<- Back to the timetable

How Do I Crack Satellite and Cable Pay TV?

Chris Gerlinsky

Analysis of, and low-cost attack techniques against, a conditional access and scrambling system used in tens of millions of TV set-top-boxes in North America. A case study of the low-cost techniques used by an individual hacker to successfully crack a major pay TV system. Topics include: chemical decapsulation and delayering of ICs in acids, microphotography and optical bit extraction of ROM, binary analysis using IDA and homebrew CPU simulators, datalogging and injection of SPI and serial TS data, designing and using a voltage glitcher, extracting secret keys from RAM of a battery-backed IC, analyzing hardware-based crypto customizations, studying undocumented hardware peripherals, MPEG transport streams and non-DVB-standards, QPSK demodulation, interleaving, randomization, FEC of OOB (out-of-band) cable data. The result is knowledge of the transport stream scrambling modes and knowledge of the conditional access system used to deliver keys. Strong and weak points are identified, advanced security features implemented nearly 20 years ago are compared to modern security designs. A softcam is designed and tested using free software, working for cable and satellite TV.

Download Slides
PDF ZIP JSON
0:00:07 - 0:00:12
0:01:25 - 0:01:35
0:01:50 - 0:02:08
0:02:08 - 0:02:11
0:02:40 - 0:03:04
0:03:33 - 0:03:37
0:03:58 - 0:04:11
0:04:22 - 0:04:51
0:05:21 - 0:05:38
0:05:38 - 0:05:46
0:05:47 - 0:05:56
0:06:10 - 0:06:17
0:06:20 - 0:06:23
0:06:23 - 0:06:33
0:06:49 - 0:07:12
0:07:22 - 0:07:55
0:08:05 - 0:08:19
0:08:20 - 0:08:28
0:09:23 - 0:09:26
0:09:26 - 0:09:29
0:09:29 - 0:09:33
0:09:44 - 0:10:27
0:10:37 - 0:11:16
0:11:42 - 0:11:52
0:12:17 - 0:12:28
0:12:56 - 0:13:09
0:13:09 - 0:13:22
0:13:35 - 0:13:44
0:13:55 - 0:14:04
0:14:12 - 0:14:18
0:14:20 - 0:14:48
0:14:49 - 0:14:51
0:15:01 - 0:15:22
0:16:01 - 0:16:04
0:16:05 - 0:16:08
0:16:09 - 0:16:57
0:17:07 - 0:17:41
0:17:42 - 0:18:03
0:18:24 - 0:18:43
0:18:51 - 0:19:03
0:19:04 - 0:19:08
0:19:09 - 0:19:18
0:19:48 - 0:19:55
0:20:09 - 0:20:12
0:20:13 - 0:20:27
0:20:42 - 0:20:52
0:20:58 - 0:21:14
0:21:46 - 0:21:55
0:22:05 - 0:22:15
0:22:25 - 0:22:52
0:23:20 - 0:23:26
0:23:50 - 0:23:57
0:24:04 - 0:24:13
0:24:24 - 0:24:32
0:24:52 - 0:25:02
0:25:38 - 0:26:04
0:26:35 - 0:26:50
0:27:14 - 0:27:31
0:27:31 - 0:28:04
0:28:05 - 0:28:11
0:28:22 - 0:29:15
0:29:16 - 0:29:21
0:29:31 - 0:30:04
0:30:04 - 0:30:14
0:30:15 - 0:30:18
0:30:22 - 0:30:52
0:31:09 - 0:31:24
0:31:25 - 0:31:43
0:31:44 - 0:31:52
0:31:53 - 0:32:24
0:32:30 - 0:32:38
0:32:43 - 0:33:13
0:33:30 - 0:33:34
0:33:35 - 0:34:10
0:34:20 - 0:34:58
0:36:30 - 0:36:48
0:37:09 - 0:37:51
0:37:51 - 0:38:01
0:38:28 - 0:39:16
0:39:41 - 0:40:09
0:40:51 - 0:41:01
0:41:19 - 0:41:39
0:41:56 - 0:42:15
0:42:37 - 0:43:03
0:43:23 - 0:43:26
0:43:26 - 0:43:48
0:44:00 - 0:44:07
0:44:45 - 0:44:54
0:45:17 - 0:45:39
0:46:09 - 0:47:05
0:47:37 - 0:47:40
0:47:42 - 0:48:32
0:48:37 - 0:49:25
0:49:45 - 0:50:01
0:50:04 - 0:50:11
0:50:15 - 0:50:34
0:50:52 - 0:51:13
0:51:22 - 0:51:31
0:51:43 - 0:51:58
0:52:16 - 0:52:32
0:52:58 - 0:53:07
0:53:09 - 0:53:40
0:54:39 - 0:55:12
0:55:45 - 0:55:49
0:56:24 - 0:56:31
0:56:39 - 0:56:44
0:56:49 - 0:56:53
1:02:24 - 1:02:28
1:02:29 - 1:02:33
1:02:34 - 1:02:39