YT YouTube2Text

YouTube2Text → Transcripts → DirecTV’s Black Sunday: The Update That Killed Pirate TV Cards

DirecTV’s Black Sunday: The Update That Killed Pirate TV Cards — Transcript

by Tech Meter · 6,432 words · 1,015 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00On the evening of Sunday, January 21st,
0:022001, millions of people across North
0:05America were sitting in their living
0:07rooms watching television. The NFL
0:09playoffs had just wrapped up for the
0:11day, and [music] the biggest broadcast
0:12event of the year, Super Bowl 35 between
0:15the Baltimore Ravens and the New York
0:17Giants, was exactly 7 days away. For
0:20most people watching TV that night,
0:22nothing unusual happened. The
0:23commercials played, the local news came
0:25on, and everyone went to bed. But in
0:27hundreds of thousands of other living
0:29rooms across the United States and
0:31Canada, right in the middle of the
0:33evening, the television picture suddenly
0:35froze for a split second,
0:37>> [music]
0:37>> and then the screen went pitch black. A
0:39small gray dialogue box popped up in the
0:42center of the television reading, "This
0:44is an unrecognized card. Please call
0:46customer service." At first, people did
0:49what you always do when an electronic
0:50stops working. They got up off the
0:52couch, walked over to the black
0:54satellite receiver box sitting
0:55underneath the TV, pulled the plastic
0:57smart card out of the front slot, wiped
0:59the gold microchip contacts on their
1:01shirt, and slid it back in. Nothing
1:03happened. So they unplugged the box from
1:05the wall, waited 30 seconds, and plugged
1:07it back in. Still nothing. Within 20
1:10minutes, underground internet forums and
1:12chat rooms were completely flooded with
1:14panicked messages from people all over
1:16the continent asking the exact same
1:18question, [music]
1:19"Did your screen just go black, too?"
1:21What those people didn't know yet was
1:23that their television hadn't broken by
1:25accident. Every single person whose
1:27screen went dark that night had been
1:28using a modified DirecTV smart card, a
1:31small white piece of plastic that had
1:33been altered at home to unlock every
1:35movie channel, every sports package, and
1:37every pay-per-view event in the sky
1:39without paying a dime. And when hardware
1:41hackers pulled those dead cards out of
1:43their satellite boxes later that night,
1:45plugged them into custom circuit boards
1:47connected to their computers, and
1:49inspected the raw code inside the
1:50microchip to see what had gone wrong,
1:52they found something chilling. Not only
1:55had [music] an invisible command from
1:5622,000 miles in space permanently fried
1:59the memory inside every hacked card on
2:01the continent at the exact same time.
2:04Whoever wrote the attack had left a
2:05personal message behind. Right at the
2:07very top of the microchips memory, the
2:10first eight bytes of computer code had
2:11been overwritten to spell out two
2:13English words in capital letters, game
2:16over. That night went down in internet
2:18and hardware history as Black Sunday. It
2:21was the climax of one of the wildest,
2:23smartest, and strangest technological
2:25wars of the late 1990s and early 2000s.
2:28For nearly a decade, an underground army
2:30of backyard tinkerers, Canadian gray
2:33market dealers, and bedroom programmers
2:35went toe-to-toe against aerospace
2:37engineers, world-famous cryptographers,
2:39and a secretive corporate intelligence
2:40unit playing a multi-billion dollar game
2:43of cat and mouse over the television
2:45signals raining down from orbit. So, how
2:47did DirecTV slip this attack past the
2:49hackers? And did it actually put an end
2:51to satellite piracy? To understand why
2:54satellite television became the ultimate
2:56playground for hardware hackers in the
2:581990s, you first have to understand a
3:00basic physical problem with broadcasting
3:03anything from space. When a cable
3:05company sends television to your house,
3:07the signal travels through a physical
3:09copper or fiber optic wire buried under
3:11your street. If you don't pay your cable
3:13bill, the company can literally send a
3:15technician in a truck to climb a pole,
3:18unscrew the wire connected to your
3:19house, and cut you off. With a satellite
3:22floating 22,300
3:24miles above the equator, you cannot do
3:26that. Once a satellite beams a
3:28television signal down toward North
3:30America, that signal isn't aimed at
3:32individual houses. It falls over the
3:34entire continent like sunlight or rain.
3:36It hits every roof, every backyard, and
3:39every balcony from Mexico to northern
3:41Canada, whether the people living there
3:43pay for a subscription or not. In fact,
3:45for the first 10 years of satellite
3:47television, the signals weren't even
3:49locked. Back in the late 1970s and early
3:51'80s, networks like HBO, CNN, and ESPN
3:55started using giant satellites in orbit
3:57for a pretty simple business reason.
3:59They needed an easy way to beam their
4:01channels from their main headquarters to
4:03thousands of local cable companies
4:04scattered across the country. Those
4:06local cable companies had big satellite
4:08dishes out back, caught the clean signal
4:10from the sky, and sent it down the wires
4:12to paying customers in town. The
4:14networks never expected normal families
4:16to catch that signal directly from space
4:18because the equipment required to pick
4:20up those early analog C-band satellites
4:22cost tens of thousands of dollars and
4:25needed a metal dish 10 ft wide.
4:27Naturally, they underestimated how much
4:29people love free television. Starting
4:32around 1980, clever electrical engineers
4:35and rural homeowners who lived too far
4:37out in the country to get cable started
4:39building their own 10-ft aluminum mesh
4:41dishes in their backyards. People called
4:43them big ugly dishes or buds. And if you
4:47had one of those giant motorized dishes
4:48in your yard in 1984, it was like having
4:51a magic window into the television
4:53industry. You could turn the dish across
4:55the sky and watch every movie channel on
4:57Earth for free along with raw, unedited
5:00live news feeds where news anchors were
5:02sitting at their desks getting their
5:03makeup touched up and swearing during
5:05commercial breaks because they didn't
5:07think anyone at home was watching. By
5:091985, over a million backyard dishes had
5:12popped up across North America and the
5:14television networks panicked. So, on
5:16January 15th, 1986, HBO flipped the
5:20switch on the first serious commercial
5:22satellite lock, an analog scrambling
5:24system called VideoCipher II. Overnight,
5:27if you pointed your backyard dish at HBO
5:29without buying a pricey decoder box and
5:31paying $12.95 a month, the sound
5:34vanished and the picture looked like a
5:36warped inverted mess of static. Three
5:39months later, a furious satellite
5:41technician in Florida named John
5:42McDougall, calling himself Captain
5:44Midnight, aimed a commercial uplink dish
5:47at HBO's satellite during a midnight
5:48movie, overpowered their signal, and
5:51forced a full-screen text message onto
5:53televisions across the country
5:54protesting the $12.95 monthly fee.
5:57Captain Midnight got caught by the FCC,
6:00but thousands of quiet electronics
6:02hobbyists took a different route.
6:03Instead of jamming the satellite, they
6:05opened up the VideoCipher decoder boxes
6:07with screwdrivers, desoldered the memory
6:10chips inside, read the secret decryption
6:12keys, and started selling modified
6:14circuit boards out of the backs of
6:15magazines and across the Canadian
6:17border. Every time the manufacturer
6:19released a new version of the
6:20VideoCipher board, hackers cracked it
6:22within months. And each time they did,
6:25the satellite company had to physically
6:27manufacture and replace giant, expensive
6:30circuit boards inside people's living
6:31rooms. By the early 1990s, Hughes
6:34Electronics, the aerospace defense giant
6:37that was owned by General Motors at the
6:38time, was getting ready to launch a
6:40project that would change television
6:42forever. They called it DirecTV. Instead
6:45of using low-power analog signals that
6:47needed a 10-ft metal dish in the
6:49backyard, Hughes built high-powered
6:51digital satellites that beamed
6:52compressed MPEG-2 digital video down to
6:55a tiny 18-in gray dish the size of a
6:58large pizza, small enough to bolt onto
7:00the side of a suburban house or an
7:02apartment balcony. When DirecTV
7:04officially launched in June of 1994,
7:07alongside its RCA-branded digital
7:09satellite system receivers, it was the
7:11fastest-selling consumer electronics
7:13product in American history, selling
7:15faster than the VCR or the compact disc
7:17player. Suddenly, anyone could walk into
7:20Circuit City or Sears, buy a box, point
7:22a small dish at 101° west in the
7:25southern sky, and get 175 crystal-clear
7:28digital channels.
7:30Having watched the VideoCipher bloodbath
7:32of the 1980s, Hughes executives knew
7:34that with millions of 18-in dishes
7:36sitting on rooftops, pirates were going
7:38to come after DirecTV immediately. And
7:41they knew one thing for sure, they could
7:43not put the permanent security chip
7:45inside the metal receiver box under the
7:46TV. Because if hackers ever cracked a
7:49chip that was soldered inside 3 million
7:51living room receivers, replacing 3
7:53million receivers would bankrupt the
7:55company. So, to build the lock for
7:57DirecTV, Hughes hired a company called
7:59News Datacom, later known as NDS. NDS
8:03had been started in Israel by a group of
8:05elite cryptographers, including Adi
8:07Shamir, the co-inventor of the famous
8:09RSA encryption that still protects
8:11almost the entire modern internet, and
8:14was backed by media mogul Rupert
8:15Murdoch, who was already using their
8:17security system for his Sky satellite
8:19network in the UK. And NDS had a
8:22brilliant solution for keeping the
8:23satellite box cheap and replaceable. Put
8:26the entire brain of the security system
8:28inside a removable plastic smart card
8:30the size of a credit card. Even if you
8:33have never looked closely at a 1990s
8:35satellite receiver, you have seen a
8:37smart card before because it is the
8:38exact same technology as the little gold
8:41chip on your modern bank debit card or
8:43the SIM card inside your phone. That
8:45little gold square on the front of the
8:46plastic card isn't a battery or a
8:48magnet. It is just a set of flat metal
8:51contact pads connected by hair-thin gold
8:53wires to a tiny silicon computer sealed
8:56inside the plastic. Inside a 1994
8:59DirecTV smart card was a miniature 8-bit
9:01computer processor, specifically a
9:03Motorola 6805, along with a few
9:06kilobytes of permanent read-only memory
9:08called ROM, a tiny sliver of working
9:11RAM, and a small block of electrically
9:13erasable memory called EEPROM,
9:16which could be rewritten over the air to
9:17update what channels you were paying
9:19for. Here is how the whole thing worked
9:21when you sat down to watch TV. Up in
9:23space, the satellite scrambled the video
9:25stream using a fast mathematical cipher
9:28that changed its secret unlocking
9:29password, called the control word, every
9:3110 seconds. If your receiver box didn't
9:34get the new 8-byte control word every 10
9:36seconds, the picture froze. Now, the
9:39satellite didn't send that password down
9:41in plain sight. Instead, several times a
9:43minute, the satellite beamed down an
9:45encrypted mathematical puzzle right
9:47alongside the video signal. The metal
9:49receiver box under your TV caught that
9:51puzzle, passed it through the gold
9:53contacts into the plastic smart card,
9:55and asked the card to solve it. Inside
9:58the smart card, the tiny processor
10:00checked two things. First, does it know
10:02the top secret master math formula
10:04burned into its hardware? And second,
10:06does the subscriber list stored in its
10:08erasable memory say that this customer
10:11actually paid their bill for HBO or the
10:13pay-per-view fight tonight? If the
10:15answer to both was yes, the smart card
10:17solved the puzzle, spat the 8-byte
10:19unlocking word back out to the receiver
10:21box, and you got 10 more seconds of
10:23television. And if hackers ever managed
10:25to crack that smart card, DirecTV
10:27wouldn't have to replace a single
10:29receiver box. They could just stamp out
10:31millions of new plastic cards for a
10:33couple of dollars apiece, drop them in
10:35the mail, and tell every customer to
10:37pull out the old card and slide in the
10:38new one.
10:39On paper, NDS and DirecTV promised
10:42investors that this digital smart card
10:44system was virtually unhackable. In
10:47reality, before the very first DirecTV
10:49dish even hit store shelves in America
10:51in June of 1994, the security on their
10:54first smart card, known as the F card or
10:57the period one card, was already living
10:59on borrowed time. Why? Because to get
11:02DirecTV launched on schedule, NDS didn't
11:05design a brand new microchip from
11:06scratch for the American F card.
11:08Instead, they based it heavily on the
11:10card they had just rolled out a few
11:12months earlier in Europe for Rupert
11:14Murdoch's British Sky Broadcasting, a
11:16card known as the Sky 09. And over in
11:19Europe, a small group of underground
11:21hardware hackers and university
11:23researchers had already figured out how
11:25to break into it. Back then, if you
11:27wanted to read the secret master program
11:29locked inside a smart card's permanent
11:31memory, you couldn't just plug it into a
11:33computer and hit copy. The chip was
11:35designed to lock out anyone trying to
11:37read its internal ROM. So, European
11:39hackers resorted to techniques that
11:41sounded like something out of a spy
11:43movie. Some labs used fuming nitric acid
11:45to physically dissolve the plastic and
11:47epoxy over the silicon chip, looked at
11:49the microscopic transistors under an
11:51electron microscope, and placed tiny
11:53micro probes directly onto the data
11:56lines inside the chip. Even more
11:58cleverly, hackers discovered that NDS
12:00had built an over-the-air update feature
12:02into the card's software, little hidden
12:04instructions called nano commands that
12:06let the satellite company rewrite bytes
12:08in the card's erasable memory. By
12:10feeding the card crafted instructions
12:12one byte at a time and watching how long
12:14the chip took to respond or how much
12:16electrical current it drew, hackers
12:18tricked the card into spitting out its
12:20own secret code from the inside out. A
12:22trick the European underground called
12:24the vampire hack. Once the guts of the
12:27European system were exposed, that
12:29knowledge jumped across the Atlantic
12:31almost immediately. And the place where
12:33the North American satellite hacking
12:34explosion truly took off wasn't
12:36California or New York, it was Canada.
12:39If you didn't live in Canada during the
12:41late 1990s, it is hard to overstate just
12:44how massive hacked American satellite TV
12:46became north of the border. By the year
12:482000, industry analysts estimated that
12:51nearly one out of every five households
12:53with a satellite dish in Canada was
12:55watching hacked American DirecTV. And
12:58the [clears throat] reason why came down
12:59to a bizarre legal loophole. When
13:02DirecTV aimed its satellites at the
13:03United States from orbit, the signal
13:06didn't magically stop at the US-Canada
13:08border. The signal was crystal clear
13:10across almost every major Canadian city.
13:13Even crazier, electronic stores across
13:15Canada were allowed to sell the 18-in
13:18RCA dishes and receivers right on the
13:20shelf. However, Canadian broadcasting
13:22regulators, the CRTC, refused to license
13:26DirecTV to operate in Canada because
13:28they wanted to protect Canadian cable
13:30companies until Canada could launch its
13:32own satellite services. So, if you were
13:34a Canadian who bought an 18-in dish at a
13:36store in Toronto or Vancouver and called
13:39DirecTV with your credit card to pay for
13:41a legal subscription, DirecTV had to
13:43tell you no. That created a surreal
13:46situation where millions of Canadians
13:48had the signal hitting their roofs, had
13:50the hardware in their living rooms, and
13:52wanted to pay for TV, but weren't
13:54legally allowed to buy it. At one point,
13:56a judge in Quebec even threw out charges
13:58against satellite dealers with the
14:00famous logic that you cannot steal
14:02something that the owner refuses to sell
14:04you. Almost overnight, a massive cottage
14:07industry was born in Canadian border
14:08towns and suburbs. First, thousands of
14:11people signed up for what was called the
14:12gray market, paying a middleman with a
14:15post office box in Florida or Montana to
14:17set up a legal American account in their
14:19name. And then, around the fall of 1995,
14:23Canadian hardware hackers, including
14:25veterans of the 1980s video cipher wars,
14:27like Norman Dick in Victoria, British
14:29Columbia, stopped bothering with legal
14:31subscriptions altogether and released
14:33the infamous Canadian battery card.
14:36Because the original DirecTV F card
14:38didn't have any custom hardware
14:39encryption chips inside it, just a
14:41standard processor running soft ware.
14:43Hackers realized they didn't even need a
14:45real DirecTV card. They built custom
14:47circuit boards sized to fit into the
14:49receiver slot, soldered on a processor
14:51and a small round watch battery to keep
14:53the memory alive, loaded the cracked
14:55DirecTV code onto it, and sold them for
14:58$700 a piece. When you slid a battery
15:01card into your box, every single channel
15:03on DirecTV and USSB unlocked instantly.
15:06DirecTV and the police fought back hard.
15:09In June of 1996, the FBI and the Royal
15:12Canadian Mounted Police launched
15:14coordinated raids across four countries,
15:16seizing thousands of bootleg cards and
15:18suing dozens of dealers. But the code
15:21was already out on the internet, and now
15:23hackers had figured out how to reprogram
15:25standard plastic F cards without even
15:27needing the bulky battery board. DirecTV
15:29realized their first generation card was
15:31completely toast. It was time to pull
15:34the trigger on their backup plan.
15:36Starting in 1997, DirecTV spent tens of
15:39millions of dollars manufacturing and
15:41mailing out a brand new second
15:43generation smart card to every single
15:45subscriber. Known officially as the
15:47period two card, or as everyone in the
15:49world called it, the H card, because the
15:51serial numbers on the back started with
15:53the letter H. Once all the paying
15:55customers had swapped their cards,
15:57DirecTV shut off the old F card data
15:59stream forever. Now, NDS had learned a
16:02big lesson from the F card disaster. The
16:04reason pirates had been able to
16:05manufacture fake F cards in their
16:07garages was that the F card only used a
16:09standard processor. So, inside the new
16:12white H card, right alongside the main
16:15processor, NDS added a custom-built
16:17hardware chip called an ASIC, an
16:20application-specific integrated circuit.
16:22Whenever the satellite sent a math
16:24puzzle down to the H card, the processor
16:26had to pass the numbers through that
16:28secret hardware chip to get the right
16:30answer. And because that custom silicon
16:32chip couldn't be bought at an electronic
16:34store or simulated on a cheap
16:36microcontroller, pirates could no longer
16:38manufacture fake cards from scratch. To
16:40watch DirecTV now, you absolutely had to
16:43have a genuine factory-made DirecTV H
16:46card in your box. For a few months in
16:481997, DirecTV executives breathed a sigh
16:51of relief. They figured that since
16:53nobody could make fake cards anymore,
16:55piracy was dead. They overlooked one
16:58massive detail. There were already
17:00millions of genuine H cards sitting out
17:02in the wild, in electronic store display
17:04boxes, in canceled subscriber accounts,
17:07and on the second-hand market. And while
17:09hackers couldn't copy the secret
17:10hardware chip inside the H card, they
17:13didn't need to. They just needed to
17:14trick the genuine H card into thinking
17:17it was subscribed to every channel.
17:19Think about how a genuine H card worked.
17:21The permanent ROM inside the card held
17:23the main operating system, which
17:25couldn't be changed. But the card's
17:27erasable memory, the EEPROM, held your
17:29personal subscription tiers, your
17:31spending limits for pay-per-view movies,
17:33and small software patches that DirecTV
17:35sent down from space. Normally, the card
17:38wouldn't let an outside computer just
17:39plug in and rewrite that erasable memory
17:42unless you knew the secret passwords.
17:44But hardware hackers discovered a flaw,
17:46known in the scene as a hole, in how the
17:49H card handled memory commands and power
17:51spikes. Within months of the H card
17:53launching, a group of hackers released a
17:55tiny software patch that became
17:57legendary across North America, the 3M
18:00hack, short for the Three Musketeers.
18:03Using a $50 hobbyist smart card reader
18:05called a Phoenix programmer, plugged
18:07into the serial port on the back of a
18:09regular home Windows PC, you could slide
18:12a deactivated expired H card into the
18:14slot, run a small program, and inject a
18:17few dozen bytes of custom 3M code
18:19straight into the card's erasable
18:21memory. That tiny patch acted like a
18:23crooked bouncer standing at the door of
18:25a nightclub. Whenever the satellite
18:27receiver asked the H card, "Hey, is this
18:29person subscribed to HBO, Cinemax,
18:32Showtime, NFL Sunday Ticket, and the
18:34pay-per-view boxing match tonight?" The
18:363M patch intercepted the question before
18:39the card could check its real
18:40subscription list and immediately
18:41replied, "Yep, they paid for everything.
18:44Go ahead and unscramble the picture."
18:46Between 1998 and the year 2000, the H
18:49card turned satellite hacking from a
18:51niche electronics hobby into a
18:52full-blown suburban craze. You didn't
18:55need a soldering iron or an engineering
18:57degree anymore. Every office building,
18:59factory floor, firehouse, and
19:01neighborhood had a guy, some coworker or
19:03cousin who owned a $50 smart card
19:06programmer and charged 50 bucks to
19:07program your H card for you. Deactivated
19:10H cards that were literally worthless
19:12pieces of plastic if you canceled your
19:14subscription were suddenly selling on
19:16eBay and in classified ads for 300 to
19:18$400 each.
19:20Inside DirecTV's Security Center in El
19:23Segundo, California, and at NDS's
19:25laboratories in Israel, California, and
19:27the UK, this was a five-alarm crisis.
19:31Billions of dollars in potential
19:33subscription and pay-per-view revenue
19:34were vanishing into thin air. And
19:37issuing a third-generation card to
19:38millions of customers would take years
19:41and cost upwards of a hundred million
19:43dollars. They had to fight the hackers
19:45using the H cards that were already in
19:47people's boxes. And the only weapon they
19:49had to reach into millions of living
19:51rooms at once was the ECM, the
19:53electronic countermeasure. An ECM was
19:56basically a booby-trapped software
19:58update beamed down from the satellite.
20:00Remember how NDS had designed the smart
20:02cards so that the satellite could send
20:04tiny nano commands over the air to
20:06update the erasable EEPROM inside every
20:09card? Well, legally subscribed cards and
20:12hacked 3M cards were both listening to
20:14the exact same satellite signal. DirecTV
20:17couldn't tell from space whose living
20:19room had a hacked card because a The
20:21dish only receives signals. It never
20:23transmits anything back up into space.
20:26So, instead, DirecTV's engineers started
20:28writing clever little diagnostic
20:30programs and beaming them down inside
20:32the normal channel data to every single
20:34card in North America. When that tiny
20:37program landed inside your smart card,
20:39it looked around inside the card's
20:40erasable memory to check if everything
20:42was exactly where factory code was
20:44supposed to be. If you had a clean,
20:46legal card that hadn't been touched, the
20:48test passed, the card updated its normal
20:50checksum number, and you kept watching
20:52TV without ever knowing anything
20:54happened. But, if the diagnostic program
20:56looked inside your card's memory and
20:58spotted a single byte of the pirate 3M
21:00patch, or noticed that a memory address
21:03had been altered, the ECM sprung a trap.
21:06Before the hacked card could stop it,
21:08the ECM instructed the card to overwrite
21:10a crucial part of its own startup memory
21:12in the EEPROM, forcing the card's
21:14processor to jump into an endless
21:16dead-end circular loop the next time it
21:18tried to run. In the hacker
21:19[clears throat] scene, this was called
21:21getting looped, or getting hit with a 99
21:24loop, because when you plugged the dead
21:26card into a computer diagnostic tool,
21:28the screen just spat out the hexadecimal
21:30code 99 over and over again forever. The
21:34very first major ECM hit the 3M cards on
21:37November 21st, 1997, followed by
21:40[clears throat] an even bigger one on
21:41January 15th, 1998, and another famous
21:44one in October of 1998, called the magic
21:47ECM. Each time DirecTV fired an ECM from
21:51space, hundreds of thousands of TVs went
21:53dark. And for a few days, DirecTV
21:56thought they had permanently killed the
21:58hacked cards, because once a card was
22:00stuck in an endless boot loop, a
22:01standard smart card programmer couldn't
22:03even talk to the card to erase the bad
22:05byte. And how did the underground
22:07respond? They invented one of the
22:09coolest pieces of backyard hacker
22:11hardware ever made, the unlooper.
22:14Initially pioneered by a Canadian
22:16hardware wizard named Eddie at Northsat
22:18in Winnipeg, Manitoba, and later turned
22:20into famous mass-produced hobby boards
22:22with names like the WildThing unlooper,
22:24the concept behind an unlooper was pure
22:27lateral thinking. When a looped H card
22:29turned on, the processor followed its
22:31startup instructions step-by-step until
22:33it hit the booby-trapped memory address
22:35that sent it into an endless circle. You
22:37couldn't change that memory address
22:39normally because the card crashed into
22:41the loop before it ever turned on its
22:42serial communication port. So, the
22:44unlooper used a technique called voltage
22:47and clock glitching. You slid your dead
22:49looped H card into the unlooper circuit
22:51board. A small microcontroller on the
22:54unlooper powered up the H card and
22:56counted the exact microsecond clock
22:58ticks as the H card's processor woke up.
23:00Then, at the exact microsecond the H
23:03card's processor was about to read the
23:04booby-trapped loop instruction, the
23:06unlooper suddenly dropped the electrical
23:08voltage and spiked the clock speed for a
23:10billionth of a second. That tiny
23:12electrical hiccup caused the processor
23:14inside the smart card to literally
23:16stumble and skip right over the trap
23:18instruction, just like bumping a record
23:20player makes the needle skip across a
23:22scratched groove on a vinyl record,
23:24dropping the card straight into its
23:25repair mode where the unlooper could
23:27wipe out DirecTV's trap and restore the
23:29card to working order in 10 seconds
23:31flat.
23:33By 1999 and the year 2000, the war had
23:36turned into an embarrassing routine for
23:37DirecTV. Hackers had even added software
23:40blockers to their cards that ignored
23:42unauthorized updates from the satellite
23:44or built wedge cards and combo cards
23:46that sat between the H card and the
23:48receiver. Whenever DirecTV beamed down a
23:51new ECM on a Friday afternoon right
23:53before a big pay-per-view boxing match
23:55or wrestling event, thousands of
23:56hobbyists immediately logged onto
23:58websites like DSSTester, DR7, or IRC
24:02chat channels. Within 15 or 20 minutes
24:05of the attack coming down from orbit,
24:06top reverse engineers in the scene had
24:08already captured the satellite data
24:10stream, disassembled DirecTV's code,
24:12written a bypass script, and uploaded
24:14the new fix to the internet. People just
24:17walked from their living room to their
24:18computer desk, flashed the new file onto
24:20their card in 30 seconds, walked back to
24:22the couch, and watched the fight. What
24:24the people celebrating in those internet
24:26forums didn't realize in the summer of
24:282000, though, was that the game had
24:30quietly changed behind the scenes.
24:32Because NDS and DirecTV had stopped
24:35treating this like a normal engineering
24:36problem, and had brought in a ringer who
24:38thought exactly like the hackers did.
24:41Years later, a landmark investigation by
24:43Wired Magazine revealed the secret
24:45weapon sitting inside NDS's security
24:47team, a brilliant self-taught hardware
24:50hacker and former US Army signals
24:52intelligence specialist named
24:53Christopher Tarnovsky. Working alongside
24:56elite smart card reverse engineers like
24:58Oliver Commerling, who had originally
25:00helped crack European pay TV cards in
25:02the mid-90s before NDS hired them onto
25:04the corporate side. Tarnovsky and the
25:06NDS team knew every single trick the
25:09underground was using. They lurked in
25:11the exact same web forums, downloaded
25:13the exact same unlooper schematics, and
25:15studied the exact same pirate patches,
25:18including the most popular pirate
25:19software running on hundreds of
25:21thousands of H cards in the year 2000, a
25:23patch with a built-in update blocker
25:25called Ultra 3M. Looking at the Ultra 3M
25:28pirate code, Tarnovsky and the security
25:30team realized why all of DirecTV's
25:32previous ECM attacks had failed so
25:34quickly. Every time DirecTV sent down a
25:37big, obvious attack packet that demanded
25:39a new security check, the hackers saw it
25:41coming, analyzed the packet in 10
25:43minutes, and wrote a patch to fake the
25:45answer. Even worse, previous ECMs only
25:49damaged the erasable EEPROM in ways that
25:51an unlooper could glitch past and fix.
25:53If they wanted to win, they couldn't
25:55fire a single big cannonball from space.
25:58They needed to smuggle a bomb into the
26:00cards piece by piece, and when it went
26:02off, it had to break a part of the card
26:04that no unlooper on Earth could ever
26:06erase. Starting in the autumn of 2000,
26:09around September, DirecTV's satellites
26:11began transmitting tiny, seemingly
26:14meaningless updates down to every H card
26:16in North America. If a hacker was
26:18watching the satellite data stream on
26:19their computer screen, each update was
26:21only a couple of bytes long. It didn't
26:24try to loop the card. It didn't touch
26:26the pirate 3M code. It just wrote two or
26:28three random-looking numbers into an
26:30unused blank space in the card's
26:32erasable memory and updated a tiny
26:34verification check so the card had to
26:36let the harmless bites inside to keep
26:38decoding TV channels. A few days later,
26:41the satellite sent another tiny harmless
26:43looking two-byte update to a different
26:45spot in memory and then another one the
26:47week after that. Because none of these
26:49tiny fragments contained a complete
26:51program or tried to attack the card, the
26:53pirate blocker software let them right
26:55through and the hackers inspecting the
26:57logs shrugged them off as meaningless
26:58housekeeping data from DirecTV. Over the
27:01course of 4 months leading right up to
27:03January of 2001, DirecTV quietly beamed
27:06down 50 separate silent fragments of
27:09code. By the third week of January,
27:11every single modified H card sitting in
27:13a receiver box across the United States
27:15and Canada had unknowingly collected all
27:1850 pieces of a dormant software program
27:20inside its memory. Then came Sunday
27:23evening, January 21st, 2001, 7 days
27:26before the Super Bowl. DirecTV
27:28transmitted the 51st and final packet.
27:31That final packet wasn't a piece of
27:33data. It was the trigger. It linked all
27:3650 dormant fragments together in the
27:37card's memory and executed them all at
27:40once. The assembled program immediately
27:42scanned the card's memory to see if the
27:44card had been tampered with by pirate
27:45software. If your card was a clean,
27:48untouched card owned by a paying DirecTV
27:50customer, the program quietly deleted
27:52itself and did nothing. But, if the
27:55program detected pirate code on the
27:56card, it executed a ruthless sequence of
27:59instructions. You see, inside the
28:01Motorola chip on the H card, there was a
28:04special section of memory right around
28:06hexadecimal address 8000, often referred
28:09to as write once or fuse memory, along
28:12with critical system pointers that the
28:14permanent ROM checked the very instant
28:16the card received electricity long
28:18before an unlooper could even attempt to
28:20glitch the processor. Normally, the card
28:22software kept that memory locked behind
28:24hardware write protection so it could
28:26never be overwritten by accident. The
28:28Black Sunday code turned off the chip's
28:30internal protection, permanently
28:32overwrote that critical startup byte
28:34from its normal factory value to zero,
28:36wiped out the card's internal jump
28:38table, and then, as a final middle
28:40finger from Christopher Tarnovsky and
28:42the engineers to the hackers who had
28:43been taunting them on internet forums
28:45for 3 years, wrote eight bytes of ASCII
28:48text into the very beginning of the
28:50EEPROM. g a m e space o v e r. Estimates
28:57of how many cards died on Black Sunday
29:00range from 100,000 to well over half a
29:02million across the US and Canada.
29:04Because it happened on a Sunday night
29:06right before the Super Bowl, the panic
29:08was hilarious and chaotic. People who
29:10had bought ready-made free TV for life
29:13boxes from some guy at a flea market or
29:15a coworker had no idea how any of the
29:17tech worked. They just knew their Super
29:19Bowl party in 7 days didn't have a
29:21working television anymore. Satellite
29:23dealers who had foolishly promised their
29:25customers free lifetime updates
29:27literally unplugged their store
29:29telephones, changed their cell numbers,
29:31and went into hiding for weeks.
29:33Simultaneously, DirecTV reported a
29:35sudden mysterious surge of hundreds of
29:38thousands of brand new legally paying
29:40subscribers calling in on Monday morning
29:42to activate accounts before kickoff on
29:44Super Bowl Sunday. Now, if this were a
29:46Hollywood movie, Black Sunday would be
29:48the end of the story. The empire struck
29:51back, the card said game over, and the
29:53hackers lost. Except in real life, if
29:56you tell thousands of obsessed engineers
29:58and backyard hackers game over, they
30:01take it personally. And what happened
30:03over the 12 months after Black Sunday is
30:05honestly almost crazier than the attack
30:07itself. First, within weeks of Black
30:10Sunday, hackers figured out a way around
30:12the problem for any H card that had
30:14happened to be sitting in a drawer or
30:16protected by a strict hardware blocker
30:18on the night of January 21st. Because if
30:20your card hadn't been hit by the final
30:22trigger yet, how could you put it back
30:24in your satellite box without the
30:25satellite immediately killing it? The
30:28answer was called the PC emulator.
30:30Instead your precious smart card into
30:33the satellite receiver, you built a flat
30:35plastic dummy board with a long ribbon
30:37cable coming out of it and slid that
30:39into the front of your TV receiver. The
30:41other end of the ribbon cable plugged
30:43into the serial port of an old cheap $50
30:45MS-DOS computer, like an old 386 or 486
30:49PC, sitting behind your TV cabinet. Your
30:51real H card sat safely inside a card
30:54reader attached to the PC. Whenever the
30:56satellite receiver sent a command down
30:58the cable, the PC intercepted it,
31:00pretended to be the smart card, filtered
31:02out every single dangerous update or ECM
31:05from DirecTV and only passed the safe
31:0710-second video math puzzles over to the
31:09real card so it could borrow the
31:11hardware ASIC chip. With an emulator PC
31:14humming quietly behind the couch,
31:16DirecTV's ECMs couldn't touch the card
31:18at all. Even more insanely, hardware
31:21hackers refused to accept that the
31:23hundreds of thousands of cards killed on
31:25Black Sunday were permanently dead. Even
31:27though Black Sunday had overwritten
31:29memory that couldn't be fixed through
31:30software, hardware modders actually
31:33started taking rotary grinding tools,
31:35Dremels, and razor blades to the back of
31:37the dead plastic H cards. They scraped
31:40away the white plastic right over the
31:41microchip, soldered tiny microscopic
31:44jumper wires, or snapped an extra
31:46replacement memory chip, nicknamed a
31:48sombrero because it sat on top of the
31:50old chip like a hat, right onto the dead
31:52silicon to physically override the
31:54damaged memory bytes during boot up,
31:56bringing unfixable game over cards right
31:58back from the grave.
32:00Realizing that the H card was a zombie
32:02that simply refused to stay dead,
32:04DirecTV moved to replace every H card in
32:07America with their third generation
32:08card, the Period 3 card, better known as
32:11the HU card or the Football card,
32:14because the front of the card had a
32:15bright red picture of a football player
32:17on it. Once again, the Football card was
32:19supposed to be unhackable. And once
32:22again, following a shadowy trail of
32:24leaked diagnostic code, Russian reverse
32:26engineers, and underground turf wars,
32:28hackers cracked the Football card, too.
32:31Leading to an infamous moment during the
32:32card swap where DirecTV set up a hidden
32:35channel that only hacked cards would
32:37automatically tune into, broadcasting a
32:39looping video of a stern spokesperson
32:41warning viewers that they were watching
32:43an illegal signal.
32:45So, what finally ended the great 90s
32:47satellite hacking war? It wasn't a
32:49single clever piece of computer code
32:51from space. It was lawyers, subpoenaed
32:53UPS shipping logs, and a brand new
32:55generation of silicon. Starting around
32:582002 and 2003, DirecTV realized that
33:01trying to beat hundreds of thousands of
33:03hobbyists solely through software
33:05updates was a losing battle. So, they
33:07created an internal enforcement division
33:09called the Office of Signal Integrity
33:12and went straight after the supply chain
33:14in federal court. Instead of trying to
33:16detect signals coming out of people's
33:18roofs, which was impossible, DirecTV
33:20raided the warehouses and web servers of
33:22the popular online stores in the United
33:24States that sold smart card programmers,
33:27unloopers, and emulator cables. Those
33:29online shops had kept years of credit
33:31card receipts and UPS shipping
33:33addresses. Suddenly, DirecTV had a
33:35database of over 100,000 regular people,
33:38doctors, police officers, teachers,
33:41suburban dads, and college students who
33:43had ordered a smart card programmer on
33:45the internet. Even though owning a smart
33:47card reader wasn't technically illegal
33:49by itself, DirecTV mailed out over
33:51100,000 terrifying federal legal demand
33:54letters across America, threatening to
33:56sue each homeowner in federal court for
33:58tens of thousands of dollars under the
34:00Communications Act unless they signed a
34:02statement, surrendered all their
34:04satellite gear, and wrote a check to
34:05DirecTV for $3,500 on the spot. Tens of
34:09thousands of terrified people paid up
34:11immediately, netting DirecTV hundreds of
34:14millions of dollars, and scaring the
34:16casual suburban hobbyists right out of
34:18the scene.
34:19At the same time, federal prosecutors
34:21tracked down the top coders and hardware
34:23designers in the underground, giving
34:25several of them a stark choice: face
34:27federal prison time and ruinous fines,
34:29or come work for the security side to
34:31help lock down the system. And in 2004,
34:34when DirecTV rolled out their
34:35fourth-generation smart card, the period
34:38four or P4 card, the hardware inside the
34:40chip finally caught up with the
34:42cryptography. Built on a far more
34:44powerful processor architecture with
34:46layers of hardware encryption and no
34:48sneaky over-the-air holes left exposed,
34:50the P4 card and the later cards that
34:52followed was never publicly cracked.
34:55Looking back at Black Sunday and the
34:57late '90s satellite wars today, the
34:59whole era feels like something from
35:01another planet. Today, everything we
35:03watch comes through encrypted internet
35:05streams over fiber and cellular networks
35:08where every single television and phone
35:10has a two-way connection back to a giant
35:12cloud server checking your login every
35:14second. The idea that you could buy a
35:16$50 circuit board, open up a hexadecimal
35:19editor on a Windows 98 computer, and
35:21rewrite the memory on a plastic card to
35:23unlock every channel beaming down from
35:25orbit belongs to a very specific window
35:28of technology history. And if you talk
35:30to the people who were part of that
35:31scene back in 1999 or 2000, almost all
35:35of them will tell you the exact same
35:36joke about what it was actually like.
35:38They had 500 channels unlocked on their
35:40television. Every movie channel, every
35:43sports package from across the country,
35:4520 different pay-per-view movies playing
35:47every half hour, and most of them barely
35:49ever watched TV. Because the actual
35:51hobby wasn't watching movies. The hobby
35:54was the game itself. For thousands of
35:57regular people with no formal computer
35:59science background, trying to keep that
36:01little white H card alive was how they
36:03accidentally taught themselves
36:04electrical engineering, binary math,
36:07soldering, and assembly code. Every
36:09Friday night was a test to see what the
36:11aerospace engineers in California and
36:13Israel were going to beam down from
36:1422,000 mi in the sky, and whether a
36:17bunch of strangers sharing files in a
36:19chat room could figure out the puzzle
36:21before kickoff on Sunday afternoon. And
36:23on January 21st, 2001, when half a
36:26million televisions went dark at the
36:28exact same second with the words game
36:31over burned into their silicon, even the
36:33hackers had to admit it was one hell of
36:36a move.

About this transcript

This page contains the full transcript of DirecTV’s Black Sunday: The Update That Killed Pirate TV Cards by Tech Meter, generated from the public captions YouTube serves with the video. The transcript has 6,432 words across 1,015 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.