We're living in an age of devices and applications that push the boundaries of dreams, an age of instant gratification, but also the age of Digital Rights Management and Copyright laws. With questionably illegal modifications becoming simple enough for children to use, where does the line get drawn between squeezing more functionality out of your digital devices and software and breaking felony laws? In this talk attendees will explore the justifications and rationales behind the use of questionable hardware and software modifications and understand the mentality behind why their use is rapidly catching on in the general population.
Hello!• – Computer Forensic Leader• DoD Cyber Crime Center– Defense Cyber Investigations TrainingAcademy (DCITA) – Deputy Technical Lead• Author / Co-Author of six books• 14 years of network / security / forensics• 20 years of computer hooliganism
Legal v. Illegal• “Unauthorized” vs. “Illegal”– Terms of Service vs. Law– Lines severely blurred since the DMCA– “copyright law now gives content ownersnew powers to silence creators ofunauthorized expression, including fairuse expression”– Julie Cohen, Professor of Law, Georgetown University
Consumers v. Criminals• Consumers are emotional and loyal• Will trust in a vendor until they feelbetrayed– If betrayed enough– and ease of crime is low enough– Consumer “Criminal”
Apple iPhone• Unlocking the phone– Modify firmware to allow it to connect tonon-AT&T networks– Currently legal under exemption filedNovember 2006 (expired today, extended)• Jailbreaking (iPhone and iPod Touch)– Allows installation of unauthorized apps– But… won’t somebody please think of thecell towers?!
Apple iPhone• The Bad– Apple / AT&T lose money if users switch networks– Pirated apps– Apps that conflict with Apple / AT&T business– Device can be used in ways that ruin Apple’sreputation• Obviously, anyone that does this is a bad guy,right?
Apple iPhone• The Good– Unlimited Functionality• SwirlyMMS – text messaging with MMS– Apple/AT&T added MMS 14 months later• Cycorder – Video Recorder• iLocalis – Remote control and locator of iPhone• xGPS – Free GPS reader for Google Maps• NemusSync – Sync Google Calendar• Five icon dock• Read PDF / Word / Excel documents
Apple iPhone• The … curious?– OpenSSH – SSH Server– LigHTTPD – Web Server• With PHP and SQLite capabilities– Veency – VNC Server
Apple iPhoneApple: Think Different (like everyone else)
Apple iPhone• So simple, even a skiddie could do it…• 3 Step Process with redsn0w orgreenpois0n– Download software and iPhone firmware– Connect device via USB/FW– Click button to load firmware• Over 4 million iPhones have beenjailbroken
Data on Websites• If it’s on the web is it:– Published?– Public?– Open for access?• Where does the onus of securitymorality lie?– User?– Host?
College Admissions• March 2005, steps posted to “hack” to checkcollege admission results on ApplyYourself• Results were already finalized, just notpublished to student’s page• “Hack”: Append login id to end of query URL• https://app.applyyourself.com/AyApplicantMain/ApplicantDecision.asp?AYID=89CFE0A-424C-4240-Z8D0-9CR5 2623F70&mode=decision&id=1234567
College Admissions• 119 Harvard Business School hopefulsattempted URL change– All were rejected from the school as aresult– Many other schools rejected “hackers”• “a serious breach of trust that cannot becountered by rationalization “– Kim Clark, then Dean at Harvard Business School
First Sale Doctrine• Copyright limitation implemented in theCopyright Act of 1976– Copyright owner cannot limit your ability toresell a product after initial purchase– Challenged by physical vs. digitaldistributions (eBay v. Steam)
First Sale Doctrine• And in walks the DMCA…– Timothy S. Vernor v. Autodesk Inc.– Company liquidated inventory of AutoCAD– Vernor sold software on eBay, had allauctions removed by eBay/Autodesk– Autodesk: EULA prevents resell or transfer,ruled transactions as violations of DMCA– Still awaiting judge’s decision…
Gaming• Video Gaming is big business– 42% of all US homes have a console – Average gamer spends over $700/yr – However, average gamer is also 35,overweight, and depressed…– June 2009: Only 50% of gamers wereunder 18 = more gamers have jobs
Gaming• Since the beginning there was hacking• Modifications were prohibitively complex– LPT ports, terminal applications– ROM patching– Modchip soldering
Gaming• Modifications are now extremely simple• Solderless solutions with ON/OFFswitches• Drag-n-dropsolutions onMicroSD
Gaming• The Bad:– Piracy– Online cheating• The Good:– Backup / import saved games– Cheat codes– Homebrew / new functionality– Bypass region locking
Gaming• Nintendo DS– Simple Slot-1 card with MicroSD reader– Drag-and-drop apps and ROMs– Homebrew:• MP3 / Movie player• Web browser• Organizer• DSLinux
Gaming• Nintendo Wii– Solderless Modchip– Hardmod (bad)– Softmod (good)– USB HDD support– Homebrew:• DVD Player• Media Center• Wii Linux
Gaming• Nintendo Wii– Hardmod• Allows for playing burned games– Softmod• Allows for playing game images• Runs homebrewCurrent Exploits:Twilight HackBannerbombSmash StackIndiana Pwns
Gaming• Legalities– Console producers heavilydiscourage homebrew apps andmodding– 28 Sep 09 – Wii 4.2 System updateseeks and destroys all homebrewapps• Nintendo code was rushed and bugged,bricking legitimate Wiishttp://modtechs.com/tag/matthew-crippen/
Gaming• Modifying a console to bypass copycontrol protection is a violation of DMCA– Aug 2009 - Matthew Crippen, 27 yr oldcollege student, indicted on two counts ofmodifying consoles for friends– Faces 10 years of federal time – Robert Schoch, ICE special agent "Playingwith games in this way is not a game -- it iscriminal." 
Conclusion• Things are going to get much worsebefore they get better– Corporations / governments are slow toevolve and rely heavily on law– The public evolves very quickly and relieson morals– Both rely on self-interest, convenience, andgreed
Conclusion• Consumers are on the losing side– Suppliers will constantly find new ways toexploit hardware/software– Consumers will seek ways to extendcapabilities– Corporations will treat consumers ascriminals until… they really do becomecriminals
Conclusion• Education is the primary answer– Public need better education on copyrightsand legal system, and it needs to start withthe kids– Corporations and government need tounderstand the changing movements oftheir bosses (the public)• “I don’t use understand or use it, but I’m going tocontrol it”
Conclusion• Words to watch in the next year:• “Making available”– RIAA’s legal suits were partially based notupon committing a crime, but makingavailable for the opportunity to commit one– HR 1319 (Informed P2P User Act - Rep.Mary Bono, R-CA)