3 ms·

Hacking group says it has found encryption keys needed to unlock the PS5

37 points by WithinReason 5y ago

atonse 5y ago
If this is actually true, how is this happening in 2021, with HSMs so readily available? Is Sony not using a secure enclave type chip on the console? Or on the server side aren’t they using HSMs?
- lathiat 5y ago
  The key is on the console (not server side). Historically either they made some silly choices or there was a hardware bug or glitch that let you read out the key that the processor has to be able to access to decrypt the firmware. Search YouTube for fail0verflow and there are some great CCC talks very approachable and understandable about how it was done on other consoles historically. PS4: https://youtu.be/QMiubC6LdTA https://youtu.be/QMiubC6LdTA Wii U: https://youtu.be/oss_dwj-IkE https://youtu.be/oss_dwj-IkE
  - codetrotter 5y ago
    What I don’t understand is why they don’t employ a second pair of keys, that the console only has the public key part of. Encrypt with one key pair, sign with another. And if the console had the public key part only of the signing key, it could first verify the signature with that public key before decrypting the payload with private key of the key pair used for encryption. People would still be able to decrypt the firmware by extracting the private key, and they could still find exploitable bugs in the firmware, but they would be unable to sign custom firmware, since the console would not hold the private key of the signing keypair. Has it been confirmed that the private keys that have been extracted would allow one to run custom firmware on the PS5? Or is Sony already doing something like what I am suggesting here, and thereby protecting against custom firmware for the PS5?
71a54xd 5y ago
I wonder if they'll use this to enable ETH or crypto mining on PS5s? There's actually a really interesting initiative to grant similar ability to the new Xbox [0] - which given current GPU prices and availability actually kind of makes sense. People seem to forget that the Ps3 was famously used by the US AirForce to create a low cost linux compute cluster[1], oddly their biggest reason to so this was power efficiency and cost (the ps3 cluster used about 10% of the power for equivalent compute as their legacy systems). [0] - https://github.com/kgrossnickle/eth-box https://github.com/kgrossnickle/eth-box [1] - https://phys.org/news/2010-12-air-playstation-3s-supercomputer.html https://phys.org/news/2010-12-air-playstation-3s-supercomput...
- WithinReason 5y ago
  Imagine what that would do to the console shortage
  - 71a54xd 5y ago
    What's more - Unity is actually considering adding crypto mitigations since one of the largest underground projects to subvert nVidia's "LHR" eth mining mitigations was a miner literally implemented within a unity "game". Similar to this xbox project - the key was writing shaders that would complete the same computations needed for eth mining. However, other mining software providers found superior albeit simpler workarounds before the project using unity was able to release anything of substance. However, wouldn't be surprised if something like that is already in the wild.

37 points by WithinReason 5y ago

If this is actually true, how is this happening in 2021, with HSMs so readily available? Is Sony not using a secure enclave type chip on the console? Or on the server side aren’t they using HSMs?

lathiat 5y ago
The key is on the console (not server side). Historically either they made some silly choices or there was a hardware bug or glitch that let you read out the key that the processor has to be able to access to decrypt the firmware. Search YouTube for fail0verflow and there are some great CCC talks very approachable and understandable about how it was done on other consoles historically. PS4: https://youtu.be/QMiubC6LdTA https://youtu.be/QMiubC6LdTA Wii U: https://youtu.be/oss_dwj-IkE https://youtu.be/oss_dwj-IkE
- codetrotter 5y ago
  What I don’t understand is why they don’t employ a second pair of keys, that the console only has the public key part of. Encrypt with one key pair, sign with another. And if the console had the public key part only of the signing key, it could first verify the signature with that public key before decrypting the payload with private key of the key pair used for encryption. People would still be able to decrypt the firmware by extracting the private key, and they could still find exploitable bugs in the firmware, but they would be unable to sign custom firmware, since the console would not hold the private key of the signing keypair. Has it been confirmed that the private keys that have been extracted would allow one to run custom firmware on the PS5? Or is Sony already doing something like what I am suggesting here, and thereby protecting against custom firmware for the PS5?

71a54xd 5y ago

I wonder if they'll use this to enable ETH or crypto mining on PS5s? There's actually a really interesting initiative to grant similar ability to the new Xbox [0] - which given current GPU prices and availability actually kind of makes sense. People seem to forget that the Ps3 was famously used by the US AirForce to create a low cost linux compute cluster[1], oddly their biggest reason to so this was power efficiency and cost (the ps3 cluster used about 10% of the power for equivalent compute as their legacy systems). [0] - https://github.com/kgrossnickle/eth-box https://github.com/kgrossnickle/eth-box [1] - https://phys.org/news/2010-12-air-playstation-3s-supercomputer.html https://phys.org/news/2010-12-air-playstation-3s-supercomput...

WithinReason 5y ago
Imagine what that would do to the console shortage
- 71a54xd 5y ago
  What's more - Unity is actually considering adding crypto mitigations since one of the largest underground projects to subvert nVidia's "LHR" eth mining mitigations was a miner literally implemented within a unity "game". Similar to this xbox project - the key was writing shaders that would complete the same computations needed for eth mining. However, other mining software providers found superior albeit simpler workarounds before the project using unity was able to release anything of substance. However, wouldn't be surprised if something like that is already in the wild.