ADVERTISEMENTS

Satellite TV hacker Christopher Tarnovsky is a controversial figure.

The 37-year-old Southern California man was at the center of a legal storm that pitted the Rupert Murdoch-owned NDS Group against competitor NagraStar in a five-year satellite-TV piracy battle that went to court this month. Now that the civil trial has wrapped up, and Tarnovsky and NDS have been cleared of sabotage allegations, the hacker granted Threat Level an exclusive interview, and even opened the doors of his laboratory to our video cameras.

The satellite TV industry is a multi-billion dollar business, and high-level pirates have allegedly made millions developing and marketing hacks to steal signals from the likes of DirecTV and Dish Network. During pay-TV's piracy heyday in the late 90s, pirates funded sophisticated laboratories -- in Bulgaria and elsewhere -- to figure out how the latest generation smart cards worked and develop methods to bypass their access controls.

You can read my story on Tarnovsky and his strange journey through both sides of the satellite TV piracy wars here.

And to see how some smart cards are hacked, check out the video (below) in which Tarnovsky shows me a technique he developed in 2003 for extracting code from smart cards -- the first step to cracking them. The victim in this case is the same Thomson-brand chip that was once used in NagraStar cards to protect the Dish Network from piracy and was at the center of the piracy trial. The chip has also been used by IBM for access-controlled cards used with laptops, which is the kind of card Tarnovsky attacks in the video.

Watch to see how the card's layers of defenses fared against Tarnovsky's process, which involves acetone, fuming nitric acid, hydrofluoric acid, red nail polish and sewing needles. Both acids are dangerous and require special care, so please don't try this at home.

UPDATE: A few readers have asked for more details about what was used in the hack, so I've added the chip specs and info about the steps used for conducting the hack (see below the video).

As for the video-viewing problems, I've passed your complaints to Wired's production team. No need to leave any more comments about it. We got the point. : )

Tools Used for the Hack

Acetone (for rinsing)

Reverse-osmosis water (substitute for dionised water)

Nail polish (red-based color works best; Orly's nail polish in "Naughty" was used for video)

Fuming Nitric Acid (HNO3) to open the chip

Whink Rust Remover (contains ~7% Hydrofluoric acid to remove glass -- oxides -- holding the metal in place

Sewing needle

Probing needle

Microscope with 10x zoom capability

Ultrasonic wash (not required but makes the rinse cleaner and faster)

Hot plate

List of Steps to Expose the Bus on the Chip:

Cut the chip out of the card, removing as much plastic as possible

Soak in beaker of acetone to break down remaining plastic then remove from beaker

Use vent-hood with hotplate and HNO3 (Fuming Nitric Acid) to remove epoxy/glue covering the chip

Rinse in ultrasonic machine with acetone

Place a drop of nail polish on the chip and spread it thinly using compressed air

When dry, use sewing-type needle to make a box where you want hydrofluoric acid (or rust remover) to touch

Apply hydrofluoric acid to chip for enough time to open the mesh in your boxed area

Rinse in ultrasonic machine with acetone (remove the nail polish)

Power up chip under microscope

Sit on bus to record data samples

Specs for the Chip in the Video

ST16CF54A

16 KB ROM

4 KB EEPROM

480 Bytes of RAM

Modular Arithmetic Processor (MAP a/k/a Crypto-Coprocessor)

Security sensors for light, clock, and voltage

Meshing covers all circuitry to prevent probing attacks (though, as you can see, it didn't prevent Tarnovsky's attack)

Enhanced 6805 CPU with lower clock cycle counts per instruction and 1:1 internal clock

The CPU die had the designers initials as well as "ST16CF54A 1994" on it. The CPU was replaced in 1997 with a "B" version (ST16CF54B). The device is known to have been used in:

Scientific Atlanta cable set-top boxes (STBs)

Nagravision ROM2,3 (the card at the center of civil suit against NDS)

IBM SecureWay smartcard kit (the card shown in the video)

GemSafe by Gemplus (similar to the IBM SecureWay concept)

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.