back to article Bad movie: Hackers can raid networks with burnt Blu-Rays

British hacker Stephen Tomkinson has found two Blu-Ray-borne attacks. His first exploit relies on a poor Java implementation in a product called PowerDVD from CyberLink. PowerDVD plays DVDs on PCs and creates menus using Java, but the way Oracle's code has been used allows naughty folk to circumvent Windows security controls …

  1. frank ly

    "... avoid playing Blu-Ray discs from untrusted origins ..."

    Any suggestions for an untrusted origin?

    1. Shadow Systems Silver badge

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Untrusted source? That would be the MPAA? =-)p

    2. Phil O'Sophical Silver badge

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Any suggestions for an untrusted origin?

      Torrented ISO images?

    3. Anonymous Coward
      Anonymous Coward

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Car boot sales where the labels are glued onto the disc?

    4. Russell Hancock

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Can you advise a TRUSTED source please? i don't trust any of the major publishers!

      1. Anonymous Coward
        Anonymous Coward

        Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

        Indeed - sounds like the kind of thing the big studios are far more likely to use over a "legit" malware pusher.

        1. PNGuinn
          FAIL

          Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

          -COUGH-

          Sony?

          Lenovo?

          Everyone Else?

          /-COUGH-

    5. RainForestGuppy

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Lenovo for one ;-)

    6. Amorous Cowherder
      Mushroom

      Re: "... avoid playing Blu-Ray discs from untrusted origins ..."

      Untrusted source? That would be a certain Japanese company by the name of SONY I believe. They've proved once they can't be trusted with even a simple CD, tech has moved on and become more complex and so I certainly wouldn't trust any media they have to sell me.

  2. Anonymous Coward
    Anonymous Coward

    Simple this,

    Rip the disk, tons of software now to decrypt em.

    Stopped using Power DVD ages ago, when it became bloatware and bloatware with the insidious "moovie" live thing...

    Piece of software that should be buried alongside Atari 2600 ET carts!

    1. Captain Scarlet Silver badge

      Re: Simple this,

      moovie is long gone and the current version has got rid of some of the boat, however if I could I would still use PowerDVD 5

    2. Trevor_Pott Gold badge

      Re: Simple this,

      "Piece of software that should be buried alongside Atari 2600 ET carts!"

      Ars Technica dug those up.

      1. Anonymous Coward
        Anonymous Coward

        Re: Simple this,

        > Ars Technica dug those up.

        Also, E.T. can actually be fixed...

  3. Anonymous Coward
    WTF?

    Eh?

    "...it's possible to put executables onto Blu-Ray disks and to make those disks run automatically on startup even when Windows is set to stop that outcome"

    "Tomkinson recommends .....prevent discs from auto-playing and accessing the internet"

    Ooookkkaaaaayyy.

  4. Annihilator
    Trollface

    "His first exploit relies on a poor Java implementation"

    His and all the others...

  5. VinceH

    "Users would have no reason to suspect the whirring of an optical drive indicated unknown software was running, making this a potentially nasty attack handy back door for companies who wish to repeat Sony's (CD) mistake."

    FTFY!

  6. Anonymous Coward
    Anonymous Coward

    Java - again

    There is no reason to have Java installed on any computer, for any reason. It is a security risk worse than Flash. If your software vendor insists of Java, find a better vendor. Java is not only riddled with security flaws, it is a slow an bloated P.O.S. that will only ruin your day.

    .Net is by far the more secure and performant choice; either server or client.

    1. Anonymous Coward
      Anonymous Coward

      Re: Java - again

      .NET is secure and performant?

      Tell the London Stock Exchange:

      http://www.computerworld.com/article/2467082/data-center/london-stock-exchange-to-abandon-failed-windows-platform.html

      1. Anonymous Coward
        Anonymous Coward

        Re: Java - again

        ".NET is secure and performant?

        Tell the London Stock Exchange:

        http://www.computerworld.com/article/2467082/data-center/london-stock-exchange-to-abandon-failed-windows-platform.html"

        Reading that and several related articles quickly shows that there were no security issues and that the system performed as per the design specification - to sub 10ms transaction latency - or 14 times faster than the system it replaced. The failure mentioned was also nothing to do with the software stack, but was network related.

    2. Tom 38 Silver badge

      Re: Java - again

      There is no reason to have Java installed on any computer, for any reason.

      How do you reconcile that position with the fact that blu ray are players mandated to support BD-J in order to get one of those lovely blu ray icons?

      1. Anonymous Coward
        Anonymous Coward

        Re: Java - again

        "How do you reconcile that position with the fact that blu ray are players mandated to support BD-J in order to get one of those lovely blu ray icons?"

        I reconcile it using TPB.

    3. Joe Drunk

      Re: Java - again

      There was a time when Java was a multi-platform OS. Write once, run anywhere. Somewhere along the line it became a slow, resource hogging programming language that seems to be the favorite of companies wanting to save money on a still pretty much write once, run anywhere, albeit slowly and poorly programming language. I thought it was just a Windows thing but it runs equally slowly on Linux. It seems that Java has become the bastard legacy programming child adopted by Oracle.

      Fortunately I don't have any dependencies on Java so it doesn't exist on any of my systems and I avoid it at all costs.

      PowerDVD? That monstrosity still around? I guess if you buy a new PC with a blu-ray drive you will have the misfortune of having that pre-installed (trial version?).

    4. Anonymous Coward
      Anonymous Coward

      Re: Java - again

      Hi, you again?

      There is no reason to have Java installed on any computer, for any reason.

      Cool, come and administer about 80% of my hardware without it. Good luck.

      1. Anonymous Coward
        Anonymous Coward

        Re: Java - again

        "Cool, come and administer about 80% of my hardware without it. Good luck."

        Sure. Step 1 - remove all hardware that mandates one of the most serious infection vectors as a dependency.

        1. Anonymous Coward
          Meh

          Re: Java - again

          No problem, need about £2million quid to do that to replace with an MS system.

          And if you can match reliability...one device 753 days uptime so far, another 4 devices 689 days uptime.

      2. Anonymous Coward
        Anonymous Coward

        Re: Java - again

        I've lost the ability to run eclipse and solr now.

        Please tell me some free alternatives that work as well and as fast as solr, maybe I should go back to sql likes and slow searches

    5. MacroRodent Silver badge

      Re: Java - again

      There is nothing wrong with Java if you use it as a "normal" programming language. Used that way, it is safer than say C++. The trouble starts only when you try using it as a sandboxed runtime for executing code from unknown sources.

  7. Mark Allen

    Blu-ray hardware

    An how many computers or laptops actually have Blu-Ray players in them? Or is the PowerDVD bug also going to work with DVDs?

    1. Anonymous Coward
      Anonymous Coward

      Re: Blu-ray hardware

      Most modern PCs will ship with Blu-Ray (possibly CD/DVD/Blu-Ray combo drives). The only exceptions I can think of are ultrabooks.

  8. batfastad
    Stop

    Blue Ray?

    Is this some sort of physical media format?

    Joking aside, I just don't have the space or desire to store a crate of discs for someone. If the publishers/studio wants me to store a copy of their latest "re-make of a prequel to a re-make of a book" for them then that's fine. Storage prices start at £20 per year for long-term archival. Though contracts might be terminated without notice when I decide to dump them at a charity shop.

    If they want me to give up my time to actually watch their latest "re-make of a prequel to a re-make of a book" then that will cost them $£$$£. Prices on application.

    Their business model is all wrong :)

    1. JEDIDIAH
      Devil

      Re: Blue Ray?

      > Joking aside, I just don't have the space or desire to store a crate of discs for someone.

      You don't have an extra cubic foot of space? Who are you? Jed Clampett? How can you even be posting? I don't think they have Internet service that far back in the woods.

      1. Michael Wojcik Silver badge

        Re: Blue Ray?

        You don't have an extra cubic foot of space?

        Indeed. I don't own a single Blu-Ray disk - I'm not sure if I even have a BR player (possible one of my computers has a BR drive). I have no interest whatsoever in the format. DVD works1 on the rare occasions when I want to watch a recorded program.2

        But this argument - "where can I store all these troublesome disks?!!" - rather strains credulity. Take 'em out of the case and put them in one of those notebook-style holders if you must. Even in a highly space-constrained environment (a Hong Kong flat, say) there must be some place you can stick something the size of a coffee-table book.

        1When the menu and other aspects were designed by someone who's not suffering severe brain damage, which seems to be about 50% of the time. I rented a DVD of The Italian Job (the real one) once, and the idiots who produced it had disabled all the controls. Couldn't even pause, rewind, or fast-forward. One title for the entire film. We were interrupted halfway through and never got around to rewatching the whole thing from the beginning.

        2Generally when I'm donating platelets at the Red Cross. Apheresis is about as lazy a way to give something back as I can imagine, but it does mean lying on a couch for upwards of an hour with needles in both arms, which makes it hard to do anything productive.

  9. Jamie Kitson

    Part of HP Bloatware

    I removed PowerDVD from my wife's HP laptop the other day. We only realised it was installed when it started nagging her every time she turned the thing on.

    1. Sandtitz Silver badge

      Re: Part of HP Bloatware

      "I removed PowerDVD from my wife's HP laptop the other day."

      What Blu-ray playback software would you recommend then?

      1. JEDIDIAH
        Linux

        Re: Part of HP Bloatware

        > What Blu-ray playback software would you recommend then?

        Something that just plays the stream you are interested in. Perversely, the MacOS BD player is a better option in this regard. Ripping the content away from the context of the rest of the disk is also a good option.

        1. Sandtitz Silver badge

          Re: Part of HP Bloatware

          "Something that just plays the stream you are interested in. Perversely, the MacOS BD player is a better option in this regard. Ripping the content away from the context of the rest of the disk is also a good option."

          Let me rephrase the question:

          What Blu-ray playback software would you recommend for the IT-declined people with their 'HP Laptops'?

          PowerDVD and such don't require ripping or searching for the correct stream file. HP pays something for the these programs so that people would be able to easily watch films. If HP was to replace it with another BD playback software what would you recommend? It doesn't have to be a free solution, but it should be easy to use for all those masses who buy computers from supermarkets.

      2. Cynic_999 Silver badge

        Re: Part of HP Bloatware

        "What Blu-ray playback software would you recommend then?"

        I use VLC. It won't play the whole disk, but it will play the movie file in the "stream" directory, which is all I am interested in watching. I don't have to sit through several minutes of FBI warnings and skipping movie trailers etc. The biggest file in the "stream" directory usually holds the entire movie, but a few movies are split over more than one m2ts file, so you have to look at the playlist to see which order to play them.

      3. DevinMariah

        Re: Part of HP Bloatware

        Macgo Blu-ray player is the software I'm using currently which I thought was the most legitimate looking one, cheaper and easier as well.

      4. DevinMariah

        Re: Part of HP Bloatware

        Macgo Blu-ray player is the software I'm using currently which I thought was the most legitimate looking one, cheaper and easier as well.

        http://www.macblurayplayer.com/

      5. JCitizen
        Coffee/keyboard

        Re: Part of HP Bloatware

        For HP users, there should already have been an HP program called "DVD play BD" in the programs list, and it should automatically come on anytime you play a blu-ray. As soon as Secunia PSI tagged PowerDVD as vulnerable I got rid of it - which severely pissed me off, because I had payed for an upgrade trying to avoid that. The stupid program got in a fight with all the DRM spies the IAA put on my computer when I bought it, and also seemed to be trying to destroy my built in HP software. So GOOD RIDDANCE Cyberlink. See if I ever try to spend a dime on their crap ever again!!

    2. Amorous Cowherder
      Thumb Up

      Re: Part of HP Bloatware

      "What Blu-ray playback software would you recommend then?"

      VLC! VLC! VLC! It reads the streams, not all the useless other shit they load onto discs. If you can't be arsed to dig about for the stream, simply pop in the disc and just throw VLC at the disc and it will soon fathom out where the menu system is and show that to you.

      Let me expand that, "What movie (file) playback software would you recommend then?"

      VLC! VLC! VLC! Transparent source and I've yet to find a format it won't at least have a crack at playing on any platform I've used it on, Linux, Windows, OSX and Android.

  10. SealTeam6

    Java is NOT an OS

    to Joe Drunk

  11. Anonymous Coward
    Anonymous Coward

    Which titles?

    No mention of which Sony titles have this malware?

  12. earl grey Silver badge
    Trollface

    Blu Ray?

    Right after i pour lighter fluid on my crotch and light it up.

  13. This post has been deleted by a moderator

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019