Film-Tech Forum ARCHIVE: Booth internet access?

This is topic Booth internet access? in forum Digital Cinema Forum at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=16;t=001874

Posted by Harold Hallikainen (Member # 5405) on 04-21-2014, 12:48 PM:

Some services, like Theater Key Retrieval rely on equipment within the booth making outgoing TCP (or HTTP) connections to servers on the Internet. What percentage of auditoriums are configured to allow equipment on the auditorium network to access the outside world (again, typically an outgoing HTTP request)?

THANKS!

Harold

Posted by Marco Giustini (Member # 4544) on 04-21-2014, 01:03 PM:

Same percentage that can reach an NTP server! [Smile]

I'd say 90% - in a way or another. As you noticed, most services today are relying on the Internet for content/key/advert transfer. The server may not be configured to access the network directly - which is wrong, their clock will drift and some manufacturers will ask money to re-sync it if the drift is too severe - but the internet would just be minutes away.

Posted by Mike Blakesley (Member # 26) on 04-21-2014, 04:00 PM:

quote: Marco Giustini
The server may not be configured to access the network directly - which is wrong, their clock will drift

I don't understand why, in this age where we can manufacture stuff down to tolerances in the microns, we can't build a computer clock that is accurate.

Posted by Mark Gulbrandsen (Member # 72) on 04-21-2014, 05:52 PM:

Mike....

Those clocks exist but they are expensive. Locking to NTP protocol via the internet is almost as accurate as having a real atomic clock. The idea being that all devices in a complex containing clocks lock to one accurate source and all stay synchronized...

Mark

Posted by Harold Hallikainen (Member # 5405) on 04-21-2014, 07:01 PM:

Thanks for the responses! So, it looks like auditoriums generally have outgoing internet access, right?

It IS difficult to build an oscillator that is stable over temperature. Getting much better than 5ppm over temperature gets expensive. 5ppm is about 13 seconds a month.

One thing I do with NTP is adjust my clock speed in the correct direction each time I need to make a correction. So, over time, the error gets smaller and smaller.

Also, I'm generally setting the default NTP server in the sutff I'm working on to pool.ntp.org and using 8.8.8.8 for DNS.

Harold

Posted by Frank Cox (Member # 6258) on 04-21-2014, 07:14 PM:

My theatre has Internet service, but it's not connected to the projector/server setup. That's on its own independent network and not connected to anything other than itself.

On my own computers I generally point ntp at time.windows.com; I figure Microsoft can afford the traffic, and I enjoy the irony of using a ms service to keep the time on Linux machines.

Posted by Marcel Birgelen (Member # 6801) on 04-21-2014, 07:27 PM:

You can also use a local server as your NTP server. Many decent routers can even take the role as the local NTP server. Let this server sync with an NTP pool and connect all your equipment to this server. That's actually what the designers of NTP had in their minds anyway.

And although I do get the convenience of your booth having Internet access, there isn't really a reason why it actually should have it. Even it you rely on something making a TCP connection to somewhere else, that should be an exceptional case, not the standard.

You know all those security leaks you hear about in the news all day long? Well, that kind of shit starts right where everything needs to be hooked up directly to the Internet, even the stuff that doesn't belong there.

Why should your projector, server or even TMS be capable of making a call to a random location on the Internet?

Stuff like "Theater Key Retrieval", which looks very "drafty" right now, should keep this in mind. The idea of automated key delivery is great, but it should NOT require every playback server or IMB being hooked up directly to the Internet. If that's the case, the design is awkwardly wrong and just blatantly ignores all the crap that's been going around on the Internet the last few years.

Posted by Steve Guttag (Member # 268) on 04-22-2014, 06:30 AM:

While we have internet access to all of our booths...what is allowed to have internet access is almost nothing...there is typically a device that has the ability to get the time and all of the devices in the booth get their time from that device. The other reason is for remote support.

There is zero reason for every device in the booth for having internet access. It is a potential breach of security and a waste of bandwidth.

Posted by Dennis Benjamin (Member # 1137) on 04-22-2014, 12:58 PM:

If your digital projection booth is a V.P.F. site, it is most likely accessible from the outside world through the Internet. However, while your N.O.C. can get in, as an operator - it is not a good idea to let your equipment "out". The only case would be for N.T.P. server access. Other than that, you are opening your equipment up for various issues. Especially if your Library Media Server is running a Microsoft based operating system.

Posted by Marcel Birgelen (Member # 6801) on 04-23-2014, 03:37 AM:

A NOC or any external service party should access their customer networks using something like a VPN. At the very least there should be some access lists in place that only allow traffic from certain approved ranges.

Essential components in your projection chain are running on "industry standard" operating systems like some flavor of Linux and sometimes even Windows and they're no less susceptible to exploits being used by viruses, Trojans, etc. Since most vendors do not have their focus on maximizing security and you shouldn't have your focus on applying every possible patch at every possible time, it's essential to keep this stuff isolated from the plain Internet as much as possible. The same is true for other systems, like POS terminals and associated servers.

Posted by Joris Springer (Member # 4175) on 04-29-2014, 05:28 PM:

Personally I wonder why those harsh restrictions, isn't the NTP protocol something you can control with certain ports?
Isn't the DCI standard going too far in some points of view or are there some ways to avoid the DCI standard and that way still make all servers vulnerable and in a way decieve the DCI standard?
I wonder why the DCI is a "holy grail"...

Posted by Frank Cox (Member # 6258) on 04-29-2014, 05:30 PM:

I'm frankly a bit surprised that NTP is allowed. I'm not a NTP expert but wouldn't it be possible to set up a "fake" NTP server to gradually shift the time on a server and/or projector? Which then creates it a security hole in the key system.

I must be missing something.

Posted by Mark Gulbrandsen (Member # 72) on 04-29-2014, 06:31 PM:

If you could control the UTC refrence up or down it theoretically might. It should follow what the the master clock is doing which may be the internet, a GPS locked NTP server or some goofy clock you devise that you can speed up or slow down... You still have to convert what ever clock to issue NTP protocol.

Mark

Posted by Harold Hallikainen (Member # 5405) on 04-29-2014, 07:42 PM:

I believe the clock within the media block can only be moved something like 6 minutes a year, and that is enforced within the media block. That, I believe, only deals with licenses and keys. Youcan start a show anywhere within the authorized window, so the servrr can use ntp to independently keep its clock accurate for show scheduling.

While my question originally mentioned TKR, our lss-100 can use http or https post to post logs to a server for analysis. This can be a server on an internal network or on the Internet, as desired by the installer. Some sample reports are here. .

Harold

Posted by Kevin Tan (Member # 8150) on 04-30-2014, 11:37 AM:

Hi Harold,

I checked with the page, it is pretty cool feature~

Kevin

Posted by Mike Blakesley (Member # 26) on 04-30-2014, 11:44 AM:

quote: Mark Gulbrandsen
Those clocks exist but they are expensive.

Why are they expensive? I have a $29 clock/weather station thing in my bedroom that is not even connected to wi-fi but it still connects to the "master clock" in the cloud somewhere and updates itself and is 100% accurate all the time. Why can't these $20,000 servers do that?

Posted by Mark Gulbrandsen (Member # 72) on 04-30-2014, 12:48 PM:

quote: Harold Hallikainen
I believe the clock within the media block can only be moved something like 6 minutes a year, and that is enforced within the media block.

On at least one brand of server there is a back door into it where time correction can be done. It is a DCI approved method and only the manufacturer is able to do it... This way no time correction script is needed.

Mark

Posted by Mike Blakesley (Member # 26) on 04-30-2014, 02:21 PM:

Look at all the money they could save if they would just connect a $20 device to read the time off of the cloud.

What am I missing here? The idea of a COMPUTER in the year 2014 needing to have a factory technician remote in through a "back door" to set a clock is completely stupid, isn't it?

Posted by Steve Guttag (Member # 268) on 04-30-2014, 03:03 PM:

Via NTP...everyone's clock "should" be accurate.

Posted by Marcel Birgelen (Member # 6801) on 04-30-2014, 04:58 PM:

quote: Mike Blakesley
Why are they expensive? I have a $29 clock/weather station thing in my bedroom that is not even connected to wi-fi but it still connects to the "master clock" in the cloud somewhere and updates itself and is 100% accurate all the time. Why can't these $20,000 servers do that?

Well, NTP is actually exactly this, instead of fitting all machines with their own atomic clock, we sync it to a large bunch of atomic clocks (like those in GPS satellites). It's actually a very nifty protocol, it compensates for most timing defects, latency issues and it is also reasonably capable of protecting you from abuse (like some evil third party trying to skew your clock). It dates back from before we were all surfing the web, has its roots in UNIX and has quite a proven track record. It has some security issues though and it is being used in DDoSes lately, that's why you do not want to expose your own NTP services to the world, you just want to use "the world" as your reference clock. Also, the original (and still best idea) of NTP is that you run one or two NTP servers on your local network which are then being used by all your clients on that network to sync with. Nowadays, it's pretty much overkill to use a dedicated server for NTP, many routers and firewalls can be NTP servers too, or you can run it as a service on another server. This NTP server, in turn, synchronizes with the servers in the cloud.

If you set up this correctly, there are almost zero security implications, no nasty firewall hacks needed and all your machines do run (yeah, ALMOST) exactly the same time. There is also very little maintenance involved.

quote: Frank Cox
I'm frankly a bit surprised that NTP is allowed. I'm not a NTP expert but wouldn't it be possible to set up a "fake" NTP server to gradually shift the time on a server and/or projector? Which then creates it a security hole in the key system.

The whole DCI security model relies on keys being valid during a certain period of time. It's not like the KDM automatically transforms once it becomes valid and self destructs once it expires, so they tied it to a timer. They're only capable of pulling this off, because of the Pandora's Box design of the media block.

I already mentioned it, but if you do NTP correctly, it will not allow you to shift the clock beyond certain limits. But even that doesn't matter.

Like Harold already mentioned, the media block maintains its own clock. It even has a separate battery to power this clock. That's the only time that matters for your KDM. Since this clock on your media block isn't totally accurate, you're indeed allowed to make small corrections, with some predefined maximum adjustments in a given year.

If the clock in your media block somehow skews too much off track because of e.g. a battery failure or inaccurate timer, your hardware becomes a support case...

Posted by Joris Springer (Member # 4175) on 05-01-2014, 06:25 PM:

We once had a hardware failure like that, caused the server to run 30 minutes behind. Not a nice day when that happened, luckily the movies kept working properly, just had to change the schedule for that booth until the new IMB board came (which came quite fast) and the new KDM's arrived (which averagely takes around a week for all movies :-( ).

Posted by Chris Slycord (Member # 4239) on 05-02-2014, 12:57 AM:

quote: Mark Gulbrandsen
If you could control the UTC refrence up or down it theoretically might. It should follow what the the master clock is doing which may be the internet, a GPS locked NTP server or some goofy clock you devise that you can speed up or slow down... You still have to convert what ever clock to issue NTP protocol.

What he's saying is he sets up a server that responds like a normal NTP server except purposely gives the wrong time. A rogue NTP server if you will.

But that threat is only valid if you presume that people will start using it. And even if that server made its way into the regular regional official pool, nothing would happen since the local server likely has a close-to-right clock and the rogue one would be out of the range for updating and in the average case his server would be periodically not used (since you connect all the time to random servers in the pool).

So a rogue one would have limited effectiveness at screwing stuff up, imo.

Although similarly, all these people would come into a theater saying "online it says this" and I've always wanted to tell them I can make a website that only shows wrong movie times.

Posted by Dennis Benjamin (Member # 1137) on 05-05-2014, 09:38 AM:

I walked into a theatre once and asked how things were since they went digital. The manager almost started to get emotional over the fact that their movies were never starting at the correct time. They had to adjust thier automated schedule start times to compensate for the 'server drift' that was occuring. At any point at this 9 plex theatre - their servers were off anywhere between 1 and 7 minutes. I told them that they need to contact their tech and get the servers to connect to an NTP server. That problem was fixed pretty quickly.

Posted by Marcel Birgelen (Member # 6801) on 05-06-2014, 04:28 AM:

quote: Chris Slycord
So a rogue one would have limited effectiveness at screwing stuff up, imo.

As long as the NTP implementation on the clients is according to specs there is indeed not a big chance for this attack to proceed.

One thing that might be notable though is that there are machines configured to do a "hard sync" on an NTP server during a reboot. As far as I know, none of the current DCI equipment is actually doing this, but there is equipment out there with this kind of behavior.