Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

nothing using poc:mecry:

Many CWs were found but we didn't see any progress here

anyone explain and describe how do we use CWs keys when there is no x83 in ts file

MaRwAn26 said:

dale_para_bajo said:

58W-3785_H_5200
Caracol_Alterno
http://www78.zippyshare.com/v/q4hOyKhe/file.html

Click to expand...

I attached all the CWs keys here

dale_para_bajo said:

C3 66 38 C6 5D 49 5D 03 #[E] PID:00C9h
57 D9 F7 25 5F AC E5 6B #[O] PID:00C9h
CE 4D E7 11 C0 C9 69 0E #[E] PID:012Dh
44 B6 3C B6 37 CE 65 94 #[O] PID:012Dh

Click to expand...

dale_para_bajo said:

PID: C9h Crypt8:AD 13 52 AE 9B 81 72 FB [O] Count:4295
PID: C9h Crypt8: D0 CF DE 2B 21 E0 DE 75 [E] Count:3931
PID: C9h Crypt8:0C FF 10 0B 62 89 CC FE [E] Count:3776
PID: C9h Crypt8:F6 50 A9 F2 29 71 CC 44 [E] Count:3736
PID: C9h Crypt8:09 91 3E FB 89 BD D6 3A [O] Count:3712
PID: C9h Crypt8:77 70 C9 30 74 A6 A1 F4 [E] Count:3586
PID: C9h Crypt8: D7 C2 C5 22 AC DB D6 8E [E] Count:3388
PID: C9h Crypt8:CC 1A 54 09 38 E9 A4 CB [O] Count:3281
...

PID: 12Dh Crypt8:67 82 E5 65 FC 97 41 3F [O] Count:3095
PID: 12Dh Crypt8:02 E3 C1 3F 1B 23 4C DF [E] Count:2371
PID: 12Dh Crypt8:B9 76 D9 D5 E9 A5 83 85 [E] Count:2340
PID: 12Dh Crypt8: DF 82 76 B1 F2 94 16 E9 [O] Count:2264
PID: 12Dh Crypt8:7F 72 59 B7 F0 BB 45 FF [O] Count:2219
PID: 12Dh Crypt8:E0 F1 6E A7 E8 6C C2 9E [E] Count:2187
PID: 12Dh Crypt8:E7 F7 B8 01 9B 2B 2C 95 [O] Count:2066
PID: 12Dh Crypt8:76 1B CF 3D 63 C4 8A 15 [O] Count:1969

Click to expand...

password will be sent by pm for those who are interested

19 CWs were found :thum: by using V1 and V2 from 20 Crypt8

Regards !!!

Click to expand...

here http://www.sat-universe.com/showpost.php?p=2036684544&postcount=531

**********************
**********************

gibsondale said:

intelsat 20
4064 H 19850
CNBC - Tanburg

PID: 550h Crypt8:A8 BB C3 51 B2 F2 60 FE [E] Count:7267
PID: 550h Crypt8:EA E6 F2 46 8E D0 06 8E [E] Count:6673
PID: 550h Crypt8:AD FD F3 E6 A1 F4 CF 1D [O] Count:4747
PID: 550h Crypt8:07 13 73 E7 B6 ED 4C DB [E] Count:4743

Click to expand...

MaRwAn26 said:

all 4 CWs keys were found and sent to your inbox :thum:

please help us and share with us here

Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

Click to expand...

MaRwAn26 said:

Could you show us in details how to use these CWs keys when found from the crypt8 you provided to get the ECM keys ? ...

Click to expand...

This was how it was explained to me:

JimBizkit said:

yes you are right, and I made a mistake, correct it should be:

if you want to brute force:
(1) brute force the cw with the rainbow table tool (like BISS) -> this gives you the cw
(2) get the EE nano tag from the ecm, that was sent during the brute forced cw period -> this will give you the encrypted cw
(3) you now have cw and (des-)encrypted cw, you can assume that the last byte of the des key is 00. now brute force the des key -> this is the ecm key

Click to expand...

I am only trying to follow those instructions to see where I get. I have no program to provide jet or any details. Just gathering info.

So I guess Bruteforce will be a waist of time, long long period, as there is no shortcuts.

MaRwAn26 said:

...so far I sent you 4 CWs of these C8...

Click to expand...

I received 1rst PM but not the password for CWs.rar! I guess I need to send you a PM.

I did re-post as requested in: http://www.sat-universe.com/showpost.php?p=2036684734&postcount=20550

But now I see your post =>

MaRwAn26 said:

I didn't see your help in this Tandberg thread
Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

so no more Tnadberg CWs keys from me anymore

Click to expand...

I am a big admired of all you masters. Yes I consider you a master. I see your help here. For that I have only thanks.

But you guys has to slow down, What is this "so no more Tnadberg CWs keys from me anymore "

Now I see why the CWs.rar has password!

Listen I am a nice unemployed guy that try to learn. I am not BOSS or making any sells. At the moment I have NOTHING to provide as I have NOTHING build. I am trying to see what is needed. As many logs from America has been post that show that poc.exe do not work. So Only solution I see at the moment is Bruteforce the ECM. SO since no body is doing it I thoght I give it a try.

But you masters has to slow down. Every time I try to join and help in this forum I get push and toss by many of you. I am a nice guy not a monster trying to take advantage of all of you.

So, if you guys want me to give it a try, send freely the password or the cw. But no more blackmail.

you understand me wrong

the message in the C8 thread was not for you

it was for gibsondale see here
http://www.sat-universe.com/showpost.php?p=2036684745&postcount=20554
which I gave him CWs keys and I thought he might share his knowledge with us here but he just kept it for himself and he is asking more for CWs that's why I say no more CWs from me.

the password is sent to you dale_para_bajo :thum:

let us hear from you if there is any progress

good luck

anyone could explain this in details, I will be appreciate it

JimBizkit said:

(2) get the EE nano tag from the ecm, that was sent during the brute forced cw period -> this will give you the encrypted cw
(3) you now have cw and (des-)encrypted cw, you can assume that the last byte of the des key is 00. now brute force the des key -> this is the ecm key

Click to expand...

MaRwAn26 said:

anyone could explain this in details, I will be appreciate it

Click to expand...

just take one crypto period,
use CSA-Rainbow tool to search the crypt8 and to get the plain CW,
in this crypto period look for the ECM pid where the 9th byte in this package is EE,
there you can see the encrypted CWs (see also http://www.sat-universe.com/showpost.php?p=2036680987&postcount=15 ),
depending on whether it is the odd or even crypto period the encrypted cw are the first or second 8 bytes,
now you have encrypted cw and plain cw, so you can bruteforce

xosef1234 said:

now you have encrypted cw and plain cw, so you can bruteforce

Click to expand...

This is made simpler as we know the last byte of the ECM Key is 00 however it is complicated as the checksum bytes in the plain CW are manipulated from the DES decrypted CW. Fortunately, one of those CS bytes is the last one so there is only the fourth byte to allow for.

And to clarify the explanation:

keep in mind you will have multiple "hits" with the key,in case you find one.
The idea is the checksum (the 4th and 8th byte of the ecm key) are sent by the provider at random meaning you will have FF options (for each of them) to find the correct ecm key .
Knowing the last byte of the key is always 00,makes it a little simpler (if the case applies to every tandberg channel) to brute force.


007.4
"Fortunately, one of those CS bytes is the last one so there is only the fourth byte to allow for."""

Not really,you are confusing the ECM key last byte with the CW last byte.
in our case,you will have to find the correct 8th byte,since the CW is not using 00,but a random number.
(Or maybe not random,but in any case is not the correct checksum byte)
You would have 256*2 different hits.


I think there is a case study here regarding this apparently random checksum bytes in the ecm.
Before start the brute force attack,I would suggest to check the way this bytes are generated.
Maybe a simple xor,or whatever,but finding this value will speed up the brute force attack on the key exponentially.

@Anubis_Ir

Are there maybe some chances for separate MDAPI plugin like for PowerVu? Not connected to vPlug? That would be awesome
Or maybe combo: BISS+PowerVu+Tandberg - DXer treasure plug? :clapping:

007.4 said:

This is made simpler as we know the last byte of the ECM Key is 00 however it is complicated as the checksum bytes in the plain CW are manipulated from the DES decrypted CW. Fortunately, one of those CS bytes is the last one so there is only the fourth byte to allow for.

Click to expand...

I agree that there will be 256^2 CW's possible due to random bytes in the checksum bytes, but you can sure search for only 6 bytes of a CW fit and the check then next CW if that fits as well

I would say if you look on some of the public ECM keys ending on 00
like xx xx xx xx xx xx xx 00 it not due to the keyare 64bit do use 00 as 1 byte, but to the fact that the DES only use 56 bit keys (the first 7 XX's)

When you go from a 64 bit DES key to 56 Key you will remove the 1 parity bit in each byte in the Key and end up with 56 bit

If you try to study some of the 00 keys you will see if there was a parity bit it's not correct, this make me to believe the 00 keys are a full 2^56 DES key without parity bit = very long time BF

BTW why on earth should anyone use 00 in all their important keys?

Hi Kebien

Thank you for your correction. I'm sure both of us know what we mean but make simple errors in writing it down
eg

kebien said:

The idea is the checksum (the 4th and 8th byte of the ecm key)

Click to expand...

I'm sure you meant "the 4th and 8th bytes of the CW"

hi, its there any pc emulator for tandberg?

12468 H
DVB-S2/8PSK
MPEG-4 9580 5/6
Turksat 42e channels tandberg is it work or is it hack keys

sometimes tanderg freezeing: not regularity by freezing time intervals between freezing
_http://prntscr.com/bolz3b

I HAVE DREAMBOX 800PVR ITS SUpport this?

007.4 said:

Hi Kebien

Thank you for your correction. I'm sure both of us know what we mean but make simple errors in writing it down
eg



I'm sure you meant "the 4th and 8th bytes of the CW"

Click to expand...

That is correct too,my mistake.
Corrections are good in the sense those trying to apply the theory must start with the correct statements/affirmations,would be a complete waste of time to start coding based in wrong input.
Good call.

This is the weirdest of all day!. I know US has its 4 of july. But what happened with the rest of the world!

This post was on a rally now suddenly 0 post from many hours, or a Day!

If I go to new post only 3 show up!

Even my FireFox decided to act weird and without explanations as all updates are disable. It went from ver 29 to version 43. It even show Sync symbol working even when I have no account for that!!! SO I went back to a backup copy. I am a few steps on not using windows any more. Now It seems FireFox will be worthless soon too. This is rediculous all programs want to do with MY HARDWARE what they want. I wonder who owns my PC. It seems it is not me!

Going back to business. So here I am more lost than before. Many hours of study and still I can not match a block of encryption with the proposed crypto8 clear txt. Without that nothing can be done.

I guess I was to ambitious and went right to a new recorded transponder just to fail. I need to go to the basics of colibri sample on page 1, 1rst post. Since we know all about that ts.

So can you guys look at post 49
http://www.sat-universe.com/showpost.php?p=2036681335&postcount=49

That clearly shows that this ts sample has 12 cws

I know nothing of crypto8 but by using ver1.3 I get ONLY

1) So if you see only 3 crypt8 vs 12 cws! Can any one explain this to me?

2) How I am supposed to match crypt8 vs any one of the 12 known cw.

3) Are the "Count:2,99,90" meaning anything?

4) By the way I will really appreciate the solution of those 3 crypto8. As I said it is of the colibri ts sample on page 1 post1.

Thanks ahead.

I know nothing of crypto8 but by using ver1.3 I get ONLY

Click to expand...

I guess you mean ver 1.03, but you should use the newest version 1.23.
You will see that there are more than those 3 crypt8. Anyway, as far as I know the tool just shows the 8 crypt8 with highest count which does not mean that there are no further crypt8. At the end, since you do not know which crypt8 belongs to which crypto period it will not help you at all.

So the first step is to extract the first crypto period and check for the corresponding crypt8.
Post this crypt8 and we will continue.