8 ms·

Console Security – Nintendo Switch [video]

162 points by moepstar 9y ago

SimeVidas 9y ago
Most secure OS, but no lock screen, cloud backup, or “find your Switch” option. If somebody steals your Switch or you lose it, you can forget about it—which is why I protect mine like a newborn child.
- spaceribs 9y ago
  "We're great at protecting our data, but you're on your own"
- resonanttoe 9y ago
  The two have nothing to do with one another. Everything you list as missing are user convenience features. Not OS security features. There is no (or very little) perception of user sensitive data being stored on the switch itself, so from that perspective you don't need user data security protections. But you do need protections against code execution that eventually leads to piracy and loss of faith in the system from publishers. The security of game consoles is developed not for the user, but for the customers of the platform, which are the publishers.
  - BillinghamJ 9y ago
    Really great security systems manage to offer a high level of security without sacrificing user experience. For example, how Apple devices sync secrets with end-to-end encryption.
    - resonanttoe 9y ago
      I don't disagree with the statement, but it is still missing the point. This is still equating user features with fundamental operating system security choices and presenting it as an either/or option. 1. They are two wildly different things. The Core Security design is not for you as a consumer of the device. It is for publishers and developers and Nintendo themselves to have trust in the system. What is being argued here is user features. Nice to have's (and I agree, REALLY nice to haves) but not MUST haves for the consoles success. Publishers aren't walking away from the switch in droves and game sales aren't endanger of being eroded because there isn't "Find my switch." 2. It's not a set in stone decision. The core security design has to be competent and hardened from Day 1. You're running against console homebrewers and hackers who will say things like "Stay on Firmware 3.0.0". Knowing full well that you will never be perfect, you have to be reasonably resistant to a webkit exploit that leads to code execution. The success of the security design is measured in days to code execution. The features that are being talked about in this particular thread can be added (and removed: see Sony and otheros without the legal argument) at any time they want. We (consumers) may very well get the user-conveinence features being talked about here.. someday. But the Switch's security model has been defeated as of Firmware 3.0.0 and it is unlikely that it'll ever fully recover. (If a 1st or 2nd stage bootloader exploit is discover, then s/unlikely/never.)
      - slipstream- 9y ago
        >update to 3.0.0 and stay there fun fact: the mentioned kernel/trustzone bugs only exist in 1.0.0...
  - nine_k 9y ago
    The missing features decrease the overall security, especially the missing lock screen. It may be a different aspect as e.g. application-level security, though.
- sweden 9y ago
  This is not about protecting the users from remote attacks via the console, this is about protecting the console from game piracy.
  - 0xcde4c3db 9y ago
    It's more about "protecting" it from unlicensed publishers in general, irrespective of whether they're producing unauthorized copies. Indeed, recent schemes have made it markedly easier to copy games without authorization than to publish original games without authorization. The former only requires subverting a protocol used to decide whether a copy is authorized (e.g. by altering optical drive firmware or outright replacing the drive with an emulator); the latter requires breaking the platform's crypto services.
- deleted 9y ago
  [deleted]
- ksk 9y ago
  Nobody has "found" their anything when it was stolen by thieves. You file a lost report and go home. You don't go knocking on the door of a thief and expect them to hand it to you.
cheschire 9y ago
interesting video, but man that website hates 21:9 monitors.
- TrueTom 9y ago
  All talks are also on Youtube: https://www.youtube.com/user/mediacccde/videos https://www.youtube.com/user/mediacccde/videos
  - cheschire 9y ago
    Thanks!
- tjoff 9y ago
  Surely you don't browse maximized?
  - neilsimp1 9y ago
    ??? Why wouldn't anyone browse maximized?
    - pjc50 9y ago
      If your monitor is larger than your field of vision, having anything maximised is just a pain.
  - cheschire 9y ago
    Typically not, as it does tend to shove all my content to the left. The problem is that when you attempt to make the video fullscreen, it still fails to scale to the monitor. So after fullscreen failed, I then attempted to view the video in a maximized browser but it still scaled it beyond the vertical limits of my monitor.
resonanttoe 9y ago
This is really cool stuff! I think it's a particularly novel idea of using on-die fuses to prevent firmware downgrade. I don't know how common that is in the console security world, but the amount of actual firmware updates vs. software updates in any given device would be pretty low and from what I've read the number of fuses is large enough they're never really going to run out of it. But I also absolutely love the use of the uninitialized PID argument value to be PID 0. There's a poor engineer sitting at Nintendo looking at that slide and just going "well... shit."
- izacus 9y ago
  eFuses were first used to prevent downgrades on Xbox 360 actually.
  - resonanttoe 9y ago
    Oh cheers! I had no idea. Thanks for the pointer :D
- 0xcde4c3db 9y ago
  > I think it's a particularly novel idea of using on-die fuses to prevent firmware downgrade. I don't know how common that is in the console security world As far as I know, it's been standard practice ever since consoles started having firmware updates. They don't necessarily blow fuses in the update procedure, but they'll generally fuse off anything below the version that a given unit shipped with.
- paulscoder 9y ago
  Don't you think Nintendo would prefer that when a product like a Switch goes EOL that it finds a new life generations later through the homebrew community? Honestly, if I hadn't been able to play roms in college 8 years after I had packed my 8bit Nintendo away I would not have purchased anything on virtual console for the Wii.
  - resonanttoe 9y ago
    I think we as users would prefer that Nintendo prefers this. But no, Nintendo wants you to buy the next console that has the Virtual console of all those games you'll emulate through homebrew. Abandonware has ceased to exist in the console world. Especially for Nintendo.
fotcorn 9y ago
The demo and Q&A section is missing on this video and on YouTube, but you can watch it here: (demo starts at around 01:08:00) https://streaming.media.ccc.de/34c3/relive/8941 https://streaming.media.ccc.de/34c3/relive/8941
- voltagex_ 9y ago
  I hope it's in the final release of the video.
- seba_dos1 9y ago
  I have reported it to c3voc and they just said they're going to recut it :) Thanks for mentioning!
saguro 9y ago
Beyond preventing the distribution of pirated games, why do console manufacturers put so much effort into preventing unvetted code from running on their hardware? Does Nintendo actually stand to lose anything if a homebrew community evolved? Shouldn't we put time limits on DRM like we do on copyright so that eventually owners of these devices are allowed to use them however they like? My sony PSP and nintendo DS are collecting dust because I already played all the licensed games I was going to on them. Now these devices are worthless to me and get tiny prices on the 2nd hand market. If their owners released firmware signing keys, these devices could have a new lease on useful life as homebrew machines, but instead their owners tell us no, they'd rather the devices became prematurely useless and that we can't get any use out of them unless they can cash in on it... It's weird now that I think about it.
- rocky1138 9y ago
  Hasbro was kind enough to do exactly that for the Atari Jaguar.
- Nursie 9y ago
  IIRC the PSP has been busted so wide open that Sony may as well have released the keys. It started with quite complex hacks like 'Desperto del cemetario' (I think) but became as simple as sticking something on a memory card and running it. But yes, it is very counterintuitive - spending so much time and effort to make sure your machine is as limited as you can possibly make it.
  - Nursie 9y ago
    "Despertar del cemetario", that's the one...
- resonanttoe 9y ago
  It's a perceptual argument I think. If publishers like EA and Ubisoft lose faith in the system's ability to protect against piracy, they're less likely to go out of their way to develop for it. This is especially true for Nintendo that requires (for varying reasons) special porting/development. For the sake of argument its easy to assume that PC, Xbox and PS4 roughly being equivilent to develop for. (this is totally cutting the gordian knot but...) They're essentially all X86_64 architecture with similar third party modules present (nVidia, AMD). So development on these systems is a lot easier. For Nintendo, you have to develop within the limitations of typically not as powerful hardware. (Take a look at WWE2K18 between PS4 and Switch.. they struggle with that). Which means that you have to not necessarily spend more, but spend extra to get it working on Switch properly (I.E, its not quick and cheap). Therefore if the piracy rates are high or perceived to be high because of a flourishing and popular homebrew community (false equivalency but I'm confident that it happens.) then the desire the expend that extra effort will go down. Espeically if the return is expected to be low. Also emulators are easy these days and that just totally erodes the Virtual Console Market. Around the Wii they discovered the HUGE proportional market for virtual console (Near 0 development cost/effort, huge returns, relatively) One of the first things that will come from this is a port of RetroArch. Which is cool but not what big N wants to see.
bugmen0t 9y ago
Funny how the first item in an exploit chain is always WebKit for.. those devices.
- IntelMiner 9y ago
  Browsers are extremely complex pieces of software for everything they can do today Likely it's simply prohibitive (and a poor user experience) to track WebKit upstream and deploy firmware updates every time a vulnerability in the engine is patched
mariusmg 9y ago
The "bypass the SMMU" part was so funny :)
Toast_25 9y ago
I'm getting a page not found. Did it die?
austinpray 9y ago
Uhoh. Page 404ed. https://webcache.googleusercontent.com/search?q=cache:https://media.ccc.de/v/34c3-8941-console_security_-_switch/ https://webcache.googleusercontent.com/search?q=cache:https:...
- seba_dos1 9y ago
  It's probably being replaced with a more complete file, since the original one had its ending cut by mistake. There's always the raw recording if somebody needs to watch it right now: https://streaming.media.ccc.de/34c3/relive/8941 https://streaming.media.ccc.de/34c3/relive/8941
  - ktta 9y ago
    The embedded video here[1] is removed too. I have a feeling there's something more to this. [1]: http://wololo.net/2017/12/29/nintendo-switch-kernel-exploit-34c3-presentation-nvidia-backdoored/ http://wololo.net/2017/12/29/nintendo-switch-kernel-exploit-...
- deleted 9y ago
  [deleted]
- throwaway90896 9y ago
  http://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8941-eng-deu-Console_Security_-_Switch_hd.mp4 http://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8941-eng-...
- thoreauway 9y ago
  Mirror: https://vimeo.com/249107036 https://vimeo.com/249107036
- throwaway5647 9y ago
  http://cdn.media.ccc.de/congress/2017/h264-hd/ http://cdn.media.ccc.de/congress/2017/h264-hd/ grep for "switch"
- seba_dos1 9y ago
0throwaway42 9y ago
I bought a couple of games from ebay once. I thought it would be the serial codes to input in the store, but the seller had me create a new Nintendo account and send him the name. They added funds to the account and bought the games themselves and told me to play from other accounts. Then I realized it might had been carding. The games downloaded and worked fine. After some weeks the bad account has an admiration sign in it's icon and I can't log into the store with it, but the games still work and even get updates. IIRC, the 3DS had the record of which games were bought tied to the console instead of the account, which made it easy for pirates to download the games once the console was jailbroken. It seems to be the same route for the Switch.
juancn 9y ago
I wished these guys would use youtube for videos. The streaming sucks.

162 points by moepstar 9y ago

Most secure OS, but no lock screen, cloud backup, or “find your Switch” option. If somebody steals your Switch or you lose it, you can forget about it—which is why I protect mine like a newborn child.

spaceribs 9y ago
"We're great at protecting our data, but you're on your own"
resonanttoe 9y ago
The two have nothing to do with one another. Everything you list as missing are user convenience features. Not OS security features. There is no (or very little) perception of user sensitive data being stored on the switch itself, so from that perspective you don't need user data security protections. But you do need protections against code execution that eventually leads to piracy and loss of faith in the system from publishers. The security of game consoles is developed not for the user, but for the customers of the platform, which are the publishers.
- BillinghamJ 9y ago
  Really great security systems manage to offer a high level of security without sacrificing user experience. For example, how Apple devices sync secrets with end-to-end encryption.
  - resonanttoe 9y ago
    I don't disagree with the statement, but it is still missing the point. This is still equating user features with fundamental operating system security choices and presenting it as an either/or option. 1. They are two wildly different things. The Core Security design is not for you as a consumer of the device. It is for publishers and developers and Nintendo themselves to have trust in the system. What is being argued here is user features. Nice to have's (and I agree, REALLY nice to haves) but not MUST haves for the consoles success. Publishers aren't walking away from the switch in droves and game sales aren't endanger of being eroded because there isn't "Find my switch." 2. It's not a set in stone decision. The core security design has to be competent and hardened from Day 1. You're running against console homebrewers and hackers who will say things like "Stay on Firmware 3.0.0". Knowing full well that you will never be perfect, you have to be reasonably resistant to a webkit exploit that leads to code execution. The success of the security design is measured in days to code execution. The features that are being talked about in this particular thread can be added (and removed: see Sony and otheros without the legal argument) at any time they want. We (consumers) may very well get the user-conveinence features being talked about here.. someday. But the Switch's security model has been defeated as of Firmware 3.0.0 and it is unlikely that it'll ever fully recover. (If a 1st or 2nd stage bootloader exploit is discover, then s/unlikely/never.)
    - slipstream- 9y ago
      >update to 3.0.0 and stay there fun fact: the mentioned kernel/trustzone bugs only exist in 1.0.0...
- nine_k 9y ago
  The missing features decrease the overall security, especially the missing lock screen. It may be a different aspect as e.g. application-level security, though.
sweden 9y ago
This is not about protecting the users from remote attacks via the console, this is about protecting the console from game piracy.
- 0xcde4c3db 9y ago
  It's more about "protecting" it from unlicensed publishers in general, irrespective of whether they're producing unauthorized copies. Indeed, recent schemes have made it markedly easier to copy games without authorization than to publish original games without authorization. The former only requires subverting a protocol used to decide whether a copy is authorized (e.g. by altering optical drive firmware or outright replacing the drive with an emulator); the latter requires breaking the platform's crypto services.
deleted 9y ago
[deleted]
ksk 9y ago
Nobody has "found" their anything when it was stolen by thieves. You file a lost report and go home. You don't go knocking on the door of a thief and expect them to hand it to you.

cheschire 9y ago

interesting video, but man that website hates 21:9 monitors.

TrueTom 9y ago
All talks are also on Youtube: https://www.youtube.com/user/mediacccde/videos https://www.youtube.com/user/mediacccde/videos
- cheschire 9y ago
  Thanks!
tjoff 9y ago
Surely you don't browse maximized?
- neilsimp1 9y ago
  ??? Why wouldn't anyone browse maximized?
  - pjc50 9y ago
    If your monitor is larger than your field of vision, having anything maximised is just a pain.
- cheschire 9y ago
  Typically not, as it does tend to shove all my content to the left. The problem is that when you attempt to make the video fullscreen, it still fails to scale to the monitor. So after fullscreen failed, I then attempted to view the video in a maximized browser but it still scaled it beyond the vertical limits of my monitor.

resonanttoe 9y ago

This is really cool stuff! I think it's a particularly novel idea of using on-die fuses to prevent firmware downgrade. I don't know how common that is in the console security world, but the amount of actual firmware updates vs. software updates in any given device would be pretty low and from what I've read the number of fuses is large enough they're never really going to run out of it. But I also absolutely love the use of the uninitialized PID argument value to be PID 0. There's a poor engineer sitting at Nintendo looking at that slide and just going "well... shit."

izacus 9y ago
eFuses were first used to prevent downgrades on Xbox 360 actually.
- resonanttoe 9y ago
  Oh cheers! I had no idea. Thanks for the pointer :D
0xcde4c3db 9y ago
> I think it's a particularly novel idea of using on-die fuses to prevent firmware downgrade. I don't know how common that is in the console security world As far as I know, it's been standard practice ever since consoles started having firmware updates. They don't necessarily blow fuses in the update procedure, but they'll generally fuse off anything below the version that a given unit shipped with.
paulscoder 9y ago
Don't you think Nintendo would prefer that when a product like a Switch goes EOL that it finds a new life generations later through the homebrew community? Honestly, if I hadn't been able to play roms in college 8 years after I had packed my 8bit Nintendo away I would not have purchased anything on virtual console for the Wii.
- resonanttoe 9y ago
  I think we as users would prefer that Nintendo prefers this. But no, Nintendo wants you to buy the next console that has the Virtual console of all those games you'll emulate through homebrew. Abandonware has ceased to exist in the console world. Especially for Nintendo.

fotcorn 9y ago

The demo and Q&A section is missing on this video and on YouTube, but you can watch it here: (demo starts at around 01:08:00) https://streaming.media.ccc.de/34c3/relive/8941 https://streaming.media.ccc.de/34c3/relive/8941

voltagex_ 9y ago
I hope it's in the final release of the video.
seba_dos1 9y ago
I have reported it to c3voc and they just said they're going to recut it :) Thanks for mentioning!

saguro 9y ago

Beyond preventing the distribution of pirated games, why do console manufacturers put so much effort into preventing unvetted code from running on their hardware? Does Nintendo actually stand to lose anything if a homebrew community evolved? Shouldn't we put time limits on DRM like we do on copyright so that eventually owners of these devices are allowed to use them however they like? My sony PSP and nintendo DS are collecting dust because I already played all the licensed games I was going to on them. Now these devices are worthless to me and get tiny prices on the 2nd hand market. If their owners released firmware signing keys, these devices could have a new lease on useful life as homebrew machines, but instead their owners tell us no, they'd rather the devices became prematurely useless and that we can't get any use out of them unless they can cash in on it... It's weird now that I think about it.

rocky1138 9y ago
Hasbro was kind enough to do exactly that for the Atari Jaguar.
Nursie 9y ago
IIRC the PSP has been busted so wide open that Sony may as well have released the keys. It started with quite complex hacks like 'Desperto del cemetario' (I think) but became as simple as sticking something on a memory card and running it. But yes, it is very counterintuitive - spending so much time and effort to make sure your machine is as limited as you can possibly make it.
- Nursie 9y ago
  "Despertar del cemetario", that's the one...
resonanttoe 9y ago
It's a perceptual argument I think. If publishers like EA and Ubisoft lose faith in the system's ability to protect against piracy, they're less likely to go out of their way to develop for it. This is especially true for Nintendo that requires (for varying reasons) special porting/development. For the sake of argument its easy to assume that PC, Xbox and PS4 roughly being equivilent to develop for. (this is totally cutting the gordian knot but...) They're essentially all X86_64 architecture with similar third party modules present (nVidia, AMD). So development on these systems is a lot easier. For Nintendo, you have to develop within the limitations of typically not as powerful hardware. (Take a look at WWE2K18 between PS4 and Switch.. they struggle with that). Which means that you have to not necessarily spend more, but spend extra to get it working on Switch properly (I.E, its not quick and cheap). Therefore if the piracy rates are high or perceived to be high because of a flourishing and popular homebrew community (false equivalency but I'm confident that it happens.) then the desire the expend that extra effort will go down. Espeically if the return is expected to be low. Also emulators are easy these days and that just totally erodes the Virtual Console Market. Around the Wii they discovered the HUGE proportional market for virtual console (Near 0 development cost/effort, huge returns, relatively) One of the first things that will come from this is a port of RetroArch. Which is cool but not what big N wants to see.

bugmen0t 9y ago

Funny how the first item in an exploit chain is always WebKit for.. those devices.

IntelMiner 9y ago
Browsers are extremely complex pieces of software for everything they can do today Likely it's simply prohibitive (and a poor user experience) to track WebKit upstream and deploy firmware updates every time a vulnerability in the engine is patched

mariusmg 9y ago

The "bypass the SMMU" part was so funny :)

Toast_25 9y ago

I'm getting a page not found. Did it die?

austinpray 9y ago

Uhoh. Page 404ed. https://webcache.googleusercontent.com/search?q=cache:https://media.ccc.de/v/34c3-8941-console_security_-_switch/ https://webcache.googleusercontent.com/search?q=cache:https:...

seba_dos1 9y ago
It's probably being replaced with a more complete file, since the original one had its ending cut by mistake. There's always the raw recording if somebody needs to watch it right now: https://streaming.media.ccc.de/34c3/relive/8941 https://streaming.media.ccc.de/34c3/relive/8941
- ktta 9y ago
  The embedded video here[1] is removed too. I have a feeling there's something more to this. [1]: http://wololo.net/2017/12/29/nintendo-switch-kernel-exploit-34c3-presentation-nvidia-backdoored/ http://wololo.net/2017/12/29/nintendo-switch-kernel-exploit-...
deleted 9y ago
[deleted]
throwaway90896 9y ago
http://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8941-eng-deu-Console_Security_-_Switch_hd.mp4 http://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8941-eng-...
thoreauway 9y ago
Mirror: https://vimeo.com/249107036 https://vimeo.com/249107036
throwaway5647 9y ago
http://cdn.media.ccc.de/congress/2017/h264-hd/ http://cdn.media.ccc.de/congress/2017/h264-hd/ grep for "switch"
seba_dos1 9y ago

0throwaway42 9y ago

I bought a couple of games from ebay once. I thought it would be the serial codes to input in the store, but the seller had me create a new Nintendo account and send him the name. They added funds to the account and bought the games themselves and told me to play from other accounts. Then I realized it might had been carding. The games downloaded and worked fine. After some weeks the bad account has an admiration sign in it's icon and I can't log into the store with it, but the games still work and even get updates. IIRC, the 3DS had the record of which games were bought tied to the console instead of the account, which made it easy for pirates to download the games once the console was jailbroken. It seems to be the same route for the Switch.

juancn 9y ago

I wished these guys would use youtube for videos. The streaming sucks.