Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

461–470 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#461

Post by fluidcruft »

AnthonyMouse wrote: post #341
fluidcruft wrote: post #336

Earlier quoted context omitted.

I think it plays differently before a jury. Juries can easily understand copying files and could potentially invalidate. But it's different when lawyers get to move the conversation to scary hacker garble about technical skill and intent. Evidence of intent is the real value.

Juries are far less incompetent than they're made out to be, not least because both sides get to describe what's happening. And you can't even get evidence of intent from this anyway because DRM circumvention tools don't actually come with a ski mask and a set of lockpicks. You install a tool called "video downloader" which supports a hundred sites and 10% of them have some kind of DRM which it automatically strips i…

I did suggest that juries are incompetent. 'Why did you seek and install "video downloader"?' is a valid and specific question that gets at intent.

Re: The GPU, not the TPM, is the root of hardware DRM

#462

Post by dr-detroit »

fc417fc802 wrote: post #438
matheusmoreira wrote: post #433

Earlier quoted context omitted.

> privileged userspace layer BS. Either we're privileged and can copy their precious content, or they're privileged and we cannot. The current status quo is they sit above us in the truly privileged hardware modes while we are isolated, virtualized and sandboxed for their safety. It's not our computers anymore, they're just allowing us to use them.

Not what I meant. For example, on most mainstream linux distributions systemd fulfills the role of privileged userspace layer that I was referring to there. > truly privileged hardware modes The presence of a hypervisor doesn't imply paravirtualized hardware. Neither does the presence of an entire OS on modern GPUs imply a reduction in kernel responsibilities. Ring 0 is still ring 0. The OS is still managing and abst…

[dead]

Re: The GPU, not the TPM, is the root of hardware DRM

#463

Post by devops99 »

AnthonyMouse wrote: post #351
devops99 wrote: post #329

Earlier quoted context omitted.

> vs. FDE with a boot key stored in some cloud service secured with the user's password instead of a TPM Without secure boot (backed by TPM), I can boot a small USB device that has LEDs on it to indicate to me that the target system has been infected to send me a copy of the target's password, after I already imaged the disk (or when I have another team member steal it or take it by force later). If there's a UEFI pa…

> Without secure boot (backed by TPM), I can boot a small USB device that has LEDs on it to indicate to me that the target system has been infected to send me a copy of the target's password, after I already imaged the disk (or when I have another team member steal it or take it by force later). Which is the same thing that happens with secure boot, because they just steal the whole device and leave you one that look…

Thank you for prompting attention to the switcheroo.

This angle of attack is generally unheard of, but should be considered. I can think of some mitigations that can work.

Tamper-evident materials are well-known by the crowds that will target users. There are many criminals among us, so many that those who don't have criminal psychology have a hard time wrapping their mind around it. Given this, I am cynical, and every defense within reasonable cost should be leveraged.

Re: The GPU, not the TPM, is the root of hardware DRM

#464

Post by dlgeek »

jandrese wrote: post #372
hex4def6 wrote: post #359

Earlier quoted context omitted.

I'm not so optimistic. Yes, you can never "plug the analog hole" completely, but you can definitely lock stuff down to the point it's impractical for 95% of people. For instance, imagine some sort of audio / video fingerprint system that resides in Intel and/or nVidia's GPU drivers. Content gets played through the on-GPU HEVC / h.264 decoders already. Doesn't seem like a huge stretch to add a fingerprint authenticati…

I was thinking of someone hacking a capture device that sniffs the output matrix of a display in order to capture the video and has a line-in plugged into the drivers on the speaker. Way out of reach of most people, but only a very small number of people need to be have the wherewithal to do it to keep the pirate scene going, especially if they live in countries that don't care about your DRM laws. The analog hole ex…

As I understand it, that's common now - cheap HDMI splitters do the HDCP negotiation on the first port, and then the unencrypted digital video and audio signals are cloned to both ports, ready to be captured.

Re: The GPU, not the TPM, is the root of hardware DRM

#465

Post by AnthonyMouse »

mardifoufs wrote: post #454
AnthonyMouse wrote: post #339

Earlier quoted context omitted.

Apparently the people doing this kind of work have been disproportionately in Eastern Europe and what's going on in Ukraine has so disrupted that part of the world that they currently have bigger problems. So then you're waiting for either that region to stabilize or demand for cracks to cause people somewhere else to get into the game, and in the interim you effectively have a temporary supply chain issue. But it's…

Who was cracking denuvo on a regular basis back in say, 2021, before the war started? Basically no one. So I'm not sure that's true.

There is an ocean of difference between "basically no one" and "actually no one" when you only need one person in the world to do it.

Re: The GPU, not the TPM, is the root of hardware DRM

#466

Post by AnthonyMouse »

fluidcruft wrote: post #461
AnthonyMouse wrote: post #341

Earlier quoted context omitted.

Juries are far less incompetent than they're made out to be, not least because both sides get to describe what's happening. And you can't even get evidence of intent from this anyway because DRM circumvention tools don't actually come with a ski mask and a set of lockpicks. You install a tool called "video downloader" which supports a hundred sites and 10% of them have some kind of DRM which it automatically strips i…

I did suggest that juries are incompetent. 'Why did you seek and install "video downloader"?' is a valid and specific question that gets at intent.

They'd be using "video downloader" to download the videos regardless of whether they have any DRM or not.

Re: The GPU, not the TPM, is the root of hardware DRM

#467

Post by jandrese »

dlgeek wrote: post #464
jandrese wrote: post #372

Earlier quoted context omitted.

I was thinking of someone hacking a capture device that sniffs the output matrix of a display in order to capture the video and has a line-in plugged into the drivers on the speaker. Way out of reach of most people, but only a very small number of people need to be have the wherewithal to do it to keep the pirate scene going, especially if they live in countries that don't care about your DRM laws. The analog hole ex…

As I understand it, that's common now - cheap HDMI splitters do the HDCP negotiation on the first port, and then the unencrypted digital video and audio signals are cloned to both ports, ready to be captured.

Oh yeah, I had to buy one of these (I called it the HDCP defeater) because my receiver was otherwise unable to forward the negotiation between the Roku and the TV fast enough. I would turn on the TV and the screen would blink on and off for several minutes before the HDCP handshake managed to win the race. In theory those devices might be defeated with newer versions of the protocol, but that part that drives the matrix of pixels can never be encrypted until you have DRM built directly into your eyeballs.

Re: The GPU, not the TPM, is the root of hardware DRM

#468

Post by MBCook »

davidczech wrote: post #347
MBCook wrote: post #322

Earlier quoted context omitted.

I figured it’s more about ensuring the kernel and boot loading and OS are 100% unmodified by attackers/malware. If that helps with bitlocker or passkeys or whatever that’s great. But I assume at its base it’s a pure integrity play. I would think that would also let you know the public key stuff used to communicate with hardware authentication like a fingerprint reader is secure too, but I don’t know how that stuff wo…

TPM can measure the Secure Boot state for later reporting (attestation) but when it comes to DRM, that’s not a terribly interesting bit of information, knowing the firmware and kernel are valid, when the configuration of the OS and installed applications is really the important part. As far as I know there’s no real scalable way for that to work in the Windows ecosystem.

That makes sense to me. It just doesn’t seem that useful for DRM, seems like kind of a reach.

Especially in modern systems where the graphics card could do all of it and so the host PC never has access to the decrypted data or keys in the first place.

Re: The GPU, not the TPM, is the root of hardware DRM

#469

Post by forty »

mjg59 wrote: post #403
forty wrote: post #400

Earlier quoted context omitted.

I don't know, maybe because not everyone has the right GPU with DRM, while the TPM is conveniently mandatory? :)

If they don't have a GPU that implements this then the decrypted material would be available to the OS, which is precisely what the streaming media platforms want to avoid.

It's because they don't trust the OS not to leak the decrypted bytes, but they could thanks to TPM (the OS would have to have a memory memory chunk not readable from admin/root etc). In this scenario the OS is part of the DRM.

Re: The GPU, not the TPM, is the root of hardware DRM

#470

Post by forty »

lxgr wrote: post #402
forty wrote: post #400

Earlier quoted context omitted.

I don't know, maybe because not everyone has the right GPU with DRM, while the TPM is conveniently mandatory? :)

Mandatory where? Most of the devices people are streaming video to these days aren't even PCs! Macs haven't had TPMs for a while now (I think Apple never really used it and dropped it even before the Apple Silicon switch), but of course they have their proprietary equivalent.

Mandatory to run windows, that's the topic of the article
Post reply on HN