DBS Hacker Update as of 11/28/95
This article is Copyright 1995 by David Lawson and
Scrambling News. Both parts may be reprinted and
distributed freely as long as they are not modified in any way.
The Canadian group has released their fix for the DSS
system. Their chief engineer is said to be Dectec's
former head engineer. The fix will be marketed from
Canada and Mexico, and underground in the U.S.
The fix is a paddleboard which fits into the cardslot.
It uses two microprocessors including a Dallas 5002
and an Atmel with Fastram. There is also a 256k ram
chip with a lithium battery backup. In order to receive
Pay-Per-View programming the EEPROM in the
receiver must be reprogrammed with a new ID.
According to informed sources, the first-run
paddleboards suffer from a 30% failure rate. In addition,
they are extremely sensitive to static electricity. If
zapped, they cannot be reprogrammed.
The developers are grabbing every penny they can on
this fix. The wholesale cost to dealers purchasing in
quantities is $400 each so retail will likely be $600-$700.
This is the cost of one year's programming and it is longer
than the fix will last. Opening the DSS receiver will also
void any warranty.
There is another, more elegant smartcard fix which is
not yet on the market. Someone placed an anonymized
ad in rec.video.satellite.dbs recently that they have
hundreds of pirate smartcards for sale. It is possible
that someone obtained a supply of blank cards and
programmed them but it is unlikely they would be
sold openly through the internet.Thousands could
very easily be sold quietly through the satellite
underground, without fanfare.
Subscribers to our newsletter ($29.95 for 12 issues)
will receive more information by mail next week.
(12/4/95). It will include important information on
the Cyber 1 fix for the VCII PLUS. One of the
individuals now distributing the paddleboard fix is
one of the individuals who was charged and convicted
in the U.S. Customs sting of 1993. That sting involved
a fix for the Videocipher II PLUS satellite system.
We have included the article we did on that sting.
It may be of interest to some of you, and it will provide
you with an inside account of how the satellite piracy
business works.Our article was prepared from court
documents and interviews with the participants. All
those charged were convicted.
The sting started in the spring of 1993 and culminated
at the SBCA trade show for satellite dealers on Septem
ber 7, 1993. Here is what happened.
With impeccable timing, the U.S.Customs Service
executed a sting on several of the largest suppliers of
satellite television modifications in the country. Most
dealers got their first news of it through a message by Ron
Mac Donald, on his Canadian BBS. The message quickly
spread across North America, with many individuals
changing the name on the header to their own. Here is
the text:
Msg#:19752 *News*
09-08-93 22:30:23 (Read 40 Times)
From: RON MACDONALD
To: ALL
Subj: FBI & GI STING
Well it seems that the FBI and the U.S. Customs
department in conjunction with GI have pulled
off a MAJOR sting operation in New Orleans
yesterday. By now everybody has heard of the
so-called VCII Plus clone fix that has been shown
around in the states.
The story starts 6 months ago and I will try to set
out the players in order of appearance.Everybody
has asked for a VCII plus fix - when will it be released?
A new member on this BBS using the name Gerald
?XXXX kept bugging me about a rumour he was
hearing and trying to chase down. I kept saying it
is too hard and too expensive to develop. But lo and
behold, 2 weeks ago, he called me and said he found
the guys with the VCII PLUS clone fix and he was now
representing them and was marketing it for the
developers. The developers wanted to keep their
names out of the picture completely.
We were told that Gerald's associate "Richard
Collins" would be in touch with us to do a demostration
of the product. Arrangements were made for "Richard"
to meet us in Canada just across from the border of
Buffalo. But at the last minute Richard called and said
he wouldn't cross the border with the VCII units and we
have to go to the states for the demo. We complied and went to
see the device. Sure enough, he had a MASTER unit and three
clones of that ID number.
All three were tested seemed to be identical. The three
cloned units had a soft epoxy on them and we were told
that the parts under the epoxy could be bought at Radio
Shack for the simple mods.
One of the cloned units was picked at random, put on line
and called in for a subscription to be added to the unit.
The hit came down within minutes and on came the new
subscribed channel. This verified the existence of a cloned
unit.
Richard informed us that the price of the technolgy was
$50,000.00. They wanted 20 people to put up $50,000.00
each to pay off the developers a total of $1,000,000.00. This
fix was to be guaranteed for a year.
A meeting was going to be held in New Orleans on Sept 7
1993 for a demo of the so-called keypuller/reader/writer device.
At this meeting we would be taught the full operation of the
process and then pay for it and leave with the product. We
stalled off on answering their questions about when we
would arrive in New Orleans.
Something was fishy! Richard was using the same sales
pitch on too many people in the inustry! Feedback was
coming in from all over the country! Even from people that
I knew, who could not afford the $50,000.00 price tag -
why were they attending this so-called hush-hush
meeting. Were they playing around with the price tag?
Better off to sit back and let it shake itself out.
Did you ever see that Eyewitness Video episode on
how a police department setup a phoney front that
bought any hot stuff from crooks. After 3 or 4 months
in operation they had a party for all of these "customers"
of theirs and then the FBI raided them and hauled them
off to jail.
Well I couldn't get that episode out of my mind! I keep
thinking - what a major catch for the FBI and GI.A perfect
STING operation - 20 or more of the top chippers in the
industry, all in one spot at one time! And that is exactly
what GI and the FBI and U.S. Customs did!
Now the others players who were involed in setting
up the sting:Richard Collins - possible alias: Ted La
Fever - U.S Customs agent Gerald XXXXX - New
Orleans - hosted the demo ! Dana XXXXXXX -
Corning N.Y. - was he busted or was he also selling
the fix. aka: Jason Bates
Busted:
Tony- Magna Systems
Jeff C.- Tennennese
Jeff P. - Tennennese
Scottie- S&S Satellite
Kenneth- New York
Theo- Nassau
Robert- Kentucky
According to official sources here is what really happened.
This information was obtained exclusively by Scrambling
News. Two individuals were arrested in New Orleans
on September 7, 1993. They were Jeffery Carr of TN,
referred to in Criminal Complaint number 93-223 MAG
in the U.S. District Court in the Eastern District of
Louisiana, and Douglas Stewart, a Canadian, with a
residence in Santa Clara, CA, and referred to in
Criminal Complaint 93-221 MAG. Both cases resulted
from the work done by an undercover officer employed
as a Special Agent of the U.S. Customs Service.
In the case of Douglas Stewart: On August 3, 1992 a
counterfeit Videocipher II descrambler module, a
device used primarily for the unlawful interception of
encrypted satellite cable programming was ordered
from Troy Stewart. The module arrived but had to
be returned due to defects. On August 28 a
replacement module arrived. The module is commonly
known as a Sunboard (a counterfeit Videocipher II module).
The module successfully descrambled encrypted
programming on satellite G5, without paying for the
services. General Instrument Corporation analyzed the
module and found that it successfully descrambled services
without paying for them.
On or about October 7, 1992 Troy Stewart telephonically
introduced the undercover officer to his father Douglas
Stewart. Then on October 29 the agent contacted Douglas
Stewart and told him that he was interested in purchasing
Sun board descramblers. During that undercover contact
the officer told Stewart that they must be careful about the
authorities and he asked Stewart how he gets descramblers
into the United States. Stewart told the officer that although
it was risky he just drove them past U.S. Customs Inspectors.
On December 1, 1992 the officer telephoned Douglas Stewart
at his home in California. During that conversation Stewart
agreed to sell to the officer, two modified Videocipher II
descrambler modules for $400 each. Stewart instructed the
officer to send the money to a California residence.
The officer phoned Douglas Stewart on December 15
concerning the purchase made on December 1. He told
Stewart that $800 had been sent via the U.S. Mail. Stewart
said that he did not accept U.S. Mail because it was mail
fraud. He instructed the officer to have the package containing
the funds returned by the U.S. Post Office and requested that
the money be sent to an address in Canada.
On or about January 8 the two modified Videocipher II
descrambler modules ordered from Douglas Stewart were
received. The package had been sent directly from Canada to
the officer's undercover address and contained an insufficient or
false description of the contents of the package for proper
declaration to U.S. Customs.
Between January 8, and February 17, 1993 the officer negotiated
from New Orleans with Douglas Stewart for the purchase of 40
additional modified Videocipher modules for a total price of $14,000.
Stewart agreed to meet the officer in Blaine WA for the transaction.
On or about February 17, the officer called Douglas Stewart in
Canada. Stewart said he was still working on the modules but
would meet the officer on February 18, in Blaine. At the February
18 meeting the officer and Stewart discussed how necessary it
was to be leery of the F.B.I. Stewart said he had just come from
the airport and that he was on the lookout for someone who fit his
profile of an F.B.I. agent. He also said that when agents recently
raided his son's home in California that they had seized 1500
GP-28 adapters, just like the ones that had been installed on the
boards which had been ordered on December 1. Stewart said
that the descramblers were at a private mailbox and that he
shipped Sun Boards from there on a regular basis.
The officer, accompanied by a female U.S. Customs officer
followed Stewart and his business partner Alan Reimer to the
private mail box company, located in Blaine WA where
Stewart and Reimer loaded the 40 modified descrambler
modules into the agents' rental car. They commented that the
trunk of the agents' car was larger than that of the rental car
they had used to transport the modules.When the officer
presented Douglas Stewart with the $14,000 cheque, he
expressed concern that the bank would generate an IRS
form because the transaction was over $10,000.
In a subsequent phone call the officer adked Alan Reimer
about the method of importation of the modules purchased
on February 18. He asked how the Customs Inspector did
not notice the boxes in the rear of the mini van that he and
Stewart were driving that day. Reimer said that they had
used another vehicle with a trunk and had been able to
drive past U.S. Customs. In later conversations between
the officer and Douglas Stewart, Stewart repeatedly
expressed concern over being caught by U.S. authorities
for being involved in the purchase/sale of modified
Videociphers or equipment designed to aid in the
modification of Videociphers and that the purchase or
sale of this type of merchandise could result in a jail
sentence.
On September 7, 1993 the officer again met with
Douglas Stewart in New Orleans and during that
conversation Stewart admitted that he committed
the act of smuggling satellite descrambling devices
on or about February 18 and numerous other acts as
well. At that time he was arrested by assisting U.S.
Customs agents and the undercover officer revealed
his true identity. Douglas Stewart was charged under
Title 47 United States Code, 605 (e) (4) for unlawfully
distributing devices designed primarily for use in the
unauthorized interception of satellite cable programming.
In the case of Jeffrey Carr: The undercover officer had
made contact with Dana LaFever of Corning, NY. LaFever
had told him that he could sell or install VMS devices
which enable satellite customers to download cable
security codes via a computer modem and telephone
line so that they can receive encrypted satrellite cable
programming without authorization. LaFever quoted a
price of $115 each.
On or about June 2, the officer again contacted LaFever.
LaFever said that either he or Bill Hunter, a Canadian who
is in the satellite piracy business would sell a host
program for $750 which would allow the officer to
automatically provide his customers with the codes
for the encrypted channels.
In a phone conversation on or about June 9, LaFever
said that his tec support program, which will enable
customers to receive the code updates would go on
line that night. LaFever told the officer that there was a
legitimate use for the VMS device but then added that it
was necessary to have a gimmick. It was necessary to
be able to claim that the device has some legitimate
purpose. At that time the officer ordered a host program,
one remote program for $900 and ten VC 018 modules
with ten VMS devices installed by LaFever for $1950.
On June 17, the officer placed another order for another
host program, remote program and a security device.
LaFever stated at that time that he tries to conduct his
business without paper work.
On July 15, during the S.B.C.A. show the officer met
Dana LaFever at the Fiddler Inn in Nashville. for the
purpose of purchasing more VMS devices. He was
introduced to Jeffrey Carr who works for Video Marketing
Services which manufactures the devices. After Carr left,
LaFever told the officer that Carr does all the programming
and that he had just paid Carr's partner over $30,000 in cash.
LaFever had a sealed box in the room which he said contained
100 VMS devices. The officer purchased 15 of them with
modems for $95 each.
The officer next met with Dana LaFever on August 30, at his
residence in Corning NY in order to purchase more illegal
satellite cable programming descrambling devices and to
demonstrate the latest illegal device, modified Videocipher
II PLUS modules. The officer told LAFever that the devices
were clearly illegal and LaFever acknowledged that he knew
they were. LaFever tested the modules and and had at least
three telephone conversations with Jeffrey Carr. LaFever
initiated the first phone call and Carr returned at least one call
to LaFever. After one of the conversations the officer was
requested to connect two of the descramblers to the same
satellite cable receiving system in order to determine if the
descramblers would receive authorization simultaneously if
only one of the unit addresses was was provided to a legitimate
programmer. LaFever said that if both descramblers allowed
the viewing of scrambled services simultaneously based on a
single unit address then it truly was a clone fix. The officer told
LaFever that an illegal seed key pulling device was in existence
in New Orleans. the officer also said that if LaFever wished to
purchase the device he would have to travel to New Orleans for
a complete demonstration and that the device was for sale for
$50,000.
On or about August 31, Jeffrey Carr phoned the officer and
said that he had been talking with Dana LaFever and that he
was interested in seeing the demonstration of the modified
VCII PLUS modules and possibly purchasing a device being
offered for sale. Carr asked if the agent and his associates
would be interested in mass production of the devices being
offered. The officer responded that he would have to
confer with his associates and said that his associates
expected payment at the demonstration/sale in New Orleans
on September 7. He added that 20 of the devices would be
sold for $50,000 each. and that only 20 were being offered to
avoid being busted. Carr acknowledged that the price was
$50,000 and that the test would be to see if the two clones
could be authorized simultaneously.
On September 7, 1993 at approximately 10 AM, the officer went
to Jeffrey Carr's room at the Oliver Hotel in New
Orleans. and was met by Jeffrey Mayes. Mayes introduced
himself as Carr's partner and he said that Carr was too ill
to see the VCII PLUS module demonstration. The agent
transported Mayes to a location in Kenner, LA and
demonstrated the VCII PLUS cloned boards. He discussed
with Mayes the illegality of the boards and Mayes
acknowledged that he was aware of it. Mayes also admitted
that he was aware that many users of the VMS device used
it primarily for the illegal descrambling of encrypted
satellite transmissions. Shortly after that, Mayes was advised
of the officer's true identity. and that he was in violation of federal
law.
At approximately 2 PM the officer returned to Jeffrey Carr's
room at the Oliver Hotel and offered to demonstrate the VCII
PLUS fix to him. On the way to Kenner, Carr described how he
pulled the seedkeys from several legal descrambling devices.
Carr said that they had recently obtained the seed keys for
Request Pay Per View services.
At the Kenner location the officer demonstrated the VCII
PLUS cloned boards and engaged him in conversation
about the VMS devices. Carr was asked specifically
about the method by which the VMS was being distributed,
whereby distributors sign a disclaimer to absolve Video
Marketing Services of criminal liability. Carr described the
legal use of the VMS and did not acknowledge that he was
aware that his distributors were utilizing the VMS for illegal
purposes. The officer then advised Carr that he
is a U.S. Customs Special Agent investigating the
distribution of devices primarily used for illegal
descrambling purposes.Shortly thereafter, another agent
spoke to Mayes and asked him if Jeffrey Carr was also
aware, as Mayes had just told the undercover agent that
many of the VMS distributors were using the VMS device
for illegal purposes. Mayes said yes.
Later that day the officer interviewed Mayes who said that
he and Carr had been in the business of manufacturing
VMS devices for approximately one year. Mayes was the
hardware designer and Carr was the software designer.
Mayes said that upon startup they had conferred with their
lawyers who had advised them to have their distributors
sign a disclaimer to protect themselves against illegal
utilization. Mayes said that he and Carr had met with all
their distributors to make sure that each one had a
computer capable of running the text data feature of the
VMS device. Mayes said each one was instructed to use
the device for legal purposes only. and to sign a disclaimer
to that effect.
Mayes also said that he and Carr recently came to realize
that Bill Hunter and LeFever were using the VMS devices
for the purpose of illegally descrambling satellite
transmissions. Mayes said that he and Carr continued to
supply them because they were such a large part of the
distribution system. Mayes also said that Carr came to him
recently after having been told by LaFever that the PLUS fix
existed. They wanted Carr to determine if it was real. Mayes
said that Carr got excited about the VCII fix and the possibility
of making a quick million dollars. He said that Hunter and
LeFever would be the actual buyers and that he and Carr
would only receive a kick-back from the sale.
Jeffrey Carr was charged under U.S. Code Title 47, Section 605
(e) (4) and under Title 18, section 371.
The Business
The following is entirely based on guesstimates and is only
intended to provide some order of magnitude.There
are several different modem systems in use, with 10-15,000
users each being typical. The VMS system is the largest,
with an estimated 100,000 users. At a wholesale price of $75
the VMS manufacturing business would have generated
approximately $7.5 million in a little less than a year of
business. [Ed. when S&S was raided in February, authorities
released information that they had done $700,00 in business
the month before they were raided]. Consumers paid an average
$200 for an installed unit for a total of $20 million at retail. In
addition they directly or indirectly have been paying for a BBS
service to download the cable security codes, at roughly $10
per month for a total of $1 million/month. Establishment
sources always calculate the cost of piracy as if each pirate
would pay for services if they weren't being received free but
that is not true. Assuming that each individual would on
average spend $100/yr. on legal programming, then
programmers have lost $10 million in revenue over the
past year.
What was allegedly being offered was a package consisting
of a 3M,3M clone and a 4M with auto- shut-off. That would
provide for three consumer upgrade levels. The qualitative
tests which were allowed to be conducted on the modules
precluded an independent test to determine whether the
three modules had in fact, all been loaded with the same
keys in the first place. According to informed sources, that
is what happened, and GI did not actually demonstrate a
compromise of its PLUS system.
The Charges
We discussed 47 U.S.C. Section 605 with attorney Barry
Teague in the September 1992 issue of Snews. Section
(e)(4) reads as follows:Any person who manufactures,
assembles, modifies, imports,
exports, sells, or distributes any electronic, mechanical
or other device or equipment, knowing or having reason
o know that the device or equipment is primarily of
assistance in the unauthorized decryption of satellite
cable programming or is intended for any other activity
prohibited by subsection (a) shall be fined not more than
$500,000 or imprisioned for more than 5 years for each
violation, or both. For purposes of all penalties and remedies
established for violations of this paragraph, the prohibited
activity established herein as it applies to each such device
shall be deemed a separate violation. (d) for purposes of this
section (1) the term satellite cable programming means video
pro - gramming which is transmitted via satellite and which
is primarily intended for the direct receipt by cable operators
for their retransmission to cable subscribers.The officer in
the affadavit describes the TVRO system used to give the
clone demonstration as a satellite cable receiving system.
Title 18 Section 371 relates to a conspiracy to commit an
offense or to defraud the United States. It reads: If two or
more persons conspire either to commit any offense against
the United States or to defraud the United States, or any
agency thereof in any manner or for any purpose and one or
more of such persons do any act to effect the object of the
conspiracy, each shall be fined not more than $10,000 or
imprisoned not more than five years, or both.
If however, the, the offense, the commission of which is the
object of the conspiracy,is a misdemeanor only, the
punishment of such conspiracy shall not exceed the
maximum punishment provided for such misdemeanor.
In the historical and revision notes for this law it says that
the statute is broad enough in its terms to include any
conspiracy for the purpose of impairing, obstructing or de-
feating any lawful functions of any department of government.
Others Involved
We have not been able to contact all those involved. Others
we spoke to were under instructions by their attorneys not to
comment. Tony at Magna Systems said that he was raided on
the morning of September 7 by approximately twelve U.S.
Customs agents, executing a search warrant. He said they
were looking for any VCII related objects, but found none.
They answered the phone for the 5 or 6 hours they were
there but it was a slow day and there were only about ten
calls. They left with some computer magazines and his
mother's bank records. He was not charged and is still
open for business.
According to sources, the offices of Video Marketing
Services were raided by U.S. Customs agents who were
towing U Haul trailers behind their vehicles. Nothing illegal
was found, though records and samples were taken. The
agent in charge reportedly told them they could continue
with their business. Video Marketing Services is still open
for business.
The Fallout
This action has visibly shaken satellite dealers across the
country, as well as those who assumed they would soon be
selling VCII PLUS products and that their flagging businesses
would return to normal. The ECM's, the upgrades, the on-going
monthly BBS charges, not to mention the danger in repeatedly
calling a phone number which only downloads cable security
codes has more and more dishowners going legal. Earlier this
year authorizations were running at about 35,000/month.
Today they are up to 75,000/month. To make matters worse
the HBO/Cinemax western commercial feeds were shut off
on September 20, the Eastern feeds are scheduled for shutdown
October 20, and Showtime/Movie Channel have announced that
they will discontinue their commercial feeds by the end of October.
First Choice in Canada has also announced that it will discontinue
its use of the VCII commercial data stream by the end of October.
We have not heard of any other services announcing their
abandonment of the VCII commercial data stream so there will
still be many services abvailable, but the loss of virtually all the
most popular services and the lack of a pirate alternative leaves
consumers no option but to go legal. Those now turning legal will
probably not readily return to piracy, considering what it has cost
them over the past eighteen months.
If a PLUS fix is released, it may well be done quietly, without publicity
or fanfare. It is inconceivable that anyone would advertise it in a
magazine any time in the near future. The normal distribution channels
which were targeted in the sting are going to be extra leery even if a
valid product appears.According to official sources this is an on-
going investigation.
The Videocipher II information is only of historical interest, but the
"biz" is the same. In the newsletter we will discuss the desirable
features of a DSS fix. Scrambling News. Voice/FAX 716.874.2088