SEASON7/OHMIGOD

Introduction

The communication between the decoder and the viewing card is simply an exchange of data. There is no reason why the decoder must communicate exclusively with a viewing card, it does not know that the viewing card is physically card-shaped or that it has a Sky logo printed on it, it simply manipulates voltages in patterns which represent digital data and expects responses in the same fashion. These data signals can be provided by any other device, provided the patterns and therefore the data are expected and understood by both communicating devices.

How It Worked

Given that data exchange between the decoder and the viewing card does not require either device to know what the physical object is that they are communicating with, a computer could be used to take the viewing card’s place. Software was written to enable a PC to act as a viewing card, receiving commands and responding appropriately in the way that a real card would respond. This was a flexible approach which could be readily updated if required.

Circuit boards were produced which would fit into the viewing card slot of a decoder and provide an interface to a PC’s serial port. This is not strictly required, simple wires would be sufficient, but the circuit boards offered a convenient refinement which would not require the disassembly of the decoder. Interfaces in the style of the device featured in the image below also contain a card reader assembly to enable not only emulation of a smartcard but the examination of the communication between the decoder and the card. This enables a user to observe the legitimate communication and behaviour of an original card in order to learn the requests and responses which need to be reproduced. If employed for long periods of time, it may be possible to record lesser-used messages such as infrequently sent commands for specific system functionality which may otherwise remain unknown.

The image below demonstrates how the card would have been used.

The photograph features a commonly used Thomson SVA1 VideoCrypt decoder, into which the card emulator is inserted, and in turn a Sky Issue 07 card is inserted into its passthrough card socket. To the right of the card is a serial cable which would be connected to a PC. The viewing card would not be necessary for viewing, the serial connection to the PC in conjunction with suitable card emulation software would perform its role. As depicted, the setup would be used for monitoring communications between the decoder and the card as a means to gleaning the insights required to write such software.

Mitigation

Actual solution employed: Later cards would be of a more complex design, including dedicated circuitry to perform operations which could not be replicated simply by copying the code. This additional circuitry would also later be emulated by the pirate smartcard emulators, so this mitigation was not entirely effective.

Notes

The name “SEASON7” refers to its creator, Markus Kuhn, wishing to watch series 7 of Star Trek: The Next Generation, which was at the time airing on Sky. The use of the numeral 7 was coincidental and did not refer to the then-current Sky Issue 07 card.

Living in Germany, Kuhn was unable to subscribe legitimately, as many living outside of the UK wished to do, so workarounds such as this were developed to allow viewing of Sky channels across Europe.