News Corp hired hacker to pirate DISH Network access cards

DISH Network and News Corp's satellite subsidiary NDS Group in California have been involved in an industrial espionage lawsuit for years now, but there was some big drama in court today: a hacker by the name of Christopher Tarnovsky (who used the handle "Big Gun," among others) testified that NDS hired him to create a device called "the stinger" that could reprogram DISH Network access cards. DISH lawyers say the plan was to flood the market with hacked cards, which would cost the satellite company $900M in revenue and repair costs. Unsurprisingly, NDS (which supplies DirecTV, among others), says that it hired Tarovsky only to reverse-engineer DISH's cards for competitive reasons, and Tarnovsky himself says that he believes "someone is trying to set him up." Sure, sure -- but no one's explaining why he was mailed mobile electronics from Canada with $20K in cash stashed inside, or why he was officially on the payroll of HarperCollins, a totally different NewCorp subsidiary, for more than 10 years. Sketchy sketchy -- and we thought satellite hacking was dead.

Read - Reuters article about Tarnovsky's testimony
Read - 2002 article about Tarnovsky and NDS

[aaron @ Apr 24th 2008 8:40PM]

Ahhhh, the days of the infamous (H4?) football card... :(

[Mr.Tech @ Apr 24th 2008 11:07PM]

I think the question everyone wants to know is this. Where can I get one of those hacked card myself? =D

[SurfinDude @ Apr 24th 2008 8:40PM]

Everyones playin dirty in the broadcast world...O wait, whats new? :-P

[Jawad @ Apr 24th 2008 8:47PM]

thats News to me

[SurfinDude @ Apr 24th 2008 8:51PM]

Just means you need to brush up on your history then ;-)

[Tim @ Apr 24th 2008 8:41PM]

Sounds like this should be made into a movie with Angelina and Halle showing us just how hot nerd chicks are.

[torqueo @ Apr 24th 2008 8:47PM]

I agree. Plus they should be naked.

[darkstar @ Apr 24th 2008 8:56PM]

did they ever hack xm or sirius???
seems like it should be simpler than sat tv.

[A.C.E.R. @ Apr 24th 2008 9:05PM]

Yeah they hacked it, but the signal reception without ground repeaters was so poor they said fuck it!

[hellspawn2 @ Apr 24th 2008 9:18PM]

Boy that was the Days!! the old F and H card and emulation!! Anonymous you're bringing up great memories. Remember the only thing you needed was the E3 write hole and the basic hex code 74 02 27 and bam!! free dave tv!! I heard rumors of some type of emulation with the p4 but around that time is when directv put the hammer down and started busting everyone that had bought iso programmers.

[Tony Rayo @ Apr 24th 2008 9:28PM]

I have a friend in Germany that obtains PPV for free. He says almost everyone in his town has a box to do this. Apparently in the Middle East (or at least two large towns I have seen), pirated sat. is almost at 100%. I am moving from the US to Japan soon and am still debating if I should risk deportation to get a cracked Sat signal. For educational purposes only of course. Feel free to e-mail me or reply to this post if you know anything or any place where Japanese Sat. cracking theory is done (oshidori AT gmail DOT com).

[zomg0t @ Apr 24th 2008 9:30PM]

DIIIIIIIIIIIIIIE!!!

[Fed @ Apr 24th 2008 9:32PM]

::Looks down at his working hacked card::
meh..guess these are hard to come by for some people now. I guess you just have to know where to look..

[Pavan @ Apr 24th 2008 9:49PM]

FTA FTW

[Matt @ Apr 24th 2008 10:28PM]

FTA is me dos!!

[rv @ Apr 24th 2008 9:41PM]

OMG HAX

[AnonymousCoward @ Apr 24th 2008 9:50PM]

The good old days of satellite hacking died with the inception of the P4 card and closing of the big piracy forums/sites, most notable the Pirates Den and HackHU. As far as the Dish Network hacking, it was never as popular as hacking DTV, but it was also much simpler. Hacking Dish could be done simply through an "activation" method- programming the access card to be in all ways the same as your normal card, just with all the channel tiers activated. This was easy enough, but Dish would frequently change the AVR, which meant you needed to either reprogram the card or get a Rolling AVR, which was all the rage. 3M's were uncommon for Dish. Hacking DTV was a much diverse scene. You could do Activation, 3M or emulation. The first two iterations of access card security, the F and H cards, were so insecure they could be programmed simply by opening a write-hole with a generic ISO-7816 programmer. The H card was thoroughly and completely hacked, including a very nice, complete emulator. The HU card was much more difficult, but could be programmed by "glitching" the card using various frequency via a programmer with a specially programmed Atmel chip in it. This was much riskier because it was possible to kill your card. In the end however, the P4 card had much, much better security and to my knowledge, no write-hole was ever opened on it.

[Ruben @ Apr 24th 2008 9:12PM]

DISH is the most poorly protected broadcaster around (along with all Nagravision 2 users). FTA boxes have made it so easy that all you do is load a new BIN in your Viewsat, Sonicview, etc. Now you can even do it with a USB key, or it can retrieve the bins/keys from the internet and self-heal.

They still use Nagravision 2, which has keys that are easily discoverable. They try to change the keys more frequently (or at least the generation code), but FTA makers have BINs out within 2 days of the code change.

Even HD from DISH is completely open.

But there are talks of Nagravision 3 coming about. While its claimed that this is hacked as well, it probably wont have the protection DirectTV has introduced, which so far is unbreakable.

This is, of course, what ive read...

[A.C.E.R. @ Apr 24th 2008 9:13PM]

The Dish scene was just as diverse as the DirecTV one. We had plenty of 3Ms and emulation tricks.

[4.7onN20 @ Apr 24th 2008 10:04PM]

3M cards are still plentiful though. Even the 10c rev has been glitched now. Last I heard they were supposed to start nagra 3 next jan but thats heresay. Right now there is a ridiculous amount of fta emulators out there. I have also heard that nagra 3 is hacked but it makes no sense for them to start using. Why would Charlie spend millions of dollars implementing nagra 3 cards if its already been owned.

[rTwelve @ Apr 24th 2008 10:01PM]

Oh man, these are the worst spammers ever, and they're on EVERY BLOG.

It's like a PLAGUE

[Virtuous @ Apr 24th 2008 11:27PM]

Murdock has no ethics.

[sxpilot @ May 5th 2008 9:13PM]

you are one ugly mo-fo!

[kg1 @ Apr 24th 2008 11:49PM]

This must be why my DISH signal has been fuzzy lately! ;) Seriously though, these are serious allegations both sides and the aforementioned hacker are making, big crappy news indeed.

[jamesFF @ Apr 25th 2008 12:06AM]

I was told that in Iraq they will sell you a dish and a box that has all the chanels unlock. They say you just move the dish a few degrees and you get a new set of chanels. Some are very interesting they say.

[krunal patel @ Apr 25th 2008 4:56AM]

NDS doesnt need tarnovsky... all they needed was to put pansat on their payroll

[Dan @ Apr 25th 2008 10:29AM]

At least we have Fox News to cover this in a fair and balanced manner.

[dc @ Apr 25th 2008 12:46PM]

the $20k cash payments were from canadian distributors for the original directv hacks. it was much more than 1 time payment, the industry was huge here in canada. BG on the payroll was because he was an unofficial NDS employee ensuring that future cards can not be hacked. the $40k that he got busted with was because after he began work with NDS he was still itching for tax free spending money. BG played both sides, gave up secrets to the hu card and helping develop a card programmer for dish cards. the programmer for dish cards was easy because the original overflow bug was already public info at that time. Once he got busted with the $40k thats when he became clean. I used to be deep in this business and know a lot of the details.

[Brian @ Apr 25th 2008 4:22PM]

My handle is "Big Gun" too. :)

[V @ Apr 27th 2008 12:14AM]

I am surprised we haven't heard of Sean Quinn, yet. He was selling Echo3m cards and was partnered with Tarnovsky et al. We all know that Dr.7 was also taking payments for the HU unlooper to be developed by Tarnovsky until it was released for free by Unatester. HUFF came first, then No1b4me released UL4S and it was all over for the HU at that point. Less than a year later we had the P4. Of course there were occurances between, like Black Sunday and the bootloaders, several variations of emulation for both H and HU cards. If I remember correctly, the battery cards were the first hack for Dave. People died over this stuff. It involves ridiculously large sums of money on many levels. Though the history is quite interesting.