13 ms·

New PlayStation 3 Hack May Be One That Sony Can’t Stop

104 points by derpenxyne 14y ago

chairmankaga 14y ago
The kotaku story is following in the steps of the older stories and is somewhat inaccurate. This was a much more interesting read by one of fail0verflows devs Marcan. http://wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/ http://wololo.net/2012/10/25/clarifying-the-confusion-on-the...
- derpenxyne 14y ago
  I grant that - essentially: Q: So the PS3 is utterly and completely broken? A: To an extant yes, debatable but unlike the 3.55 hack we have mostly everything needed. Sony will never be able to re-secure existing consoles.
9999 14y ago
I think Sony overestimates the amount of piracy that this will enable. I softmodded my Wii long ago (in order to unlock the region to play Japanese and European games on a U.S. Wii). Ever since it's been an incredible pain in the butt to keep it updated to the latest modded firmware revisions in order to play legitimate games. Almost every time I buy a new game I have to dig through an incredibly dense array of sketchy forum posts and file sharing sites to find the newly patched custom firmware. If a person were looking to play a game on its release day (legitimate or pirated), they would find the process so time consuming and annoying that I doubt more than 1% of Wii owners would bother with it. I would guess the same pattern would repeat for hacked PS3s. Of course, even a 1% loss in sales would be a pretty big blow for Sony and the other developers, but it's debatable whether or not that population would have paid for a pirated game in the first place. Does anyone know if Nintendo ever announced how much they've lost in sales to piracy on the Wii? Has Sony ever released estimates on how much they might lose to piracy?
- chairmankaga 14y ago
  I think its important to consider not only piracy but the effects of malicious users in online games. It only takes one person to ruin your experience in a game, even worse if you are cheated and can't do anything about it.
  - 9999 14y ago
    I have advocated in the past for Sony and MS that they are behaving as mostly rational actors defending their business interests. People using cheats and hacks in multi-player games is another strong case for keeping consoles locked down. More and more I'm questioning the methods they use to do so though. The constant firmware/system software updates that they roll out are incredibly obtrusive. Prior to this generation of consoles one of the things that really made console gaming superior to PC gaming was the ease of use. Buy game. Stick game into console. Play game. Now you buy the game, download it (and wait) or stick it in, install whatever stupid update is required for the game (and wait), restart your stupid console (and wait), install the game (and wait, or don't install it and suffer awful load times), and then after all that maybe you get to play the thing. Meanwhile, PC gaming is way ahead of the curve in this new paradigm in almost every respect. Yes, you often have to download the game, but you can also start installing and playing before it's finished downloading (Diablo 2 let you do this, I'm not sure how common that is), and you don't have to restart your computer due to some stupid firmware update (that is really just there to prevent piracy).
- jpablo 14y ago
  By the time there are easy to use tools to pirate games in the ps3 (a year maybe as the most recent) there will be a PS4 out and it won't be as important for Sony.
- hkmurakami 14y ago
  A realization I had when I first started working was just how cheap video games are compared to virtually any other form of entertainment. Movie ticket = $10 / 2 hours = $5/hour Amusement park = $30 / 5 hours = $6/hour Dining out = $20 / 2 hours = $10/hour Video game = $50 / 20 hours = $2.5/hour I don't own any of the latest generation video game consoles, but if I did, I'd certainly be buying a bunch of them via download for their sheer economy in giving me entertainment value.
jpablo 14y ago
He says that all future firmware updates can be decrypted, since every PS3 must be able to upgrade to any future version, but can't Sony just put an intermediate update that changes the keys and is the only one that older consoles can update too, and then after having that one update you are allowed to the newer updates encrypted/signed with newer keys?
- chairmankaga 14y ago
  "Q: Can Sony “fix” this like they did for the 3.55 exploit? A: No. With 3.55 the keys metldr used to verify its dependent modules were recovered. So Sony simply stopped using the now-insecure metldr and started using bootldr (which was still secure) to load.. Sony doesn’t have any more secure modules like bootldr left so like I said in my original post they have no options and cant fix anything; without getting too technical, we now have the keys to every “common” hardware module that is able to decrypt Sony-signed modules. The only thing left are the modules that use per-console keys, which are useless for booting common firmware (which must be decryptable by every PS3)" http://wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/ http://wololo.net/2012/10/25/clarifying-the-confusion-on-the...
chucknelson 14y ago
Is this really a big deal? Average consumer X, the majority of customers, does not know or care about any of this. They will buy games they want (or parent X will buy them) and that will be that.
- derpenxyne 14y ago
  By that logic huge security vulnerabilities in games, software and operating systems also aren't a big deal as people don't know about them or don't care about them.
  - chucknelson 14y ago
    I guess just the way the announcement was written made it seem like the event of the century or something. Guess it all depends on the audience...
- jiggy2011 14y ago
  It's a big deal for Sony if it makes piracy easier. It's also going to affect gamers if it makes cheating easier.
pmichaud 14y ago
I have a PS3 because it's dead simple to buy a game, pop it in, and just play it without worrying about anything else. I would never use this, it defeats the purpose of the ps3 for me. I'd rather just spend $20 on a game.
- wlesieutre 14y ago
  Are there many games worth playing that sell for $20? Going rate on new releases is more like $60.
  - derpenxyne 14y ago
    Jeez, what new games do you know that sell for $20?
    - teamonkey 14y ago
      FTL! Launched on Steam at about $10
  - HeXetic 14y ago
    Highly successful Playstation titles tend to roll over into being re-released as "greatest hits" editions for about $20 in a year or so. The list is fairly extensive: https://en.wikipedia.org/wiki/Greatest_Hits_%28budget_range%29#PlayStation_3 https://en.wikipedia.org/wiki/Greatest_Hits_%28budget_range%...
  - evoxed 14y ago
    Tokyo Jungle is only $15 if you have a US account. I was ready to buy it at BookOff for 4500円 or something until I heard about the US download release... Edit: also, Jet Set Radio HD! ~$12 IIRC.
  - kin 14y ago
    For brand new games, yes, $60. But greatest hits and sales can easily knock that down to $40, $30, or even $20 for greatest hits (definitely worth playing). That being said for new games Amazon/Tos R Us/Best Buy do tons of BOGO Sales and if you just follow http://www.cheapassgamer.com/ http://www.cheapassgamer.com/ you'll be surprised how many great gaming deals there are. For used games you can try Craigslist for $15 GREAT used games or even http://glyde.com/ http://glyde.com/
Karunamon 14y ago
Serves them right. SCEA earned their place on my "do not ever buy" list after the Geohot fiasco - everyone knew their system was insecure and it was just a matter of time before someone else picked up where he left off. You lose. Good day sir.
durpleDrank 14y ago
As someone who bought his PS3 only for the bluray player and the ability to have linux on his tv in one little box, and after doing hours of research to verify it was a legit feature (only to have it stripped less then a year later) I find it impossible to empathize with sony.
- csense 14y ago
  A thousand times, this. I bought an original-model PS3 when the slims first started to come out, specifically because I wanted to put Linux on it. It's like if you were to buy a new car, and you really like the sound system it has, and you wouldn't have bought it if not for the sound system. And then a year later you take it in for service, and they say, "Sorry, we have to take your sound system out and smash the jacks with a sledgehammer so you can never put another sound system in your car. If you don't agree to this, that's your right. But if you want to keep the sound system, you'll never be able to get any repairs or an oil change from us ever again -- and since all the parts are proprietary and the oil change valve is locked with our encryption key, you won't be able to DIY your maintenance or get it from a third party repair shop either." Then again, this is the same company that put rootkits on audio CD's.
  - jberryman 14y ago
    I'm not sure I follow your crazy car analogy, but I guess a major issue is that PS3s are heavily subsidized, unlike cars.
  - djhworld 14y ago
    I still have the original box for my PS3, it has "Linux support" and screenshots plastered all over it. Makes me weep a bit
unkoman 14y ago
Too bad the PS3 doesn't have any games.
sturadnidge 14y ago
From the article: > a 2006 launch PS3 can still update directly to the latest software A few other tech companies could take a leaf out of that book. Look at the state of the iPad 1 for example...
- WiseWeasel 14y ago
  So you're saying Apple should stick with the same set of hardware capabilities for six years?
JCordeiro 14y ago
This is bad news for PlayStation fans :( The easier it is for people to pirate games, the more people who will pirate. The more people who pirate games, the less moneys the developers make. This is how studios get shutdown. Sony's closed at least 3 first-party studios just this year.
guylhem 14y ago
Correct me if I'm wrong, but after reading the article apparently it's all fine and dandy if you have a cracked PS3, but if you have a useless PS3 with the latest official firmware and want to put it to a better use (XMBC, linux, whatever) there's nothing for you. So : - this is good for those who cracked their ps3 - this is a non event for those who did stick to the rules and would like to do with their ps3 what sony said they were no longer allowed to do (running linux)
- chuppo 14y ago
  > but if you have a useless PS3 with the latest official firmware and want to put it to a better use (XMBC, linux, whatever) there's nothing for you. I dont think thats correct. With these keys you can sign whatever you like and have it run on the PS3.
cyber 14y ago
There has been a lot of comments on the piracy aspect, but I think the cheats are just as important, if not more so. With the assumption that the vast majority of players don't want to jump through the hoops to deal with keeping updated on "liberated" firmware versions, the piracy threat is contained to a small population, not likely to damage the bottom line. However, the risk to online play is greater with cheat enabled clients. A single cheat client can cause great havoc within a game instance. Even if the individual device can be banned, another actor can take it's place. Legitimate clients will get frustrated quickly on a prolonged attack. And that is where the real damage is.
leoh 14y ago
Am I missing something? The next firmware may be vulnerable, but what about the one after?
- nitrogen 14y ago
  I'm not familiar with the PS3's architecture, but it seems that any firmware update that includes new keys will... have to include the new keys. Since the update includes the new keys, and the old keys decrypt the update, the old keys can be used to obtain the new keys. Corrections welcome.

104 points by derpenxyne 14y ago

The kotaku story is following in the steps of the older stories and is somewhat inaccurate. This was a much more interesting read by one of fail0verflows devs Marcan. http://wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/ http://wololo.net/2012/10/25/clarifying-the-confusion-on-the...

derpenxyne 14y ago
I grant that - essentially: Q: So the PS3 is utterly and completely broken? A: To an extant yes, debatable but unlike the 3.55 hack we have mostly everything needed. Sony will never be able to re-secure existing consoles.

9999 14y ago

I think Sony overestimates the amount of piracy that this will enable. I softmodded my Wii long ago (in order to unlock the region to play Japanese and European games on a U.S. Wii). Ever since it's been an incredible pain in the butt to keep it updated to the latest modded firmware revisions in order to play legitimate games. Almost every time I buy a new game I have to dig through an incredibly dense array of sketchy forum posts and file sharing sites to find the newly patched custom firmware. If a person were looking to play a game on its release day (legitimate or pirated), they would find the process so time consuming and annoying that I doubt more than 1% of Wii owners would bother with it. I would guess the same pattern would repeat for hacked PS3s. Of course, even a 1% loss in sales would be a pretty big blow for Sony and the other developers, but it's debatable whether or not that population would have paid for a pirated game in the first place. Does anyone know if Nintendo ever announced how much they've lost in sales to piracy on the Wii? Has Sony ever released estimates on how much they might lose to piracy?

chairmankaga 14y ago
I think its important to consider not only piracy but the effects of malicious users in online games. It only takes one person to ruin your experience in a game, even worse if you are cheated and can't do anything about it.
- 9999 14y ago
  I have advocated in the past for Sony and MS that they are behaving as mostly rational actors defending their business interests. People using cheats and hacks in multi-player games is another strong case for keeping consoles locked down. More and more I'm questioning the methods they use to do so though. The constant firmware/system software updates that they roll out are incredibly obtrusive. Prior to this generation of consoles one of the things that really made console gaming superior to PC gaming was the ease of use. Buy game. Stick game into console. Play game. Now you buy the game, download it (and wait) or stick it in, install whatever stupid update is required for the game (and wait), restart your stupid console (and wait), install the game (and wait, or don't install it and suffer awful load times), and then after all that maybe you get to play the thing. Meanwhile, PC gaming is way ahead of the curve in this new paradigm in almost every respect. Yes, you often have to download the game, but you can also start installing and playing before it's finished downloading (Diablo 2 let you do this, I'm not sure how common that is), and you don't have to restart your computer due to some stupid firmware update (that is really just there to prevent piracy).
jpablo 14y ago
By the time there are easy to use tools to pirate games in the ps3 (a year maybe as the most recent) there will be a PS4 out and it won't be as important for Sony.
hkmurakami 14y ago
A realization I had when I first started working was just how cheap video games are compared to virtually any other form of entertainment. Movie ticket = $10 / 2 hours = $5/hour Amusement park = $30 / 5 hours = $6/hour Dining out = $20 / 2 hours = $10/hour Video game = $50 / 20 hours = $2.5/hour I don't own any of the latest generation video game consoles, but if I did, I'd certainly be buying a bunch of them via download for their sheer economy in giving me entertainment value.

jpablo 14y ago

He says that all future firmware updates can be decrypted, since every PS3 must be able to upgrade to any future version, but can't Sony just put an intermediate update that changes the keys and is the only one that older consoles can update too, and then after having that one update you are allowed to the newer updates encrypted/signed with newer keys?

chairmankaga 14y ago
"Q: Can Sony “fix” this like they did for the 3.55 exploit? A: No. With 3.55 the keys metldr used to verify its dependent modules were recovered. So Sony simply stopped using the now-insecure metldr and started using bootldr (which was still secure) to load.. Sony doesn’t have any more secure modules like bootldr left so like I said in my original post they have no options and cant fix anything; without getting too technical, we now have the keys to every “common” hardware module that is able to decrypt Sony-signed modules. The only thing left are the modules that use per-console keys, which are useless for booting common firmware (which must be decryptable by every PS3)" http://wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/ http://wololo.net/2012/10/25/clarifying-the-confusion-on-the...

chucknelson 14y ago

Is this really a big deal? Average consumer X, the majority of customers, does not know or care about any of this. They will buy games they want (or parent X will buy them) and that will be that.

derpenxyne 14y ago
By that logic huge security vulnerabilities in games, software and operating systems also aren't a big deal as people don't know about them or don't care about them.
- chucknelson 14y ago
  I guess just the way the announcement was written made it seem like the event of the century or something. Guess it all depends on the audience...
jiggy2011 14y ago
It's a big deal for Sony if it makes piracy easier. It's also going to affect gamers if it makes cheating easier.

pmichaud 14y ago

I have a PS3 because it's dead simple to buy a game, pop it in, and just play it without worrying about anything else. I would never use this, it defeats the purpose of the ps3 for me. I'd rather just spend $20 on a game.

wlesieutre 14y ago
Are there many games worth playing that sell for $20? Going rate on new releases is more like $60.
- derpenxyne 14y ago
  Jeez, what new games do you know that sell for $20?
  - teamonkey 14y ago
    FTL! Launched on Steam at about $10
- HeXetic 14y ago
  Highly successful Playstation titles tend to roll over into being re-released as "greatest hits" editions for about $20 in a year or so. The list is fairly extensive: https://en.wikipedia.org/wiki/Greatest_Hits_%28budget_range%29#PlayStation_3 https://en.wikipedia.org/wiki/Greatest_Hits_%28budget_range%...
- evoxed 14y ago
  Tokyo Jungle is only $15 if you have a US account. I was ready to buy it at BookOff for 4500円 or something until I heard about the US download release... Edit: also, Jet Set Radio HD! ~$12 IIRC.
- kin 14y ago
  For brand new games, yes, $60. But greatest hits and sales can easily knock that down to $40, $30, or even $20 for greatest hits (definitely worth playing). That being said for new games Amazon/Tos R Us/Best Buy do tons of BOGO Sales and if you just follow http://www.cheapassgamer.com/ http://www.cheapassgamer.com/ you'll be surprised how many great gaming deals there are. For used games you can try Craigslist for $15 GREAT used games or even http://glyde.com/ http://glyde.com/

Karunamon 14y ago

Serves them right. SCEA earned their place on my "do not ever buy" list after the Geohot fiasco - everyone knew their system was insecure and it was just a matter of time before someone else picked up where he left off. You lose. Good day sir.

durpleDrank 14y ago

As someone who bought his PS3 only for the bluray player and the ability to have linux on his tv in one little box, and after doing hours of research to verify it was a legit feature (only to have it stripped less then a year later) I find it impossible to empathize with sony.

csense 14y ago
A thousand times, this. I bought an original-model PS3 when the slims first started to come out, specifically because I wanted to put Linux on it. It's like if you were to buy a new car, and you really like the sound system it has, and you wouldn't have bought it if not for the sound system. And then a year later you take it in for service, and they say, "Sorry, we have to take your sound system out and smash the jacks with a sledgehammer so you can never put another sound system in your car. If you don't agree to this, that's your right. But if you want to keep the sound system, you'll never be able to get any repairs or an oil change from us ever again -- and since all the parts are proprietary and the oil change valve is locked with our encryption key, you won't be able to DIY your maintenance or get it from a third party repair shop either." Then again, this is the same company that put rootkits on audio CD's.
- jberryman 14y ago
  I'm not sure I follow your crazy car analogy, but I guess a major issue is that PS3s are heavily subsidized, unlike cars.
- djhworld 14y ago
  I still have the original box for my PS3, it has "Linux support" and screenshots plastered all over it. Makes me weep a bit

unkoman 14y ago

Too bad the PS3 doesn't have any games.

sturadnidge 14y ago

From the article: > a 2006 launch PS3 can still update directly to the latest software A few other tech companies could take a leaf out of that book. Look at the state of the iPad 1 for example...

WiseWeasel 14y ago
So you're saying Apple should stick with the same set of hardware capabilities for six years?

JCordeiro 14y ago

This is bad news for PlayStation fans :( The easier it is for people to pirate games, the more people who will pirate. The more people who pirate games, the less moneys the developers make. This is how studios get shutdown. Sony's closed at least 3 first-party studios just this year.

guylhem 14y ago

Correct me if I'm wrong, but after reading the article apparently it's all fine and dandy if you have a cracked PS3, but if you have a useless PS3 with the latest official firmware and want to put it to a better use (XMBC, linux, whatever) there's nothing for you. So : - this is good for those who cracked their ps3 - this is a non event for those who did stick to the rules and would like to do with their ps3 what sony said they were no longer allowed to do (running linux)

chuppo 14y ago
> but if you have a useless PS3 with the latest official firmware and want to put it to a better use (XMBC, linux, whatever) there's nothing for you. I dont think thats correct. With these keys you can sign whatever you like and have it run on the PS3.

cyber 14y ago

There has been a lot of comments on the piracy aspect, but I think the cheats are just as important, if not more so. With the assumption that the vast majority of players don't want to jump through the hoops to deal with keeping updated on "liberated" firmware versions, the piracy threat is contained to a small population, not likely to damage the bottom line. However, the risk to online play is greater with cheat enabled clients. A single cheat client can cause great havoc within a game instance. Even if the individual device can be banned, another actor can take it's place. Legitimate clients will get frustrated quickly on a prolonged attack. And that is where the real damage is.

leoh 14y ago

Am I missing something? The next firmware may be vulnerable, but what about the one after?

nitrogen 14y ago
I'm not familiar with the PS3's architecture, but it seems that any firmware update that includes new keys will... have to include the new keys. Since the update includes the new keys, and the old keys decrypt the update, the old keys can be used to obtain the new keys. Corrections welcome.