Globecast Keys

[GeordieCA]

I can see why Setanta Sports is no longer decrypting. I just didn't pay enough attention beforehand to know what has changed.
Does anybody have any knowledge (or logs) beyond a week. To jog your memory I*'m interested in the ECMs 0x0750 & 0x1782 of CAs 0x1800 & 0x0801 respectively. Only half of that making sense would be useful too.

Failing that pretty optimistic request how about which keys were used when Setanta was decrypted?

[ajayjose]

Eb4ac41a455bdd23547eef4b3abf4d62

[Crow 492]

Some channels are not coming in.

Just to let you know. Right Key's

[GeordieCA]

Eb4ac41a455bdd23547eef4b3abf4d62

Can you let me know how you were using this key, please.
If you were using a key file could you paste all of the lines starting with c001 or c101.
Which plugins & versions were you using?

Thanks.

[GeordieCA]

Some channels are not coming in.

Just to let you know. Right Key's

Yeah, I've been looking into it. I can see the ECM reading key 01 then failing. I just don't know if the ECM is new or if the key has changed.

I don't really know that much about Globecast yet. I'd be happy to hear anything useful. For example, is anybdy familier with their key rolling policy?

[ajayjose]

SAT 97W APROX 180 CHANNELS LOTS OF THEM ARE FREE AND SOME USING NAGRA 2(c101)ROM110 AND SOME NAGRA1 (C001)

key00 EB4AC41A455BDD23547EEF4B3ABF4D62 this is the last known active key

Key01 83203CA8E57B93A67B1267AB406203B1

now both keys are not working

autoroll was not working on any FTA frimware

SO even if it is a simple key change same thing will hapen

I heard tripledragon has a fix for it

if some one can read globecast rom110

and post new keys that can help so please help smart guy's out there please.......

[zag1958]

ROM110 is NOT hackable (currently) just like s01, s02, s04 etc. Unitil a hack comes out (if ever) you can forget N2 encrypted Globecast channels.

[GeordieCA]

ROM110 is NOT hackable (currently) just like s01, s02, s04 etc. Unitil a hack comes out (if ever) you can forget N2 encrypted Globecast channels.

I know from that statement that you have little to offer this discussion.
Polsat 2, for example, is Nagra 2 and currently has a working key.

[GeordieCA]

SAT 97W APROX 180 CHANNELS LOTS OF THEM ARE FREE AND SOME USING NAGRA 2(c101)ROM110 AND SOME NAGRA1 (C001)

key00 EB4AC41A455BDD23547EEF4B3ABF4D62 this is the last known active key

Key01 83203CA8E57B93A67B1267AB406203B1

now both keys are not working

autoroll was not working on any FTA frimware

SO even if it is a simple key change same thing will hapen

I heard tripledragon has a fix for it

if some one can read globecast rom110

and post new keys that can help so please help smart guy's out there please.......

There are still some keys that will decrypt some N1 & N2 stuff. Try these:
key00 EB4AC41A455BDD23
Key01 2A9349EAA7B915EE

There are also autorolling keys in the stream. They're just crap and old.

[zag1958]

I know from that statement that you have little to offer this discussion.
Polsat 2, for example, is Nagra 2 and currently has a working key.
Man you are clueless. I don't even know where to begin. It's very obvious that you know nothing about Nagra 2 or ROM cards.

Have you noticed why the ROM102 cards are so expensive and the later cards like the 110, S01, S02, S04 etc are so much less expensive? It is because right now 102 cards at revision 108 or less and a few 103 card revisiond are the ONLY cards that can be hacked. Should BEV or Dish do the same thing that Globecast did (get rid of the rom102s and rom103s and only have rom110 and higher) that would end testing period. Until someone finds a way to hack the ROM110 there is no way to get the keys. Period. How do you think you get keys anyway, sniff them out of thin air?

I repeat ROM110 cannot be unlocked which means there is no way to retrieve the keys out. They no longer support ROM102 which was the reason why we were able to retrieve the keys.

You need to read up on what exactly is allowing the testing community to recieve tv.

BTW, Nagra 2 just like nagra 1 was never hacked. The only thing people have been able to is get inside some of the cards (and only certain portion of the card, not the entire card) which allowed the information to be retrieved. Why do you thing FTA is down right now? Think about it.

[GeordieCA]

So I was imagining watching Polsat 2 yesterday. OK.
I could easily win this argument but as the old saying goes: Winning an argument on the internet is like winning a medal at the special olympics. You may have won but you're still a retard.

Been watching Globecast for months.
hxxp://www.curious-contraptions.com/forums/showthread.php?t=23045 (http://www.curious-contraptions.com/forums/showthread.php?t=23045)
Oh, and the IDEA keys; Yes, we "sniff them out of thin air".

[zag1958]

You are not understanding how things work. You are confusing Nagra 2 (the encryption process) with being able to hack ROM cards. Nagra 2 has never been compromised. The reason why you can watch Polsat 2 or Dish Or Bev or any other Nagra 2 encrypted system is because we can hack the cards. If we could hack the actual Nagra 2 code we woudn't need to have to get into the ROM cards. The reason why you could watch Polsat 2 or (globecast before) is because they use/used ROM102 cards. ROM102 cards (and previously ROM101 cards) have been hacked and that is the only reason why you can watch them. BTW, dish replaced all the ROM101 cards and that is why they no longer work. Once the cards are replaced they are shot off by the provider.

To give you an example. Here in North America when Dish and BEV switched to Nagra 2 last fall the hack for the ROM101 card was released. We were able to watch Dish right of way because they were using ROM101 cards. BEV on the other hand never issued ROM101 cards so guess what? BEV remained dark, no one could watch them even though they were using the exact same Nagra 2 encryption method. It wasn't unil about 3 months later when the ROM102 hack was released that BEV became available to watch because they were using the ROM102. Now they both are watchable because they continue to use ROM102 cards. Should DISH or BEV do a card swap and get rid of the ROM102 we would be dark again. The only reason we can watch any of the Nagra 2 providers is because we can gain access to some of their cards. That is the reason why a card swap causes fear among the hacking community. Globecast, being a very small provider, did just that. They got rid of the ROM102. They only have ROM110 or higher cards. Ask anyone, anywhere if ROM110 cards can be unlocked and you will see. D+ in europe did the same thing and now they cannot be hacked. It's all about the cards not the Nagra2. If we loose access to the card we are out of luck.

If what you say is true why is it that one one as posted working globecast keys?

[ajayjose]

HI ZAG

Unlike dish &bell in my knowledge globecast swap was from rom10 to rom110

they never used any rom 101,102,103 at that time rom110 was hacked in europe

and with gobecast also i dont know if the have newer rev but this is true there

rom110 dump was all over the net in europe d+ went dark becouse of the same type of hash that put dish black

[zag1958]

HI ZAG

Unlike dish &bell in my knowledge globecast swap was from rom10 to rom110

they never used any rom 101,102,103 at that time rom110 was hacked in europe

and with gobecast also i dont know if the have newer rev but this is true there

rom110 dump was all over the net in europe d+ went dark becouse of the same type of hash that put dish black

So they just now went from Nagra 1 (ROM10) to Nagra 2 (ROM110)? Why bother with the swap if the ROM110 was compromized? Why not go directy to S01 or higher or are those hacked too?

I have heard nothing but rumors about ROM110 being hacked. I will do some more research and see if this is the case.

Doesn't change the fact that for over a month Key01 from Globecast hasn't been working and no one seems able to produce a working one. Shouldn't be a problem if what you say is true.

[GeordieCA]

So they just now went from Nagra 1 (ROM10) to Nagra 2 (ROM110)? Why bother with the swap if the ROM110 was compromized? Why not go directy to S01 or higher or are those hacked too?

I have heard nothing but rumors about ROM110 being hacked. I will do some more research and see if this is the case.

Doesn't change the fact that for over a month Key01 from Globecast hasn't been working and no one seems able to produce a working one. Shouldn't be a problem if what you say is true.

I didn't really read much of your previous post beyond your insult and "I don't even know where to begin." That we can agree upon.

The algorithm to decrypt both Nagra 1 & Nagra 2 is trivial. That is the strength of good encryption. If it were a complex ALGORITHM then the 8 bit processors the size of dime wouldn't be powerful enough to decrpyt it. The strength lies in the variables (or keys) that are needed. These keys are the private keys of the transaction. NOT the same as the public (or IDEA) keys.
That private key is stored on the cards. the lifetime of the cards is as long as the key (or keys) remains secret.
When a card is compomised, as the rom 102 & rom110 were the private keys are extracted and decryption can occur. In the case of the rom102 only SOME of the keys were extracted.
I've never seen a rom110 but as far as I can tell it is the same as a rom102, ie a ST19XL18 by ST Microelectronics. So when the rom102 was opened so ws the rom110.
The rom110 was dumped in Spain and the private keys were made public. The DVB crowd quickly produced a solution. This was follwed by FTA.
Almost all FTA receivers had a version that would decrypt all Nagra 2 channels on Globecast.

This recent ECM on Dish & BEV is caused by a new private key being used.
Frankly, nobody has really taken the time to find out what has happened with Globecast.
There are many providers with many cards and many encryption algorithms running on Globecast. That is why some channels can be viewed, others not.

This is the private, or RSA, key that was extracted for Globecast:
336991F2DD42C0EC25597B75DBDDF751CF069CF32DDDBC3084 53F4B60506A59D652FAC9BADFE168CA75EDB18AFCAC0E9827D 7A4447AAE1FC00EABD0213CAAE87
You may see it referenced with N C101 M1, This is the way DVB decided to identify it to the decryption tools. N - Nagra. C101, Globecast Nagra 2. M1 - RSA key.
Most FTA implementations copied it although some use C001; The Nagra 1 identifier for Globecast.

Your crazy logic and reasoning for events makes no sense.
- Dish has been rolling out rom102s for some time.
- Encryption was backward compatible to older cards until enough customers had received their new cards.
- Dish eventualy decided that they could handle the support calls and called an encryption feature of the rom102 that didn't exist on previous cards.
- THAT'S why everything is black now.

I can't be bothered to explain autorolling keys right now. Google it.

[GeordieCA]

You are not understanding how things work. You are confusing Nagra 2 (the encryption process) with being able to hack ROM cards. Nagra 2 has never been compromised. keys?

Dish started broadcasting signals encrypted with Nagra 2 in April 2005. There have certainly been many people watching signals encrypted with Nagra 2 in many different ways until recently.
Go look at the files sections at most site for FTA flashes. See where they have N2 or indeed Dish/BEV in the last 6 months - that was Nagra 2.
Do you really think that the strength of the encryption relies on muppets like you not understanding it.
How do you think different companiies around the world deploy access control? Do you think there is one person who flies everywhere because he knows the secret?
The only way this could work was if MANY people could have deep understanding of the way it works AND STILL be unable to hack it.

Damn I really am trying to avoid my real work now. And yes, this does make me a retard.

[zag1958]

Everything you have posted in these last two posts makes sense and I have no quarrels with it. What I was trying to convey was that the Nagra 2 encryption itself was not compromised. The hacking community is only able to decrypt the signal because, as you said, the private key is extracted from a compromised card. Hence the card must me compromised before any software can be written and decryption can take place. I was under the impression that the ROM110 was NOT compromised therefore, as you made the argument, the private key could not be extracted. The fact that providers have started to use MAP calls and completely shut down FTA further illustrates that the Nagra 2 encryption itself is alive and well. Everything in this "hobby" hinges on the hacker community to be able to get into the cards and be able to understand what it does. If n2 was hacked all you would need is a computer, a tuner and a decryption algorithym no need to hack into any card.

[GeordieCA]

Dude, I'm not trying to make a big deal of this, but, really, no.
Nagra 2 is just a framework that can be used to make sending encrypted messages easier.
Satellite signals that were encrypted using the Nagra 2 framework have been decrypted by unauthorized means. That is a fact.

Imagine you wanted to send a secret message to one of your friends. You'd write it in a secret code then put it in the mail. Your friend would get it and decrypt the secret message. You could use any number of ways to encrypt and decrpyt the message as long as you agreed them beforehand. The US mail wouldn't care what was inside the letters.
Nagra 2 is the US mail. It lets secret messages be transported around in any number of ways. It also lets crappy encryption messages through, as shown by how much porn people have seen in the last year..
What is happening now is an example of public key encryption. The algorithms and the mechanisms are well defined and well understood. That is what makes the breakthrough in encryption technology so profound. You can know EXACTLY what is happening and still be unable to decrypt it. This is what makes the ViewSat bollocks about dumping the MAP such a joke.

Seriously, go and read this well written story about the history of public key encryption.
hxxp://www.wired.com/wired/archive/7.04/crypto.html (http://www.wired.com/wired/archive/7.04/crypto.html)
When you get to the description about Alice, Bob & Eve imagine that Bob is Dishnetwork, Alice is a rom102 & you are Eve.
Also consider that in your scenario Alice can't communicate with Bob (rom102s can't talk back to dishnetwork) and must therefore have the secret key known beforehand (in this case stored behind a hardware firewall).

So saying that Nagra 2 is or isn't hacked is nonsense. What is or isn't hacked is the encryption used. In this case RSA, which depends upon secret keys stored in the card.

I did actually try and read your comments and correct you. However your basic lack of the concepts involved made it impossible.
That made your abusive, condescending attitude even more amusing.

You launched into this thread based on your belief that Nagra 2 wasn't hacked. Nagra 2 can carry unencrypted data. At the moment on Globecast the RSA validation string is ignored on some streams.

I repeat, TV encrypted using Nagra 2 has been hacked and is being hacked RIGHT NOW. The point of this thread was to work out what was going on. Thanks for distracting everybody.