14 ms·
Playstation confirms chain of 5 vulnerabilities on PS4/PS5
- mmastrac 4y agoAm I reading it right that this was a 20k bounty only?
- deleted 4y ago[deleted]
- meibo 4y ago$20k seems a bit low for a chain of 5 exploits that defeat the entire security model on their flagship product, but what do I know. Interesting to see that one of the most impactful exploits is in an open source library.
- Cyph0n 4y agoI'm not a security researcher, but this seems extremely low.
- highwaylights 4y agoIt certainly seems like a strong disincentive to report the next one, yes.
- eli 4y agoAnd do what with it instead?
- solveit 4y agoJust... not find it. It takes concentrated intentional effort to find these.
- highwaylights 4y agoI’m quite certain there are groups in the world who would have paid far north of $20k for the ability to copy PS4/PS5 discs that don’t need a modification or jailbreak to play. I’m not saying that’s what should have happened, but $20k for something this severe is practically asking for that to happen.
- synicalx 4y agoSell the exploit to the highest bidder, I assume
- numpad0 4y agoIt feels like an another bullet point towards the end of the history of dedicated game consoles.
- rvz 4y agoIt is very low for the target and also for that effort. I've seen a small amount of effort bounties that reel in $100K+. If that was a chain of 5 vulnerabilities for say the iPhone or Android, that would be worth over $1 million.
- whoknew1122 4y agoBecause a similar iPhone or Android vulnerability would be useful to state actors, APTs, and everything in between. It'd be easy to weaponize and market. Hell, you could start a career in the ethically dubious world of selling 0 days to to governments. But what we got here is a way to pirate video games. Weaponizing this vulnerability means someone can play bootleg video games. And to profit from bootlegging video games, you'd have to create manufacturing and distribution channels. Then you'd have to find people who want to buy games. That's a lot of work, and when you inevitably get caught you'll like face stiff fines (if not prison). Is this vulnerability worth more than $20k to Sony? Yes. Is it worth more than $20k to the person who found the vulnerability? Only if they can monetize it, which would require breaking various and sundry laws.
- Cyph0n 4y ago> Only if they can monetize it, which would require breaking various and sundry laws. I mean, doesn't the same restriction apply to mobile exploits? You'd be breaking some kind of law by selling the exploit off, no? In my opinion, game piracy for latest gen consoles would be very easily monetizable. The challenge is figuring out how to make money without revealing your identity and/or basing your operations out of a more piracy-tolerant jurisdiction. Or you could sell the exploit off to someone who is willing to deal with all of this.
- pvg 4y agoDistributing pirated games for hacked consoles without getting caught is not easy, as you point out yourself. This also goes for whoever you're trying to sell the exploit to it. I can't see any combination of these facts that add up to 'very easily monetizable'.
- capableweb 4y agoEspecially because of the last part: > With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities. So this person basically saved them from loosing tons of money (if you accept these companies claim that pirating games actually make them lose money in the first place) and they only awarded them $20K. Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.
- cosmodisk 4y agoI had some considerations of getting into white hat hacking. I'd have enough motivation to become somewhat proficient in a few years,maybe even very good in a decade. But then I look at the rewards for vulnerability discovery and I think what the hell??? If I'd spend years honing my skills and someone would offer me a few grand for something that could potentially cost them millions,I don't think I'd manage not to sell it for the highest bidder. This is like a gig economy but for infosec.
- foepys 4y ago> for something that could potentially cost them millions You can be very sure that if a piracy case went to court, Sony would claim to suffer billions in damages.
- HideousKojima 4y agoNot sure on that, the Nintendo v Team Xecuter case ended up with $10 million in damages for selling Switch piracy mods/tools https://torrentfreak.com/gary-bowser-agrees-to-pay-10-million-in-piracy-damages-to-nintendo-211207/ https://torrentfreak.com/gary-bowser-agrees-to-pay-10-millio...
- smoldesu 4y agoI despise Team Xecuter for a number of reasons, but these two exploits aren't necessarily comparable. The Playstation vuln in question would allow people to create pirated Blu-Ray disks that work as-expected on vanilla PS5 models. TX created a custom firmware that required hardmodding your Switch to persist. Nintendo couldn't really wring out TX without proving that their damages went beyond just the owners of hacked Switch consoles, which it certainly didn't. In Sony's case, they could probably sue pretty hard if people started selling pirated or counterfeit PS5 games, since every PS5 owner is effected. IANAL, but I think you have to keep the scope of the damages in consideration.
- rvz 4y ago> Interesting to see that one of the most impactful exploits is in an open source library. WebKit is infested with vulnerabilities and it is a hackers paradise for exploitation. Probably the most exploited and targeted software component out there.
- ec109685 4y agoSeems like the perfect case for firecracker esque VzM where it’s run in isolation.
- pvg 4y ago$20k seems a bit low What's the market for this exploit, though? Who is going to pay never mind $20k but more or less anything for it?
- kevingadd 4y agoWide-scale game piracy can be very profitable in markets that aren't well-served by the console operator. You're not gonna make money selling pirate blurays in the US since you'll go straight to prison, but I can imagine PS4 owners in second or third-world countries buying a stack of pirated blurays for 20% the cost of retail and local law enforcement not being terribly interested in doing something about it.
- pvg 4y agoWide-scale game piracy can be very profitable Possibly but who is going to pay you $20k to realize these theoretical profits? They essentially mean un-networking your console, never updating it, only using physical media, likely losing your PSN account. There's a huge leap from step 1. 'an exploit exists', step N 'lots of hacked consoles and people buying pirated discs for them' and whatever step 'PROFIT' appears in. A latent market for free or cheap stuff is not the same thing as a market for this exploit.
- sangnoir 4y ago> They essentially mean un-networking your console, never updating it, only using physical media, likely losing your PSN account. Everything you list there is a plus in non-wealthy countries were internet access is slow and expensive. I suspect the total sales of bootleg PS2 games greatly exceeded Sony's legit sales in the global south due to the widespread availability of "chipped" PS2 consoles.
- pvg 4y agoSure, but still nobody is going to pay you $20k today for an exploit that might, just might, in a few years time, enable brisk business in the street markets of Cochabamba.
- keewee7 4y agoMaybe paying more than $20k through the HackerOne platform became a tax or regulation problem so they bank wired the rest.
- woodruffw 4y agoThis is pretty unlikely. If it's a regulation problem via HackerOne it's probably also a regulation problem via a direct wire.
- Shank 4y agoFrom experience managing a program, one of the benefits of HackerOne is that we can actually pay more researchers. It's surprisingly annoying to pay researchers via direct wire and other means. HackerOne is, legitimately, an amazing international payment system for this kind of thing.
- deleted 4y ago[deleted]
- dontbenebby 4y ago> $20k seems a bit low for a chain of 5 exploits that defeat the entire security model on their flagship product, but what do I know. Especially when so many people work on sensitive work in their homes due to COVID, huge chunks of the federal government are having conversations next to hot mics as they do Tinder and the like on their "personal" devices.
- superjan 4y agoThe title suggests more but if you read the entire post, Vulnerability 2 and 4 are specific to PS4. Not exactly the flagship product anymore.
- highwaylights 4y agoIs this patched? Or is this essentially a 0-day now?
- capableweb 4y agoResolved April 4th 2022 (3 months ago). Probably patch went live on the systems some days/weeks/month after that.
- crtasm 4y agoFor PS4, 9.50 released on 23rd March: https://www.dualshockers.com/ps4-system-software-update-9-50-patch-notes-today-march-23/ https://www.dualshockers.com/ps4-system-software-update-9-50...
- sergiotapia 4y ago$20k for pirated ps4/ps5 games? Seems ridiculously low. When I lived in Bolivia I remember buying PS2 games in the market for 10 Bs. ($2). I imagine few people in Bolivia can buy these games. Same for other third world countries. I imagine the exploit author reported it for the clout and a "good get" right? It's quite the feather in your cap.
- lucb1e 4y agoIt's also not like house owners reward people that tell them about an open front door with the total value of their house's contents. In Dutch we say "10% finder's wages" (10% vindersloon) when someone returns an item they found, say a smartphone. Sometimes you get nothing, sometimes you get 20%, but nobody expects to get 100% (or even half) of the true value of the item you are dutifully returning. That there is a huge market in less-wealthy countries for pirated games is a well-known fact. What strikes me as a leap is that there is some mastermind behind it all that has enough savings (or other liquidity) to buy these exploits for whatever you would consider the true value (if $20k is "ridiculously" low), and then needs to earn all that money back by selling game copies (presumably there is some hardware cost to burn discs) to a population that is large but, indeed, poor.
- ShroudedNight 4y agoIf they already have the networks in place to sell stuff like pirated movies, I don't see why they would balk at paying for an exploit to sell pirated games. I could also see them using an advance + royalty model to share the risk with the exploit writer.
- pvg 4y agoThe movies play on unmodified players. This would be like making it so the only thing your tv can play is stuff you torrented.
- akira2501 4y agoNo one is returning something to PlayStation, though. This is independent intellectual property. Property, that if exposed, runs the risk of destroying their entire ecosystem. And this possibly cuts well beyond simple piracy. PlayStation enjoys exclusive control over who does and does not get to publish on their platform. A mechanism that earns them millions in licensing deals, to the extent that they can happily lose money on the sale of the hardware itself. The destruction of that mechanism seems akin to destruction of their entire platform. This isn't a "we found your front door unlocked" situation. This is a "we found a bomb attached to your spine, and we know exactly how to dismantle it."
- bluedays 4y agoI need to stop updating my ps4
- deleted 4y ago[deleted]
- incognitoes 4y ago
- Kaze404 4y agoIf your console is in 9.00 or lower you can easily exploit it through an exFAT vulnerability and play Bloodborne in 60fps. It's a great deal.
- markx2 4y agoThe author of this post has some excellent history. They used an exploit chain on the PS Vita. https://theofficialflow.github.io/2018/09/11/h-encore.html https://theofficialflow.github.io/2018/09/11/h-encore.html https://github.com/TheOfficialFloW/h-encore https://github.com/TheOfficialFloW/h-encore
- propter_hoc 4y ago100%, TheFloW is a legend in the Vita community. Every time Sony released a new firmware fixing one of his exploits, he released another one, until Sony stopped updating the Vita.
- bozhark 4y agoWhy hasn’t Sony offered to hire them? edit: or contract
- ethbr0 4y agoBecause Sony is fine with having a shit security culture? And patching issues only when they make the news?
- saagarjha 4y agoMaybe they have, a lot of people would rather not work in that kind of environment though.
- bentcorner 4y agoLooks like he already does security work for Google.
- aasasd 4y agoThe guy also developed quite a bunch of useful low-level software—he and Rinnegatamante basically carry the homebrew/jailbreak community for Vita, at least lately. Meanwhile, his twitter says ‘Security Engineer @ Google’. Bit weird that he didn't turn this into a jailbreak for PS5, though. But perhaps I'm missing something about PS5's firmware update scheme.
- muterad_murilax 4y agoSony, not Playstation.
- bsagdiyev 4y agoSIE is technically a different part of Sony and is analogous with PlayStation at this point.
- mshockwave 4y agoSIE is a subsidiary of Sony but they're quite different. Even inside SIE the division that makes PlayStation is quite unique compared to other (first-party) game studios.
- nodja 4y agoI don't think that $20k is too little. There's 2 types of people that will find these kinds of exploits. Black hat hackers that do it for the money, and white hat hackers that do it for themselves/openness. The black hat hacker would have to be paid handsomely so that he could disclose his exploit. For these types of exploits I assume they would do something like sell you a PS5 with dozens of games included for $700, and tell you that you can load many more. That means that he only needs to sell 101 hacked PS5s to make more than the reward money, and he'll probably sell thousands of them before a copycat copies him stealing his profits or Sony patches the bug, which won't stop him completely since he'll probably have a big stock of unpatched PS5s. The white hat hacker does it for fun or curiosity, a white hat hacker is usually an advocate for open source and probably trying to run linux on the thing is the main motivation for him to keep going. After they find something they'll release it to the public, usually with piracy enabling things off by default, but since it's all open source the pirates will find a way to use it anyway. Sony is doing the smart thing and targeting the white hacker, they're the most likely to find these exploits anyway. If they made the reward money high enough that it would disincentivize the black hat hacker from commercializing his findings, it would instead be an incentive for people to find exploits. Lets say they pay $200k per exploit, they would no longer be paying these types of bounties once a year, but every month. I'd argue that paying millions a year to protect their system is valuable, but the fact is that they can get away with much less, hence $20k is just about the perfect amount of money for a bounty like this. tl;dr: If they paid more they'd basically be creating and funding a market of exploit finders for little gain.
- deleted 4y ago[deleted]
- sensitivefrost 4y agoYes? That's how bug bounties work. Companies that care about their security pay for bugs. Those that don't, don't. Sony care, but $20k for this chain of bugs is pretty poor, especially when they offer up to $50k (for criticals). I'm curious why Sony think this is a High severity and not Critical. EDIT: looks like it's not critical because of this https://twitter.com/theflow0/status/1535424299397369856 https://twitter.com/theflow0/status/1535424299397369856 In which case, 20k still feels low, but not as unfair.
- e4m2 4y agoAuthor's presentation on the topic: https://github.com/TheOfficialFloW/Presentations/blob/master/2022-hardwear-io-bd-jb.pdf https://github.com/TheOfficialFloW/Presentations/blob/master... (video not yet available) Public reimplementation: https://github.com/sleirsgoevy/bd-jb https://github.com/sleirsgoevy/bd-jb (not a "full" jailbreak yet, the kernel part is missing) To clarify, this exploit only works up to firmware 9.04 on the PS4 and up to 4.51 on the PS5.
- tlbsofware 4y agoAlthough 20k seems quite low, I think it is reasonable given the rise of game subscriptions. Who would want to jailbreak and leave their ps5 offline to get 5$ games that won’t work once the station is updated. Where on the flip side you could pay 5-15$ Monthly (not sure of PlayStation Nows cost but that amount is for Xbox game pass) to have hundreds of games at your disposal and never have to physically acquire a new disk via black market to play a new game?
- SV_BubbleTime 4y agoIs there a reason this wouldn’t in theory allow a full jailbreak and play of the $79 games? PlayStations’ main unique feature are the narrative based single player exclusives. So, if you were going to get a PS5 and Xbox, it seems Xbox for multi and hacked PS5 for single seems like an excellent combo - you know - if you were the type of person that could justify that sort of thing.
- 14 4y agoBack in the day I faced the same consideration with Xbox 360. I went with the reset glitch hack and was able to have hundreds and hundreds of games all play from an HDD. Eventually the hackers got servers running and you could also play online with others. A fully jail broken ps5 would definitely be appealing.
- Kaze404 4y agoLots of people in developing countries would.
- thirtyfivecent 4y ago[flagged]
- alar44 4y ago
- tgsovlerkhgsel 4y agoThe disclosure timeline is interesting: - theflow0 submitted a report to PlayStation. Oct 25th (8 months ago) - PlayStation rewarded theflow0 with a $20,000 bounty. Nov 12th (7 months ago) - shoshin_cup PlayStation staff closed the report and changed the status to Resolved. Apr 4th (3 months ago) - theflow0 requested to disclose this report. Apr 4th (3 months ago) - sazerac HackerOne staff agreed to disclose this report. Jun 10th (9 days ago) I generally refuse to participate in Bug bounty programs through intermediaries like HackerOne, because they severely restrict and delay your ability to disclose. After having been denied a bug bounty for reporting a vulnerability directly, and often spent frustrating amounts of time just trying to get a response even from major companies, I've basically given up completely on bug bounty programs, and will likely go for full disclosure in the future (with a note to the corresponding security team for awareness). For smaller issues, the bounties often don't even fairly compensate the (usually significant) effort spent communicating with the security team if you value your time at a competitive hourly rate, and payment is hit or miss. Not worth giving up your right to talk about the issues in exchange.
- roastedpeacock 4y agoNot saying public bug-bounty programs such as this are perfect. Those around a certain date in the past remember strongly when the situation with public research was more precarious and Sony attempting lawsuits, prosecutions and other utterly horrible attempts at 'damage-control' with the PS3. In that light and with the researcher being able to disclose his research after public security-patch it does appear more amicable.
- robocat 4y agoFrom a $ perspective, most bug bounty programs look rather uneconomic to me, which I presume is by design. Bounty programs require a hacker to reveal their secret. That cripples a hacker’s negotiation strength, and the hacker cedes nearly all control (as you point out). Are there any organisations which can authenticate a vulnerability, without the hacker revealing the vulnerability itself? Vulnerability authentication seems like a hard problem: * powerful adversaries will wish to “steal” the vulnerability for themselves, * the hacker will want to remain anonymous, * the hacker needs to believe they will be safe and their vulnerability will not be stolen, * legal, social, and financial incentives would be difficult to align for such an organisation to even exist. In a “safe jurisdiction” three-letter-agency and legal issues would probably be prohibitive (can’t aid extortion etcetera), and in other looser jurisdictions there would be powerful dark threats (far dominating over any legal issues). * in most markets authentication is handled by organisations doing repeat transactions so that their incentive is to be trustworthy. However in this market government or blackhat organisations will want to create fronts or suborn organisations. I guess on the dark markets there are authentication options for black hats. Any links to discussions about that? Can vulnerability authentication be solved for white hats?
- incognitoes 4y ago
- Szpadel 4y ago5 vulnerabilities, this is the issue that I'm often see, nobody wants to fix issue that isn't exploitable, so reporting all those alone won't get them fixed for maybe even years, and then someone figure out how to connect them and we get chains like this
- abigail95 4y agoi wouldn't have submitted this for less than $1M
- trentthethief 4y agoI found an open redirect in a large American insurance company’s website and was given $200. I imagine finding 100 low hanging vulnerabilities would be a lot easier for $20,000…
- vlovich123 4y agoThe researcher I think should be able to negotiate the rate prior to disclosure (ie “how much would a vulnerability that accomplishes xyz be worth it to you?”). I wonder if that might change some of these payouts.