The best quality video viewing device known as the Blu-Ray player can easily be hacked through 2 different approaches, stated British hacker Stephen Tomkinson. He claimed about having built a disc which has the capabilities of detecting the player's type which can execute it's own special programs before continuing to play the desired video on the disc without the knowledge of it's user. This attack can be used to carry further attacks on to the target network or get hold of sensitive files.

Blu-Ray is the best technology in the market which provides a superior video quality as compared to a DVD having a enhanced user experience over the outlay design from menus to embedded games. These features are built using a java variant known as the BD-J which permits the disc authors to design the embedded applications & user interface structuring them into Xlets. " An Xlet is an application or service designed to be run and controlled by an application manager via this lifecycle interface. The lifecycle states allow the application manager to manage the activities of multiple Xlets within a runtime environment by selecting which Xlets are active at a given time "

About the Vulnerabilities

1. Windows Auto-Run Bypass Vulnerability

PowerDVD has been supporting Blu-Ray for quite some time now but with no major upgradation to the security structure. This vulnerability focuses mainly on the mechanism of bypassing Window's auto-run integrations. PowerDVD is a software generally installed in devices who run Blu-Ray discs for it's better optimization as well as customization. This PowerDVD is tightly structured with additional Java classes by provide better functionality to the internal player with the ability of calling the Xlets present on the disc.

The CUtil class which has access to functions in the native coding falls outside the purview of Security Manager. The functions which can be accessed stores the details of current licence, the pop-up windows & then can easily read the files arbitrarily from the disc.

2. Physical Blu-Ray Players

The attacker attaches a USB stick to which has files present in the library that are coded by the attacker as well as controlled by him. Though not all the users favour the use of USBs so it has made it's way into Blu-Ray discs. Now that the infected disc make its entry into the system, the proceeding case is fairly simple to exploit the embedded system which is specially designed system of Linux by BusyBox.

Looking at the listening network services we see there are two services which are bound to localhost (the net inf daemon and the ipc daemon):

" The two daemons aren't accessible to external network users, but as our Xlets are executing on the same system they will have network access to them. Handily these two daemons also have equivalent client applications on the player named ipcc and netinfc. From these we can determine that the IPC daemon includes an execute function which will run a command provided over the network. As everything on the player runs as root, this gives us a way in if we can emulate the client ", the report stated.

Instead of using reverse engineering for IPC protocol, it is deemed fit to use tcpdump command to ignore the TCP stream while engaging some other execute request already present on the disc from the application of IPC client. Using this PCAP dump it is fairly easy to remove TCP stream & write a Java Xlet which will be associated in replaying the same byte back to the daemon. The whole action will now be ready to launch the attack using the Blu-Ray under a conducive environment.

Conclusion

Both vulnerabilities can be used considering if one has knowledge about the player it is being run on. In "PowerDVD" it can be exploited by requesting the Java system's property, "http.agent" which in return will give us "CyberLink PowerDVD" while a similar request on our physical player results in a SecurityException.

Mitigation

• Don't use any removable media from unconfirmed origins.
• Use the AutoPlay section of control panel to stop discs playing as soon as they're inserted:

'

• Many physical players have settings to prevent discs from accessing the Internet for privacy reasons. In practice this can disable all BDJ network access including access to localhost which will effectively block the second vulnerability.
• Consider if network connectivity is essential for your hardware Blu-ray player usage and if not do not connect it to network/Internet.