3 ms·

Breaking the console: a brief history of video game security

96 points by sprado 6mo ago

sprado 6mo ago
After some time without posting on my blog, I decided to get back to it — and my first post after the break is about the history of video game security! There are also some great stories along the way, like Atari reverse-engineering Nintendo’s lockout system, or how simply changing the name of Link's horse became an attack vector on the Nintendo Wii. I had a lot of fun researching and writing this article, and I learned a lot in the process. I hope you enjoy it too!
- djmips 6mo ago
  Thanks I did enjoy it! One thing is, I feel like the PS1 wobble disc protection, although bypassed with swaps and mod chips, it has never been possible (besides one historic example: Datel) for someone other than Sony to make a disc bootable on the console. I feel like most PS1's weren't modded so it was quite a well done lockout. But I understand that wasn't your main point - just that it was a surprisingly effective copy protection.
yaros_love 6mo ago
Thanks for such an interesting read. Would be awesome to get sort of a "follow up" about modern sophisticated digital solutions we have now (denuvo and so on)
- sprado 6mo ago
  That would be a great follow up. Added to my list of next articles. Thanks for the suggestion!
riverforest 6mo ago
The cat and mouse between console makers and hackers is one of the more honest stories in tech. Both sides kept making each other better.
- sprado 6mo ago
  True!
serhack_ 6mo ago
interesting video I was seeing the other day: https://www.youtube.com/watch?v=FTFn4UZsA5U https://www.youtube.com/watch?v=FTFn4UZsA5U
- ytch 6mo ago
  Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo I like this video too, Tony Chen explains the overview of Xbox security system.
wise0wl 6mo ago
So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He had notebooks about the timing for these bad sectors per game. So, yeah. The "article" is incorrect from nearly the get-go about the "wild west" Atari age.
- sprado 6mo ago
  Thanks for the comment. No, it is not AI generated. It was based on my research. I think there is a mix-up here between Atari home consoles and Atari home computers. In that section I was talking about early console platforms such as the Atari 2600, where the cartridge interface itself had no lockout/authentication mechanism comparable to what Nintendo later did with the 10NES. That is why third-party cartridges could exist and Atari’s main response was legal rather than technical. What you describe for the Atari 800 is real, but it belongs to a different context: the Atari 8-bit computer line, especially floppy-disk software, where copy-protection tricks such as intentional bad sectors and timing-based checks were indeed common. So I agree that Atari computer software often used copy protection, but that does not contradict the point I was making about the early console era.
  - landr0id 6mo ago
    Hi, quick note on "For modern Xbox platforms, public 2024 work exposed SystemOS kernel exploitation on both Xbox One and Xbox Series" I'm a former Xbox hacker, then former Microsoft employee, and (long after) leaving Microsoft helped with the Collateral Damage post-exploitation payload. The design of the Xbox One security predates me, but Microsoft has always known that SystemOS would be a weak link that would almost guaranteed to be compromised and shoved most of their attack surface that can be trivially attacked in there. The system shell, 3rd-party apps, guide, etc. all run in SystemOS. The key things they focused on though were: 1. Extremely strong defense-in-depth 2. Making full or partial exploitation not economical 3rd party apps and the web browser were seen as being obviously untrusted _and_ needed JIT because they'd mostly be based on .NET or the JS VM. But practically speaking there should be nothing interesting in that VM: its compromise shouldn't enable piracy/cheating and ideally shouldn't leak game plaintext. What some others found though was that for some reason plaintext was actually visible to SystemOS, but didn't enable piracy on console. You can take those games though and run them on PC using XWine1: https://github.com/xwine1 https://github.com/xwine1 Technically speaking there's no reason why Collateral Damage couldn't have happened waayyyyy earlier in the Xbox One's lifecycle except for motivation. Even still you could probably take some Hyper-V N-day and compromise HostOS through. Over there years there have been other "exploits" too: some folks have managed to tamper with gamesaves via cloud connected storage and other shenanigans, XSS in the system shell (some of these apps are JS), etc., but most of this was relatively benign and easily patchable. And there has been a very, very small group of people with similar but less capable exploits to Collat. Collat allowed compromise of plaintext. Bliss breaks everything :)
cheeseomlit 6mo ago
Back in the day I remember my brother got his hands on a PS1 modchip, but it didn't require any soldering- you just plugged it into the "parallel I/O" port in back of the console and it let us run games on burned CDs. We really got our moneys worth at blockbuster after that
- wil421 6mo ago
  My buddies brother did the same thing with a PS1 and maybe sent his Xbox off somewhere to get it modded. However he was an asshole hermit and wouldn’t let us play or burn any games. My dad would never cheat or do anything illegal even though he was an EE who could’ve done the mod himself. Today he might do it but there was a strict no stealing policy even for digital things. Like the time he freaked out because I was grabbing stuff from The Scene and wrote down a bunch of terms to research, he saw the word Warez and freaked out.
  - Obscurity4340 6mo ago
    Bewarez warez
bob1029 6mo ago
The modern consoles are pretty close to perfect with how they use PKI and certificates. Even if you clone the cryptographic identity of a valid console, the vendor can quickly detect this impossible access scenario.
- sprado 6mo ago
  Correct. And identity management is so important nowadays that most security-related certifications and regulations require it.
favorited 6mo ago
The best part of the 10NES design, as a consumer, was that it was fail-safe, rather than fail-secure. The console defaulted to booting. So, if your NES started having the infamous boot-reset flashing light, all you had to do was unscrew the NES enclosure and clip the power pin on the 10NES chip. And these were huge pins, it didn't require any subtlety. You could do it with a nail clipper.
tempaccountabcd 6mo ago
[dead]

96 points by sprado 6mo ago

After some time without posting on my blog, I decided to get back to it — and my first post after the break is about the history of video game security! There are also some great stories along the way, like Atari reverse-engineering Nintendo’s lockout system, or how simply changing the name of Link's horse became an attack vector on the Nintendo Wii. I had a lot of fun researching and writing this article, and I learned a lot in the process. I hope you enjoy it too!

djmips 6mo ago
Thanks I did enjoy it! One thing is, I feel like the PS1 wobble disc protection, although bypassed with swaps and mod chips, it has never been possible (besides one historic example: Datel) for someone other than Sony to make a disc bootable on the console. I feel like most PS1's weren't modded so it was quite a well done lockout. But I understand that wasn't your main point - just that it was a surprisingly effective copy protection.

yaros_love 6mo ago

Thanks for such an interesting read. Would be awesome to get sort of a "follow up" about modern sophisticated digital solutions we have now (denuvo and so on)

sprado 6mo ago
That would be a great follow up. Added to my list of next articles. Thanks for the suggestion!

riverforest 6mo ago

The cat and mouse between console makers and hackers is one of the more honest stories in tech. Both sides kept making each other better.

sprado 6mo ago
True!

serhack_ 6mo ago

interesting video I was seeing the other day: https://www.youtube.com/watch?v=FTFn4UZsA5U https://www.youtube.com/watch?v=FTFn4UZsA5U

ytch 6mo ago
Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo I like this video too, Tony Chen explains the overview of Xbox security system.

wise0wl 6mo ago

So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He had notebooks about the timing for these bad sectors per game. So, yeah. The "article" is incorrect from nearly the get-go about the "wild west" Atari age.

sprado 6mo ago
Thanks for the comment. No, it is not AI generated. It was based on my research. I think there is a mix-up here between Atari home consoles and Atari home computers. In that section I was talking about early console platforms such as the Atari 2600, where the cartridge interface itself had no lockout/authentication mechanism comparable to what Nintendo later did with the 10NES. That is why third-party cartridges could exist and Atari’s main response was legal rather than technical. What you describe for the Atari 800 is real, but it belongs to a different context: the Atari 8-bit computer line, especially floppy-disk software, where copy-protection tricks such as intentional bad sectors and timing-based checks were indeed common. So I agree that Atari computer software often used copy protection, but that does not contradict the point I was making about the early console era.
- landr0id 6mo ago
  Hi, quick note on "For modern Xbox platforms, public 2024 work exposed SystemOS kernel exploitation on both Xbox One and Xbox Series" I'm a former Xbox hacker, then former Microsoft employee, and (long after) leaving Microsoft helped with the Collateral Damage post-exploitation payload. The design of the Xbox One security predates me, but Microsoft has always known that SystemOS would be a weak link that would almost guaranteed to be compromised and shoved most of their attack surface that can be trivially attacked in there. The system shell, 3rd-party apps, guide, etc. all run in SystemOS. The key things they focused on though were: 1. Extremely strong defense-in-depth 2. Making full or partial exploitation not economical 3rd party apps and the web browser were seen as being obviously untrusted _and_ needed JIT because they'd mostly be based on .NET or the JS VM. But practically speaking there should be nothing interesting in that VM: its compromise shouldn't enable piracy/cheating and ideally shouldn't leak game plaintext. What some others found though was that for some reason plaintext was actually visible to SystemOS, but didn't enable piracy on console. You can take those games though and run them on PC using XWine1: https://github.com/xwine1 https://github.com/xwine1 Technically speaking there's no reason why Collateral Damage couldn't have happened waayyyyy earlier in the Xbox One's lifecycle except for motivation. Even still you could probably take some Hyper-V N-day and compromise HostOS through. Over there years there have been other "exploits" too: some folks have managed to tamper with gamesaves via cloud connected storage and other shenanigans, XSS in the system shell (some of these apps are JS), etc., but most of this was relatively benign and easily patchable. And there has been a very, very small group of people with similar but less capable exploits to Collat. Collat allowed compromise of plaintext. Bliss breaks everything :)

cheeseomlit 6mo ago

Back in the day I remember my brother got his hands on a PS1 modchip, but it didn't require any soldering- you just plugged it into the "parallel I/O" port in back of the console and it let us run games on burned CDs. We really got our moneys worth at blockbuster after that

wil421 6mo ago
My buddies brother did the same thing with a PS1 and maybe sent his Xbox off somewhere to get it modded. However he was an asshole hermit and wouldn’t let us play or burn any games. My dad would never cheat or do anything illegal even though he was an EE who could’ve done the mod himself. Today he might do it but there was a strict no stealing policy even for digital things. Like the time he freaked out because I was grabbing stuff from The Scene and wrote down a bunch of terms to research, he saw the word Warez and freaked out.
- Obscurity4340 6mo ago
  Bewarez warez

bob1029 6mo ago

The modern consoles are pretty close to perfect with how they use PKI and certificates. Even if you clone the cryptographic identity of a valid console, the vendor can quickly detect this impossible access scenario.

sprado 6mo ago
Correct. And identity management is so important nowadays that most security-related certifications and regulations require it.

favorited 6mo ago

The best part of the 10NES design, as a consumer, was that it was fail-safe, rather than fail-secure. The console defaulted to booting. So, if your NES started having the infamous boot-reset flashing light, all you had to do was unscrew the NES enclosure and clip the power pin on the 10NES chip. And these were huge pins, it didn't require any subtlety. You could do it with a nail clipper.

tempaccountabcd 6mo ago

[dead]