Crypto talk at 28C3: Implementation of MITM Attack on HDCP-Secured Links, Day 3, 18:30, Saal 1

On Day 3 of 28C3, an absolute crypto highlight will be presented. A Person-In-The-Middle (previously known as Man-In-The-Middle)attack against HDCP-secured links. For those who don’t know, HDCP is a protocol for digital video links like DVI, Display Port and HDMI, that encrypts the content between your PC or Blue-Ray player and your digital TV or display. HDCP was invented so that the encrypted high quality video, as you can find it on a Blue-Ray disc or HD-DVD will never be unencrypted in it’s digital form on the way to the display. If those systems would be secure, this could prevent pirated high quality rips of these videos on the internet.

However, such systems have been broken, for example Blue-Ray discs can be ripped with a standard PC using the right Blue-Ray drive and a commercial software. Even HDCP has been broken in practice so far. I don’t know how it append exactly, but the HDCP master key has been posted on a public website on the internet, which I won’t link here. Using this key, you would be theoretically able to decrypt a HDCP secured link, and record the raw digital signal transmitted there. The practical problems are, that DVI, HDMI and DisplayPort are very high speed links, and no general sniffers and universal transmitters are available for a low price. In contrast to that, WiFi can usually be sniffed using the build-in WLAN adapter in a consumers laptop.

In this talk, a custom build hardware will be presented, that can be used to act as a Person-In-The-Middle on DHCP secured links, and can alter the signal transmitted there. The actual brilliant idea here is, that this type of attack does not allow you do record the transmission in clear, so that this is a non-copyright circumventing attack, and cannot be prosecuted using copyright enforcement laws. However, due to the open nature of the hardware platform, one may modify this attack to archive other goals.

A short summary from the abstract:

A system has been described that enables a man-in-the-middle attack upon HDCP secured links. The attack enables the overlay of video upon existing streams; an example of an application of the attack is the overlay of a personalized twitter feed over video programs. The attack relies upon the HDCP master key and a snooping mechanism implemented using an FPGA. The implementation of the attack never decrypts previously encrypted video, and it is incapable of operating without an existing, valid HDCP link. It is thus an embodiment of a bona-fide, non-infringing and commercially useful application of the HDCP master key. This embodiment impairs the equating of the HDCP master key with copyright circumvention purposes.

The slides are already available at: http://events.ccc.de/congress/2011/Fahrplan/attachments/2011_HDCP_MITM_28c3_bunnie.pdf

See the talk: Day 3, 18:30, Saal 1

Author: Erik Tews