8 ms·
The First PS4 Kernel Exploit: Adieu
- adieu 9y ago?
- afandian 9y agoI think you've been exploited.
- jacquesm 9y agoPrescient! 4 years and a bit.
- unkown-unknowns 9y agoOn Reddit they call it Beetlejuicing. /r/beetlejuicing
- microcolonel 9y agoI guess it makes sense that the vulns would be in Sony's new kernel code, and not in its FreeBSD ancestor.
- faustocarva 9y agoHow huge is this?
- bluehazed 9y agoThis is an old exploit that has been since patched by Sony in firmware 4.07 (the last section of the article shows the fix).
- ninh 9y agoSony appears to have patched it from firmware 4.06 and up. The adieu in the title appears to refer to bidding a farewell to the exploit rather than a codename for it ;-) Great and insightful write-up nonetheless!
- Cyph0n 9y agoqwertyoruiopz[1] claims to have achieved kernel-level code execution on 5.00. It's probably not going to be released to the public anytime soon, but it's still not over for the PS4 homebrew scene. [1]: https://twitter.com/qwertyoruiopz https://twitter.com/qwertyoruiopz
- hd4 9y agoFrom what I've observed, this is where the unending cat-and-mouse game begins for Sony.
- ygjb 9y agoIn fairness, it started back when Sony shipped their first piece of hardware with technical measures to prevent users from consuming the media of their choice :)
- jarjoura 9y agoNaw, the homebrew/piracy groups have been around since the birth of the console industry. It’s been an ongoing cat and mouse game for over 30 years at least.
- K0nserv 9y agoAm I reading it correctly that it's possible to invoke syscalls from Javascript? That seems like a monumentaly bad idea...
- GranPC 9y agoNo, that's just a library they made that uses a WebKit exploit to invoke a ROP chain to run syscalls.
- DSMan195276 9y agoNot directly. The exploit referred to by the title is a kernel exploit, but to execute the kernel exploit you need to be able to already run user code. They're using a Webkit exploit to run their user code.
- DCKing 9y agoIt's interesting to see that this is a vulnerability caused by PS4 specific kernel modifications. I guess it's good news for FreeBSD users that PS4 jailbreaks do not imply vulnerabilities in FreeBSD. Conversely, I'd imagine the PS4 jailbreak community is vigourously looking for privilege escalations in FreeBSD, but no results so far. I wonder if anyone familiar with it could shed some light on whether that's a correct way of looking at it.
- nkg 9y agoIs it me or Sony has become good at protecting its software ? I remember a time when every new console would be hacked within the year it was released.
- gruez 9y agoxbox one also hasn't been hacked.
- deleted 9y ago[deleted]
- martin_bech 9y agoWhats xbox one?.. :)
- uytuijhgj 9y agoAre u an idiot?.. :)
- dang 9y agoCommenting like this will get you banned here, so please read and follow https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html from now on. I normally would have banned a new account that posted like this, but https://news.ycombinator.com/item?id=15529586 https://news.ycombinator.com/item?id=15529586 looks pretty good, so we'll assume you want to use HN as intended. Please do read those guidelines though!
- oculusthrift 9y agoI don’t know much about it, but some other users were implying that they now use freebsd when previously they rolled their own OS. If that’s the case, it makes sense.
- teh_klev 9y ago
- faragon 9y agoTheir PCI-Express bus hack is amazing.
- Kipters 9y agoTwiizers/fail0verflow work is amazing. I wonder why didn't even try with Xbox though.
- fenollp 9y ago> However, this turns out to be impossible (as far as I know) because of a side effect of the ps4 page size being changed to 0x4000 bytes (from the normal of 0x1000). It appears that in order to change the page size globally, the ps4 kernel developers opted to directly change the related macros. One of the many changes resulting from this is that the smallest actual amount of memory which malloc may give back to a caller becomes 0x40 bytes. While this also results in tons of memory being completely wasted, it does serve to nullify certain exploitation techniques (likely completely by accident…). This is pretty cool (and probably obvious to a lot of people) as a security technique. Could this be done for consumer OSes? 64 bytes as the smallest malloc-able size doesn't seem too bad for today's ultrabooks...
- Cryptoboss 9y agoDid PS4 even get much of a homebrew scene?