS obtained the anti-piracy codes from Canal+ smartcards and allowed them to be posted on the Web, letting pirates fake millions of valuable Canal+ pay-TV cards and sell them illicitly. NDS refutes the allegations and says it will counterclaim.
Whatever the result of the lawsuit, the case has uncovered an unhappy truth for the pay-TV industry, say experts at TAMPER, Cambridge University鈥檚 Tamper and Monitoring Protection Engineering Research Laboratory. So much information on hacking smartcards is published on the Net, says a lab spokesman, that any card holding secret data is likely to be hacked sooner or later.
Advertisement
Canal+鈥檚 Mediaguard and NDS鈥檚 Videoguard smartcard systems both look for a code buried in the broadcast signal that shows the subscriber has paid to view a particular programme. To prevent pirates simply copying cards, this code is changed regularly, and to keep up with these changes the smartcards carry a piece of secret anti-piracy software. If pirates acquire this software, they can use it to persuade counterfeit cards to accept codes intended for legitimate users.
Pirate Mediaguard cards have been circulating for a couple of years. Videoguard has not been hacked so far, but NDS expects it to be compromised at some point. Next month, Canal+ will start replacing 13 million legitimate Mediaguard cards in more than a dozen countries in Europe and Asia.
In its lawsuit, Canal+ alleges that a laboratory in Israel working for NDS obtained the anti-piracy software, called UserRom, from Mediaguard smartcards by 鈥渆lectrical and optical examination鈥�, packaged it as a compressed file and gave it to a website. From there it was copied by dozens of other sites. Many of these sites have now been shut down, but it is too late for Canal+. 鈥淭he horse was then out of the box,鈥� says Fran莽ois Carayol, the firm鈥檚 executive vice-president.
The technology is part of the problem. Ordinary read-only memory (ROM) chips are no use for storing secret data. Under infrared light, the metal tracks connecting transistors are visible through a microscope and reveal the pattern of stored data.
So Canal+ stored its secret codes in 鈥渆lectrically erasable programmable ROM鈥� (EEPROM), similar to those used to hold data in cellphone SIM cards or store the tuning settings of TV sets. This was once thought to be secure, but it has since been shown that the secret data can be extracted if the chips undergo certain chemical treatments.
This could be thwarted by the anti-hacking technique known as zeroisation, which wipes a chip clean as soon as a tamper attempt is detected, says Markus Kuhn at the TAMPER lab, and his colleague Oliver K枚mmerling. But zeroisation won鈥檛 work with today鈥檚 pay-TV smartcards, as it requires a constant power supply. Current smartcards don鈥檛 have a battery and rely on non-volatile memory, so they are inherently insecure, they say.
After BSkyB鈥檚 analogue service was heavily hacked, the company used a new trick for its digital service. The secret data is stored in transistors that are stacked in many layers, making it hard for hackers to decode their connections and build replica circuits. So far they have not succeeded. But one day they will, admits NDS chief executive Abe Peled: 鈥淎ll smartcards can be hacked if left in the field long enough.鈥�
Unless the cards destroy their data when they are tampered with, that is.