SE-2011-01 Proof of Concept Code (technical information)

Last update: May-28-2012

Characteristics of the Proof of Concept (PoC) code developed during the research of digital satellite TV platform's security:

145 Java classes,
34000 lines of source code,
345 kb of compiled jar file,
implementation of over 70 commands,
compatibility with ITI5800S, ITI5800SX, ITI2850ST, ITI2849ST digital satellite receivers and STi7100 / STi7111 processors.

Commands implemented by Security Explorations' proof of concept code illustrate the following:

ability to escape Java security sandbox,
ability to escape OS security sandbox,
full read/write access to file system (sample)
privilege elevation to OS admin,
full read/write kernel and I/O space access (arbitrary system call installation)
smart card interface interception (sample)
runtime firmware interception of STi7111's embedded crypto processor,
firewall disabling,
java and system level directory tree listing (sample),
java and system level file/directory tree transfer (sample)
access to information about system configuration (serial number, software version, hardware type, network configuration) (sample)
access to information about MPEG services (sample)
access to information about various cryptographic keys (Conax, chipset, hdcp and upgrade) (sample)
access to Push Video on Demand (PVOD) movies and its properties (sample)
access to Electronic Program Guide (EPG) (sample)
access to information about user's subscription's status (sample)
Digital Video Recorder (DVR) control (scheduling recording, management of existing recordings and PVOD files),
playing of arbitrary user provided video content fetched from Internet (MPEG files),
Xion web browser control (opening arbitrary URL's, stealth URLs redirection, http and https requests sniffing),
graphic screen capture (sample)
control over the TV remote (imitation of the keyboard input),
displaying arbitrary messages on a user's TV screen,
access to other subscribers' broadcasted invoice data (billing information),
download and decryption of device's upgrade image (sample)
DSMCC carousels mounting,
simple MPEG sniffing by PID value (sample)
access to SI MPEG sections (PAT, PMT) (sample)
MPEG stream capture of arbitrary programming (including HD programming) (sample)
Video on Demand ECM decryption and sharing of programming protected with Conax conditional access method with chipset pairing,
reuse of Video on Demand access rights (beyond rental period of 48 hours),
Control Words sharing via network between arbitrary decoders protected with Conax conditional access method and chipset pairing,
persistent and stealth backdoor installation,
automatic backdoor execution upon system startup.