10 ms·
$20k seems a bit low for a chain of 5 exploits that defeat the entire security model on their flagship product, but what do I know. Interesting to see that one
by meibo 4y ago
$20k seems a bit low for a chain of 5 exploits that defeat the entire security model on their flagship product, but what do I know.
Interesting to see that one of the most impactful exploits is in an open source library.
- Cyph0n 4y agoI'm not a security researcher, but this seems extremely low.
- highwaylights 4y agoIt certainly seems like a strong disincentive to report the next one, yes.
- eli 4y agoAnd do what with it instead?
- solveit 4y agoJust... not find it. It takes concentrated intentional effort to find these.
- highwaylights 4y agoI’m quite certain there are groups in the world who would have paid far north of $20k for the ability to copy PS4/PS5 discs that don’t need a modification or jailbreak to play. I’m not saying that’s what should have happened, but $20k for something this severe is practically asking for that to happen.
- synicalx 4y agoSell the exploit to the highest bidder, I assume
- numpad0 4y agoIt feels like an another bullet point towards the end of the history of dedicated game consoles.
- rvz 4y agoIt is very low for the target and also for that effort. I've seen a small amount of effort bounties that reel in $100K+. If that was a chain of 5 vulnerabilities for say the iPhone or Android, that would be worth over $1 million.
- whoknew1122 4y agoBecause a similar iPhone or Android vulnerability would be useful to state actors, APTs, and everything in between. It'd be easy to weaponize and market. Hell, you could start a career in the ethically dubious world of selling 0 days to to governments. But what we got here is a way to pirate video games. Weaponizing this vulnerability means someone can play bootleg video games. And to profit from bootlegging video games, you'd have to create manufacturing and distribution channels. Then you'd have to find people who want to buy games. That's a lot of work, and when you inevitably get caught you'll like face stiff fines (if not prison). Is this vulnerability worth more than $20k to Sony? Yes. Is it worth more than $20k to the person who found the vulnerability? Only if they can monetize it, which would require breaking various and sundry laws.
- Cyph0n 4y ago> Only if they can monetize it, which would require breaking various and sundry laws. I mean, doesn't the same restriction apply to mobile exploits? You'd be breaking some kind of law by selling the exploit off, no? In my opinion, game piracy for latest gen consoles would be very easily monetizable. The challenge is figuring out how to make money without revealing your identity and/or basing your operations out of a more piracy-tolerant jurisdiction. Or you could sell the exploit off to someone who is willing to deal with all of this.
- pvg 4y agoDistributing pirated games for hacked consoles without getting caught is not easy, as you point out yourself. This also goes for whoever you're trying to sell the exploit to it. I can't see any combination of these facts that add up to 'very easily monetizable'.
- capableweb 4y agoEspecially because of the last part: > With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities. So this person basically saved them from loosing tons of money (if you accept these companies claim that pirating games actually make them lose money in the first place) and they only awarded them $20K. Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.
- cosmodisk 4y agoI had some considerations of getting into white hat hacking. I'd have enough motivation to become somewhat proficient in a few years,maybe even very good in a decade. But then I look at the rewards for vulnerability discovery and I think what the hell??? If I'd spend years honing my skills and someone would offer me a few grand for something that could potentially cost them millions,I don't think I'd manage not to sell it for the highest bidder. This is like a gig economy but for infosec.
- foepys 4y ago> for something that could potentially cost them millions You can be very sure that if a piracy case went to court, Sony would claim to suffer billions in damages.
- HideousKojima 4y agoNot sure on that, the Nintendo v Team Xecuter case ended up with $10 million in damages for selling Switch piracy mods/tools https://torrentfreak.com/gary-bowser-agrees-to-pay-10-million-in-piracy-damages-to-nintendo-211207/ https://torrentfreak.com/gary-bowser-agrees-to-pay-10-millio...
- smoldesu 4y agoI despise Team Xecuter for a number of reasons, but these two exploits aren't necessarily comparable. The Playstation vuln in question would allow people to create pirated Blu-Ray disks that work as-expected on vanilla PS5 models. TX created a custom firmware that required hardmodding your Switch to persist. Nintendo couldn't really wring out TX without proving that their damages went beyond just the owners of hacked Switch consoles, which it certainly didn't. In Sony's case, they could probably sue pretty hard if people started selling pirated or counterfeit PS5 games, since every PS5 owner is effected. IANAL, but I think you have to keep the scope of the damages in consideration.
- rvz 4y ago> Interesting to see that one of the most impactful exploits is in an open source library. WebKit is infested with vulnerabilities and it is a hackers paradise for exploitation. Probably the most exploited and targeted software component out there.
- ec109685 4y agoSeems like the perfect case for firecracker esque VzM where it’s run in isolation.
- pvg 4y ago$20k seems a bit low What's the market for this exploit, though? Who is going to pay never mind $20k but more or less anything for it?
- kevingadd 4y agoWide-scale game piracy can be very profitable in markets that aren't well-served by the console operator. You're not gonna make money selling pirate blurays in the US since you'll go straight to prison, but I can imagine PS4 owners in second or third-world countries buying a stack of pirated blurays for 20% the cost of retail and local law enforcement not being terribly interested in doing something about it.
- pvg 4y agoWide-scale game piracy can be very profitable Possibly but who is going to pay you $20k to realize these theoretical profits? They essentially mean un-networking your console, never updating it, only using physical media, likely losing your PSN account. There's a huge leap from step 1. 'an exploit exists', step N 'lots of hacked consoles and people buying pirated discs for them' and whatever step 'PROFIT' appears in. A latent market for free or cheap stuff is not the same thing as a market for this exploit.
- sangnoir 4y ago> They essentially mean un-networking your console, never updating it, only using physical media, likely losing your PSN account. Everything you list there is a plus in non-wealthy countries were internet access is slow and expensive. I suspect the total sales of bootleg PS2 games greatly exceeded Sony's legit sales in the global south due to the widespread availability of "chipped" PS2 consoles.
- pvg 4y agoSure, but still nobody is going to pay you $20k today for an exploit that might, just might, in a few years time, enable brisk business in the street markets of Cochabamba.
- keewee7 4y agoMaybe paying more than $20k through the HackerOne platform became a tax or regulation problem so they bank wired the rest.
- woodruffw 4y agoThis is pretty unlikely. If it's a regulation problem via HackerOne it's probably also a regulation problem via a direct wire.
- Shank 4y agoFrom experience managing a program, one of the benefits of HackerOne is that we can actually pay more researchers. It's surprisingly annoying to pay researchers via direct wire and other means. HackerOne is, legitimately, an amazing international payment system for this kind of thing.
- deleted 4y ago[deleted]
- dontbenebby 4y ago> $20k seems a bit low for a chain of 5 exploits that defeat the entire security model on their flagship product, but what do I know. Especially when so many people work on sensitive work in their homes due to COVID, huge chunks of the federal government are having conversations next to hot mics as they do Tinder and the like on their "personal" devices.
- superjan 4y agoThe title suggests more but if you read the entire post, Vulnerability 2 and 4 are specific to PS4. Not exactly the flagship product anymore.