3 ms·

Hat is off to the author for executing like that. I feel like I missed out by never playing games, as cracking them seems like the real game behind the game. F

Hat is off to the author for executing like that. I feel like I missed out by never playing games, as cracking them seems like the real game behind the game. From a design perspective, this is why you don't have your entire ecosystem depend on a shared secret stored in secure hardware, even if they're written when the chip is still in the flasher at the fab. You need either to diversify your keys in the flasher, or do an initialization/personalization protocol to update the keys to new unique per-console ones so that a crack like this isn't portable across every other customer device. As a design consideration, it means the customer has to be online to personalize the device to get their unique keys, but that's the trade off. The beauty of demonstrating this attack is that if you think game consoles with security modules are vulnerable to having ecosystem compromising shared secrets extracted, wait until you see phones.

bo1024 5y ago
……or this is why you let people own the hardware they purchase and give up on this ridiculous “secure” boot idea?
- naikrovek 5y ago
  some people forget, or don't know about, Atari's first consoles, which had zero "secure" features and the enormous mess that caused. the entire home video game industry in the US virtually died for a while because of all the crap games that were produced. imagine mobile-like shovelware games selling for $60 each for a while, and consumers being unable to tell which games were good and which were bad until you took them home and played them. then, finding out you can't return the crap ones because too many other people were returning those same games, and the retailers couldn't absorb the cost. then, seeing all console video games in "bargain bins" for $1-$2 each and even then extremely few people were buying them. I recall seeing bins going virtually untouched for months. parents just stopped buying games for their kids' consoles, nearly completely. the idea of a home video game console was so negative that Nintendo needed to call the NES an Entertainment System in order to get their device into homes. That Nintendo Seal of Quality really meant something, and only Nintendo could manufacture the lockout chip that prevented unauthorized games from running, so that Seal of Quality really had weight and it basically meant "no shovelware games" for it's entire existence. Entrepreneurs showed Nintendo and Atari what happens when you have no console security: that lots and lots of people will eagerly crush the entire market in exchange for a bit of money. Nintendo has not forgotten this lesson, and they're not likely to.
  - bo1024 5y ago
    I did not know about that, very interesting!
  - ratorx 5y ago
    How does hardware/software security solve this? Is this not just a certification issue? If Atari had officially blessed games and told retailers which games were good, would that not have solved the issue? I guess securing the device to not load unauthorised games is a solution, but isn’t just certifying games and publishing information about the good ones enough? I guess distributing information widely was a lot harder back then. If the reason for people buying shovelware is that they need to go home and try it to see if it’s bad, wouldn’t a simple blank CD packaged as a game achieve the same thing?
    - naikrovek 5y ago
      do you really think that game publishers would simply obey orders from a console manufacturer who told them to "only make good games"? game publishers take every shortcut possible when publishing games, including (but not limited to) strongarming the developers, lying via box art and/or wording on packaging, and so on. game publishers optimize for profit, not game quality. even with the NES CIC chip keeping most unauthorized games from working, Atari successfully duplicated the functionality of the chip and published their own games under the "Tengen" brand. Nintendo was very unhappy about this, and while Nintendo won in court, they learned their lesson and doubled-down on console protections from then on. Nintendo are unlikely to ever forget the lesson that this court case taught them. So, with that, even with the presence of technological measures to keep non-nintendo-made carts out of the NES, there were still non-nintendo games running inside NES consoles. things like this are why Nintendo, Microsoft, and Sony are so dedicated to locking the consoles down and doing everything they can to prevent unauthorized access. Nintendo has been shown multiple times that companies will just do whatever they want unless there are strong lockdown features to the hardware. others have learned from Nintendo's experience, as well, and that's why we are where we are today. we will not be returning to the early days of video game consoles, where hardware was unprotected.

bo1024 5y ago

……or this is why you let people own the hardware they purchase and give up on this ridiculous “secure” boot idea?

naikrovek 5y ago
some people forget, or don't know about, Atari's first consoles, which had zero "secure" features and the enormous mess that caused. the entire home video game industry in the US virtually died for a while because of all the crap games that were produced. imagine mobile-like shovelware games selling for $60 each for a while, and consumers being unable to tell which games were good and which were bad until you took them home and played them. then, finding out you can't return the crap ones because too many other people were returning those same games, and the retailers couldn't absorb the cost. then, seeing all console video games in "bargain bins" for $1-$2 each and even then extremely few people were buying them. I recall seeing bins going virtually untouched for months. parents just stopped buying games for their kids' consoles, nearly completely. the idea of a home video game console was so negative that Nintendo needed to call the NES an Entertainment System in order to get their device into homes. That Nintendo Seal of Quality really meant something, and only Nintendo could manufacture the lockout chip that prevented unauthorized games from running, so that Seal of Quality really had weight and it basically meant "no shovelware games" for it's entire existence. Entrepreneurs showed Nintendo and Atari what happens when you have no console security: that lots and lots of people will eagerly crush the entire market in exchange for a bit of money. Nintendo has not forgotten this lesson, and they're not likely to.
- bo1024 5y ago
  I did not know about that, very interesting!
- ratorx 5y ago
  How does hardware/software security solve this? Is this not just a certification issue? If Atari had officially blessed games and told retailers which games were good, would that not have solved the issue? I guess securing the device to not load unauthorised games is a solution, but isn’t just certifying games and publishing information about the good ones enough? I guess distributing information widely was a lot harder back then. If the reason for people buying shovelware is that they need to go home and try it to see if it’s bad, wouldn’t a simple blank CD packaged as a game achieve the same thing?
  - naikrovek 5y ago
    do you really think that game publishers would simply obey orders from a console manufacturer who told them to "only make good games"? game publishers take every shortcut possible when publishing games, including (but not limited to) strongarming the developers, lying via box art and/or wording on packaging, and so on. game publishers optimize for profit, not game quality. even with the NES CIC chip keeping most unauthorized games from working, Atari successfully duplicated the functionality of the chip and published their own games under the "Tengen" brand. Nintendo was very unhappy about this, and while Nintendo won in court, they learned their lesson and doubled-down on console protections from then on. Nintendo are unlikely to ever forget the lesson that this court case taught them. So, with that, even with the presence of technological measures to keep non-nintendo-made carts out of the NES, there were still non-nintendo games running inside NES consoles. things like this are why Nintendo, Microsoft, and Sony are so dedicated to locking the consoles down and doing everything they can to prevent unauthorized access. Nintendo has been shown multiple times that companies will just do whatever they want unless there are strong lockdown features to the hardware. others have learned from Nintendo's experience, as well, and that's why we are where we are today. we will not be returning to the early days of video game consoles, where hardware was unprotected.