When "smart" isn`t too clever
Porn Free !
Porn Free !
The Usual Disclaimers
The Usual Disclaimers
●
Live demo may not work!
The Usual Disclaimers
●
●
Live demo may not work!
It may work, but you may wish
it hadn't!
The Usual Disclaimers
●
And some warnings...
Responsible disclosure
Responsible disclosure
Responsible disclosure
The FBI : guardians of THE
porniverse!
The FBI : guardians of THE
porniverse!
Porn Free !
Starring...
Previously seen in...
Previosuly seen in...
●
Hotel tv hacking
– Infra Red
●
Satellite hacking
– Feed hunting
Previosuly seen in...
●
Hotel tv hacking
– Infra Red
– Boobies!
●
Satellite hacking
– Feed hunting
– boobies
Also starring...
Also starring...
●
The BBC
Also starring...
●
The BBC
– Her Majesty's
TV
Also starring...
●
The BBC
– Her Majesty's
●
Red Button
TV
Also starring...
●
MHEG-5
Also starring...
●
MHEG-5
– ISO/IEC 13522-5
Also starring...
●
MHEG-5
– ISO/IEC 13522-5
●
aka “how to
transmit porn”
And introducing...
●
Babestation Xtra
And introducing...
●
Babestation Xtra
– Pr0nographers
Guest star...
●
Television X
Guest star...
●
Television X
– Prawnographers
WTF is MHEG?
●
Extra text services
●
Games
●
Multimedia
WTF is MHEG?
●
Extra text services
●
Games
●
Multimedia
●
Teletext on steroids
mheg
●
ASN1 encoded program
–
●
Embedded command set
●
Draw objects
●
Manipulate variables
●
Stream Audio/Video
–
Local storage
–
OTA
Broadcast alongside normal programming
mheg
{ :Scene ( '/video.mhg' 0 )
:ObjectInfo '(c) Ocean Blue Software Ltd'
:Items (
{ :Stream 921
:CHook 10
:OrigContent :ContentRef ( 'dvb://233a..3b80' )
:Multiplex (
{ :Video 22
:OrigBoxSize 720 576
:ComponentTag 1
}
{ :Audio 23
:ComponentTag 2
}
)
}
)
:InputEventReg 3
:SceneCS 720 576
}
mheg
Interpreted
& executed by
the TV!!!
Red Button
Red Button
Red Button
Red Button
Why?
●
Designed for information &
added value services
Why?
●
Designed for information &
added value services
●
Being used to add “security”
Why?
●
Designed for information &
added value services
●
Being used to add “security”
–
Pay Per View
Where?
●
Embedded TV
–
●
●
All modern TVs support MHEG
Samsung
–
http://samygo.tv
–
Telnet
humax freeview player
–
http://hummy.tv
–
Ssh
Humax
Humax
Why not do it on a PC?
●
Same as satmap – fighting the
technology
●
Cheap DVB-T2 dongle
mheg
mheg
mheg
{ :Scene ( '/video.mhg' 0 )
:ObjectInfo '(c) Ocean Blue Software Ltd'
:Items (
{ :Stream 921
:CHook 10
:OrigContent :ContentRef ( 'dvb://233a..3b80' )
:Multiplex (
{ :Video 22
:OrigBoxSize 720 576
:ComponentTag 1
}
{ :Audio 23
:ComponentTag 2
}
)
}
)
:InputEventReg 3
:SceneCS 720 576
}
targets
●
Top-up tv
●
Television X
●
Babestation Xtra
BT Sport...
BR Sport...
●
No boobies!
OK, enough foreplay...
Show me your tool!
Mheg-plus
●
Java MHEG development
environment
–
Player
–
Debugger
Red Button
●
rb-browser
●
rb-download
●
Offline demo
●
Online demo
●
http://redbutton.sourceforge.net
“Live” BSX hack
“Live” BSX hack
“Live” BSX hack
Live generation of challenge
response
MHEG replacement attack
© Copyright 2024