8 ms·
5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability
- therogerwilco 13y agoWow. I'm so completely amazed by his technical expertise. :|
- samelawrence 13y agoIs it just me, or should they have given him more than $120 for exposing this major flaw?
- zacharytamas 13y agoI was thinking the same. If you value a video game at $50, it comes closer to $300 but that still seems paltry for a vulnerability that seems to give full access (from the console at least) to a user's account.
- johnchristopher 13y agoExcept those games won't resell at that price. In the end it's less expensive for MS but I suppose it would satisfy a young gamer. As an adult I wouldn't like to be paid in games or in on-line subscriptions.
- bitJericho 13y agoI'm sure if MS hired you as a security researcher they would pay you better.
- watty 13y agoIt may have just been a way to get into local accounts, which I wouldn't consider "major". Also four games, one year of live, and $50 is more than $120.
- ampersandy 13y agoIf Microsoft's entire child-security protections don't work; I'd say that's fairly major. What might have been a very compelling feature for parents has been shown to be ineffective (if your kids know about the vulnerability, which for young children is admittedly unlikely). They paid him at all, which is good, but it also shows that there's no reason they couldn't have authorized a bigger payout. It's still, at most, $350. Why not free Xbox Gold for life instead of one year? There's no cost to Microsoft.
- wil421 13y agoWhy are the obligated to give something out for finding a flaw?
- unfunco 13y agoThere's no obligation, it works as a deterrent for publishing the vulnerability to potentially bad people. Many tech companies now offer a reward for submitting vulnerabilities, it's more often than not cheaper than being exposed.
- ilbe 13y agoSpaces, really? Can someone speculate what might be happening under the hood?
- binarymax 13y agoIt was noted as a backdoor. Presumably that means it was purposefully programmed in for testing (and possibly even production), and made its way into the delivered software. So the under-the-hood speculation being a simple if statement allowing for all-space passwords to grant access.
- Mtinie 13y agoThat was the first thing that came to mind, too. It isn't unusual to program in a shortcut like that for the QA team. It just looks like it was missed when they rolled that code out. It just goes to show (if my assumption is correct) that it's worth NOT adding in those efficiencies, when possible, because of situations just like this one.
- lostcolony 13y agoNo, that's why you tie that kind of code to a compiler flag.
- zheshishei 13y agoI feel kind of dumb for asking this, but how do you do that?
- S4M 13y agoSeriously, is this true or a late April's fool?
- raptorious 13y agoThis was my first thought also. But his name is actually on the list of security researchers (or someone who has the same name of course ;). http://technet.microsoft.com/en-us/security/cc308589.aspx http://technet.microsoft.com/en-us/security/cc308589.aspx
- gygygy 13y agoWhy do I get the feeling someone is trying to say that a xBox could even be hacked a 5 year old. I smell something fishy. :p
- deleted 13y ago[deleted]
- dredmorbius 13y agoNB: what is it about small and local news sites, usually TV stations, but also newspapers and such, which cannot * CLEARLY * indicate where in the world they are? "Ocean Beach" is a pleasantly anonymous place name (I can think of several neighborhoods matching this, the U.S. Gazetteer of Places identifies it as Ocean Beach, NY), affording very little by way of actual location. In an age before widespread Internet use, I experienced similar frustrations while listening to clear channel AM radio broadcasts in the back country. It wasn't uncommon to pull in strong signals from hundreds to a thousand miles away. And while there's something delightfully surreal in listening to the mundania of local traffic and news reports, if you happen to be in a wilderness location trying to find a reliable weather forecast, "area conditions" doesn't do much for you.
- anarchy8 13y agohttp://en.wikipedia.org/wiki/KGTV http://en.wikipedia.org/wiki/KGTV San Diego, California
- dredmorbius 13y agoI'm aware that I can look up broadcasters' call letters, but that really shouldn't be necessary. Why cannot KGTV note * ON ITS WEBSITE * its geographic affiliation. Worse is when you run into a newspaper site which flat-out refuses to ID its locale. Where the hell is, without looking it up, the Springfield News-Leader? (The only hint on the publication's website is its weather forecast). It's a * WORLD * wide web, folks. Start acting like it.
- shawnz 13y ago> It's a * WORLD * wide web, folks. Start acting like it. But they're not a worldwide news service, they are a local one. Why are they obligated to cater to people who don't live in the area they service?
- sixothree 13y agoAt least some place on their site, they might acknowledge what state they are in.
- peterwwillis 13y agoWow. This is the mavis beacon typing tutor hack. Years ago (jesus, has it been 15 years?), I was in computer class on the old Macintoshes they had with Mavis Beacon Typing Tutor. We were supposed to type out the sentences we read to increase our typing speed, and learn the home row. I hated home row, and insisted that hunt-and-peck was more comfortable for me. But the teacher was adamant I use home row only, which was annoying. I was also not very fast at either form of typing. I discovered by accident that if I hit the spacebar for each letter in each word, the program interpreted it as a successful spelling. All I had to do was keep typing the spacebar to complete the words. So i'd put my fingers on the home row, moving my fingers up and down, and pressing the spacebar with my thumb. I got 120 words per minute.
- 72deluxe 13y agoHaha that's stupid. Did the program not bother checking to see what the keycodes were? Did it have just a function OnKeyPress that incremented the counter? Laziness! Why do I bother writing decent software when there's so much junk floating around that people BUY?
- gosub 13y agoerrors = 0 if keypress == ' ': for i,letter in enumerate(entered_word): if letter != presented_word[i]: errors += 1
- pervycreeper 13y ago>Why do I bother writing decent software when there's so much junk floating around that people BUY? Assuming it's free software, that question answers itself.
- vxNsr 13y agoMavis Beacon? They charged schools an arm and a leg for that back in the day.
- davidb_ 13y ago
- vectorpush 13y agoLook out homakov. :)
- 67726e 13y agoMaybe I'm just cynical, but given that the father is a security researcher, does anyone else think that he himself found the vulnerability but concocted the story to get some free press?
- FLUX-YOU 13y agoWouldn't be the first time parents did the work for their kids to give them a line item on their 'resume'. As an aside, this gave me an idea: Grey hat SEO/reputation consulting for your kids' reputations.
- Gracana 13y agoYou don't have to be a security researcher to type stuff into a password box and try it out. It doesn't seem so far-fetched to me.
- stephengillie 13y agoSo this is like junior astronomers getting credit for finding planets with telescopes designed and funded by senior astronomers?
- scott_karana 13y agoExcept that it's an off-the-shelf Xbox One. Any of his friends could have hypothetically found the vulnerability.
- astrodust 13y agoI don't think a security researcher would waste his time hitting the space bar to try and crack in. They'd probably look for other, more sophisticated vectors, simply because the probability of such a crude attack working is very low. In this case, inexplicably, it worked. Given the kid's history of interesting discoveries, I'd say this is legit. It's not very sophisticated, but it sure is effective. If your father was someone trained to probe for problems, if you'd grown up with that sort of encouragement, you'd probably try the same thing at your own level of ability. Props to the kid!
- Aardwolf 13y agoWhen I was 5 years old all I could do was sort Duplo blocks by color, and I don't even have a memory of it :(. I get sort of jealous if I see how smart small kids can be.
- yincrash 13y agoIt's really refreshing to see a family embrace their son's inventiveness and tenacity rather than reprimand the kid for breaking past the parental controls
- theandrewbailey 13y agoIt's really refreshing to see a company embrace their customer's inventiveness and tenacity rather than suing them for breaking their products.
- rbanffy 13y agoIt's really refreshing to see a company that sets their security bar so low that even a small kid can get a kick out of discovering a security vulnerability. This could be the start of a long and rewarding career, ;-)
- giantrobothead 13y agoIt's really refreshing to hold Ctrl-R and see what new comments slide into place.
- chanced 13y ago"At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key." Not to be "that guy" or anything but I suspect it is pretty normal for a child to hold down a button. First, what kind of lousy lock wouldn't safeguard against, what was likely either the only or one of a few buttons, being held down? Second, sounds like proud father has made at least a few false connections. He is a geeky equivalent of a creationist museum tourist.
- jdorfman 13y agofucking awesome
- Evolved 13y agoIf you scroll down to the bottom where it says "Trending Now" all of the headlines (including this one) state 10news.com KGTV ABC San Diego.
- quackerhacker 13y agoSo I told this story to my wife, because at first I was a little envious (wishing my boy did this)...then her being the devil's advocate made me realize something...if a 5-year-old can bypass Xbox's verification by pressing space keys and enter then it says volumes about Xbox's verification checks. Who was sleeping at the wheel when Xbox didn't add empty strings to password verification checks?
- SwiftCeipt 13y agoI don't think its that surprising, kids have all the time in the world. When I was a kid I worked on cracking the Fridge lock.. Perhaps my time was poorly spent.
- quux 13y agoAs I read the article I kept expecting the part where he was suspended from school for the rest of the semester for breaking the school's zero tolerance policy on "cyber attacks" or something.
- kmfrk 13y agoOn another note, the whitehat bounty seems ridiculously low, if we're to take him as a peer: Kristoffer will receive four games, $50 and a year-long subscription to Xbox Live from Microsoft.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- snorkel 13y agoSennnsatioonal!!! > At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key. ... uh ... pretty sure because that's because he watched his father doing in order to use the phone.
- zemo 13y agowhat level of crime is this? Does this count as computer trespass in NY? If so, that's a class E felony. § 156.10 Computer trespass. A person is guilty of computer trespass when he or she knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without authorization and: 1. he or she does so with an intent to commit or attempt to commit or further the commission of any felony; or 2. he or she thereby knowingly gains access to computer material. Computer trespass is a class E felony. http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=$$PEN156.10$$@TXPEN0156.10+&LIST=LAW+&BROWSER=BROWSER+&TOKEN=03545439+&TARGET=VIEW http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAW...
- dkrich 13y agoWell, first the father would have to press charges against his 5-year-old son. Probably not likely, and, eh, I just can't.
- h4pless 13y agoI'm not sure about New York but in many states, the victim has no say whether or not charges are pressed against the defendant. It's usually at the sole discretion of the District Attorney. That being said, this is hardly a triable case as the defendant is 5 years old. The DA would have to prove that the kid knew what he was doing enough to have the culpability to commit a crime, then they would have to convince a jury of adults that a kid should face criminal consequences for hacking his dad's xbox account.
- lawnchair_larry 13y agoCFAA violation, affecting interstate commerce. Definitely also wire fraud. This kid better watch out for Carmen Ortiz and Stephen Heymann.
- crystalmace 13y agoOh sure. When he bypasses child locks he gets rewarded by his parents and Microsoft. When I bypassed child locks and parental controls when I was younger, I got in trouble and my computer taken away. :D
- elwell 13y ago“I was like yea!”
- elwell 13y agoThis is indicative of disorganized program structure. Form validation shouldn't be unique to separate forms; they should all be piped through the same place, where validation is done.