Satellite TV Hacker Tells His Story

Wired is running a story about Christopher Tarnovsky, the man who was accused of working for NDS, a company owned by Rupert Murdoch's News Corp., to sabotage a competitor's satellite TV system. Wired had a chance to speak with Tarnovsky and get his description of how the smart-card hacking war developed. Quoting: "Tarnovsky, who was known online as 'Big Gun,' says Ereiser offered him $20,000 to fix cards that were killed by ECMs, and he agreed. Each time NDS created a countermeasure, Tarnovsky would analyze the code and find a way to circumvent the countermeasure. He did it while working full-time as a software engineer for a semiconductor company in Massachusetts. 'I'd be at work and I'd check the IRC (channel) to see if they'd launched their Thursday countermeasure yet,' he says. 'It was like a chess game for me. I couldn't wait for them to do a countermeasure because I would counter it in minutes.' It wasn't long before NDS came courting. Tarnovsky had a contact at the company to whom he'd begun passing information about holes in its software, even supplying patches to fix them."

OLD

[Anonymous Coward]

This was a good story when I read it last year too.

Impressive

[phasm42]

That video was pretty damn cool. I didn't know chips could be disassembled that way.

That aint nothing.

[emj]

The guys at Flylogic really make some high quality micro chip reverse engineering [flylogic.net] (I was going to say porn).

The Video Shows the Holy Grail of Sat Hacking

[Anonymous Coward]

I spent years hacking satellite television, from the early days, the glory days of the H and HU cards and then left the scene when DTV killed with the P4 card and lawsuits. I've written my own 3Ms and emulators. What Chris has done in this video really is the ultimate holy grail of smart card hacking. The security layer he is referring to, at least on NDS cards, is sort of a sticky layer that when you attempt to pull off the coating to access the bus, it simply rips up many of the thin wires on the chip and you're SOL. This is enough to discourage casual hackers and those without good resources. It also, as he mentions late in the video, eliminates the need for using "glitching", which was accomplished using a specially programmed Atmel chip and some software, to attempt to oscillate the voltage in such a manner that allows you to read/write to the card without having a properly signed packet. Dumping ROMs is exceptionally difficult to do, even with the thoroughly hacked HU cards, and he can just casually do it with his setup. Makes me think he could also dump the ASIC, something even in the heyday of DTV hacking, was never accomplished. This would eliminate the need for an access card at all- once you've dumped the ROMs, got a valid EEPROM, all you need to do is emulate the ASIC and opcodes for the processor (which on the HU card was a Texas Instruments TMS370 chip with a modified instruction set).

Re:The Video Shows the Holy Grail of Sat Hacking

[Forbman]

I forget the company, but at the OMSI (Oregon Museum of Science & Industry), they had a table top electron microscope there 3 or 4 months ago. It's a Netherlands company that makes it. I wish I remembered more about it, but the pricing on it was probably in the $10-50K region for the one they had there.

Kind of "google earth" in reverse was its software interface for looking at stuff. Slicker than snot.

Re:The Video Shows the Holy Grail of Sat Hacking

[Anonymous Coward]

The ASIC could be 'logic probed' in the same way the ATMEL 2313 was with the lock bits set on the WT2, and the creation of the SU/SU2, once completed, an emulator coded.

Those are techniques used in failure analysis

[ciscoguy01]

The techniques Tarnovski used to burn the top off with acid is failure analysis stuff.
I knew a guy who worked at a chip manufacturer and that's what he did. Failure analysis.
Burn the top of the chip off with what he called "formic acid" (I think, this was over 20 years ago) which "didn't hurt the chip".
They would then look at it under a microscope and try to determine what had failed.
The second microscope Tarnovsky was using looked to be a wire bonder.
It welds wires on by hand, with a pantograph type positioner.
So you can connect the chip to the leads, for example in the package, common for eproms. You can see the little leads in the window of older eproms.
But hackers can also use those to reconnect the last link of a programmable chip like a PAL that has had the security fuses blown after programming. Then you can just read the program out of the chip. OOPS, there goes that programmable security.
I had a chance to get one of those once, but it was a big one. Too big for me.
The little tabletop one in the video would be neat. I would grab one of those if it ever presented itself.
Tarnovski used that wire bonder to grab the signals off the chip internally, where they are actually running.
Those smartcards are likely a serial device, but if you can get back to where the data bus is parallel maybe that is before the inherent security.
The guy is obviously good. Wonder if he has a college degree?

Tarnovsky == Flylogic

[kju]

Christopher Tarnovsky, the guy portrayed in the article, IS Flylogic. Yes, this is slashdot and nobody reads the article, but it even links to flylogic.net.