Yup. All you can do. I know flash ICs have unique serial numbers too, but thats only on ICs that have heightened security. Most CableCARDs used SLE88 infineon 8051 based microcontrollers, which house the keys to decrypt the MECM. They are VCC and Clock glitch protected, VCC uses a switched capacitor core voltage regulator, prevents VCC sagging. Clock is protected by an isolated oscillator. uses an internal RC oscillator to develop the core clock, the external clock is hooked only to the USART.
The older CableCARDs used the SLE66, which is vulnerable to a clock glitch from initial powerup before the RC Osc kicks in, it will run off the external clock early in the boot process. Proper timing is required, you can get past the transport key check and get into the siemens CardOS backdoor which is accessable only by holding the I/O line at a certain state during power up for around 200mSec.
TWC and im sure other cable companies started swapping thier cablecards and harware to the new powerkey multistream ones which contained the SLE88, and thus better security. and not the single stream cards which were SLE66 based. (vulnerable/hackable).
the non-cablecard digi boxes were running ST16/ST19 which is 68HC05 based and contain NO protections, only protection is the box authorization from the head end. But nothing stops you from using a modified non-provisioned digital cable reciever (like ones used in Tvs to get cable based HD locals), and having the keys. whoops.
nowadays though, cable has become more and more streaming based. the new cable boxes use the cablecard for the VA decoding like before, but the actual video is transported via media stream on request, and not global transmission that anyone can recieve thats connected on the network looking for it. (like sat, or older cable days). Basically a DOCSIS modem on the box, and a "glorified encrypted netflix". So you still have to have a provisioned unit (like a un/pw) to request access to the stream, plus the cablecard has to have the auth key for that particular stream. Double wammy.
The older CableCARDs used the SLE66, which is vulnerable to a clock glitch from initial powerup before the RC Osc kicks in, it will run off the external clock early in the boot process. Proper timing is required, you can get past the transport key check and get into the siemens CardOS backdoor which is accessable only by holding the I/O line at a certain state during power up for around 200mSec.
TWC and im sure other cable companies started swapping thier cablecards and harware to the new powerkey multistream ones which contained the SLE88, and thus better security. and not the single stream cards which were SLE66 based. (vulnerable/hackable).
the non-cablecard digi boxes were running ST16/ST19 which is 68HC05 based and contain NO protections, only protection is the box authorization from the head end. But nothing stops you from using a modified non-provisioned digital cable reciever (like ones used in Tvs to get cable based HD locals), and having the keys. whoops.
nowadays though, cable has become more and more streaming based. the new cable boxes use the cablecard for the VA decoding like before, but the actual video is transported via media stream on request, and not global transmission that anyone can recieve thats connected on the network looking for it. (like sat, or older cable days). Basically a DOCSIS modem on the box, and a "glorified encrypted netflix". So you still have to have a provisioned unit (like a un/pw) to request access to the stream, plus the cablecard has to have the auth key for that particular stream. Double wammy.