27 ms·
Root keys for Sony’s PlayStation 3 go public
- st3fan 16y agoWow. How did this happen? Was the root key stored in the PS3? Or was it brute forced?
- jtdowney 16y agoPart 1 - http://www.youtube.com/watch?v=c77Qnk_CMF8 http://www.youtube.com/watch?v=c77Qnk_CMF8 Part 2 - http://www.youtube.com/watch?v=ovy2kPFOu0E http://www.youtube.com/watch?v=ovy2kPFOu0E Part 3 - http://www.youtube.com/watch?v=Y23LUiBRcOg http://www.youtube.com/watch?v=Y23LUiBRcOg That talk was at the 2010 Chaos Communication Congress which just concluded a few days ago.
- sp332 16y agoSlides here (PDF): http://stadium.weblogsinc.com/engadget/files/1780_27c3_console_hacking_2010.pdf http://stadium.weblogsinc.com/engadget/files/1780_27c3_conso... The talk covers the motivations of hackers, as well as the vulnerabilities they found. The new exploit starts toward the bottom, on the slide that just says "ECDSA" in big letters.
- ghurlman 16y agoPart 3 has the specific answer to parent's question, though I recommend watching all 3 if you have the time.
- aw3c2 16y agohttp://events.ccc.de/congress/2010/Fahrplan/events/4087.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4087.en.h... It might be worth waiting until the official recording gets released at http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/ http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/ (named "Console Hacking 2010").
- robryan 16y agoI always assumed the PS3 has top notch security given how long they had managed to avoid exploits. Seems from watching the videos that they could go a long way on a future console to prevent hacks just by plugging these issues. The hypervisor happily allocating/ running anything and everything seems like a good place to start. Obviously other ways would probably eventually be found but as these guys say, just providing a way for people to run their own code to begin with takes a lot of effort behind people hacking the system. There will always be an army of people out there wanting to pirate games and an army of people wanting to profit off of it but only a tiny amount of them can really do anything about it.
- marshray 16y agoI always assumed the PS3 has top notch security given how long they had managed to avoid exploits. Sometimes absence of evidence really is evidence of absence. Sometimes it's just that nobody was really looking that hard. Their presentation makes a good case that real hackers really do just want to run their own code and that the 'piracy' bugaboo is something else entirely. When I was little, I thought Sony was the coolest company ever. They made high-quality reasonably priced HiFi gear. Now my small children have made Sony the laughing stock of the household. Between this Linux debacle and the Windows rootkit, Sony has shown itself to have a habit of shooting its customers in the foot my opinion. No other company has fallen so low in my view. Seems from watching the videos that they could go a long way on a future console to prevent hacks just by plugging these issues. Naah. Every major security layer they had in place was broken or ineffective. That's usually a sign of deeper problems in the development process. IBM probably wrote the hypervisor layer for them. IBM discontinued development on the Cell processor a few years back. It's likely nobody really understands that system at this point better than the hackers.
- stcredzero 16y agoNaah. Every major security layer they had in place was broken or ineffective. That's usually a sign of deeper problems in the development process. That, plus the serious problems they had at the launch of the PS3 Fat might indicate that a lot of know-how has leaked out of their organization and moved onto better things.
- Omega191 16y agoNo, no, no. This is a different exploit. We don't know how he did it yet. (He did get the private key mathematically, using the method from the talk, but not using the revocation list exploit)
- tompagenet2 16y agoThere's a good Eurogamer/Digital Foundry article on this here: http://www.eurogamer.net/articles/digitalfoundry-ps3-security-in-tatters http://www.eurogamer.net/articles/digitalfoundry-ps3-securit...
- Swannie 16y agoWow. Not a great article, but not a bad overview of the subject!
- ronnier 16y ago"if you want your next console to be secure, get in touch with me. any of you 3." I would take the mans word and hire him. I'd even through Apple into his list, he did after all release jailbreaks for the iPhone too.
- geoffw8 16y agoSurely, someone has to hire this guy. Forget Apple. Intel? Nokia? IBM?
- executive 16y agoThe US Government?
- deleted 16y ago[deleted]
- jrockway 16y agoThey don't need security; they can just throw you in jail indefinitely, eventually give you a "trial" where some military types say they can execute you, and then execute you. BAI! It's the phone manufacturers that have to use cryptography to prevent you from actually enjoying a device you just paid them $600 for, since they can't legally kill you if you do something they don't like.
- fuxx0r 16y agoI would never hire him. This guy would release everything he knows if someone in the company wont do what he want. "GIMME MORE MONEY OR I WILL RELEASE THE KEY FOR THE PS4!". Sry, thats not business.
- ronnier 16y ago*throw
- marshray 16y agoI'm not so sure I'd want to take a job having just made my new chain of command look like incompetent idiots, they'd probably find a way to repay the favor. They'd just make him to sign a bunch of long-term NDAs and fire him 6 months later. If this guy had much experience in the workplace he'd know that development like this usually happens when an organization has systematically driven out the detail-oriented security-minded people. They tend to be on the low end of the "net reduction in buglist items per salary dollar" scale. On the other hand, there are any number of independent security assessment/pen testing firms that would love to have this guy's skills. He might even end up working on consoles. That's probably the way he should approach it.
- YetAnotherDvlpr 16y agoalmost makes me want to get one.
- sybreon 16y agoFrom the mathematician on stage: "and for some reason, Sony uses the same random number all the time!" - classic!
- nkassis 16y agoCan you provide a time index for that in the videos?
- eirikref 16y agoHave a look at http://www.youtube.com/watch?feature=player_detailpage&v=hcbaeKA2moE#t=2227s http://www.youtube.com/watch?feature=player_detailpage&v... and watch for a few minutes. The whole video is really interesting, but that part is the really embarrassing one.
- deleted 16y ago[deleted]
- Swannie 16y agoI'm not sure if that was hyperbole or not. As I understand it, all that was required was for them to use the same random number /twice/. Let's say you're Sony and you sign a patch, release it, realise there is a minor fix, and release within 2hours... maybe in your rush you failed to regenerate the random seed? Or, my initial thoughts, someone inside Sony did this maliciously?
- gnaffle 16y agoNo, it was parabole. :) From what I understand, they use the same number every single time without exception.
- Swannie 16y agoThat's really quite astounding. Thanks.
- JonnieCache 16y ago
- jpablo 16y agoSo what are the implications of this ? Homebrew software ? Pirated games ?
- iloveponies 16y agoHomebrew first and foremost, and reclaiming back the ability to run Linux on the consoles (and run it on the PS3 Slim as well). It's possible to pirate games with this knowledge, but from my understanding a lot of the Blu-ray security has not been broken at this point in time so these keys are by no means all you need to get up and start ripping those discs.
- artmageddon 16y agoI have a PS3 that hasn't been received the update to remove the "Other OS" option(and I'm damn glad I waited...). Does this also provide access to the PS3 Hypervisor? I remember reading, a long time ago, that that was one portion of the PS3 that was restricted from running Linux. On the same token, I wonder if that could mean better performance... I found that running Yellow Dog Linux on it was awfully slow.
- daeken 16y ago> On the same token, I wonder if that could mean better performance... I found that running Yellow Dog Linux on it was awfully slow. The hypervisor is minimal in terms of overhead. The biggest impact comes from the fact that the PPC core in the PS3 doesn't do out-of-order execution. You'd be downright amazed how huge a difference this makes.
- artmageddon 16y agoNo kidding? I remember someone from GDC in 2005(the one, I believe from Maxis, who created a storm on Gamasutra after bashing the Wii two years later) that putting out-of-order execution on gaming consoles was going to cripple their capabilities... but the PS3 certainly doesn't seem to suffer from it as far as games are concerned. I don't know enough about the topic at this point so I'd have to read some more.
- cantbecool 16y agoLooking at GeoHotz accolades on his Wikipedia page makes me feel like a terrible underachiever.