By: Chris Gerlinsky

Scheduled on: June 18 at 14:00

Follow the steps taken to crack a conditional access and scrambling system used in millions of TV set-top-boxes across North America. From circuit board to chemical decapsulation, optical ROM extraction, glitching, and reverse engineering custom hardware cryptographic features. This talk describes the techniques used to breach the security of satellite and cable TV systems that have remained secure after 15+ years in use.

Topics include:

  • chemical decapsulation and delayering of ICs in acids,
  • microphotography and optical bit extraction of ROM,
  • binary analysis using IDA and homebrew CPU simulators,
  • datalogging and injection of SPI and serial TS data,
  • designing and using a voltage glitcher,
  • extracting secret keys from RAM of a battery-backed IC,
  • analyzing hardware-based crypto customizations,
  • studying undocumented hardware peripherals,
  • MPEG transport streams and non-DVB-standards,
  • QPSK demodulation, interleaving, randomization, FEC of OOB (out-of-band) cable data.

The result is knowledge of the transport stream scrambling modes and knowledge of the conditional access system used to deliver keys. Strong and weak points are identified, advanced security features implemented nearly 20 years ago are compared to modern security designs. A softcam is designed and tested using free software, working for cable and satellite TV.

Slides