6 ms·

PS4 security article follow up

92 points by FiloSottile 11y ago

Aissen 11y ago
> As a little side note; with the recent release of LLVM 3.7, if we specify -target x86_64-scei-ps4 to clang, we can compile code with the exact same options that Sony uses to compile official code for the PS4. I wonder if this will undermine the opensource strategy of Sony's LLVM/SDK team. I hope not.
- SXX 11y ago
  Reason why Sony open source their version of LLVM is to make it easier (cheaper) to maintain it. So it's commercial interest and it's unlikely to change because it's wouldn't affect how soon it's going to be hacked at that point anyway. It's just like with previous "Linux on PS3" that was mainly done by Sony to decrease taxes as they could pay less if their system can be considered as general purpose PC and not just gaming console. On the time that feature was removed this trick just didn't make sense anymore.
  - Kristine1975 11y ago
    Essentially this. There was a talk by Sony at the 2013 LLVM Developers' Meeting: http://llvm.org/devmtg/2013-11/#talk8 http://llvm.org/devmtg/2013-11/#talk8 From the slides: Initial development hampered by secrecy - Blanket secrecy policy included compiler project - No advice/feedback from the group consciousness - Sitting on features and bugs and fixes applicable upstream Clear value to working openly with upstream - File a bug; somebody else might fix it - Send a patch; people will review/advise - Bigger features can get better design review - Putting private changes upstream reduces merge pain And: Merging once per upstream release was a nightmare - We stuck our fingers in everywhere - The 3.0 merge work took three months
    - Aissen 11y ago
      You know that and we know that here. I just feared someone might decide that making engineers miserable to do the constant porting might be a good security tradeoff.
- tacos 11y ago
  Sony just lost their top LLVM open source proponent to Apple. Read into that what you will.
  - brazzledazzle 11y ago
    Who's that?
    - tacos 11y ago
      Alex Rosenberg - https://twitter.com/alexr https://twitter.com/alexr
      - vive-la-liberte 11y ago
        His bio reads "day: console OS development, night: home". Time for wild speculation! Apple are making a game console! (He probably just hasn't updated the bio.)
        geofft 11y ago
        Aren't they already the manufacturers of the most popular game console, namely, the iPhone? :)
        tacos 11y ago
        old bio.
tptacek 11y ago
The reason I didn't mention encryption in my last article is because trying to defeat it would be a complete waste of time. The PS4 probably uses AES (like the PS3 and PS Vita), which is the same type of encryption used by the U.S. government. Argh! No! Keep at the encryption! The only exception to this is would be for implementation mistakes such as the PS3's infamous use of the constant 4 instead of what should have been a random number. Whilst it is unlikely that Sony has made another mistake like this in the core of the PS4's encryption... Argh! No! Look for other stupid mistakes!
- unknownv2 11y ago
  He's saying trying to bruteforce the encryption keys is the wrong way to go about it, instead opting to find an exploit.
- profeta 11y ago
  The wii hacks were all based on awful implementation of the AES methods, wasn't it?
  - beefhash 11y ago
    Wasn't the first main Wii hack (trucha bug) actually a bad implementation of RSA signature verification (strncmp instead of memcmp)? I don't know about the other ones, but I thought they were all pretty much game-local.
    - JoshTriplett 11y ago
      > Wasn't the first main Wii hack (trucha bug) actually a bad implementation of RSA signature verification (strncmp instead of memcmp)? Yes; with that bug, you could select a signature to collide with that had an early NUL and brute-force a signature that matched up to that NUL. > I don't know about the other ones, but I thought they were all pretty much game-local. No, at least two other exploitable issues occurred in the system software: Bannerbomb (http://wiibrew.org/wiki/Bannerbomb http://wiibrew.org/wiki/Bannerbomb) exploited the parsing of banners for data stored on an SD card (running arbitrary code when accessing the SD data management menu), and LetterBomb (http://wiibrew.org/wiki/LetterBomb http://wiibrew.org/wiki/LetterBomb) exploited the parsing of Wii Message Board "letters".
floatboth 11y ago
> our process is running in a FreeBSD jail, which I'm not sure is possible for a process running as root uh... that's, like, the whole point of jails. If you get root in a jail, you get root. In the jail. You only see the jail's root fs, the jail's processes and, usually, a very limited set of devices in /dev.

92 points by FiloSottile 11y ago

> As a little side note; with the recent release of LLVM 3.7, if we specify -target x86_64-scei-ps4 to clang, we can compile code with the exact same options that Sony uses to compile official code for the PS4. I wonder if this will undermine the opensource strategy of Sony's LLVM/SDK team. I hope not.

SXX 11y ago
Reason why Sony open source their version of LLVM is to make it easier (cheaper) to maintain it. So it's commercial interest and it's unlikely to change because it's wouldn't affect how soon it's going to be hacked at that point anyway. It's just like with previous "Linux on PS3" that was mainly done by Sony to decrease taxes as they could pay less if their system can be considered as general purpose PC and not just gaming console. On the time that feature was removed this trick just didn't make sense anymore.
- Kristine1975 11y ago
  Essentially this. There was a talk by Sony at the 2013 LLVM Developers' Meeting: http://llvm.org/devmtg/2013-11/#talk8 http://llvm.org/devmtg/2013-11/#talk8 From the slides: Initial development hampered by secrecy - Blanket secrecy policy included compiler project - No advice/feedback from the group consciousness - Sitting on features and bugs and fixes applicable upstream Clear value to working openly with upstream - File a bug; somebody else might fix it - Send a patch; people will review/advise - Bigger features can get better design review - Putting private changes upstream reduces merge pain And: Merging once per upstream release was a nightmare - We stuck our fingers in everywhere - The 3.0 merge work took three months
  - Aissen 11y ago
    You know that and we know that here. I just feared someone might decide that making engineers miserable to do the constant porting might be a good security tradeoff.
tacos 11y ago
Sony just lost their top LLVM open source proponent to Apple. Read into that what you will.
- brazzledazzle 11y ago
  Who's that?
  - tacos 11y ago
    Alex Rosenberg - https://twitter.com/alexr https://twitter.com/alexr
    - vive-la-liberte 11y ago
      His bio reads "day: console OS development, night: home". Time for wild speculation! Apple are making a game console! (He probably just hasn't updated the bio.)
      - geofft 11y ago
        Aren't they already the manufacturers of the most popular game console, namely, the iPhone? :)
      - tacos 11y ago
        old bio.

tptacek 11y ago

The reason I didn't mention encryption in my last article is because trying to defeat it would be a complete waste of time. The PS4 probably uses AES (like the PS3 and PS Vita), which is the same type of encryption used by the U.S. government. Argh! No! Keep at the encryption! The only exception to this is would be for implementation mistakes such as the PS3's infamous use of the constant 4 instead of what should have been a random number. Whilst it is unlikely that Sony has made another mistake like this in the core of the PS4's encryption... Argh! No! Look for other stupid mistakes!

unknownv2 11y ago
He's saying trying to bruteforce the encryption keys is the wrong way to go about it, instead opting to find an exploit.
profeta 11y ago
The wii hacks were all based on awful implementation of the AES methods, wasn't it?
- beefhash 11y ago
  Wasn't the first main Wii hack (trucha bug) actually a bad implementation of RSA signature verification (strncmp instead of memcmp)? I don't know about the other ones, but I thought they were all pretty much game-local.
  - JoshTriplett 11y ago
    > Wasn't the first main Wii hack (trucha bug) actually a bad implementation of RSA signature verification (strncmp instead of memcmp)? Yes; with that bug, you could select a signature to collide with that had an early NUL and brute-force a signature that matched up to that NUL. > I don't know about the other ones, but I thought they were all pretty much game-local. No, at least two other exploitable issues occurred in the system software: Bannerbomb (http://wiibrew.org/wiki/Bannerbomb http://wiibrew.org/wiki/Bannerbomb) exploited the parsing of banners for data stored on an SD card (running arbitrary code when accessing the SD data management menu), and LetterBomb (http://wiibrew.org/wiki/LetterBomb http://wiibrew.org/wiki/LetterBomb) exploited the parsing of Wii Message Board "letters".

floatboth 11y ago

> our process is running in a FreeBSD jail, which I'm not sure is possible for a process running as root uh... that's, like, the whole point of jails. If you get root in a jail, you get root. In the jail. You only see the jail's root fs, the jail's processes and, usually, a very limited set of devices in /dev.