"Cinavia"/Verance BluRay audio watermark protection

[setarip_old]

@xenex

What are you referring to when you speak of the "SONY mistake"?

[SamuriHL]

@xenex

What are you referring to when you speak of the "SONY mistake"?

Not keeping their private key for the PS3 secure.

[derbeDeus]

Not keeping their private key for the PS3 secure.

Hum, not realy. They kept it secure, it never left Sony HQ, it was not a leak :)
"SONY mistake" refers to the use of ECDSA algo to sign executables which has a requirement to provide a random number... and Sony used same "random" therefore creating signatures with same first half. Somebody noticed and calculated the, otherwise very well kept, private key :p

For some reason also the public key to verify the AACS certs is not very public. I think I've seen it somewhere...78....

[SamuriHL]

Hum, not realy. They kept it secure, it never left Sony HQ, it was not a leak :)
"SONY mistake" refers to the use of ECDSA algo to sign executables which has a requirement to provide a random number... and Sony used same "random" therefore creating signatures with same first half. Somebody noticed and calculated the, otherwise very well kept, private key :p

For some reason also the public key to verify the AACS certs is not very public. I think I've seen it somewhere...78....

LOL! :) Ok, well, my interpretation of that is that they didn't secure the private key very well. :D When I work on code, when I need a random number, I tend to, you know, make it at least "pseudo" random. SONY mistake indeed!!!

[derbeDeus]

SONY un-f***ing-believable mistake! You come to think that they did it on purpose
1,2,3,4... would have been better than same "random". Millions of programmers would not have made that mistake.
Once again Sony confirms that they are absolutely terrible at software and quite brilliant at hardware.

[SamuriHL]

I couldn't agree with that last statement more if I wanted to. Good thing they let someone else write Cinavia for them. :D

[setarip_old]

@derbeDeus

Hi!

Thanks for your answer to my question;>}

I gather this is a reference to the "stuff" I posted about in Post#448 of this thread:A randomized variable was made a constant instead, the hack means that any code can now be signed to made to look like officially sanctioned code, and there's not a thing Sony can do about it.

In other words, the PS3 can no longer tell legal, authorized software apart from pirated ones that have been signed using the leaked key.

[spock2000]

Just to let everyone know. I just ripped and compressed the Blu ray movie Salt with Dvdfab beta 8.0.7.2. I burned it to a 25gb Sony BD-RE. The movie played flawlessly from beginning to end on my Sony PS3 with the newest 3.55 firmware.:)

[setarip_old]

@spock2000

HI!

Did you also confirm that if you hadn't used DVDFab, "Cinavia" would show up?

[spock2000]

That is correct. I must use Dvdfab because it creates a protected blu-ray disk. It creates a AACSmv folder along with the usual BDMV and Certificate folder. I get the feeling that Cinavia will be a thing of the past here pretty soon,thanks to everyones efforts:sly:

[mike20021969]

I get the feeling that Cinavia will be a thing of the pastIt will be interesting to see, out of the 2 competitors, who permanently beats this first.

I know who I'd like to see win, but I get a feeling they may get sliver.

[xenex]

@derbeDeus

Hi!

Thanks for your answer to my question;>}

I gather this is a reference to the "stuff" I posted about in Post#448 of this thread:


What derbeDeus described in re: to my mention of the "SONY Mistake" is exactly what I meant. I should have explained it better. And yes, setarip_old, what you refer to in your post #448 is the exact same issue.

There is an IF here. It's a big if! But if the private AACSLA key is 'leaked' or if someone manages to re-construct it, then at least for Cinavia DVDs it would be possible to re-create the hash table and re-create a signed AACS Certificate.

For Cinavia-infected DVDs (at least) this would be a valid solution. And if I were a fortune-teller, I'd guess that SlySoft and DVDFab are already looking at this approach.

I'm not a fortune-teller, though. So take what I say with a peanut and a grain of salt.

[rotty]

Hi all

Just out of interest, what happens if the player can tell if the inserted disk is a -R or a ROM.

I dont know if current hardware can or cant but future.

It could be that future players will only allow play of watermarked disks if the disk is a ROM.

I think what Peer said is the only way, remove the "stink" as he says from the audio.

[setarip_old]

@mike20021969 It will be interesting to see, out of the 2 competitors, who permanently beats this first.
Not everyone operates in the glare of daylight ;>}

[derbeDeus]

Hi all

Just out of interest, what happens if the player can tell if the inserted disk is a -R or a ROM.

I dont know if current hardware can or cant but future.

It could be that future players will only allow play of watermarked disks if the disk is a ROM.


They can tell the difference, or course. Iirc, PS3 tells you that in the XMB interface.
Otoh, recordables are among Trusted Source, in the AACS specs, see here (http://forum.doom9.org/showpost.php?p=1472915&postcount=636).

[rotty]

They can tell the difference, or course. Iirc, PS3 tells you that in the XMB interface.
Otoh, recordables are among Trusted Source, in the AACS specs, see here (http://forum.doom9.org/showpost.php?p=1472915&postcount=636).

Hi derbeDeus

Thanks for info.

[xenex]

So, it appears according to here:

http://forum.dvdfab.com/showthread.php?t=7102

There will be another Cinavia-infected DVD coming soon. "Burlesque" Starring Cher and Aguilera, LOL! This can be verified with the back-cover scan here:

http://www.dvdempire.com/Exec/v4_item.asp?item_id=1563964&tab=5&back=1&anchor=1#topoftabs

Props to Sony for testing their new protections on movies that no one would EVER want to watch. If I can find a Redbox free-rental code when this comes out, I'll take a look at the AACS folder. I won't pay $1 for the rental, though. And I certainly won't waste my time watching it!

[setarip_old]

VLC has a few colorful built-in tools: oscilloscope, VU meter, spectrometer - that appear in a separate window while the video is playing. Is this of any use to "those in the know", regarding Cinavia tracking and analysis?

[lchiu7]

I was watching a "backed up" copy of Salt the other day and since this titile apparently has Cinavia protection we did an experiment.

We extracted the h.264 video and DTS audio from the backup and using tsmuxer created a one hour AVCHD version of the movie.

We then burnt this to a DVD as UDF 2.5 and put it in a PS3 with the latest firmware. The PS3 recognised the disc as AVCHD but played it with no video, just audio.

Then we put the same disc into an Oppo BDP80 BluRay player and on that player the title played fine with both audio and video.

So having never seen Cinavia protection before I thought you saw an error message so the fact there was no video might because of the way the disc was authored. I guess some more experimenting is required.

[dvgeek]

@Ichiu7

Here is something I had posted in another thread
http://forum.doom9.org/showthread.php?p=1473466#post1473466

To add to what I had done - I remuxed the original movie track with the DTSHDMA audio track and put it on a BD-RE.

On the PS3 - Cinavia protection kicked in
On the BDP-S360 - Played flawlessly
On the NeoTV550 - Played flawlessly

@spock2000

I checked my Salt rip (via AnyDVDHD) and it does not have the AACSmv folder that you mentioned that is created by DVDFab. Have to check out DVDFab out to see if the rips can be reencoded to BD9's.

Thanks to all.

[lchiu7]

Since I had no video from the beginning and audio on the PS3 I might have done something wrong when I created the AVCHD disc (I was using a DVD/RW) so might try again with a DVD-R.

I am idly curious what the error message looks like.

[fengtao]

Hi dvgeek,

BD-9/5 is DVD media, not Blu-ray media, so it cannot be burnt as BDMV-REC, since it doesn't support AACS auth.

We are checking it we can burn it as AVCREC now.

Best Regards,
Fengtao

[setarip_old]

@fengtao

Hi! BD-9/5 is DVD media, not Blu-ray media, so it cannot be burnt as BDMV-REC, since it doesn't support AACS auth.

1) What is "auth" an abbreviation for, "authoring", "authorization", "authentication", or something else?

2) When you say BD/DVD5s and 9s "don't support AACS auth.", are you saying that it's not physically possible, or that it's not legally/ethically possible?

I sense that the following may be somehow applicable to your thinking and greatly appreciated efforts thus far:

http://www.aacsla.com/specifications/AACS_Spec_Signed_CSS_Final_0.951.pdf

This document, the Signed CSS book, defines how to use AACS to validate the integrity of audiovisual content protected by CSS Technology provided by DVD CCA.

[fengtao]

I mean "authorization", maybe I'm not clear here, AACS authorization is the ability of a drive, so for BD-9/5, I should say: it doesn't support binding nonce, so cannot be burnt as BDMV-REC.

[fengtao]

Hi setarip_old,

Thank you very much for the document.

Best Regards,
Fengtao

[setarip_old]

Thank you very much for the document.You're quite welcome ; >}

[setarip_old]

@fengtao

In light of the Cinavia "situation", perhaps it would be a good idea to re-activate and enhance (Convert Blu-ray to HD-DVD) HD-DVD support in the DVDFab product line?

[SamuriHL]

Could you explain how that would possibly help Cinavia? :confused: HD DVD structures aren't supported on any Blu-ray player I'm aware of except one software player that as of yet doesn't do Cinavia detection anyway. So how would converting to HD DVD help those that have Cinavia infected players?

[setarip_old]

Could you explain how that would possibly help Cinavia?I'm fairly certain that "fengtao" and others with similar qualifications can determine if it might be worthwhile to pursue "the other" High Definition format that, like Blu-ray, uses a blue laser - and couples that with a basic file format much like that of a standard DVD.

(At this juncture, I'll choose to take the route previously suggested by "neuron2")

[SamuriHL]

Well, HD DVD uses evo files. I'm not sure how that's similar to that of a standard DVD. Again, though, I'm not sure how this helps those with a cinavia infected blu-ray player. If I'm reading between the lines of what you're suggesting, and I could be mistaken here, I believe you're thinking that since HD DVD employed AACS, and AACS is required to diffuse Cinavia detection, that somehow that format in some way would help fengtao and others to come up with a way to use AACS on DVD5/9 backups? Is that what you were getting at? If not, I apologize as I'm quite confused by the mention of HD DVD and Cinavia.

[ChiDragon]

Since I had no video from the beginning and audio on the PS3 I might have done something wrong when I created the AVCHD disc (I was using a DVD/RW) so might try again with a DVD-R.

I am idly curious what the error message looks like.

The PS3 Cinavia message really isn't ambiguous. :)

http://img51.imageshack.us/img51/8986/cinaviamute.png

[xenex]

Not only are the Cinavia messages quite unambiguous, they are explicitly REQUIRED by the AACS agreements. If people would actually read the specifications before idly speculating, there would be so much less confusion. So again I say, go to this page:

http://www.aacsla.com/license/

And download the PDF named AACS Final Content Participant Agreement. Go to page 92 and read section 2.52. I'll quote it here, and I have changed a few parts to bold text so that they may stand out.

2.52 “Trusted Source Mark Enforcement Action” means with respect to each such action required to be taken pursuant to the requirements of Part 4 Sections A.3 and A.4:

a. if a Licensed Access Product is Accessing particular Audiovisual Content for the purpose of playback:

(1) muting of any and all output of the audio portion of the screened Audiovisual Content where:

A. the muting of the audio output continues for no less than 15 seconds (the “Enforcement Period”);

B. the Licensed Access Product’s audio mute indicator associated with the screened Audiovisual Content, if present, is illuminated or otherwise set to indicate that the audio output is muted for the duration of the Trusted Source Mark Enforcement Action; and

C. the Licensed Access Product’s “un-mute” function associated with the screened Audiovisual Content is made inoperable for the duration of the Trusted Source Mark Enforcement Action; and

(2) display or direct to be displayed a written message concerning the reason for the muting of the audio, where the message so displayed or directed by the Licensed Access Product shall:

A. state either:

i. “Audio outputs temporarily muted. Do not adjust the playback volume. The content being played is protected by Cinavia and is not authorized for playback on this device. For more information, see http://www.cinavia.com. Message Code 3” or a message with substantially the same meaning (including, but not limited to, translation into a language other than English), provided that the Cinavia website URL (or an alternative Cinavia website URL that is established by Verance Corporation as applicable to a particular country or region) and message code number are either (x) included without change in the message, or (y) provided in written operating instructions provided with the Licensed Access Product; or

ii. “Cinavia playback restriction (3)”, or a message with substantially the same meaning (including, but not limited to, translation into a language other than English), provided that a message as specified in Part 1 Section 2.52.a.(2)A.i. is provided in the written operating instructions provided with the Licensed Access Product. For the avoidance of doubt, the message code number is not required to be included in a message with substantially the same meaning, provided that it is included in the written operating instructions provided with the Licensed Access Product.; and

B. be prominent, clear and legible on an active display available to the consumer, which AACS recommends to be the same screen as the video portion of the Audiovisual Content.; and

C. not direct consumers to any party or address other than the Adopter itself, the Cinavia website URL as stated above, or a mail address provided expressly for this purpose by Verance Corporation, without the explicit written permission of that third party, nor state or indicate to the consumer that AACS, Verance Corporation, Content Participants or Content Providers (in general or by specific name) are responsible for the enforcement action taken by the Licensed Access Product.

[Ghitulescu]

If people would actually read the specifications before idly speculating, there would be so much less confusion.

That's the point I've raised long time ago.

On one hand, speculating is a bad thing, as it would unnecessarily waste resources on false tracks. But on the other hand, it is helpful to hide the real progress behind a smoke barrier.

[ChiDragon]

That part about not stating that AACS, Verance, and the film publisher are the reason you're staring at this message is interesting...

[xenex]

@ChiDragon

That last "C" part is interesting, isn't it. It kind of says "don't blame us, AACS, Verance, or the studios! Aim your anger at Cinavia!!!" Which, as Ghitulescu says, is a smokescreen! Go to:

http://www.cinavia.com

And TRY TO FIND any contact information, physical address, email address, etc, or any way to contact them. You won't find it, because it is not there. Try to use 'WHOIS' to see who owns the 'cinavia.com' web domain. You will not get far there either. It's a "shell" website badly made with a few pieces of 'clip-art' to make people think that there is a "Cinavia Company." There is not.

The "Cinavia" name and the 'cinavia.com' website are just a shell set up BY the AACS and the studios for people to direct their anger to. There is NO real "Cinavia" company - they don't exist! They have no contact information! AACS just named their watermark Cinavia and threw up a quick and dirty website for people to be fooled by. So, consumer, sucker, you are out of luck. If you have a complaint, email "Cinavia" (at their nonexistent email) or contact them (at their nonexistent contact page.)

And don't bother to contact AACS, Verance, or the studios. It's all Cinavia's fault. They did it!!!!

Clever them.

[Ghitulescu]

Cinavia is a Trademark and as such it should be in a Registry; I'm not familiar with US regulations so I don't know exactly its name.
http://tess2.uspto.gov/bin/showfield?f=doc&state=4008:akav6f.2.3

[xenex]

@Ghitulescu

Sometimes, I don't know if you agree with me, or disagree. What I am saying is that - even IF "Cinavia" is a trademark, or whatever, the studios and the AACSLA are using the "Cinavia" name - and website:

http://www.cinavia.com/

To direct anger to "Cinavia" itself, which is a thing that does not really exist. The AACS watermark exists, of course, but the Cinavia website just gives the watermark a "name" and has NO CONTACT INFORMATION.

I call it "passing the buck." It directs the angry customer to the dead-end website "cinavia.com" which has no contact information. The customer is only left to be mad at "Cinavia" which is not even a real thing! It is a brand name MADE by the AACSLA and studios to make the customer hit a dead-end!!

OF COURSE the AACSLA, Verance, and the studios invented the audio watermark! You KNOW they did. They just made up a name - "Cinavia" - and made up a website - "cinavia.com" to "pass the buck" and shift the blame!

Just LOOK at the "cinavia.com" website. It is basically 3 pages with "warnings" about Cinavia messages and NO CONTACT INFORMATION AT ALL. There is no "ABOUT US." There is no "CONTACT US." There is no "WHO WE ARE." There is no address or telephone number. In fact, there is no way to contact them at all. No real company I have ever seen has a website such as this. This is a fake "shell" website to be a dead-end for people who get Cinavia messages. Period.

[Ghitulescu]

I agree with you

I just wanted to explain that there is a "findable" connection between CINAVIA and Verance and this can be found as I did. However, Average Joe doesn't know this. I haven't read the patents for a long while, but I think no cinavia is mentioned there (I think that's against the regulations of the USPTO). So the only way of finding the owner is this. Who stand behind Verance Corporation, well, that's another story....

[derbeDeus]

I agree too. www.cinavia.com is a dead end. And xenex makes a very good point. It did occur to me that it's very "slim" in content and does not make any reference to Verance or even AACS - it seemed weird. There are references from Verance and AACS to Cinavia but not the other way around, which is exactly what an average user will do.
Let's just hope that the average user will use a search engine or wikipedia to find the real ppl behind Cinavia.

Btw: I wonder if Rade Petrović & co. get more "fan mail" these days? :devil:

[badbackUp]

Another thing interesting from that web site is the "10 minutes of cinavia, followed by 10 min of non-copyrighted music, followed by...", etc. There seems to be an effort to allow limited-use.

[setarip_old]

@xenex, @Ghitulescu

Please note that I've made a minor addition to the title of this thread, so that at least those who read this thread may be aware of the connection ;>}

However, I really think this is much ado about nothing. Anyone whose curiosity and/or anger is piqued and who has the most basic knowledge of search engines can simply perform a Googlesearch for "cinavia.com+owned" (WITHOUT the quotation marks) - and the first hit will take you to:

https://www.trademarkia.com/protected-c-cinaviacom-85070039.html

PROTECTED C CINAVIA.COM - Trademark by Verance Corporation San ...1 post - Last post: Jun 23, 2010
Find up to date information on PROTECTED C CINAVIA. ... COM. This trademark is owned by Verance C..., ********, San Diego, CA 92121. ...

[Ghitulescu]

@setarip_old:

try not to forget that the results of a google search depends on the country (IP address). One also needs not to forget that some domains can be "invalidated" by the local ISP (observing laws, requests and so on). And it's not really a rare case when a resource simply "disappeared".

[ChiDragon]

Looks like Verance hadn't decided what to call their services when they registered the trademarks on July 2, 2008. At the same time they registered marks for "Sonavia" and "Meravia". Each of these, including Cinavia, is registered as a digital watermarking service, but each also has a second registration (https://www.trademarkia.com/cinavia-77513377.html) for

Market research services, namely, providing audience data, viewership data, listener data, and proof of performance data to advertisers and media buyers relating to broadcast content; conducting online business research, namely, providing searching, cataloging, and reporting services, for purposes of finding the global computer network locations of audio, video, and audiovisual content for owners and providers of the audio, video, and audiovisual content

Does that mean part of their business plan is actively tracking down the internet pirates?

[Ghitulescu]

Tracking the pirates is patented (in the US only) AFAIK since 1995 or so. Nothing new under the sun.

[SamuriHL]

WOO HOO! Forums are back. Now I can ask a question that I've been wanting an answer to. Has anyone tried a DVDFab backup of a Cinavia disc with the 3.56 PS3 firmware? Has anything changed? Thanks!

[setarip_old]

@SamuriHL Has anyone tried a DVDFab backup of a Cinavia disc with the 3.56 PS3 firmware?

Does it make a difference if it's already been hacked? (by "KaKaRoToKS")

Has anything changed?This was posted at another forum (before the hack was noted): seems to include a new master key to counter the leak, and the 3.55 CFW.

(I do not have a PS3 - "CFW" stands for "custom firmware". More than that I don't know)

[SamuriHL]

@SamuriHL

Does it make a difference if it's already been hacked? (The following is for information only)


This was posted at another forum (before the hack was noted):

(I do not have a PS3 - "CFW" stands for "custom firmware". More than that I don't know)

It's good that they're continuing to hack the firmware for the PS3. However, afaik, that effort has done nothing (so far) related to Cinavia. I hope that someone does in fact use those tools to work on the Cinavia issue for the PS3.

My question, in particular, was whether or not the situation has changed with regard to the DVDFab method of making "TRUSTED_SOURCE" backups. Some have suggested that there's nothing they can do because a recordable disc with AACS on it is in fact considered part of the "TRUSTED_SOURCE" dataset by default according to the standard. I'd be curious to see how, if at all, Cinavia evolves in future firmware updates to counter this and other attacks.

My expectation is that Cinavia will end up being similar to BD+ in that it will "evolve" over time as new attacks are released against it. One would have to think that Verance learned from history that a "static" protection without the ability to change and adapt is futile. It'll be interesting to see if anything is done to prevent these AACS recordable disc backups from working going forward. That's why I was asking if the unmodified 3.56 firmware has changed anything in that regard.

[setarip_old]

@SamuriHL

I've removed the link from my post (as it might be misconstrued as inappropriate) - and would appreciate if you also removed it from your quote. Thank you.

[SamuriHL]

@SamuriHL

I've removed the link from my post (as it might be miscostrued as inappropriate) - and would appreciate if you also removed it from your quote. Thank you.

Done. Not a problem. :)

[haggi]

Is the cinavia.com website also "officially mentioned" to German customers? If so they are begging to be sued. There is a German law that requires every company to mention its identity on every website (some even say this applies to personal websites intended for German citizen). As they don't even give away who they are on the German version, they to not comply with German law. Any German lawyer around? ;) The law even requires the starting page of the website to provide a direct link to the aforementioned information.

PS: Providing a German version of a website is considered to be prove enough to qualify the website to be intended for German citizens.

PPS: Die ist keine Rechtsberatung. Für eine verbindliche Einschätzung der Rechtslage kontaktieren Sie bitten einen zugelassenen Anwalt. (The German law requires me to state that this is my personal opinion and one is to contact a registered lawyer to get a "qualified" opinion.)