
                        ***  The Videocrypt System ***

     An Overview

     Researched and written by Darren Ingram, author of Satnews

     - Satnews.. the latest and non-Commercial satellite news -


     Version 1.31 - 06.05.91


     Introduction

     Videocrypt is a pay-tv scrambling system jointly developed by  Thom-
     son Consumer Electronics and News Datacom.   Over one million  users
     receive  Videocrypt encrypted signals and this system, has to  date,
     remained  secure from illicit decoder manufacturers, protecting  the
     revenue of Videocrypted television channels.

     Requirements

     Videocrypt  is a multi-standard encryption system which is  suitable
     for  PAL, NTSC and SECAM transmissions.  Language is no barrier  for
     Videocrypt  with  its capacity for multi-lingual  transmissions  and
     broadcasts utilising a comprehensive on-screen instruction menu.

     Features and applications

     A  smart card is the central key to the Videocrypt system,  and  the
     card  can be used for a variety of diverse applications.   The  card
     is  pre-coded  to determine a users requirements and it  can  subse-
     quently be addressed utilising the decoders logic to amend the users
     services at the broadcasters will.

     There are a number of broadcasting modes which the smart card can be
     used within including:

     Clear Mode
     Signals sent in the clear are recognised by the decoder and
     passed to the display without further processing.

     Free Access
     Pictures transmitted with an encryption key are delivered
     directly to the display through the decoder.

     Controlled Access
     Access to encrypted pictures is determined by the level
     of access authorised to the users smart card.  No signals
     will be transmitted in an unencrypted state without prior
     authorisation.

     Programmes can be tailored to usage with the Videocrypt system and
     the system offers a flexible way for pay-tv operators.  There are  a
     number of operations mode offered as standard including:

     * Single or multiple subscriptions with many tier levels in one
     channel

     * Pay Per View (PPV) and impulse purchasing

     * Thematic selection (enable all arts programming)

     * Geographic limitation (restrict to a country/area)

     * Single-event (throwaway cards)

     * Parental Control (reception with card only)

     * Pre-determined time period

     Videocrypt  enables  smart cards to be pre-programmed  to  suit  the
     specific programming requirements.

     Smart card - providing the revenue security

     Security  can be addressed on a multitude of levels when  using  the
     smart card.  These include:

     Chaining

     An existing customer would receive a new card which contains part of
     the  new code, the remainder of the code would be  transmitted  when
     the  card is inserted into the decoder and the  subscriber  compiles
     with the instructions contained within the on-screen graphics.

     Over-the-air addressing

     Systems operators can now address individual subscribers, which is a
     vast  improvement over other scrambling systems.  The  operator  can
     provide  additional  services,  reduce  service  entitlements,  send
     individual messages, blacklist and/or whitelist viewers.

     Cloning

     A  number of steps have been taken to stop smart cards being  copied
     or cloned.   A physical deterrent is the first line of defence,  and
     the  integrated  circuit contained within the card  makes  "probing"
     very difficult as the IC is likely to become damaged in the process.

     Cost  is a second factor which is likely to deter  manufacturers  of
     illegal  decoders.    A  considerable amount of  time,  trouble  and
     expensive resources would be required to clone the card.

     The  manufacturers  of Videocrypt recommend that the cards  are  re-
     placed  every six months, and each time this is done a  "secret  en-
     crypting  algorithm" will be changed.  Any pirate decoders  manufac-
     tured during this time would be relatively useless.

     And  should  a  pirate decoder be manufactured, it  will  contain  a
     unique  security  code, which could be blacklisted  by  the  systems
     operator  once  the code has been discovered - leading to  calls  of
     complaint by angry customers.

     Video taping

     Videocrypt  offers  an simple method of tracking  down  pirates  who
     video high-value programming and then distribute it.

     The customers unique number can be displayed on the unencoded screen
     for  reference  and future litigation.   Although  an  on-the-screen
     code  can  be generated for signals piracy in a  public  place,  the
     codes  can be hidden in the picture - and retrieved by a  technician
     at a later stage.

     Videocrypt-your flexible friend?

     Videocrypt  can  be used in a number of applications other  than  tv
     signals protection.  They include:

     Messaging, messages can be transmitted to individual subscribers  or
     to a group, so target messaging is now a potential.  Messages  like:
     "Satellite  owners in LONDON call 081 XXX XXXX now for a great  bar-
     gain".

     Selling, sales over the air can be utilised with the unique identity
     number which verifies an owner and their registered address.    Data
     can be matrixed with a user personality during ad-breaks to  tailor-
     make the advertisement.

     A unique transaction alphanumeric can be displayed on the TV screen,
     and  the  subscriber  will telephone a given number  and  quote  the
     alphanumeric - and the deal can then be completed in total security.

     Scrambling

     The  majority  of  scrambling systems currently on  the  market  are
     dependent on analogue processing circuitry, and it is a hard task to
     get a secure system without picture deterioration.

     Videocrypt can encode and decode a picture without degradation.

     The crux of the scrambling system evolves around a patented develop-
     ment of Active Line Rotation (Cut and Rotate principle).

     Every  line  of the signal is cut at a number or  points  along  its
     length,  and  this  is chosen at random by a 60  bit  psuedo  random
     binary  sequence generator (PRBS).   As each cut point differs  from
     the next the signal has no viewing value to an unauthorised  recipi-
     ent,  but authorised recipients decoders recode the picture so  that
     the  true  state  of the unscrambled line is always  first  out  for
     display.

     The  PRBS is re-seeded at times too, to enhance the security of  the
     system even more.

     Before  this  ALR process can take place, the decoder  needs  to  be
     aware  of  the cut point on each of the transmitted lines,  this  is
     provided  within the encryption process.  Each decoder  utilises  an
     PRBS  which reflects the characteristics of the system so  that  the
     two halfs can be synchronised and a viewable picture displayed.

     Data is transmitted in a series of over-the-air packets, which looks
     like:

     SYSTEM-----SMART or BLACKLIST

     The system comprises of system data included Flat-Shamir identifica-
     tion  information,  on-screen display messages,  fingerprinting  and
     blacklisting data.

     The smart card packet comprises of:

     HEADER-----ENCRYPTED DATA-----CHECKSUM

     The  Videocrypt encryption system is based around a  tightly-guarded
     secret  which has defeated system hackers throughout the world.    A
     final control algorithm is central to the systems security and  this
     can be changed at will if the system has been hacked.

     Complex calculations are performed within the system in order not to
     compromise its security.

     But  hackers who have attempted to hack the decoder will  be  disap-
     pointed - as there are no secrets held within the system.

     Smart Cards
     The smart card offers great flexibility to the programme  controller
     and the viewer alike, and is the key to the Videocrypt system.

     The  Integrated circuits incorporated within the smart card  have  a
     lot  of power and contain EPROM elements which are partially  burned
     during their manufacture.   The ICs are buried within the design  to
     make the system harder to penetrate.

     Smart card block diagram


     -------     -------     -------
     VCC  ->       - RAM -     - ROM -     -EPROM-
     -------     -------     -------
     ^           ^           ^
     TO AND FROM
     -------------------------------
 GND ->        -    INTERNAL BUS             -
     -------------------------------
     TO AND FROM
     -------     -------     -------
     -8 BIT-     -ANTI -     -S/WRE-
 RST ->        -CPU  -     -FRAUD-     -CNTRL-
     -     -     -DVCES-     -I/FCE-
     -------     -------     -------


     CLK        VPP           I/O

     Over the air addressing

     Algorithmic  information is transmitted to the viewer over the  air,
     encrypted within the Videocrypt system.

     This data is transmitted within the Vertical Blanking Interval (VBI)
     and  four  lines are employed for active data and  two  others,  one
     white and one black (for test purposes).

     An  application of Non Return To Zero (NRZ) with an constant  energy
     spectrum maximises the systems characteristics.

     Four picture-sustaining techniques are used to ensure a high quality
     picture.  Bit interleaving, hamming codes, quadruple repetition  and
     check sums are used within the process.

     The  system  can  cope with fringe reception areas  and  will  still
     function correctly with high levels of noise.

     Picture quality

     Picture  quality is paramount for any scrambling system and  due  to
     the  standard being of a digital origin, integrity of the signal  is
     maintained  throughout  the encryption  and  de-encryption  process.
     Amplitude sampling is conducted by the decoder and a 14MHz  internal
     clock  ensures jitter-free pictures and unstable framing.   A  digi-
     tally  derived Automatic Gain Control (AGC) is also included  within
     the receiver.

     Scrambling Sound

     Videocrypt  also has the capability of encrypting sound  sources  to
     enhance  the  security  of premium events.  To date  this  level  of
     security has not been utilised by broadcasters.

     The system of spectrum inversion renders the sounds received without
     authorisation  worthless.   Videocrypt  transposes  the  frequencies
     transmitted and this in turn removed distortion of the sound.

     Technical Data
     (supplied by Thomson Consumer Electronics, 1991- subject to change)

     VIDEOCRYPT BASEBAND DECODER
     * Stand alone video decoder
     * On screen display
     * De emphasis switch
     * Authorise button
     * Integrated smart card reader
     * Power indicator

     PAL MODEL
     Video input level             IV +/- 3dB flat and clamped
     Baseband input level          250 mV +/- 3dB, unclamped level
     measured at pre-emphasised transition
     frequency
     Suitable de-emphasis          CCIR 405-1
     Video output level            IV p.p. into 75 ohms
     Video bandwith                50Hz - 4.8 Mhz -3dB typical
     Line tilt                     <_ 1% typical
     Luma/Chroma Delay             +/- 50nS typical
     S/N ratio:                    50dB typical weighted

     CONNECTIONS
     AV Peritel (Scart)
     Audio loopthrough             Left and right
     Pin 8                         High with scrambled video input
     Low with clear video input
     Pin 16                        5v 50mA maximum for external
     modulator (OPTION)

     MISCELLANEOUS
     Standards                     Designed to IEC 65
     Operating Temperature Range   5-40 C
     Mains Input                   216-255 V AC 50 Hz
     Power Consumption             15W
     Weight                        2.5Kg

     VIDEOCRYPT ENCODER (PAL/SECAM/NTSC)
     * 19" rack mounting
     * Active line cut and rotate
     * Twin or single scrambler
     * Separate power supply
     * Integrated cooling unit
     * Data for control access in the VBI
     * RS232 interface

     Video input level             IV 75 ohm
     Video output level            IV peak to peak +/- 2% 75 ohm
     Line tilt                     0.5% typical
     Base line distortion          0.5% typical
     Chrominance to luminance      3% typical
     2T/Bar ratio                  2% typical
     Synchro level                 1% typical
     S/n ratio RMS weighted        >_ 67dB
     Chrominance luminance:
     intermodulation              <_ 2%
     differential gain            1% typical
     differential phase           1" typical
     luminance non-linearity      1% typical
     chrominance/luminance delay  +/- 10nS typical
     video bandwith at 3dB        >_ 5.8 Mhz
     Output DC level               300 mV +/- 50 mV
     Sampling frequency rejection  >- 50dB at 14 Mhz
     Number of bits per sample     10

     CONNECTIONS
     Connections to security comp  RS232
     Local VT100 terminal          ditto
     Video in                      BNC 75 ohm
     Scrambled video out           BNC 75 ohm

     MISC
     Local terminal functions are to
     show working parameters
     give warnings
     control local
     remote
     autonomous
     Select scrambling mode
     clear
     free access
     control access

     Mains input low pass filtering
     Audio scrambling using spectrum
     inversion 0dB/600 ohm (optional)

     ENDS


                **** Sky card hacking info 26/06/1993 ***


 

     When  the  VideoCrypt  system was  launched,  the  press  releases 
     claimed that it was the most pirateproof system yet devised.  Some 
     of the people involved in the design of the system claimed that it 
     would  take  billions  of years to break the  codes  used  by  the 
     system.  The usual media journalists swallowed this hook line  and 
     sinker. The hackers knew otherwise. 

     The  VideoCrypt  system  is the mainstay of  the  BSkyB  satellite 
     television empire. It is the means by which BSkyB makes its  money 
     from  the  subscribers.  The  basic theory  is  that  they  pay  a 
     subscription  for  the premium channels and they receive  a  smart 
     card.  This smart card, when inserted into the VideoCrypt  decoder 
     will allow the decoder to descramble the channels paid for. It  is 
     also possible for BSkyB to turn off the cards of those subscribers 
     who have not paid.

     Hacking  scrambling systems such as VideoCrypt is a  multi-million 
     pound industry. Due to the present legal situation it is perfectly 
     legal  to hack a channel that originates outside the  UK.  However 
     for someone in the UK to hack a UK originated channel is  illegal. 
     Such mere facts as illegality have never bothered pirates.

     In the last few weeks the impossible has happened. The  VideoCrypt 
     system  has  been  conclusively  hacked. It  is  now  possible  to 
     purchase  a pirate smart card or chip which will allow the  viewer 
     to  descramble Sky Movies Plus, The Movie Channel, Sky  Gold,  Sky 
     Sports and TV Asia. The cost of this pirate card is œ99. The price 
     in itself is lower than the subscription for the channels.

     Other channels using the VideoCrypt system. Are worried. According 
     to  the  latest  reports, The Adult Channel  and  JSTV  have  been 
     compromised as well. This means that all of the channels currently 
     using  the VideoCrypt system as a fee gathering system  have  just 
     lost control of the market. It is now, well for the moment anyway. 
     a pirate's market.

     This  hack is, like all hacks, colourfully named. It is  known  as 
     the "Ho Lee Fook" hack. The joke being that this is generally  the 
     exclamation uttered by people when told of the hack. There are two 
     forms of the hack; a card and a chip. 

     The  card version of the hack is about sixteen millimetres  longer 
     than  the  official BSkyB card. Essentially it is  a  single  chip 
     mounted  on a printed circuit board that plugs directly  into  the 
     VideoCrypt  decoder's card socket. This is the more  user-friendly 
     version as it does not require any modification to the decoder.

     The  chip version does require some modification to  the  decoder. 
     The  official VideoCrypt name for the chip in the decoder is  "The 
     Verifier".  This  chip  has to be removed and  replaced  with  the 
     pirate  chip. The decoder will then decode the scrambled  channels 
     without the need for the BSkyB smart card.

     The  pirate cards and the chips are on sale. It is  believed  that 
     a number of them are already in the UK. Indeed I received one,  in 
     a brown paper envelope, on June the eighth. It is still working.

     The problem for BSkyB and other users of the VideoCrypt system  is 
     not  one of containment. Things have progressed too far for  that. 
     The problem is more serious. Unless they can come up with a  quick 
     fix for the system that will render the Ho Lee Fook hack inactive, 
     they have to replace the smart cards.

     BSkyB  initially set out to replace their smart cards every  three 
     months.  This continual update was, so the theory went,  meant  to 
     deter hackers from trying to hack the system. Fiscal reality has a 
     crushing  effect of such business school theories. 

     VideoCrypt   suffered  its  first  real  disaster   when   someone 
     discovered  that by limiting the programming voltage to the  card, 
     it was possible to stop the card being switched off. This hack was 
     known  as the "Infinite Lives" hack. It was an old  computer  term 
     for  a  modification  to  a games program  that  gave  the  player 
     unlimited  lives.  Since  BSkyB could not turn off  the  cards  it 
     seemed an apt name. This hack was followed by a new issue or batch 
     of cards. The "Infinite Lives" hack did not work on the new  cards 
     but a new hack did.

     The KENtucky Fried Chip upped the ante. It was the first time that 
     the  actual  internal  operation of  the  VideoCrypt  decoder  was 
     interfered  with.  It  was a rewritten "Verifier"  chip  that  was 
     programmed to stop the cards being turned off. It did not work  at 
     full efficiency so it was not marketed by the pirates. After  this 
     hack,  BSkyB issued a new batch of cards which was more  resilient 
     to this hack.

     The  current  card  issue is issue 07. The Ho  Lee  Fook  hack  is 
     working  on  this batch. If BSkyB introduce issue 08  cards,  then 
     there  is  the possibility of the hack ceasing to  work.  At  this 
     stage  there is the terrible spectre of the hack being updated  to 
     work  with  the  08  cards.  It is  the  thing  of  which  BSkyB's 
     nightmares are made of.

     The issue of new card batches occurs mainly in Spring or Autumn. A 
     Summer launch of the new 08 cards would be unusual. As  VideoCrypt 
     will  be  going to a tiered channel structure in  the  Autumn,  it 
     would  seem  that they have planned an Autumn update. The  Ho  Lee 
     Fook  hack  may force them to bring their plans  forward  by  some 
     three months or so.

     The  confidence  in  a system is not based on how  well  a  system 
     repels hacks but rather on how well a system recovers from  hacks. 
     This  will be a true test of the VideoCrypt system and  its  smart 
     card  based philosophy. The philosophy is that of  the  detachable 
     secure controller. Basically what this means is that if the system 
     is  hacked then all that needs to be done to stop the hack  is  to 
     issue a new card.

     The effects on the confidence of present and prospective users  of 
     VideoCrypt is more difficult to gauge. The smart card is the  core 
     of  the  VideoCrypt system. Seeing it replaced by a  pirate  smart 
     card contradicts every claim made in favour of VideoCrypt. It  was 
     not  supposed to be possible. One thing is certain, channels  will 
     now have to look at a scrambling system as only being a  temporary 
     form  of protection that has to be frequently updated. Failure  to 
     do so will be fatal.

     John McCormac
     Author of "European Scrambling Systems 3" ISBN 1-873556-02-0
     Editor of Hack Watch News.---
 
                                *** Latest ***


     There is no such thing as coincidence - or is there? On the day that
     the film "Sneakers" was released on video, I received an actual working
     hack for the scrambled Sky channels. The film "Sneakers" is about
     events surrounding a piece of equipment that can hack any cryptosystem.
     The piece of equipment that I received is essentially a chip that can
     hack the Sky VideoCrypt channels. 
     This latest hack on the VideoCrypt system has been labelled the "Ho
     Lee Fook" hack. The reason for this name is more to do with people's
     reaction to the hack rather than its origin, which incidentally is
     Central Europe. 
     This is perhaps the most dangerous hack to have occurred on VideoCrypt
     - it replaces the smart card. In effect it is a new smart card that
     gives access to all the Sky channels. Of course the problem for Sky is
     that it is not a genuine Sky card.

     The card is approximately sixteen millimetres longer than the official
     Sky card. It is a blue printed circuit with a single surface mount
     chip, and five connector pads. The identification numbers on the chip
     have been scrubbed. 
     The standard check for a card of this nature is to look for a wafer
     from an official smart card. In the early days, a fairly common scam
     was to take the chip and connector pad from a valid Sky card, trim away
     the plastic and then put the chip in a DIL header. The DIL header would
     then be blobbed in a lump of black resin so that it looked like an IC.
     The decoder would then have its card reader replaced with an ordinary
     DIL IC socket. Then the decoder and chip would be shown or sold to some
     unsuspecting, if greedy, punter. 
     The chip appeared to be real, with no wafer underneath the body of the
     chip. The actual stubs of the chip die were just visible at the end of
     the chip. It was a genuine chip.

     It has been working steadily for the last few days and there appears
     to have been no kill messages sent to it. If it had been a direct
     clone, Sky would have been able to kill it over the air - or would
     they? 
     Since the people who developed this hack obviously understand the
     operation of the over the air addressing, they may well have designed a
     filter to stop the kill message from having any effect of the pirate
     card. There are of course more devastating implications here. The card
     itself may only contain the data and algorithms necessary to descramble
     the signals. 
     The chip version of this hack is based on the 8752. This Ho Lee Fook
     chip will replace the official 8052 in the decoder. A selling price of
     ninety nine pounds has been mentioned in Germany.

     Nobody is sure what the people in News Datacom are doing about this
     hack. Sky are more than likely very upset that someone has hacked their
     pirateproof system yet again. This is the fifth hack and the image of a
     pirateproof system now only exists in the minds of PR people.



                *** -=Y_HS=- all (c)'s acknowledged ***

