Entries Tagged "television"

Page 2 of 2

Blowfish on 24, Again

Three nights ago, my encryption algorithm Blowfish was mentioned on the Fox show 24. The clip is available here, or streaming on Hulu. This is the exchange:

Janis Gold: I isolated the data Renee uploaded to Bauer but I can’t get past the filed header.

Larry Moss: What does that mean?

JG: She encrypted the name and address she used and I can’t seem to crack it.

LM: Who can?

JG: She used her personal computer. This is very serious encryption. I mean, there are some high-level people who can do it.

LM: Like who?

JG: Chloe O’Brian, but from what you told me earlier she’s too loyal to Bauer.

LM: Is her husband still here?

JG: Yes, he’s waiting to see you.

LM: He’s a level 6 analyst too.

…

JG: Mr. O’Brian, a short time ago one of our agents was in touch with Jack Bauer. She sent a name and address that we assume is his next destination. Unfortunately, it’s encrypted with Blowfish 148 and no one here knows how to crack that. Therefore, we need your help, please.

…

Morris O’Brian: Show me the file.

MO: Where’s your information. 16 or 32 bit wavelength word length?

JG: 32.

MO: Native or modified data points?

JG: Native.

MO: The designer of this algorithm built a backdoor into his code. Decryption’s a piece of cake if you know the override codes.

LM: And you do?

MO: Yeah.

LM: Will this take long?

MO: Course not.

LM: Mr. O’Brian, can you tell me specifically when you’ll have the file decrypted?

MO: Yes.

MO: Now.

O’Brian spends just over 30 seconds at the keyboard.

This is the second time Blowfish has appeared on the show. It was broken the first time, too.

EDITED TO ADD (4/14): Avi Rubin comments.

Posted on March 19, 2009 at 12:18 PM • View Comments

Information Leakage in the Slingbox

Interesting:

…despite the use of encryption, a passive eavesdropper can still learn private information about what someone is watching via their Slingbox Pro.

[…]

First, in order to conserve bandwidth, the Slingbox Pro uses something called variable bitrate (VBR) encoding. VBR is a standard approach for compressing streaming multimedia. At a very abstract level, the idea is to only transmit the differences between frames. This means that if a scene changes rapidly, the Slingbox Pro must still transmit a lot of data. But if the scene changes slowly, the Slingbox Pro will only have to transmit a small amount of data—a great bandwidth saver.

Now notice that different movies have different visual effects (e.g., some movies have frequent and rapid scene changes, others don’t). The use of VBR encodings therefore means that the amount data transmitted over time can serve as a fingerprint for a movie. And, since encryption alone won’t fully conceal the number of bytes transmitted, this fingerprint can survive encryption!

We experimented with fingerprinting encrypted Slingbox Pro movie transmissions in our lab. We took 26 of our favorite movies (we tried to pick movies from the same director, or multiple movies in a series), and we played them over our Slingbox Pro. Sometimes we streamed them to a laptop attached to a wired network, and sometimes we streamed them to a laptop connected to an 802.11 wireless network. In all cases the laptop was one hop away.

We trained our system on some of those traces. We then took new query traces for these movies and tried to match them to our database. For over half of the movies, we were able to correctly identify the movie over 98% of the time. This is well above the less than 4% accuracy that one would get by random chance.

More details in the paper.

Posted on June 4, 2007 at 1:24 PM • View Comments

1 2

Sidebar photo of Bruce Schneier by Joe MacInnis.