Newsgroup: it.hobby.satellite-tv.digitale
Titolo: Chi sono i pirati ?

Smart card piracy has been a firebrand for the satellite industry for years.
Last year, in perhaps the world's highest-profile hacking case, two pay-TV
companies sued media mogul Rupert Murdoch's smart card maker NDS.
First Vivendi Universal's Canal Plus, Europe's largest pay-TV provider,
filed a lawsuit against NDS, accusing Murdoch's smart card firm of
supporting piracy against their competitive smart card platforms, costing
the firm $1 billion in lost subscriptions. DirecTV and Echostar lawyers
later piled on with similar accusations. But all three legal battles are
currently in limbo as Vivendi deals with an impending spin-off of its pay-TV
operations to Murdoch and DirecTV and Echostar deal with fallout from their
failed merger attempt, recently scuttled by federal regulators.
In actual fact, this claim is very likely to be true and the employee that
is unnamed below is very likely to be the hacker previously known as BG or
"BIG GUN" in the battery card days where he did all the main hacks. In fact
his real name, which he always hid is Chris Tarnovsky and he turned RAT and
became an NDS employee and informant.
It is a rather well known rumor that this individual hacked various systems
at the request of NDS and this rumor has been around in the satellite
community for a few years now. Frankly we are surprised that it took so long
to have someone sue NDS based on this activity by Mr. Tarnovsky.
At one point US customs stopped a VCR and a DVD heading to Mr. Chris
Tarnovsky that was filled with CASH and were sent to him by DR7. This was
reported on several sites at the time but not on DR7. I wonder why :)
It will be very interesting to see what liability will accrue to Chris
Tarnovsky over this issue and I am sure he will testify in this case and may
even now have turned again, this time towards Canal Plus. Sometimes it takes
a while but "what comes around, go's around".
We have long predicted that the SCAM MENTIONED HERE whould cause
shareholders to file suits as well and we have long reported on the TRIVIAL
SECURITY on NDS Cards.
It is interesting to see that NDS, who manufacture DirecTVŽ Access cards are
being SUED for "HACKING" competitors codes in their access cards. I wonder
how many other people who have specific knowledge of this action will NOW
step up to the plate and testify about their knowledge of this matter. That
would CERTAINLY HELP Vivendi :)
Currently 5 more companies have jumped in as intervenors in the Canal +
lawsuit against NDS and while canal + may now drop the case (for the sale of
telepiu for almost $1 billion dollars) new companies are jumping on the
bandwagon with their own evidence. They all accuse NDS of having hacked both
the canal + smartcard and the nagra smartcard. This does not bode well for
NDS which is supposed to stop hacking, not do it themselves. NDS is owned by
the multinational News Corp., itself owned by Rupert Murdoch.
I certainly DO KNOW who might help in this matter :)
Some people may be expecting a return E-mail on this matter SOON!!!
The following was posted on the DR7 website and is the work of Chris
Tarnovsky nder the AKA name of sWiss chEEsE pRODuCtIoNs
DirtNetwork Notes by (c)1998 sWiss chEEsE pRODuCtIoNs
Protocol: ISO-7816 T=1 Block Protocol
Bitrate: ATR: 12096 (86uS) / Runtime: 140625 (7.11uS)
Standard IO handling performed. 2 Stop bits
follow each byte. Non-standard parity appears
to be used. Parity IS checked.
CPU Core: Standard SGS Thompson ST16F?? Processor
20k (1.5k SGS Test Code) ROM
4k EEPROM
768 Bytes RAM (40-7F reserved for stack)
1:1 Input frequency unless overclocked!
Frequency's >5.000 Mhz = /2 on input freq.
Internal Clk @3.57mhz = 279ns/Cycle.
The protocol they choose is one not known to many people. T=1
was meant to be used by a group of equipment. It's ability to
address up to 255 different "Nodes". Some aspects are quite simular
to T=0 (DSS Protocol). The Packets will always follow the following
structure:
[NAD] [PCB] [LEN] ; [Data block] [LRC]
NAD: Node Address (0-255)
PCB: Procedure byte
LEN: Total length of this packet not counting LRC
--
LRC: Starting with 0 XOR of all bytes in packet. Result must be zero.
Psuedo Code: lrc = NAD;
lrc ^= PCB;
lrc ^= LEN;
for (i=0; i<LEN; i++)
lrc ^= data[i];
lrc ^= LRC; (taken from stream)
if (lrc==0) continue... ;
else process_bad_pack();
This has to be the stupidest way to Checksum a packet this company could
have done. Now you the listener may check your receiving data to ensure
you are logging correct data!
The NAD in EchoStar (DirtNetwork) is always 0x21 from the IRD and
0x12 from the Card. Again, a stupid mistake. thanks guys for pointing
out to us (the deemed ignorant ones) both direction and correctness.
The data inside the block is sent to the card extremely quickly (140k),
however there are not many packets. Initial powerup procedures will
give you the most transferred data. Afterwhich, you will see poll's
being performed in between control words. Please examine the below
logs. Some data has been removed (Log your own log):
The PCB's function isn't used the way it would be in T=0 (DSS). Here,
it's purpose is to determine if the block is a continuation of the
previous block. If you are using an older system, they run @4.000 Mhz
and cannot handle the big packets. I would recommend learning the stream
on the new systems. They send all data in one packet to the card.
Protocol Explanation (Partial):
; Always the initial powerup packet sent out from IRD.
; Sets the maximum length the card will accept.
; Here it is 0-57h. This includes the 3 byte header along
; with LRC trailing the end of the packet.
;
; Biggest packets are 3 for header, 53 in body + 1 lrc = 57h
;
; Notice, no acking of the procedure byte?
;
21 C1 01 ; 58 B9 ; Irds request
12 E1 01 ; 58 AA ; Cards response
; IRD Poll Packet
;
21 00 08 ; A0 CA 00 00 02 C0 00 06 87
; ^^- Command Requested
12 00 08 ; B0 - Return Command B0
04 - Length 04
08 03 00 00 - Data block to IRD
90 00 - SW1/SW2
35 - LRC of this packet
21 40 08 ; A0 CA 00 00 02 C0 00 06 C7
12 40 08 ; B0 04 08 01 00 00 90 00 77
; Serial Number Request Packet
; Command 12
;
; Card returns Cam ID "00112233" or 1122867
;
21 00 08 ; A0 CA 00 00 02 12 00 06 55
12 00 08 ; 92 04 00 11 22 33 90 00 2E
; ?? Always the same in virgin/subscribed cards
; Command 14
;
21 40 08 ; A0 CA 00 00 02 14 00 06 13
12 40 08 ; 94 04 0F 4C 54 60 90 00 2D
; ?? Always the same in virgin/subscribed cards
; Command C1
;
21 00 08 ; A0 CA 00 00 02 C1 00 04 84
12 00 06 ; B1 02 CF FF 90 00 07
; Request Poll for IRD Information.
; Command 20 SubCmd 01
;
; This ones important! It wants the CAM to
; return "How many" more polls are needed for
; this type of request.
;
21 40 0C ; A0 CA 00 00 06 20 04 01 02 FF FF 03 25
12 40 05 ; A0 01 01 90 00 67
^^- CAM has 1 item to be sent to IRD
; Command 21 - Return of 20 01 request.
; This packet has your IRD information they downlowed
; to your CAM when you subscribed. this information
; is sent to your CAM in the CLEAR. Get your loggers
; out!
;
; You may also find this data inside the 24C08/16 Serial
; EEPROM inside the IRD.
;
; Take NOTE: IRD Number is implanted BACKWARDS!! It's obvious
; they watched the DSS hacks in the 'F' card and changed their
; system to prevent those tactics. Nice try, but Sorry Charlie..
;
21 00 0D ; A0 CA 00 00 07 21 05 01 03 FF FF 00 20 47
12 00 22 ; A1 1E 00 01 00 01 00 01 xx xx xx 00 "33 22 11 00" <-IRD #
Backwards
xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx <- Text info
90 00 22
;
; Command 20 SubCmd 02
;
21 40 0C ; A0 CA 00 00 06 20 04 02 02 FF FF 03 26
12 40 05 ; A0 01 01 90 00 67 ; 1 item to return
21 00 0D ; A0 CA 00 00 07 21 05 02 03 FF FF 00 06 62
12 00 08 ; A1 04 01 01 00 00 90 00 2F ; returning the 1 item
21 40 0C ; A0 CA 00 00 06 20 04 03 02 FF FF 03 27
12 40 05 ; A0 01 00 90 00 66 ; none
21 00 0C ; A0 CA 00 00 06 20 04 04 02 FF FF 03 60
12 00 05 ; A0 01 00 90 00 26 ; none...
21 40 0C ; A0 CA 00 00 06 20 04 05 02 FF FF 03 21
12 40 05 ; A0 01 00 90 00 66
21 00 0C ; A0 CA 00 00 06 20 04 06 02 FF FF 03 62
12 00 05 ; A0 01 02 90 00 24
... Polls continue till 0x01
Finally, once they have dumped the entire EEPROM (almost) out of the
card into the IRD, they are ready to send you a control word.
; Command 03. Control Word Packet (ECM)
;
21 40 35 ; A0 CA 00 00 2F 03 2D 01 01 10 29 05
11 22 33 44 55 66 77 88
99 AA BB CC DD EE FF 00
11 22 33 44 55 66 77 88
99 AA BB CC DD EE FF 00
11 22 33 44 55 66 77 88
05 6D
12 40 07 ; 83 03 B1 01 06 90 00 F3 ; <Accepted, working..>
; <Poll Packet>
; What is your state?
;
21 00 08 ; A0 CA 00 00 02 C0 00 06 87
12 00 08 ; B0 04 08 00 00 16 90 00 20 ; OK, Ready to return CWs
; Command 13. Request of Control Words (2)
;
; 1 = Video / 1 = Sound ??
;
21 40 09 ; A0 CA 00 00 03 13 01 03 19 09
12 40 1B ; 93 17 B1 01 06
11 08 11 22 33 44 55 66 77 88 ; Control Word 1
12 08 11 22 33 44 55 66 77 88 ; Control Word 2
90 00 CE
In between all this, they send EMM's or management packets.
These packets have the following structure:
21 00 53 ; [Data of 53h] LRC
-- 4.00 Mhz difference:
Below is an example of Control word pack for older system:
; Command 03
;
21 20 18 ; A0 CA 00 00 2F 03 2D 01 01 10 29 05
11 22 33 44 55 66 77 88
99 AA BB CC [to be continued in 21 60 packet]
DA
12 90 00 ; 82
; Command 03 "more data" packet (PCB.5 Set)
;
21 60 18 ; DD EE FF 00
12 23 33 11 11 11 11 11
11 11 11 11 11 11 11 11
11 11 11 11
D8
12 80 00 ; 92
; Command 03 finale..
;
21 00 05 ; 11 22 33 44
05 8B
12 00 07 ; 83 03 B1 01 03 90 00 B6
; Poll the State
;
21 40 08 ; A0 CA 00 00 02 C0 00 06 C7 ; Are you ready?
12 40 08 ; B0 04 08 00 00 16 90 00 60 ; Ready!
; Command 13 - Return of CW's
;
21 00 09 ; A0 CA 00 00 03 13 01 03 19 49
12 00 1B ; 93 17 B1 01 03
11 08 44 44 44 44 44 44 44 44
12 08 55 55 55 55 55 55 55 55
90 00 DE
Simply way to log stream using 8051 @12mhz. Insure you follow the header
if using this procedure. sit in a loop to fetch complete packet. You may
even trigger this routine via interrupt. If so, use "Falling Edge" to
trigger the start-bit. After, automatically buffer data into an array and
use a different pointer to know when to issue our data serially into PC.
If ptr's match, sit in waiting loop.
; Fetch a byte from IO @7.11uS per bit
; Byte is returned in A
;
Recv140k: jb IO, RecvByte ;2
nop ;1
jb IO, RecvByte ;2 <Noise trap>
;
mov A, #001h ;1 When this '1' shifts into C, done!
nop
nop
;
ShiftIn: mov C, IO ;1 Fetch bit from port
rlc A ;1 Shift into Acc
nop ;1
nop ;1
nop ;1
jnc ShiftIn ;2
;
; The byte is in A
;
mov C, IO ;1 Fetch Parity bit (ignored)
cpl A ;1 Compliment byte received.
nop
nop
nop
nop
ret
This information has been taken months of research to determine. If you
believe something is incorrect, please post your comments to this site.
Have fun and, "Sorry Charlie".
--Enjoy,
(c)1998 sWiss chEEsE pRODuCtIoNs AKA Chris Tarnovsky
Canal Plus claims rival cracked,
distributed its digital TV code
March 12, 2002 02:34 PM
By MATTHEW FORDAHL
AP Technology Writer
SAN JOSE, California (AP) _ Vivendi Universal's Canal Plus Group on Tuesday
accused a rival owned by News Corp. of cracking its digital television smart
cards and distributing the information on the Internet.
In a lawsuit that alleges not only corporate espionage but also conspiracy
with criminals, Canal Plus claims NDS Group spent millions of dollars to
crack its signal protection scheme to flood the European market with
counterfeit cards.
We believe the illegal acts performed by NDS were part of a conspiracy to
enhance NDS' competitive position at the expense of Canal Plus, said
Francois Carayol, Canal Plus Technologies chief executive.
The lawsuit, which was filed in federal court here Monday, claims damages of
more than dlrs 1 billion and alleges violations of the Racketeer Influenced
and Corrupt Organizations Act, copyright laws and California unfair business
practices laws.
NDS called the claims outrageous and baseless, and said it plans to file a
counterclaim once it has had the opportunity to fully review Canal Plus'
claims.
Abe Peled, NDS' chief executive, blamed Canal Plus' problem on its old
technology.
That problem is due solely to the inferior nature of Canal Plus' conditional
access technology, the failure of its business plan to contain measures to
protect against piracy and its failure to deal with piracy once it began, he
said.
The news spooked investors, who sent NDS shares down nearly 26 percent, or
dlrs 5.94, to dlrs 17.06 in afternoon trading on the Nasdaq Stock Market.
Shares of Vivendi fell dlrs 1.18, or 3 percent, to dlrs 39.25 on the New
York Stock Exchcnge.
Smart cards _ each roughly the size of a credit card _ slip into satellite
receivers or cable television boxes and include a sophisticated chip that
descrambles programming that subscribers have paid for.
Canal Plus, which operates mainly in Europe, claimed it has not been able to
win more contracts with digital television providers because of flood of
counterfeit cards.
It also had to spend money to electronically deactivate the bogus cards and
develop a new smart card.
According to the lawsuit, filed in San Jose because that is where Canal Plus
Technologies Inc. is based, NDS used advanced optical and electrical means
at a lab in Israel to unravel the smart card technology.
The information was eventually made available to the operators of Web sites
that distribute smart card cracks, Carayol said.
Carayol declined to specify what evidence it has that NDS was directly
involved in the cracking of the cards and the subsequent distribution,
saying the information will come out in the course of the lawsuit.
These were sophisticated and well funded efforts to circumvent our security
systems by a major competitor, he said.
Canal said it took the step of filing a civil lawsuit because it was the
most efficient means of stopping the activity. He said no law enforcement
agencies are currently involved.
NDS, which is 80 percent owned by News Corp. is the leading maker of
so-called conditional access software, with about 27.3 million digital TV
subscribers receiving signals encrypted through its system. Canal Plus has
about 12.7 million users.
Canal Plus alleges NDS's Israeli lab broke digital broadcasting code
Avishai Ovadya
12.03.2002 17:01
Canal Plus, of the Vivendi Universal SA group, which provides satellite
television broadcasts and develops smart cards for digital broadcasting, is
suing NDS of the News Corp. group, alleging that NDS set up a laboratory in
Israel for break its digital broadcasting code. NDS, which develops
conditional access systems for digital television, has a large development
branch in Israel that employs nearly 500 people.
Canal Plus, NDS's smaller competitor, alleges in the suit filed in the
District Court in San Jose, California, that its broadcasting codes were
broken in 1998, and that NDS distributed them on the Internet, to enable
people to produce counterfeit smart cards and view Canal Plus's broadcasts
without payment.
Canal Plus, whose business situation is difficult, plans to develop new
smart cards this year. The company has been severely damaged by pirate
subscribers to its broadcasts, and is claiming monetary compensation from
NDS amounting to some $1 billion.
NDS, which is traded on Wall Street with a capitalization of $1.1 billion,
had not responded to the suit at the time of web-posting.
NDS is the leading company in the digital broadcast access systems market,
with some 27 million viewers. Canal Plus serves about 12.5 million
subscribers.
Published by Israel's Business Arena on 12 March, 2002
NDS calls Canal Plus lawsuit "outrageous and baseless"
Globes correspondent
12.03.2002 20:08
NDS today released a statement, describing the lawsuit filed against it by
Canal Plus as "outrageous and baseless". NDS further pointed out that it had
a "long-standing commitment to eradicating piracy from the conditional
access industry."
NDS has not yet been served with the Canal Plus complaint but said it plans
to file a counterclaim "once it has had an opportunity to fully review Canal
Plus' suit."
NDS president and CEO Dr. Abe Peled denied his company had any involvement
with the piracy problem Canal Plus has suffered since 1999. "That problem is
due solely to the inferior nature of Canal Plus' conditional access
technology, the failure of its business plan to contain measures to protect
against piracy and its failure to deal with piracy once it began," Peled
said. "The clear evidence is that the pirate community targeted Canal Plus
early in 1998 and succeeded without any help from anyone, particularly NDS."
Peled continued: "All smart cards can be hacked if left in the field long
enough, which is why NDS' business plan calls for periodic replacement of
cards. NDS also designs its system to permit electronic counter measures to
be sent over the air to disable counterfeit cards. Canal Plus' card has not
provided effective counter measures."
In its statement, NDS accused Canal Plus on several counts, alleging that
"[having recognized] the inferiority of their own conditional access
technology, Canal Plus approached NDS in December 2001 with the idea of
merging the two companies, and [was now attempting] to use these baseless
allegations to gain leverage in the negotiations."
NDS further said that Canal Plus "acknowledges that it has reversed
engineered its competitors' cards."
NDS also accused Canal Plus of "trying (without success) to hire away the
very employee they claim gave their code to DR7. In fact, their own lawyer
has been involved in this poaching process, despite the fact that the
employee is under contract with NDS. Why would Canal Plus want to hire a
person they claim was involved in such activity?," the NDS statement read,
adding that there was additional "tortious interference with other
employment and contractual relationships of NDS's".
The NDS statement also cast aspersions on the management of Canal Plus,
citing "numerous published reports [of]... significant differences of
opinion within the Vivendi companies about the management and operations of
Canal Plus."
Peled concluded: "This lawsuit is a blatant attempt by Canal Plus both to
deflect criticism of its new generation card, which is not believed to be
state of the art, and to shift blame for its inadequate technology and its
past losses."
DISH Targets NDS in Court
EchoStar is the latest company to target News Corp.'s TV technology arm NDS
in the legal arena, alleging in a federal court
filing that NDS employees hacked into access cards from Nagra, the
conditional access technology used by EchoStar.
In a filing sent to the U.S. District Court in San Francisco, EchoStar
alleged that NDS was attempting to pirate technology "intended to facilitate
the reception and decryption of EchoStar's encrypted satellite-delivered
television programming service by persons not authorized to receive such
programming." EchoStar's filing at the court seeks to intervene in a lawsuit
Canal Plus Technologies filed against NDS alleging - among other things -
copyright infringement, tortious interference with contract, and unfair
competition.
In a statement, NDS rejected the EchoStar litigation as baseless. "NDS had
nothing to do with the piracy of EchoStar's DBS system, or any other system.
We have a long-standing commitment to eradicating piracy from the entire
conditional access industry and have spent millions of dollars and thousands
of man hours towards that goal," said NDS President and CEO Abe Peled.
"The proposed EchoStar/NagraStar complaint is basically a repetition of
Canal Plus' groundless lawsuit, which was filed over six months ago," Peled
added. "If this complaint were really about remedying a wrong done to
EchoStar and NagraStar, it would have been brought sooner. EchoStar and
NagraStar are bringing this lawsuit now in an obvious attempt to distract
attention from the numerous problems of those involved with EchoStar and
NagraStar and to harm NDS."
Earlier this month, DirecTV filed a separate suit against NDS, alleging
misappropriation of trade secrets, fraud and other violations relating to
services delivered by the satellite TV company. The unrelated suit is under
seal in U.S. District Court in Los Angeles

Senti.. oltre a fare dei grandi copia/incolla, oltre a sparare una marea di
idiozie, oltre a presentarti con due identita', sai fare altro ?
Sei monotono....

 
Inoltre ti invito a leggere le Faq... questo é un gruppo IT* sta per
Italiano dove si comunica in Italiano 
Prego.
-- 
 Ciao
	M@rc
Non o scai ma unamica mi  racconta tutto perche il fidanzato a scai

 Smart card ----CUT----------
Ti sei accorto che sei l'unico idiota nel raggio di almeno 1000 messaggi in
questo ng che ha postato ben 21k  e perdipiu
in inglese ?ci sara un motivo noh ?
non ho parole .................
che babbeo !