57 ms·
The PS5 Has Been Jailbroken
- sylware 4y agoI am astonished it was found via one of the vanguard/blackrock people (aka google and apple, yeah microsoft is there too), insanely bloated and kludgified, javascripted web engines, Ohlala! Really surprised! (severe irony).
- dtx1 4y agoSo now would be a good time to buy a PS5, keep it in boxed until this is released and use it to pirate all the games?
- eru 4y agoWhy don't you use the PS5 in the meantime, or wait with buying until later?
- hericium 4y agoIt will likely get patched in following versions. Stores may be required to update the firmware before selling consoles.
- _joel 4y agoOn a sealed boxed console? No chance. It's literally the first thing that will pop up when a network connection is established.
- ninjaoxygen 4y agoIf you want to use it, the firmware will need to be updated, and therefore quickly no longer vulnerable once Sony patches it. If you wait until later, the units in the shops will also have patched firmware.
- mihau 4y agoThis is already kinda-released: https://twitter.com/SpecterDev/status/1576714840650883074 https://twitter.com/SpecterDev/status/1576714840650883074
- bskan 4y agoIf you can find stock somewhere…
- AdvancedCarrot 4y agoI suspect it depends on where you live - in the UK at least they're readily available in GAME for example.
- haunter 4y ago>now would be a good time to buy a PS5 This might be the bigger task than the actual jailbreak
- easton 4y agoMy local Costco has had them for months. You have to buy it in a bundle with an extra controller and a game (and maybe a few other things), but it’s at MSRP for all those things.
- AdvancedCarrot 4y agoProbably not - this exploit only works on firmware version 4.03. The latest being 6.0 which any new PS5 is likely to already have installed.
- bhaak 4y agoGaming is already one of the cheaper hobbies. Going through the hassle of wasting time and nerves to pirate games that are very cheap to get after a few months after release or in sales is beyond my comprehension.
- mariusmg 4y ago> Gaming is already one of the cheaper hobbies. In the West maybe. To keep up with Playstation example, in my country you can buy 6 new PS5 games with the minimum salary.
- eru 4y agoSingapore is one of the richest countries in the world. Our minimum salary buys you exactly 0 PS5 games. I'm not sure that says much either way.
- homarp 4y agocan you elaborate a bit? https://www.bal.com/bal-news/singapore-minimum-monthly-salary-to-be-increased/ https://www.bal.com/bal-news/singapore-minimum-monthly-salar... says min salary is 3k sgd https://store.playstation.com/en-sg/concept/10000956 https://store.playstation.com/en-sg/concept/10000956 says Gran Turismo is 98 SGD so I am puzzled
- dartharva 4y agoI'm scared to know what you may see as mid-budget hobby if you think gaming is cheap.
- kristofferR 4y agoThis exploit is only for 4.03, a pretty old firmware from December, most PS5 still unsold probably have way newer firmware.
- grodes 4y agohttps://wololo.net/2022/10/03/released-ps5-kernel-exploit-webkit-vulnerability-for-firmware-4-03/ https://wololo.net/2022/10/03/released-ps5-kernel-exploit-we...
- kevingadd 4y agoFeels like any time a console gets jailbroken, it's always a JavaScript use-after-free exploit in the browser webview that they use to open the user manual. IIRC this was true for the PS Vita, 3DS, Wii U, among others? I wonder if at some point console vendors will stop using webviews entirely?
- AdvancedCarrot 4y agoI do suspect that this is a big part of why the PS5 doesn't include a browser, despite one being available on the PS4. It's a shame really, would love to be able to browse the web from my PS5.
- LinAGKar 4y agoIt does have one, e.g. for opening links in tweets, though it doesn't let you enter URLs directly.
- kotaKat 4y agoYep, this is exactly why. Sony got too scared of having a fully user-facing browser this time around because of all the Webkit exploits slamming the PS4. It actually leads to frustration as an ISP employee; we get reports of end user devices getting slow speeds and the built-in PSN speedtests can often give us bad results (eg, a customer might be rated for 100x100 and the PSN test yields 20x5) -- running a browser-based speedtest we might be getting full speed to the device indicating a PSN issue. Removing the browser takes that troubleshooting option away from us.
- gowery 4y agoNice one, from the video it looks like he chained a browser vuln with a kernel vuln to make his jailbreak. Assuming it's a JIT optimization bug (as browser vulns often are, but I'm just guessing here), I wonder if Sony might attempt to mitigate this in future by disabling JIT, as Apple has done with its Lockdown Mode. Looks like the other thing they could do for this particular vector is prevent https requests from being intercepted and replaced - why should the user be permitted to override certificate errors in this case? Doesn't make sense.
- pjmlp 4y agoMicrosoft is also exploring the same path with security on Chrome Edge.
- inglor 4y agoReference to the Edge thing called "Super Duper Secure Mode" https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
- capableweb 4y ago> Most importantly we plan to have fun with this project That seems like the wrong main focus for a security project. I'd have preferred if the "most important" thing was to provide a secure browsing experience, but, to each their own...
- jefftk 4y agoWhen you're at the exploratory stage having fun is often a key component of making progress.
- ygjb 4y agoNah; with years of experience in the security space, and a chunk of those working at a browser vendor, watching bug classes vanish (even if it's the expense of some usability) is worth it when I imagine the tears of bad guys who have to work harder, and the users who won't have to go through the charade of credit monitoring services offered by some of the worst companies in the world. They are specifically calling out that it's not ready for prime time, and that it will have an impact on users. In practice, many very effective security controls for browsers (and other software) get tuned down or disabled by default because they break too much of how the web works (SameSite cookies are a good example), or because it creates friction in customer acquisition or growth.
- amelius 4y agoHow do you know for sure if it's jailbroken? For instance it might still phone home and install a new firmware/software image.
- throwaway742 4y agoIt's standard practice not to connect a jailbroken console to the internet.
- rany_ 4y agoor block the update server with custom DNS
- seba_dos1 4y agoTime to port my game engine to PS5 I guess.
- robertlagrant 4y agoIt's surprising that they deploy all of that debug stuff onto the console and then hide the switch behind a big lock to be picked. Why not just not deploy it?
- entropy_ 4y agoI'd guess a lot of it is in hardware and firmware which would be very costly to change that late into the development cycle
- capableweb 4y agoNot to mention it can break stuff. If QA tested everything with the debug stuff being on the console but temporarily hidden, that's how you want to deploy it as well, otherwise you're gonna have retest and surely fix a bunch of stuff before deploying. Yes yes, systems should not act like that, probably means everything is too tied together. But real world systems do act like that, especially in things with not too high stakes and with high focus on shipping stuff quickly.
- mariusmg 4y agoApparently the debug stuff are needed for servicing. Plus if someone manages to run custom code, having the debug options or not becomes irrelevant.
- robertlagrant 4y ago> Apparently the debug stuff are needed for servicing Yeah, that makes sense. I'd have thought it would be better to have an ephemeral debug client that's deployed from remote if you have the key to the big lock, but perhaps that's for the PS6. > Plus if someone manages to run custom code, having the debug options or not becomes irrelevant. Agreed, but it might be harder as they have to write custom tooling to inspect the system.
- bpye 4y agoI can't speak to PlayStation but on Xbox switching into (at least a limited) development mode just requires the right cert [0]. [0] - https://learn.microsoft.com/en-us/windows/uwp/xbox-apps/devkit-activation https://learn.microsoft.com/en-us/windows/uwp/xbox-apps/devk...
- deleted 4y ago[deleted]
- WelcomeShorty 4y agohttps://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Fine documentation of the process and the (limitations of the) exploit.
- capableweb 4y agoSeems to be a different exploit, since the one you linked mentions you can't run arbitrary code with it nor install custom packages, while the video in the Twitter does allow you to install new/overwrite packages.
- ErneX 4y agoIt’s the same, the article even mentions the exploit does not allow code execution yet.
- fbanon 4y agoPS6 will be written in Rust.
- peanut_worm 4y agoAnd PS7 will be fought with sticks and stones
- adroitboss 4y agoI have zero idea why my brain also went to this quote.
- ok123456 4y agoSo it's never coming out?
- kristofferR 4y ago> "This exploit achieves read/write, but not code execution. This is because we cannot currently dump kernel code for gadgets, as kernel .text pages are marked as eXecute Only Memory (XOM). Attempting to read kernel .text pointers will panic! > As per the above + the hypervisor (HV) enforcing kernel write protection, this exploit also cannot install any patches or hooks into kernel space, which means no homebrew-related code for the time being." [1] So yeah, it's not a full jailbreak yet. [1] https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit
- vario 4y agowhat does it mean "jailbreaking" a gadget, esp a PS5? noob here.
- dewey 4y agoUsually that you can then run custom code, or by extension sometimes pirated software.
- vario 4y ago
- alienchow 4y agoBased on prior works, I assume it means you can access the PS5 root. i.e. you can run anything you want on a jail broken PS5 as opposed to just what Sony wants you to run.
- vario 4y ago
- kristofferR 4y agoI was unfamiliar with the term gadget in this context too, it seems to refer to an exploitation technique to bypass ASLR: https://ctf101.org/binary-exploitation/return-oriented-programming/#:~:text=to%20do%20this%2C%20we'll%20use%20small%20snippets%20of%20assembly%20in%20the%20binary%2C%20called%20%22gadgets.%22%20these%20gadgets%20usually%20pop%20one%20or%20more%20registers%20off%20of%20the%20stack%2C%20and%20then%20call%20ret%2C%20which%20allows%20us%20to%20chain%20them%20together%20by%20making%20a%20large%20fake%20call%20stack https://ctf101.org/binary-exploitation/return-oriented-progr.... https://trustfoundry.net/2019/07/18/basic-rop-techniques-and-tricks-2/ https://trustfoundry.net/2019/07/18/basic-rop-techniques-and...
- deleted 4y ago[deleted]
- 4y ago
- fomine3 4y agoThis post looks better? https://www.psxhax.com/threads/ps5-4-03-kernel-exploit-webkit-rop-implementation-via-specterdev.14405/ https://www.psxhax.com/threads/ps5-4-03-kernel-exploit-webki...
- RektBoy 4y ago
- wafriedemann 4y ago
- jylam 4y agoIf you don't care, don't post <3
- junon 4y agoFlagrant dismissal of work is against HN's guidelines which you can review at the bottom of this page.
- pbhjpbhj 4y agoWe're also supposed to interpret comments in the best light; they make a reasonable point in asking, albeit acerbically, 'what's the benefit'?
- ddevault 4y agoI am entirely supportive of the user's right to do what they please with their devices (a right which may soon be enshrined in European law under the Digital Markets Act), and I celebrate jailbreaks as a means of liberating users from oppressive vendors. That said, I cannot help but smile at the fact that console hacks are almost always exploited from the web browser these days. If you need more proof that the web is a bloated, complex platform which is impossible to secure, then here you have it.
- diydsp 4y agoPSP was swaploit. I wouldn't diss web too hard, it's just the biggest attack surface. Plus this also used a kern vuln.
- erk__ 4y agoI find it much more surprising that it uses a CVE which was fixed upstream in 2020, I guess PlayStation don't pull upstream often https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20.ipv6.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20...
- collegeburner 4y agoi mean that's just part of the exploit chain, looks like sony probably didn't keep the kernel up to date either. a browser is just the easy starting point bc it's a widely-understood piece of open source code an attacker can use.
- EMIRELADERO 4y ago> (a right which may soon be enshrined in European law under the Digital Markets Act), That only applies to a handful of companies, no? And even then, the gatekeeper can take "appropiate measures to protect the integrity of the operating system".
- lofaszvanitt 4y ago"Often when the PS5 panics (at least in webkit context), there will be awful audio output as the audio buffer gets corrupted in some way." Hmmm... when I bought the PS5, for a few days everything was fine. Then it started to have garbled sounds whenever It booted up. If I power cycle the monitor the sound issues disappear. Couldn't bring it back to its normal state. Maybe just some quirks with the monitor... maybe someone is sitting inside my PS ;D. Monitor has no issues with the Xbox.
- alrlroipsp 4y agoOr maybe the explanation can be found in the snippet you quoted.
- lofaszvanitt 4y agoYeah, that's the most plausible explanation. It might store some thing that sticks after factory reset.
- alpaca128 4y agoAt least it's only on boot. My Xbox controller's headphone jack only produces garbled sounds. It also has the wobbliest headphone jack I've ever seen. No bluetooth headphone support even though the console transmits audio to the controller using bluetooth. The only other option to output audio is the HDMI-connected screen, but that disables volume controls. The volume controls that always take 10-15 keypresses to reach because it's the very last entry of the menu and the cursor can't loop around.
- Kukumber 4y agoI guess it's time to buy one! That kind of news always increase sales, so they can benefit from it if they damage control correctly, a new model is just around the corner, so it's all good i guess
- ChuckNorris89 4y agoBy the time you buy it, the patch will be out already.
- alrlroipsp 4y agohttps://memegenerator.net/instance/64466228 https://memegenerator.net/instance/64466228
- YurgenJurgensen 4y agoSony are already selling every unit they can manufacture, and many places still have waiting lists, lotteries or one-unit-per-customer limits on the PS5) even after raising the MSRP (which actually lowered the effective price to consumers by pricing less-efficient scalpers out of the business of scalping). Sales can't increase because they have no more PS5s to sell.
- Ruq 4y agoThis reminds me of a meme. > PS5 User: hey can I install a SSH server on my PlayStation? > Sony: NOOOOOO YOU CAN'T DO THAT THAT'S' ILLEGAL WE'LL SUE YOU FOR VIOLATING TOS > Steam Deck User: hey can I install a SSH server on my Steam Deck? > Valve: It's already included. Have fun.
- sorenjan 4y agoThat's not a meme, that's a joke.
- Aaargh20318 4y agoHow is a joke not a meme, in the original sense of the word ?
- deleted 4y ago[deleted]
- hdjjhhvvhga 4y agoIt's not a joke in the sense that it's actually true. Not just SSH, you can install practically any Linux piece of software on it.
- phoe-krk 4y agoThat's not the joke, Sony's approach to their hardware is.
- Covzire 4y agoHow does Sony's approach differ from Microsoft or Apple?
- roblabla 4y agoMicrosoft has yet to totally lockdown their hardware. They usually provide a way to disable secureboot or to enroll your own keys (with a few specific exceptions). Apple's macs are also fairly open. You can install your own bootloader, and boot whatever you want on them. There's a secureboot, but it can be disabled. Of course, apple's iPhone are very similar.
- zagrebian 4y agoThat reminds me of a video that I watched a few months ago about how an earlier generation of PlayStation got jailbroken very late in its lifecycle because Sony decided to disable Linux (or something like that, I don’t remember). As long as that feature was available, nobody cared to hack the console because they could do what they want, but as soon as Sony pulled the feature, the console was hacked in a very short time.
- knorker 4y agoPS3. Disabling Linux, as I remember it, basically instantly got it jailbroken. Suddenly not just pirates out to save/make money, but hobbyists too, wanted to break it.
- yebyen 4y agoYeah, hobbyists like the US Air Force Research Lab (I imagine, I don't have any info to suggest they actually had to literally jailbreak their PS3s in order to build their supercomputer, but just making a jab) If it's good enough for the USAF, it should be good enough for hobbyists to have a go around with it!
- frozenlettuce 4y agoOil & gas companies as well, for their drilling and prospecting simulations.
- yebyen 4y agoSeriously a bit miffed at the characterization of people who have bought a piece of hardware to install Free and Open Source Software on it (and then been absolutely rugged by the manufacturer) as "pirates out to save/make money, and hobbyists too" Every business I have ever worked at has either been built almost exclusively on Open Source software, or a bank that ran almost exclusively on Microsoft. We're not just pirates and hobbyists!
- lapser 4y ago
- davewritescode 4y agoWhile I applaud people being able to use their hardware the way they want to, I know that this inevitably leads to rampant cheating and will ultimately ruin games across consoles as most of the big games these days support cross play.
- rmellow 4y agoWindows is a gaming platform, as is Linux in a lesser degree. So not more than already happens, and games can require anti-cheat software to be installed.
- tpxl 4y agoAnti-cheat is cancer and doesn't do much to prevent cheating anyways. The only way to prevent cheating is moderation, but that doesn't "scale" (even though every time you ban a cheater they have to re-buy the game and is actually a net plus)
- hhh 4y agoI don’t agree. I think anticheat CAN do plenty. Many game companies don’t have the resources or care to build entire divisions around anticheat. Hardware bans are extremely effective when done right. Not many games do invasive hardware bans though.
- tpxl 4y ago> I think anticheat CAN do plenty. It can, but usually doesn't do anything but make your system less secure. I'd have no problem with anti-cheat systems, but they by and large don't work.
- weberer 4y agoOf course it scales if you allow dedicated servers run by a 3rd party admin, like TF2 or Factorio or so many games of the past. But most companies these days don't want to give up that control.
- deleted 4y ago[deleted]
- jbverschoor 4y agoNice! But can you even buy it?
- hijinks 4y agoya last night my walmart had a few plus they are all over online stores now
- jbverschoor 4y agoStill nothing available here in NL
- 1MachineElf 4y agoIt's easier to get than most newer Raspberry Pi hardware.
- atemerev 4y agoPS5 is still not available anywhere in Switzerland. Why it is so scarce? It is used for mining or something?
- 734129837261 4y agoI still can't buy the PS5 in my country. To me, Sony is dead. I've had every Playstation console from the start and have bought one within months of release, it has been almost TWO years now and still there's nothing. I'll never purchase any of their things ever again.
- moffkalast 4y agoWell yes, how would you buy them if you literally can't buy them? That's pretty sound logic alright.
- ErneX 4y agoThe pandemic was tough on the supply chain of many things, including consoles. Supply has been improving though my guess is next year it will be available in most stores. It is still on high demand they are selling all they make.
- rosnd 4y agoYour previous comments suggest that you're in the Netherlands. You can easily have a PS5 delivered to you within the week.
- jeroenhd 4y agoWhere? They're out of stock everywhere as far as I can see.
- doublepg23 4y agoAre you able to purchase directly from Sony? My friends have gotten a ton of PS5s that way.
- w4rh4wk5 4y agoSo, it's now easier to run custom software on the PS5 than obtaining one?
- dylan604 4y agoExcept if you don't have one, you can't exploit it now can you?
- lemoncookiechip 4y agoNow people can pirate all 5 exclusive games that aren't already on PC. But really, pretty cool.
- mynameisvlad 4y agoFrom Sony? The king of exclusives? Yeah they recently released old games on PC but there is a large collection of exclusives either out or coming soon. https://www.gamesradar.com/ps5-exclusives/ https://www.gamesradar.com/ps5-exclusives/
- kklisura 4y agoI remember people using PS3 as compute cluster [1] some time ago. Is this still possible with PS5? My general question is: are there and what are some non-gaming purposes of jailbroken PS5? [1] https://en.wikipedia.org/wiki/PlayStation_3_cluster https://en.wikipedia.org/wiki/PlayStation_3_cluster
- maxfurman 4y agoThe PS3 had a unique CPU design that made it suitable for certain specialized tasks. The PS5 is much closer to an off-the-shelf gaming PC, and so I don't think there's any good reasons to use a PS5 in that way, especially since PS5s are difficult to even buy in the first place.
- sudosysgen 4y agoThe PS5 has one of the strongest available APUs, so it can make sense (along with all of the other consoles this gen) for heterogeneous compute.
- crote 4y agoIf I remember correctly, the PS3's CPU is uniquely suited to the kind of work people use clusters for. It provided a halfway point between CPU and GPGPU, and at a price point which couldn't be beaten. The PS5, on the other hand, basically uses medium-range off-the-shelf computer components. Its most powerful feature is the extremely fast SSD, but that is not very useful for a compute cluster. Nowadays anyone wanting a compute cluster would just fill a server rack with GPUs and be done with it.
- beavisthegenius 4y ago
- racl101 4y agoPlaystation 5? What's that? I've head of them but have never seen one in a store.
- purpleblue 4y agoThe dedication jailbreakers have to the craft is truly admirable. I remember back in the mid-1980s coming to the realization that the war between people trying to build copy protection and those trying to crack it was an unwinnable war. I thought this as I copied the latest version of CopyWrite so that I myself could just copy whatever program I wanted at the time.
- magic_hamster 4y agoThe kernel exploit has been fully published: https://wololo.net/2022/10/03/released-ps5-kernel-exploit-webkit-vulnerability-for-firmware-4-03/ https://wololo.net/2022/10/03/released-ps5-kernel-exploit-we...
- system2 4y agoMaybe I am old fashioned, I am not buying an expensive device which I cannot use 100% completely. Only exception is my iPhone. They release consoles every year or so and not letting anyone update the previous ones. I find it silly to purchase consoles every year.
- stonegray 4y agoI wonder when companies will move to more adversarial tactics like banning accounts to try and stay ahead in the jailbreak arms race. We’ve seen similar tactics for gaming anti-cheat purposes for quite some time. Companies like Tesla have threatened to disable services to discourage reverse engineering and software modification.
- psychphysic 4y agoCompanies do ban hackers [0]. For whatever reason it's never clear what triggers the bans however. It does seem likely bans only are used for those who go online, or submit spurious data to the services. Still the reverse engineers, by and large, do not go online. If they update it's from a pre-downloaded firmware. So there is not much to ban. [0] https://www.desinerd.co.in/howto-avoid-nintendo-3ds-ban-wave-002-0102-cfw/ https://www.desinerd.co.in/howto-avoid-nintendo-3ds-ban-wave...