37C3 - Full AACSess: Exposing and exploiting AACSv2 UHD DRM for your viewing pleasure

media.ccc.de/v/37c3-12296-ful...
Following the failure and easy exploitation of the AACSv1 DRM on HD-DVD and Blu-ray, AACS-LA went back to the drawing board and announced the next generation AACSv2 DRM scheme, launching alongside 4K UHD Blu-ray in 2015. Since then, nearly no information has come out publicly about any vulnerabilities or even the algorithms themselves, owing in large part to software players requiring the use of Intel SGX secure enclave technology, which promises integrity and confidentiality of AACSv2 code and data through local and remote attestation mechanisms. Join us as we explore the broken history of AACS, describe practical side-channel attacks against SGX, and present the first look into the inner workings of AACSv2 DRM, culminating in a demonstration of the first full compromise of AACSv2 and unofficial playback of a UHD-BD disc.
The Advanced Access Content System (AACS) is a DRM scheme used to safeguard audio and visual content, particularly in high-definition formats like HD-DVD and Blu-ray. First introduced in 2005 following the failure of the Content Scramble System (CSS) used in DVDs, AACS was designed to be not only secure against regular piracy, but included multiple features intended to restrict the impact of a potential leak of cryptographic material such as revocation lists and traitor-tracing. The concepts and algorithms of AACS were described in a publicly-released whitepaper, relying on strong cryptography and secrecy of keys to maintain security. Unsurprisingly, less than a year after publication, the first unlicensed decryption tool was demonstrated using keys reverse-engineered from a software player binary. While AACS-LA was quick to revoke those keys, a cat-and-mouse game emerged with new keys being regularly extracted from sources such as software updates and PS3 firmware.
With AACS effectively broken and easily bypassed as described in Eckersley’s 24c3 presentation, AACS-LA would announce the introduction of AACSv2 for the next generation 4K UHD Blu-ray discs. This time, however, AACS-LA would not release the specifications of the DRM publicly, requiring strict NDAs for implementers and increased software/hardware security measures. Most notably, playback of legitimately purchased UHD-BDs on PC requires Cyberlink PowerDVD software running on Windows 10 and an SGX-capable 7th-10th generation Intel CPU. Since the DRM would run exclusively in the SGX secure enclave, no further information about its inner workings or vulnerabilities would be discovered publicly, until now.
In this presentation, we explore the security system of AACSv2 DRM and the Intel SGX trusted execution environment. We first analyze the principles of SGX and its promises of an isolated environment, protected from all software running on the machine. We also investigate the use of SGX local and remote attestation primitives intended to verify the integrity and confidentiality of AACSv2 key material and DRM code, and why it has resisted outside analysis for so many years. We then discover how hardware side-channel attacks can be used to undermine these guarantees of SGX, and craft an effective exploit to extract cryptographic material from the enclave and defeat the DRM code obfuscation.
Following that, we present the first public description of the inner workings of AACSv2, the key derivation process, and the updated revocation and traitor-tracing mechanisms. We studied BIOS updates from six motherboard vendors to show how SGX can be broken both easily and cheaply, and that vendors are now faced with a decision of security vs. usability in trusting unpatched machines. Finally, we conclude with the first demonstration of a UHD Blu-ray disc being decrypted and played back on a non-official platform.
Adam Batori
events.ccc.de/congress/2023/h...
#37c3 #Security

[@charm3979]

clta_sw.dll is fucking hilarious when i saw that decompiler output i literally yelled “OHHH NO LMFAO”

[@PaulLoveless-Cincinnati]

I enjoy presentations in English on this channel.

[@HupfderFloh]

Once again, legitimate users get the short end of the stick. Owning things seems to have gotten out of fashion as well in the age of remote server dependent playback.

[@wilh3lmmusic]

Screw digital restrictions management

[@NicholasAndre1]

The amount of engineering that went into this feature stack is insane. Maybe instead they could figure out how to make high quality content reliably easier to stream than to pirate…

[@dorukayhanwastaken]

It already is. The problems of streaming come from capitalism, not technical difficulties.

[@juligomez2493]

Fuck DRM

[@voxelsofsorrow]

Right? I don't get why they do such rocket-science copy protection when you can always point a camera at a TV, or snoop the bus going to the actual display panel or something.

[@der.Schtefan]

It is funny how many drives just die hours before a presentation on these conferences. This is the 6th video I binge with a dead drive.

[@Intermernet]

The demo gods are the only gods that exist. I don't know why we haven't started worshipping them yet. Manually corrupt one slide of your presentation to appease them and avoid their non-deterministic wrath.

[@ltsiver]

This is why I use high endurance micro SD cards on my Pis. I learned this lesson the hard way too many times.

[@JoFuSoA]

Wow! Huge respect! You are a legend! Greetings to DVD John and Muslix64!

[@TroubleDog54]

Sick presentation, thank you internet!

[@electronash]

I still have some sealed HD-DVDs, hoping they might be worth (literally) a few dollars one day. lol I personally thought HD-DVD worked a bit better than typical Blu Ray disks/players of the time. The menus and extras on HD-DVD were often a bit nicer. The menus on Blu Rays seemed to be more sluggish. (that could have been partly due to the player at the time. I was using an Xbox 360 with HD-DVD drive. Then an LG Blu Ray burner in the PC a few years later.) I don't know much about the encryption stuff, but it's always interesting to hear how it got broken.

[@Daniel-wn5ye]

DRM is awful for honest buyers! I've been bitten by it for at least once and I hate it.

[@elliottf313]

Very impressive, great talk. Thank you.

[@LigH_de]

The doom9 forum will enjoy knowing about this continuing success.

[@holyraider]

great presentation! thx👌

[@davidwillmore]

AACS v2.1 is used for the screeners for awards, isnt it?

[@rootuser9218]

Wouldn’t shock me

[@Kr0noZ]

So... I own exactly ONE UHD Blue-Ray, and I specifically bought a suitable DVD drive to go along in 2017 when that stuff was new, imported it from the US as it wasn't even on the market in Germany at the time. I placed it in my I7-7700k system, used it a single time to watch the movie because it turned out I had to use the IGPU to hook up my TV due to DRM issues with my graphics card ( i guess the idea was if the media content is played out to a monitor via a video card it could be captured along the way and rerecorded) and that was a hassle. Now I find out that once this system dies and I need a new CPU, both that BD and the drive are going to be paperweights I will never be using again to watch said movie because Intel dropped a required feature for those DRM shenanigans after it got broken and abused. Cool beans. Anyone interested in buying a once-watched UHD Bluray of "Solo - a Star Wars Story" ?

[@dascandy]

No, they're not paperweights. You'll just have no officially sanctioned software to play it with. But you can use VLC to play it regardless. And expect more software to come.

[@45545videos]

Amazing talk

[@NiekNooijens]

45:58 lol. "sony mode" as throwback to the PS3 hacking video.

[@TofuInc]

The unfortunate side of this is that it is one more nail in the coffin for physical media. If studios and producers don't feel safe releasing content on physical media, it's one more reason for them not to. I was quite content with being able to rip blu ray but watch 4k as intended from disc. I will be super disappointed if this brings the demise of new releases on 4k uhd blu ray.

[@MazeFrame]

Well, the big companies need to understand that they can make huge bank by just trusting the consumer. They expect the consumer to "trust me bro", so them doing the same should be reasonable...

[@ltsiver]

Well, the content industry is pretty much removing any further development of physical media, so this is just more justification for them to move to streaming only.

[@DerKlappspaten]

Heave ho!