For most companies, the word "hacker" conjures up nightmarish images of legions of code-busting thieves, out to steal service and programming and to generally wreak havoc. But personal video recording pioneer TiVo Inc. looks at hackers in a very different light.
Several Web sites offer the storage-challenged TiVo user detailed information about how to add an extra hard drive to the boxes, which are manufactured by Philips Consumer Electronics and Sony Corp. of America.
"Our position is: If what you do to your box involves no harm, no foul — and it makes you a happier TiVo customer — then we're all for it," said TiVo chief evangelist and "TiVolutionary" Richard Bullwinkle.
"We're not a hardware company," he added. "We're in no way offended by [subscribers adding hard drives]. When people hack a TiVo, they're not stealing from us, they're just allowing themselves to record more stuff."
TiVo users who venture inside their boxes void the warranty, Bullwinkle noted. At the same time, TiVo hacker Web sites typically provide explicit warnings that fiddling with a box's innards could result in electrocution. The original TiVo box was designed to be hard drive upgradeable, explained TiVo CTO Jim Barton. That means a second hard drive can be added using proprietary software hooks.
But the cost of such an upgrade proved to be exorbitantly high. Consequently, hackers utilized that capability, decompiled the hard drive and figured out how to add a second disk.
In a technical breakthrough late last year, a group of renegade Australian-based Linux programmers devised a way to add Ethernet connectivity to a TiVo box. According to information found at the 9th Tee Enterprises Web site (www.9thtee.com), the so-called TiVoNet Ethernet card plugs in the Peripheral Control Interconnect (PCI) shaped connector on the TiVo motherboard. It also has an Integrated Systems Architecture (ISA) connector, into which one can plug in a modified Ethernet network-interface card.
The purpose of the card is to share compressed video over a local-area network. Bullwinkle said subscribers would meet "fair use" parameters as long as the scheme is used to play back a movie or TV show in another room of a subscriber's home.
TiVo has developed code to stymie the Ethernet hacks, if needed, said Bullwinkle. He draws the line at violating intellectual property and content rights.
"The first person who raises their head and says I used my TiVo to steal content, we'll go after them," he declared. "We will protect the rights of the person who owns the content."
TiVo is in constant touch with hackers, said Bullwinkle. Because of their good relationship with the company, they often share potential problems and security issues.
Interestingly, Bullwinkle noted that he spotted a posting on the TiVo Underground forum in which the author said code designed to extract digital media from a TiVo box exists, but the hacker refused to release it.
Because TiVo is tolerant of the hacker community — the result, to some degree, of the open-source Linux software that runs its boxes — "they'll protect us," Bullwinkle predicted.
In another case, Bullwinkle said a hacker figured out how to steal TiVo's subscription service, but eventually turned over the information to the company. Because of that and other information culled from the hacker community, "we think we're about one year ahead of them," said Bullwinkle.
Barton pointed out that TiVo's encryption software and security keys are stored on a processor that's separate from the central processing unit, or CPU. He said TiVo boxes use asymmetrical key encryption based on the ElGamal algorithm, using 894-bit keys as the fundamental authentication mechanism. In that mechanism, a unique private key is stored in the processor; TiVo has the public key for each receiver.
"It would take an act of God to violate that," said Bullwinkle.
As TiVo revises its software and downloads it into subscribers' boxes using the telephone connections that receive program guide information — as it did recently in its 2.0 release — it incorporates information gleaned from hackers to beef up security and digital-copyright protection, Bullwinkle said.
Though TiVo has been kind in its treatment of hackers, a prominent privacy advocate has recently questioned some of the company's other activities. After a four-month investigation, Denver-based Privacy Foundation late last month alleged that TiVo collects and shares personal data to track its subscribers' viewing habits without their consent.
TiVo denied that charge in a statement, claiming it has never collected personal viewing information and shared it without the consent of its subscribers. Any information that is shared with "certain groups" in the TV industry is done only in the form of aggregate, anonymous data, the company said.
While not a hacker, respected cable-TV consultant and engineer Walt Ciciora said he was able to test the digital video quality of his box by transferring images from his camcorder to a TiVo disk using the receiver's baseband video and audio inputs and causing the TiVo menu to record an arbitrary DBS channel, which happened to be running video stored on his camcorder.
This method could become a quick way to store and retrieve home videos, he said.
But there's a larger issue at stake for the cable industry, Ciciora said. "Cable operators need to be aware that the public includes some fairly sophisticated consumers who enjoy opening up and playing with their hardware."
As the industry considers consumer set-top box ownership, operators should be aware that hackers are out there ready for a challenge, he added.
Executives at Scientific-Atlanta Inc. and Motorola Broadband Communications Sector, citing years of security development from both analog and digital set-top deployments, seem confident in their security and encryption schemes. Set-tops with on-board PVRs are set begin to appear in the marketplace later this year.
Meanwhile, hackers continue to use the information culled from the Web to add up to 80 gigabytes of more storage to their TiVo boxes.
As one poster gleefully pronounced as he gathered information about adding a second disk: "Tonite [sic], I operate!"
