4 ms·

> In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means

> In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means that it's entirely possible that next generation of consoles really might actually be unhackable Pirates will always find a way, the Nintendo Switch had all the countermeasures you mentioned, the latest revisions also have a patched bootloader but someone figured out that they could still boot a custom firmware via power fault injection on the SoC.

jedrek 3y ago
The Playstation 4 was launched in 2013 and there is no modern hack for it.
- jiehong 3y ago
  Playstation 5 has been jailbroken, though [0]. Well, even the PS4, actually [1]. [0]: https://www.youtube.com/watch?v=5Cq3K9lBli0 https://www.youtube.com/watch?v=5Cq3K9lBli0 [1]: https://www.youtube.com/watch?v=OxRTGMe_RuE https://www.youtube.com/watch?v=OxRTGMe_RuE
NotPractical 3y ago
> Pirates will always find a way Except it's usually not pirates who find these exploits, rather curious tinkerers that want to unlock the full capabilities of the hardware that they own. The pirates / script kiddies usually come in after the groundwork has already been laid by these true hackers. E.g. the people who hacked the Switch in fact condemn piracy and any discussion of it on within their communities will lead to an immediate ban. I'm proud to say that I've hacked my Switch, but have never pirated anything on it. An impressive homebrew scene has formed around the console, which has produced gems such as Mission Control, allowing you to seamlessly pair third party controllers. I use it with my PS4 controllers. https://github.com/ndeadly/MissionControl https://github.com/ndeadly/MissionControl
jsheard 3y ago
Nintendo (or rather Nvidia) was behind the curve on fault injection counter-measures, Sony and Microsoft did their homework and it's never been achieved on their last two generations of systems as far as I know. Microsoft openly talked about it here: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo Seriously, console security is getting really good. The Switch had some major hardware blunders between the bootloader bug and fault injection, but the developer of the main Switch CFW project is on record that their custom microkernel is absolutely bulletproof and he expects there will never be another software exploit. If Switch 2 gets the hardware right, there's no way in. https://twitter.com/SciresM/status/1486787208333774848 https://twitter.com/SciresM/status/1486787208333774848 https://twitter.com/SciresM/status/1327721899862888448 https://twitter.com/SciresM/status/1327721899862888448 The Playstation is the weakest of the bunch, since they run FreeBSD on bare metal there's a large attack surface and a lot of eyes on the code. The Xbox uses some variant of NT but each application gets its own Hyper-V virtualized NT instance, so to jailbreak you need to escape Hyper-V, which is easier said than done and has a $250,000 bug bounty so MS would probably be the first to be informed.
- NotPractical 3y ago
  It seems surprising to me that they went from shipping a vulnerable WebKit with numerous public CVEs on day 1, to producing a more or less bulletproof OS?
- graphe 3y ago
  Xbone has no hacks. It has dev mode, no exclusives both which killed hacking and piracy.
  - coretx 3y ago
    The PS3 had "OtherOS" for lucrative import/export levies. Saving a dime on removing it post sales and export/import is what lead to hacking & piracy.
  - Jerrrry 3y ago
    yup, the "cat-and-mouse" game ended when they embedded the decryption key physically to the CPU. You can't read it without breaking it.

jedrek 3y ago

The Playstation 4 was launched in 2013 and there is no modern hack for it.

jiehong 3y ago
Playstation 5 has been jailbroken, though [0]. Well, even the PS4, actually [1]. [0]: https://www.youtube.com/watch?v=5Cq3K9lBli0 https://www.youtube.com/watch?v=5Cq3K9lBli0 [1]: https://www.youtube.com/watch?v=OxRTGMe_RuE https://www.youtube.com/watch?v=OxRTGMe_RuE

NotPractical 3y ago

> Pirates will always find a way Except it's usually not pirates who find these exploits, rather curious tinkerers that want to unlock the full capabilities of the hardware that they own. The pirates / script kiddies usually come in after the groundwork has already been laid by these true hackers. E.g. the people who hacked the Switch in fact condemn piracy and any discussion of it on within their communities will lead to an immediate ban. I'm proud to say that I've hacked my Switch, but have never pirated anything on it. An impressive homebrew scene has formed around the console, which has produced gems such as Mission Control, allowing you to seamlessly pair third party controllers. I use it with my PS4 controllers. https://github.com/ndeadly/MissionControl https://github.com/ndeadly/MissionControl

jsheard 3y ago

Nintendo (or rather Nvidia) was behind the curve on fault injection counter-measures, Sony and Microsoft did their homework and it's never been achieved on their last two generations of systems as far as I know. Microsoft openly talked about it here: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo Seriously, console security is getting really good. The Switch had some major hardware blunders between the bootloader bug and fault injection, but the developer of the main Switch CFW project is on record that their custom microkernel is absolutely bulletproof and he expects there will never be another software exploit. If Switch 2 gets the hardware right, there's no way in. https://twitter.com/SciresM/status/1486787208333774848 https://twitter.com/SciresM/status/1486787208333774848 https://twitter.com/SciresM/status/1327721899862888448 https://twitter.com/SciresM/status/1327721899862888448 The Playstation is the weakest of the bunch, since they run FreeBSD on bare metal there's a large attack surface and a lot of eyes on the code. The Xbox uses some variant of NT but each application gets its own Hyper-V virtualized NT instance, so to jailbreak you need to escape Hyper-V, which is easier said than done and has a $250,000 bug bounty so MS would probably be the first to be informed.

NotPractical 3y ago
It seems surprising to me that they went from shipping a vulnerable WebKit with numerous public CVEs on day 1, to producing a more or less bulletproof OS?
graphe 3y ago
Xbone has no hacks. It has dev mode, no exclusives both which killed hacking and piracy.
- coretx 3y ago
  The PS3 had "OtherOS" for lucrative import/export levies. Saving a dime on removing it post sales and export/import is what lead to hacking & piracy.
- Jerrrry 3y ago
  yup, the "cat-and-mouse" game ended when they embedded the decryption key physically to the CPU. You can't read it without breaking it.