5 ms·

This was my first thought as well. It seems these management engine tools have only two uses in the real world: enterprise IT, and various forms of DRM. Both e

This was my first thought as well. It seems these management engine tools have only two uses in the real world: enterprise IT, and various forms of DRM. Both exist to treat the user as a hostile entity.

mindslight 7y ago
Well it would be nice for cloud servers, so that you wouldn't have to trust the hosting provider. But given the choice of needing to trust (cloud: intel, home: intel), and (cloud: intel+provider, home: nobody), it would be foolish to not choose the latter! At the individual level, remote attestation has a particularly terrible end game. Think of all those websites that attempt to enforce their desired business whims client-side, that we rightfully laugh at - browser fingerprinting, image save as, anti-adblock, etc. Now imagine they're successful!
anonymousDan 7y ago
Cloud computing (SGX).
baybal2 7y ago
Given the presence of 4k web-dls (original, not reencoded content,) somebody must have the key, or they must have managed to pwn the DRM on an even deeper level, like tapping the memory (which is even worse.) Another possibility is still a source leak, where 4k content gets lifted off Netflixes own internal content storage.
- jandrese 7y ago
  Or a simple HDMI defeat and re-encode. It only takes one guy to put it out on the net. DRM is an inherently flawed concept.
  - deleted 7y ago
    [deleted]
  - sounds 7y ago
    The content is watermarked by the time it is available on HDMI. The guy who re-encoded it would get a knock on the door.
    - kevin_thibedeau 7y ago
      XOR frames captured via two different accounts.
      - wizzwizz4 7y ago
        Wouldn't you need three? Or, better still, do a bitwise 3 of 5 / integer median on the pixel values.
      - herogreen 7y ago
        Except if the watermark is terribly designed, that will not work. There is a lot of information that you can hide from the eye in a video.
      - effie 7y ago
        What would that accomplish? If you want to exclude differences, use AND.
    - mschuster91 7y ago
      No. HDMI/HDCP does not do watermarking or any other modification to content. Cinema DCP packages, however, do - it's either watermarked at the DCP distributor or in the decryption module, but that stuff is out of reach for most warez crews.
      - zozbot234 7y ago
        Even if HDMI doesn't do that, the streaming provider just might. It would be feasible to implement, and inconvenience potential pirates quite a bit.
        mschuster91 7y ago
- aftbit 7y ago
  Just curious, how can one distinguish original content from a full-res re-encode without access to the actual bits of the original file?
  - bavell 7y ago
    This may not be exactly what you're asking for but every re-encode introduces additional noise (generational error). Over many re-encodings (even at same high bitrate/quality) the noise will accumulate in a predictable manner. See [0] for an interesting deep-dive blog post on the subject. Now, as for whether or not you can distinguish the re-encoding from it's original source.... difficult but plausible in certain scenarios? Perhaps if the content was heavily re-encoded to the point where you can statistically determine the presence of the generational noise. With only a single re-encode it may be impossible to determine. [0] https://goughlui.com/2016/11/22/video-compression-x264-crf-generational-loss-testing/ https://goughlui.com/2016/11/22/video-compression-x264-crf-g...
  - effie 7y ago
    Hash the file you have, then compare to the hash of the official version.
holtalanm 7y ago
what about drive encryption? I'm a little un-versed in hardware related to security, but my understanding of the article was that, given the ability to essentially MitM the TPM, anyone could unencrypt the contents of an encrypted drive, potentially even remotely. if so, that is definitely not a good thing.
- Karunamon 7y ago
  The problem with drive encryption at the mainboard level is that it comes with a free side order of vendor lock-in. Apple is a good example here. You can't even touch the internal storage whether you want it encrypted or not, because all access to the onboard storage is gated by their black box security processor. I'd rather just forego the silicon and do it all in software, since there's no way to ensure that the OEMs aren't being bastards. Another reason is that the hardware vendor is in a great, centralized position to be backdoored either by hackers or the bad guys with badges.

mindslight 7y ago

Well it would be nice for cloud servers, so that you wouldn't have to trust the hosting provider. But given the choice of needing to trust (cloud: intel, home: intel), and (cloud: intel+provider, home: nobody), it would be foolish to not choose the latter! At the individual level, remote attestation has a particularly terrible end game. Think of all those websites that attempt to enforce their desired business whims client-side, that we rightfully laugh at - browser fingerprinting, image save as, anti-adblock, etc. Now imagine they're successful!

anonymousDan 7y ago

Cloud computing (SGX).

baybal2 7y ago

Given the presence of 4k web-dls (original, not reencoded content,) somebody must have the key, or they must have managed to pwn the DRM on an even deeper level, like tapping the memory (which is even worse.) Another possibility is still a source leak, where 4k content gets lifted off Netflixes own internal content storage.

jandrese 7y ago
Or a simple HDMI defeat and re-encode. It only takes one guy to put it out on the net. DRM is an inherently flawed concept.
- deleted 7y ago
  [deleted]
- sounds 7y ago
  The content is watermarked by the time it is available on HDMI. The guy who re-encoded it would get a knock on the door.
  - kevin_thibedeau 7y ago
    XOR frames captured via two different accounts.
    - wizzwizz4 7y ago
      Wouldn't you need three? Or, better still, do a bitwise 3 of 5 / integer median on the pixel values.
    - herogreen 7y ago
      Except if the watermark is terribly designed, that will not work. There is a lot of information that you can hide from the eye in a video.
    - effie 7y ago
      What would that accomplish? If you want to exclude differences, use AND.
  - mschuster91 7y ago
    No. HDMI/HDCP does not do watermarking or any other modification to content. Cinema DCP packages, however, do - it's either watermarked at the DCP distributor or in the decryption module, but that stuff is out of reach for most warez crews.
    - zozbot234 7y ago
      Even if HDMI doesn't do that, the streaming provider just might. It would be feasible to implement, and inconvenience potential pirates quite a bit.
      - mschuster91 7y ago
aftbit 7y ago
Just curious, how can one distinguish original content from a full-res re-encode without access to the actual bits of the original file?
- bavell 7y ago
  This may not be exactly what you're asking for but every re-encode introduces additional noise (generational error). Over many re-encodings (even at same high bitrate/quality) the noise will accumulate in a predictable manner. See [0] for an interesting deep-dive blog post on the subject. Now, as for whether or not you can distinguish the re-encoding from it's original source.... difficult but plausible in certain scenarios? Perhaps if the content was heavily re-encoded to the point where you can statistically determine the presence of the generational noise. With only a single re-encode it may be impossible to determine. [0] https://goughlui.com/2016/11/22/video-compression-x264-crf-generational-loss-testing/ https://goughlui.com/2016/11/22/video-compression-x264-crf-g...
- effie 7y ago
  Hash the file you have, then compare to the hash of the official version.

holtalanm 7y ago

what about drive encryption? I'm a little un-versed in hardware related to security, but my understanding of the article was that, given the ability to essentially MitM the TPM, anyone could unencrypt the contents of an encrypted drive, potentially even remotely. if so, that is definitely not a good thing.

Karunamon 7y ago
The problem with drive encryption at the mainboard level is that it comes with a free side order of vendor lock-in. Apple is a good example here. You can't even touch the internal storage whether you want it encrypted or not, because all access to the onboard storage is gated by their black box security processor. I'd rather just forego the silicon and do it all in software, since there's no way to ensure that the OEMs aren't being bastards. Another reason is that the hardware vendor is in a great, centralized position to be backdoored either by hackers or the bad guys with badges.