News for hackers. Stuff that matters.
Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @09:50PM (#32745480)
And in the movie world, look at Blu-ray. HDCP (for HDMI Cable Encryption), versions 1.4 (1080p) and 2.2 (4K). BD+ (a literal VM running on the player to correct intentionally erroneous data on the disc), AACS v1 and v2 (tons of keys, player keys, device keys, permanent revocation lists, even traitor-tracing), Cinavia (audio watermarking to detect whether AACS is present), and Drive Bus Authentication (no unauthorized players can talk to the drive).

AACS was supposed to last years. HDCP, indefinitely. BD+, the creators thought it would last a decade at least. Cinavia? They thought it would never be removable. Drive Bus Encryption? Almost impossible they thought.

All of these technologies were defeated about ~2 years after their introduction. Some had minor updates breaking things for a little bit, but were broken again shortly later. And some are only partially broken (not enough to make your own player), but in practice broken enough where you can rip the disc which is all most people want.

Re:On the efficacy of online proctoring using Proctorio (202... by bawolff on Tuesday September 06, 2022 @10:42PM (#32745781)
AACS did actually work pretty effectively. Keys were discovered and then revoked. You could play old disks but not new ones.

Similarly afaict there are some sketchy closed source programs to remove cinavia,but given we are a decade in, and there is no open source implementation/public description, i would say it lasted better than i would expect.

Definitely not a total success for DRM, but better than many people predicted.

Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @11:47PM (#32746114)
Well... no. Right now there are multiple software packages available from questionable sources that break AACS offline on-demand no problem. So... yeah.

As for Cinavia, if you shift the pitch of the music, you can cause the player to stop recognizing the track. Or, as some people have experimented with, you can compare the audio to a version of the film from alternative sources (i.e. streaming) to detect and patch over potential watermark signals. Or, well, burn a streaming rip to the disc instead of the disc encode.

Re:On the efficacy of online proctoring using Proctorio (202... by bawolff on Wednesday September 07, 2022 @12:31AM (#32746333)
> Well... no. Right now there are multiple software packages available from questionable sources that break AACS offline on-demand no problem. So... yeah.

Including disks with the latest MKB?

> As for Cinavia, if you shift the pitch of the music, you can cause the player to stop recognizing the track

Sure, but that distorts sound, which people dont like.

Like its definitely not totally blocking piracy by any means, but its certainly not totally defeated the way DVDs DRM was. Its still present enough to be a little annoying, which is much better than early predictions thought would happen.

Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Wednesday September 07, 2022 @01:16AM (#32746618)
> Including disks with the latest MKB?

AFAIK, it appears so. Also AACS LA appears to have given up and stayed on v68 for a few years now. Maybe there is a new one at last... maybe. AACS 2.0 it sounds like started from v72 and counting up.

> Sure, but that distorts sound, which people dont like.

True... but if I just burn a stream rip instead to the disc, problem solved. Plus most discs do not have Cinavia.

> Its still present enough to be a little annoying, which is much better than early predictions thought would happen.

From what I can gather... you can just download MakeMKV and rip Blu-rays on any PC Blu-ray drive, no problem, no internet connection required, latest MKB, BD+ completely defeated. It's only annoying if you are trying to actually copy the disc.

Re:On the efficacy of online proctoring using Proctorio (202... by hsbauauvhabzb on Tuesday September 06, 2022 @10:04PM (#32745564)
If you look at console copy protection, the controls are slowly getting better, presumably the same will happen with content control. I guess the key difference is console protection is about preventing the masses and content protection is about preventing any single failure.
Re:On the efficacy of online proctoring using Proctorio (202... by tshaddox on Tuesday September 06, 2022 @10:20PM (#32745654)
Content protection isn’t about preventing any single failure. The actual purpose of most video and audio DRM gets missed by a lot of people. The purpose is for content owners to exert control over device manufacturers and content distribution services. It’s completely irrelevant if anyone can easily go to a torrent site and download your movie. You still get to use the legal system to force device manufacturers and distribution services to do whatever you want them to do in order to be able to play your content.
Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @10:23PM (#32745669)
Not quite. If that were true, Blu-ray would have been quite happy with AACS. It had it all: key revocation, device-specific keys, blacklists, remote updates, it was plenty, and it even worked on the defunct HD DVD.

But they heaped on BD+ VMs, Cinavia watermarking, BD-ROM Mark, basically threw everything they had at the problem and hoped that something would stick. Movie studios actually say that Blu-ray supporting more DRM methods was actually a major reason they chose Blu-ray over HD DVD (which didn't support BD+, which supposedly was DRM designed to last a decade).

And again, if that perspective were true, the movie studios wouldn't have done the whole dance again with HDCP 2.2, BD+2, and AACSv2 when 4K Ultra HD Blu-ray came out (only for all of them to get broken again not long after release despite being completely-fresh implementations). You already needed the older versions, right? So, I would argue, it's actually a mixture of both.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Tuesday September 06, 2022 @11:00PM (#32745893)
Does audio DRM really exist? CDs were sold without any DRM and you can buy DRM free songs from the likes of itunes and amazon. Itunes used to have DRM but dropped it years ago; afaik songs bought from amazon never had DRM.

It's funny, songs are much easier to share than movies, the files are a hundredth the size, yet the movie industry thinks DRM is very important while the music industry survives just fine without it.

Re:On the efficacy of online proctoring using Proctorio (202... by elcomet on Tuesday September 06, 2022 @11:36PM (#32746075)
The "selling songs" music industry is basically dead, most people stream or use YouTube nowadays. Maybe that's why they don't bother with DRM? It would make them even less attractive compared to streaming
Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Tuesday September 06, 2022 @11:57PM (#32746158)
Maybe. But iTunes started phasing out DRM in 2007 and had 80% of their songs DRM-free by 2009. I think that's a few years before streaming became big. And Amazon was selling DRM-free mp3s from the big four labels in 2008.
Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Tuesday September 06, 2022 @10:24PM (#32745682)
There is a little bit of difference here though. Console copy protection usually doesn't prevent making copies of the media, rather it prevents _using_ those copies. It's more of an authentication mechanism.

OTOH, video is just pixels and waveforms. If you can get that raw content out somehow, copy protection cannot prevent someone from enjoying that copy (which can then be re-encoded to not have protection). So making video copy protection is much harder because you actually need to prevent copies rather than just make sure the authentication is hard to break.

Re:On the efficacy of online proctoring using Proctorio (202... by sandworm101 on Tuesday September 06, 2022 @10:31PM (#32745717)
>> which can then be re-encoded to not have protection

There are actually a handful of technologies meant to survive the transcription process only to reappear in the new medium. Probably the most effective schemes are used in money, in paper bills. There are little things there (ie the eurion constellation) that are purposely designed to be scanned. They can be copied. But then they are detected by software (Adobe Photoshop) and hardware (high-end printers) which then refuse to edit or reprint them.

https://en.wikipedia.org/wiki/EURion_constellation

Other tech is meant to leave a trail leading back to forgers, a bit like a DVD ripping software embedding your MAC/IP information in any Mp3 it generates.

https://en.wikipedia.org/wiki/Machine_Identification_Code

Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Wednesday September 07, 2022 @12:32AM (#32746336)
Persistent marks as copy protection doesn't work for media mainly because they deal with the consumption rather than copying side, so just one single non-compliant legacy device spoils the entire thing.

As for fingerprinting, that's a whole 'nother can of worms. I've never seen it be used for DRM specifically but it has been successfully used many times to track down who was leaking trade secrets etc. In fact it might be more widely deployed than most people realize.

The problem with fingerprinting for DRM would be the plausible deniability of an unsuspecting user "getting hacked" and then their fingerprinted copy ending up as the illegally distributed one without their knowledge or control.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Wednesday September 07, 2022 @04:48AM (#32748176)
The movie industry uses something like 'fingerprinting for DRM', adding dots to film prints sent to movie theaters to figure out where bootleg telecining is being done: https://en.wikipedia.org/wiki/Coded_anti-piracy
Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Wednesday September 07, 2022 @02:34PM (#32754426)
Does it help though? I feel like bootleg recording hasn't really been affected much...
Re:On the efficacy of online proctoring using Proctorio (202... by cowtools on Tuesday September 06, 2022 @10:56PM (#32745868)
I suppose, as long as you use locked down software and hardware. But you will be usually be able to reverse-engineer whatever heuristic they use.

>Other tech is meant to leave a trail leading back to forgers, a bit like a DVD ripping software embedding your MAC/IP information in any Mp3 it generates.

It is simple: rip the media multiple times with different identifying information, and then analyze the diffs (or just take the average). You cannot hide the existence of steganographic data if there are multiple copies with different steganographic data. It is not like analog where a loss of precision is justifiable

Re:On the efficacy of online proctoring using Proctorio (202... by jamiek88 on Tuesday September 06, 2022 @09:58PM (#32745542)
Yep and there’s always the analog loophole in the interim.
Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @10:02PM (#32745553)
Well... they tried to patch that by locking the analog outputs on Blu-ray players to 960x540 (slightly better than DVD quality), and by removing the analog outputs entirely in 2013 on all new players after that point.

However... even the best intentions went awry after the first Blu-ray player software for PC was released with the flaw of allowing Print Screen to capture frames. Which caused people to quickly figure out they could run a script using Print Screen to capture all the frames, while having their audio-out headphone jack connected with a male-male 3.5mm cable straight into Line In. No real hacks necessary!

This was, of course, patched by blacklisting the player key and rolling out new keys in updated player software (to render new discs unplayable without an update) but it was a major oversight. ;)