FTA - Dish Network- Bell ExpressVU - The FTA Pirate era that changed everything!
ฝัง
- เผยแพร่เมื่อ 28 ธ.ค. 2023
- Dish Network & Bell seemed almost defenseless when we entered the FTA Pirate era. It was their worst nightmare become reality. How was it even possible that a cheap Korean FTA satellite box could suddenly be used to fully emulate the providers hardware, intercept and decrypt their programming, and do it all without even the need of a physical Nagra access card? I explore the era of the FTA Pirate receiver and how all of this was even possible !
Business enquiries please contact me here: contact@commandergateway.com
Part #1: • Satellite Card Hacking...
Part #2: • DirecTV Black Sunday E...
Part #4: • Satellite Pirate 2001 ...
Part #5: • nFusion IKS Private Se...
![แม่กลองสองใจ - ซีแกรม โตเกียว มิวสิค [ OFFICIAL MUSIC VIDEO ]](http://i.ytimg.com/vi/GSQfVjcr_f4/mqdefault.jpg)
I was the viewsat, sonicview, pansat, extremeview, captain, coolsat, probox, prosat, neusat, and pansat coder. TheBroken checking in.
I remember you! I think... I was involved with rom10x until snaggs got busted, but i was a late teen in those years so my memory is fuzzy.
Now this is exciting! I remember this era quite well.. hard to believe it's been roughly 12/13 years since I last used IKS. Being able to get DN and Bev in one receiver with one dish, was so cool. Looking forward to this Peter! Thanks!
Hey this brings back good memories 😊😊😊❤❤this gonna be lot of fun .
iks still around just bin era is not
@@djflakoelmonstruo9908dish network iks?
Same here. A blast from the past. The best box i used was the Coolsat 5000. Great UI and a better picture than the Pansat
After watching the whole video, it's crazy to think how far stuff came after the unlooper days, we went from having to emulate with a legit DirecTV box and computer to having an all in one receiver being able to accomplish the same thing, but with a different company.
Literally any Joe blow could download a .bin and upload it to a receiver, I remember a little later, most if not all of them had USB capabilities, making it even easier. I know in my city, any neighborhood you went down, 50/60% had an old DirecTV dish, and then a bell or DN dish, or even both, being fed to their TV, and we definitely knew what they were doing. Pansat 3500 was a box I used, but jumped the gun to Sonicview and Sonicview 8000HD.
Can't wait to see what the IKS story has to say! I had a limesat box and Sonicview 360p, 360p had a dongle but the limesat had a built in ethernet port making for easier hook up.
what a throwback to FTA pirating. I remember this era of hacking. It was EVERYWHERE. I personally had a pansat.. pantech... dreambox... captain... there was so many all using the same ST chip inside. Crazy that no one covered this on youtube until now. The blackbird... silverbullet clones and so on all did the same thing.
Didn't someone clone the Pansat boxes and then Black List started to put clone killing code in his bins. "Hacking the Hackers"
@@peterfairlie2296yeah i had a clone it was called a pantec. It was the bin that introduced the epg. I had a feeling and didn't flash it. eventually there was a fix, you had to solder a pin from the cpu to a resistor, then add a fan to the cpu cause it ran hotter.
Good times.
@@peterfairlie2296 yup the fortec's suffered from this too. the quickfix was a jtag flash most ppl were using null modem cables to flash at this point and the common guy didnt know what a jtag was. eventually everything went to IKS and dreambox and dragon set tops took over... there was iLink and some other boxes that could do this but nothing as robust as the DM series devices.
@@peterfairlie2296 ChancySand removed the clone kill and changed the remote codes for the Fortec remote.
I think a lot of it wasn't covered on TH-cam for a reason, likely the fear of backlash from Nagra. But the statute of limitations are likely long since passed.
in 2007, I had a DVB pci card (PC only). I followed the guides, bought a dish, filled a bucket with cement and a pole. I had a north-facing apartment, so I asked my apartment for permission to run a dish, as long as I didn't drill into the building. they said yes, so I had a north-facing patio, cement bucket, vertical pole, 45-degree angle, (protruding outside, 2nd story), followed by another 45-degree angle, so now I have a plastic pole straight up (pointing SOUTH, barely above the roof line!). Attached a Dish receiver, carefully aimed it (using a Dish receiver), plugged it in and got my keys running over the PCI card. It was such an epic waste of time! I never got the EPG (programming guide) working. So I had 30-60 "channels" but never knew what they were. I would scan, find something, watch for a while, and tomorrow the channel was different. Weather? forget it, re-center the wobbly (PVC plastic tubes) base, get it centered, repeat. It absolutely sucked.
If I remember correctly, DirecTV wasn't much different than Dish. You could convert the LNB (low-noise block, the "horn" at the end of the dish) from DTV to Dish by removing a "polarizer" - a piece of plastic that polarized the signal and made it only work for DirecTV. This stuff is way over my head, I'm just sharing it for fun. It was an amazing technology for the time. Unfortunately mine never worked long enough to actually be useful but I proved it worked at least!
I had one of the pci cards, they used to be all over flea markets and swap meets then they blew up in price with the FTA boom. The pci cards were so complicated it was easier to just give up and get the damn receiver lol. The pci cards were meant for OTA tv but worked with satellites and cable.
Yes you could use the Directv lnb, but The L.O. frequency was a bit different (10500 I think).
For a short while around 2007 there was a PCI card that went in your PC. The video was passed through on-board HDMI. It targeted Bell. I had one.
the skyview
Yeah we called em DVB cards. There would be a softcam plug-in for MyTheatre i think it was called.
I was quite surprised that at least as of about a year ago, the NBC affiliate feed was still available FTA. The IRD was like $30 on Amazon and supports a bunch of codecs up to h.265
lmao - I love how the hackers always kept hitting back at the law. I really have been enjoying these stories you have.
Thank you.
Awesome throwback, I did wonder if you were gonna start covering the more underground stuff, looking forward to your CS video, that stuff was and still is a pain but running right it was a good time.
The digital era was wild, one cracked encryption led to another and before long CS ruled the waves.
To this day people still fight on the underground about having working "Sly" CS again after the wave a couple years ago where they bolted an additional layer to their STB firmware and flicked the switch. First in Italy, then in Germany and then finally in UK. Premium channels for your sports? Think again!
Oh and even the cable side of the pond, they stopped card sharing by moving to card emulation, in software I believe, after pirates moved from locked down sat to cable for a bit before everything went IPTV.
It'll always be a game of cat and mouse, and the solution is to stop charging insane amounts of money for it in the first place, not that it's worth it now anyway ;)
Thank you for the history lesson 👍
Same thing happened in South America in those days on Telefonica / Movistar at 61° using Telesystem boxes.
The memories… I had several Pansat receivers back in 2006-2007
i remember doing the dishnet FTA game back in the day too, when u couldnt do DirecTV, basically a back and forth lol. Also definitely subbed and liked ur vids, this is some crazy nostalgia even for an engineer xd
Excellent video. rescued a bunch of this gear this past summer from a friends roof. and the recievers. and one with an illuminati card in a 9200HD. Thanks :)
This is so cool & interesting. Thank you!
Glad you enjoyed it!
Fascinating video.
Great content.
Wohoo another great video Peter! Lots of new and interesting stuff here!
We are using DVB-T2 here in Singapore for our FTA Digital TV.
DVB-T = Terrestrial Over-the-Air broadcast.
DVB-S = Satellite
DVB-C = Cable TV
Hi Lee, Glad you like them!
@@peterfairlie2296yep. Antenna based FTA TV here.
Wow. Dreamboxes at the end. I'm pretty sure you can stream the video streams over http or something. Enigma doing its magic haha.
It be interesting to see if the flipper could duplicate a dish card. That way you can play a dish in a separate room. Lol my buddy sold eco star boxes. With dish network. Back in the day. Good stuff. Like the video
As crazy as that sounds it probably could have worked. The Nag-2 card image that was being emulated by the FTA receivers could have also been emulated by Flipper and you'd just wire the GPIO's to the card slot of a Dish receiver.
ST19NA18 was a Motorola 6805 with a bank register for execution and a bank register for data. It had a one way firewall for the modular arithmetic processor's rom (No data reads unless you were in bank 40). It was not complex, and the hard part (math functions) were HLE'd.
@@pinheadjones74Well the ST19NA was the Nagra Merlin (Nagra 3) card. It has a sample and hold glitch detector. There is a vulnerability within that hardware which requires a tuned RF probe but I basically retired out once they heard what I was doing and they started chasing me, NagraStar were NOT about to let me crack the door wide open on a system they just spent millions implementing... The ST19WL and ST19XL were the former chips in Nagra 2. Also its not even really a "firewall". its just a programmable MMU which required privilage escalation. Think 68K's supervisor/user mode. even OTP was reprogrammable once you had the MMU bits set right. (required escalation) Once you had privilage escalation, the MMU became transparent and you can read out any of those ROMs from anywhere. One such method to obtain escalation was using MAP to write arbitrary values into the stack which it will refuse to do, until you glitch it.
interesting; thank you for sharing
Vraiment bon vidéo!
It's this why we have iptv all over the place n jus now finally getting looked at by others. Been streaming before it was even a thing
So ProgDVB is still a thing apparently, any plans to cover it sometime, with the USB grabber? I'm sure there are still some FTA sats or decryptable ones out there you can receive from...could also cover filegrabbers like skygrabber too?
Also fun is "wild feeds" in general. Love your stuff, nostalgic!
This is intriguing. What is the state of Satellite piracy today? Would love to know!
Pirate channel for the win, that combined with the 3000 clone a willy commercials. classic.
The old fta has no epg. When coolsat came out with a full epg that was a game changer for fta
Ah i remember the card sharing business i used to have.... CCcam Oscam etc. Good time lol
Is there anymore dish network or directv service hacks. Genuinely curious I never watch tv lol. I know Iptv has taken over the market just curious if the old methods of streaming with satellite still exist
any info on N3 i heard the person the created it was an N2 hacker that went to work for nagra and created the N3
I'm a software and RF engineer and it looks like I live in the GTA with you. Would be cool to collab. I don't know a lot about satellites but I know a lot about hardware and digital modulation/comms below 6ghz. Have a load of equipment too, BladeRF, B210, then too many mixers/amps/modulators, TI chips etc. Recently been getting into 40ghz and 60ghz radio, and slowly collecting some equipment (horns, LNAs)
What did they (dish/bell) do to stop these receivers from de-scrambling their signals? Or did they?? Could you explain ECMing a little bit more? Thanks!
They started changing encryption codes quicker which become a hindrance, at first, and then as the boxes and the firmware got better, the firmware would roll through all the options as quick as possible. From an outsider perspective, seemed like they ran all the plays they had left with Nagra2, while the groups figured the rest out with each change, and ultimately, providers were basically forced into an encryption standard change.
@@pXnEmerica Actually, in the end game, Raton and I wrote a full emulation of the ST19NA18, including the modular arithmetic processor, which meant that as long as we could receive the EMMs (Electronic Management Messages), we had the new crypto as soon as it was activated in stream.
@@pinheadjones74 Insightful, IIRC that was pretty late in the game? Which became the autoroll basically? I don't really recall much uniformity in firmware until the later stages.
My (tired) brain wants to remember there being chunks of the system/card? hadn't been figured out in full. Or that was the forum story.
I mean you should have been able to pull EMM data from a standard DVB card so that wasn't exactly a restricting factor?
@@pXnEmericaWell in the endgame they would start sending down random MAP calls, obscuring the crypto becuase the only way you knew what was going on in MAP was from example input/output. Since MAP wasn't available unless you had an NDA with ST, the only way to know what was going on was by usage. So they would randomly add extra/change crypto to the ECM processing using functions never seen before. The main ECM Decrypt remained unchanged. However, what they did do was add post-processing to the control words. It was a cat and mouse game, eventually the MAP ROM was dumped and then that exposed everything. But by that point, they were already well on their way of switching over to nagravision merlin.
need to cover gempix skywalker
What are you using now????
This is cool how do we havk satellite today?
This has to be the first case I've ever heard of a company purposefully making its hardware _easier_ to hack! 😂
Is there any iks nowadays? I'm just curious
Not sure why it's still valid in europe but nothing in north America!
Apparently my post was auto-moderated.
I made a botnet out of the Relook FTA boxes.
Great little platform, Ran Linux it had plenty of ram, a hard-drive, mips cpu and UPNP support so it automatically forwarded all the ports on the targets router.
In my infect script I had it check if it was running a softcam before I proceeded so I wouldn't mess with non-pirates.
I was shocked dish or bell never made a worm for this. It would have been nearly effortless to automate self propagation, checking if it was pirating a specific service, and replace the contents of the /dev/mtd* with /dev/zero so the NAND was blank and it was bricked.
At least if you did, the community had enough familiarity with JTAGs to unbrick them. I guess people should have put "TSOP lock" switches on the NAND chips on FTAs just like OEM IRDs. I feel like people should do that for their cable modems and home routers too.
Did ST completely overlook chip level security ? Can't see anything in data sheet. Seems there is nothing to lock a 5518 to any smart card where CA is enabled. I take it the Omega chips in the FTA boxes were legit. This must have been great revenue if ST needed fabs in 3 countries. Thanks for the effort you put in reviving the hardware for our education.
I think when these chips were planned, DVB was the standard, so they wouldn't add functionality that wasn't required. DirecTV is proof that the crypto between the smart card and CPU can be done securely, so Dish was just a consequence of poor technical design at the system level.
@@mcpr5971I remember the DirecTV RCA 4th gen boxes had the same STI55XX chipset. Someone did write modified firmware to allow those RCA boxes to get Dish programming for a time.
DirecTV was getting hacked too even though they were DBS not DVB, Wonder what happened to IKS?
IKS is still alive and well
@@loganmacgyver2625 Oh wow.
@@Capturing-Memories most boxes from direct to china sites that connect to the internet support it
FYI: CSA-Rainbow-Table
Have read about that, but seems completely unheard of in North America, just a couple of arabic youtube videos and some Germans. Is it dead or just not very popular due to IPTV?
@@443DM i think it is still popular to find BISS keys of feeds or geo-blocking tv channels.
@@443DM CSA-RT takes advantage of the limited keyspace in the CSA control words, and the time available after switching from odd to even control words. with only 40 bits of keyspace, brute forcing was out of the question, but an RT was not. Knowing the mpeg-ps header was what made it possible.
Yeah, those were the days. I had my Dish Network 18" dish with three LNBs. It was pretty easy to do two but I bought a bracket off the Internet to do three rather than make my own. I forgot that third LNB was to get Bell - that's where the porn was (you dirty, dirty Canucks, jk). I remember the switch to IKS and I had a capable receiver, but I didn't trust giving my credit card to potential criminals. Plus, if they got raided I'd be at risk.
Of course Sky Tv in the UK refused to provide a conditional access module for their encryption..
Recently had a tree fall on my primestar dish farm :( so I found a semi-local guy selling his Wavefrontier T90 Toroidal dual reflector dish and snagged it. I am curious if you have had any experience with a multi LNB toroidal dishes? Unfortunately it just started snowing and getting too cold for me to want to set a permanent install for it, so my plan is to get what LNBs I need that he did not include, get the dish reassembled, and have all ready to install this spring. I am also looking for info on doing a site survey on my lot for placing a prime focus/BUD (I have several that are potential candidates, but the only one I have in really good shape is only a 6', trying to determine if a 10" with one quadrant damaged will have better results than a smaller excellent condition dish too.) Would love to discuss with you, and I plan to document my journey on my channel (plan to do a TVheadend, and network DVR to share across family network) Love your videos, thank you for the content!
Hi Reagan, I know all about them and have owned in the past a T-55 and the T-90. They have a very wide view of the sky which makes them interesting. One thing to note here is, because it's a double reflector, if you're after circular signals like Dish & Bell you'll need a reversed polarized LNB. Anything linear will work the same and you can use any FSS LNB. The reason I got rid of them was snow issues. Snow would collect on the main reflector and then when there was enough it would avalanche down onto the sub-reflector and get stuck there blocking the LNB's. As for the BUD, full 6 foot will outdo a 10 foot with quarter panel missing. You're also going to need an updated C-band LNB with 5G filter.
@@peterfairlie2296 I wouldn't say the full quadrant is missing. I would say between 10 to 15 percent damaged/bent. I will see about putting up a short showing the damage. I have kept is around as I really feel like at some point I can either repair it or have it repaired (I have access to a CMM and FARO arm, so I can measure it and get a local shop to fab what I need, I prefer to save dishes from the scrapper though). It also has a nice chain drive H-H mount on it to boot. Where I am located, if anyone complains about the dishes they were most likely trespassing, so I am not afraid to mount several lol. I cannot think of anything I would need the circular polarized lnbs for these days lol, but good to keep in mind, especially considering I was planning to use dish and dtv birds to get it aimed in, I wonder if there is such an animal as a polarity inverter for a circular polarized lnb. All you are doing is changing the voltage for polarity in a rhcp or lhcp lnb (been several years since I have played with this stuff, glad I kept my meters and install tools lol)
You were f-n with us about that German channel right?
Seems boring. The Libyan channelis way better.
Fast times in German
(Great scramble)
Pasant 3500
This was fun time but once steaming took off it made this not worth the effort I took down my dishes and never looked back
make a Video to Hacking NDS Cards Brow🤠
Great lore
has nagra3 been hacked yet?
In secret it has but it was never publicly released to the wild.