Zeroday 01100100011010010

“iPhone features a rich HTML email client and Safari — the most advanced web browser ever on a portable device — which automatically syncs bookmarks from your PC or Mac. Safari also includes built-in Google and Yahoo! search. iPhone is fully multi-tasking, so you can read a web page while downloading your email in the background over Wi-Fi or EDGE.”

My work at the Stop Badware group has shown me that trojan dialers are still all the rage. And I have to step back from my multiple T-1 connections at the collective space I hang out at or the even larger bandwidth provided on Harvard’s campus to realize that some people still use the plain old phone system to dial up to the internet. I don’t have a single system anywhere with a modem left so infecting me with a dialer really isn’t going to get you anywhere.

An iPhone however is just ripe for this type of abuse (and so are PocketPC based phones now that I think about it). So it isn’t that iPhones are going to be the only portable devices that will likely be targeted by this type of attack in the future but the descriptions of the iPhone certainly did set off that alarm in my head. Not just from browser based attacks but the rich HTML interface. MS has been quietly reducing the HTML rendering capabilities in their email clients because attackers kept exploiting every single aspect of it. I think over time Apple may need to learn this lesson as well. Rich HTML sounds great in the marketing of an email client but rarely has one survived without getting spammed to death, infected by trojans, or both.

“Okay, congrats to those who have won round one and yes–the keys are on the disk, but they are encrypted keys on the disk. We still need an (unrevoked) player to decrypt new keys for us or even play old encrypted disks. If your player is revoked, it’s end of round one; you won’t even be able to play old titles! Here’s why: Take a look at Fig. 4-1 of AACS_Spec_Common_0.91.pdf. It appears that the drive holds a Host Revocation List and the host holds a Drive Revocation List. Maybe I’m missing something here but it seems that the first time you place a disk that contains any given player in its revocation list into the drive, that player will forever more no longer function with that drive–even after a fresh reinstall of the player software. Drive firmware hacks may soon be useful.”

From the Doom Forum:

Alright, this is good news.
The key “EF21329F7D838D9A7056882DBF665CD5” is the 2nd key which decrypts the file UNILOGO.EVO from the movie Serenity. This is *CONFIRMED* and *WORKING*.

Here are all the keys for Serenity:

1-31325529846E19E90D88F414DA7D1661
2-EF21329F7D838D9A7056882DBF665CD5
3-46BE356597AD71BFFADEDA14FE335B64
4-8906E3E8B05EEC17E594E98D42C913FE
5-0F998F1C0C7FEB30381C01F135FBE8E9
6-97895F12C018845C9CDCE95DFF4101DF
7-6C005DA9DAA97E168129753319D748A1
8-0608D2628A9FE952398B0FB432BDB6B1
9-A24471CC766C6E7F7F56DB560CCD31E5
10-6EC977757A9E8AC378CC680770874E33
11-55962EA8084BF5135CB2ED5A5E795233

Here are the keys for KingKong:

1-7D743D3C92652CC16B66D9CB87F6D132
2-70B71C6E767E213AEB7456985BAAD8A4
3-4BC362995030035312A5B6030D76C817
4-A019B5101E904A700A44F056B7EB3579
5-896AB02D3D77554EABCE3CCE931DA39D
6-BEC07637E9C4EFA1F70FED6891DB277B
7-1DC0D276F2C5B9FCFDE1414C5002BAAB
8-BC7EB577D1936818AEB9241F024DE681

To find these keys, my best advice would be to search your memory for “VPLST000.XPL” and they will be near one of the instances of it.

Now we have to find the volume keys for a lot less trouble.

true to our word we are hosting the next Beansec at the Enormous Room this coming wednesday from 6-9pm. In case you forgot what Beansec is all about let me fill in the gaps!

BeanSec! is an informal meetup of information security professionals and academics in the Cambridge/Boston area. Unlike other meetings, you will not be expected to pay dues, “join up”, present a zero-day exploit, or defend your dissertation to attend.

map to the Enormous Room in Cambridge.

“A vulnerability has been reported in WordPress, which has unknown impacts.

The vulnerability is caused due to an unspecified error. No more information is currently available.

The vulnerability is reported in versions prior to 2.0.6.”

The vulnerability is rated as ” Highly critical”
 http://wordpress.org/development/2007/01…

“Some argue that the consumer gets little or negative ‘benefit’ from this increase, this is false. The consumer gets premium content on their PC”

Pete Levinthal
Software Engineering
ATI Technologies, Inc

This is a fair statement. Playing HD content from a Blueray or HD DVD disk is clearly an advantage that end users would appreciate. So in the sense that a benefit is an advantage I would say Levinthal’s statement is accurate. However, benefit can also refer to “profit” which would make his statement questionable. Considering that he mentions ‘negative “benefit”‘ I think we should delve further into this connotation. Profit is the positive difference between the amount spent and the amount earned. So in purely mathematical terms the amount of “cost” to the end user to play premium content must be lower then the amount gained in the operation of HD playback for a profitable expierence. I believe it is safe to assume what the amount gained is, HD playback. What isn’t so clear is what the costs are. In the programmers universe cost is generally associated with amounts of cpu cycles spent solving some problem. Thus if a programmer writes a function for a program which needlessly recomputes values it is considered “expensive”. An accomplished programmer can write elegant solutions which do not incur much cost.
Keeping the previous definition of “cost” in mind I think it is fitting to look into what the premium content protection really costs a user. From this analysis we can make a fair judgement on whether a user profits overall from the ability to play HD content. According to the Micosoft presentations here, here, here, and here the playback of HD content requires no less then two rounds of encryption/decryption before the video is sent to the display. First the video comes from the original HD media in encrypted format and is decoded. That decoded media is then encoded again using the AES algorithm and sent across the PCIe bus. Once it reaches the other side of that bus it is decoded and then sent across the HDMI interface to the display.
The entire process is documented here in a presentation by Microsoft:

Based on my own valuation of HD content playback I would say that the price is either near or exceeding the gain of watching content on my PC. Clearly the price of these computations goes down every 18 months* by 50% according to Moore’s law. This led to my earlier prediction that an affordable and usable system running Vista is perhaps 5 years away. Before I close on this installment I want to give a preview of the next piece I have lined up. This image struck me and has pervaded my thoughts about this article.

This image from a presentation delivered by Dave Marsh (Program Manager, Windows Media Technologies) captures how Microsoft frames this problem. Perhaps not intentional but all too apparent in this image is their end user acting deviously and maliciously hurting Hollywood, Microsoft, and probably America.

* Wikipedia cites Moore as stating 12 months between the doubling of transistors which given my previous statement would reduce the distance of a usable and affordable system 3.3 years away. There are other references in the article that state the chip making industry adheres to the “doubling every 18 months”. My prediction was that of 3.5x current capacities for an affordable system to play back HD content on a Vista PC.