9

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access to physical hardware and the ability to run native code. This appears to be the case for standalone bluray players, but what about if I watch a bluray disc on my Windows PC (e.g. with Cyberlink PowerDVD). Does the software on the bluray get full administrator access to my system? This seems like a horrible security risk (I would never like to run anything Java-based as root). Can anyone tell me more about how BD+ protection works, in particular when watching on computers? What are the security implications?

5
  • Are you sure you mean BD+ and not BD-J ? BD+ looks like a primitive virtual machine for handling the decryption of the disc's content, and has nothing to do with Java. BD-J on the other hand uses Java to make stuff like interactive menus. But anyway, about the root access, if you don't run the BD player software as root then there's no way for the BD-J code to run as root.
    – user42178
    Commented Jul 12, 2014 at 18:20
  • Maybe I was confused about the Java bit -- that could just be BD-J. As for the root thing, I believe that on Linux, but is it true on Windows, where the default user account is usually an administrator account?
    – Alex
    Commented Jul 14, 2014 at 0:06
  • On Windows XP yes, but on Windows Vista and later there is User Account Control that makes your administrative account behave like a standard account until you give it permission by clicking "yes" in the UAC dialog box or by manually executing the program as administrator (right click on the .exe -> execute as admin).
    – user42178
    Commented Jul 14, 2014 at 0:10
  • You wouldn't be running a video player as root in Linux. There's no need to do that nor would that be the default on any common distribution.
    – Ángel
    Commented Jul 18, 2014 at 20:25
  • 2
    "I would never want to run anything Java based as root". The programing language isn't the issue. Java is being used by many companies for different types of projects. The issue is the code quality. Commented Dec 7, 2014 at 8:52

1 Answer 1

1

I believe your mixing several separated technologies together. First BD-J => this is a special subset of "java" which is used for the menu's and interactive elements, it runs inside its own VM-container and does NOTHING on the host without the player software (so it works with the same permissions as your player or lower... meaning your user or none at all) source:Wikipedia article BD-J

BD+ is a a virtual machine embedded in players. it is NOT JAVA based at all. It can verify a players footprint against a list of allowed fingerprints (this does not really apply to PC's) and it facilitates the decryption of some "corrupted" data from a hidden secret encrypted location on the disc.

the way it can "run code" is through so called "TRAPS" this is hard to write code for, or even utilise for arbitrary code injection. all though not impossible.

The way for example VLC utilise DB+ is through running the VM in its own Library container it in no way runs with root permissions it just yieldds the enrypted blueray information for playback. source:Wikipedia article BD+

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .