Slashdot Mirror
Keeping Secrets in Hardware: Xbox Case Study
BS405397 writes "Here is the just released MIT whitepaper on the security holes in the MS X-Box, and for those who are interested, opens up the X-Box pretty nicely." Update: 06/04 17:13 GMT by M : The server appears to be down at the moment. There is a copy of the paper mirrored here. Reuters and other news outlets have now picked up the story, two days after Slashdot.
Doesn't this violate the DMCA?
Mr. Smoove
When the xbox first came out I wondered about the security holes it would have once they rolled out the internet service. Does anyone know if it is setup in a way that it can receive software updates?
Hacker Media
Here is the guys website (bunnie), with a ton of other hacking information not in the whitepaper.
He also has an alternative link to the paper.
the byproduct of years of oppression by the white man
Inconceivable!
I quote from a posting to XBOXHACKER that quotes "I did the work in february, but it took about three months to get it positioned and cleared with both MIT and Microsoft."
I guess that means the DMCA was not violated although the posting mentions that Microsoft intend on addressing these 'holes' in future revisions of XBOX hardware.
[)amien
While the rest of the world waits for the site to come available...
Let's all go to the lobby,
Let's all got to the lobby,
Let's all go to the lobby...
To get ourselves a drink!
you don't have to outrun the bear, just the slowest person in your group.
Hopefully, this is yet one more step in fully hacking the X-Box (can't tell because the site's been /.ed)
And I don't meant the usual Playstation-like hacking. I couldn't care less about not having to pay for games...
What I can't wait for are things like a DiVX player (DivX movies on TV!), Linux -> and with it all those wonderful applications, DVD Movies without the hardware adapter, etc. and all of this for only 200 bucks!
Many Dreamcasts were sold because of their hacking potential...just imagine what an X-Box is capable of! This, more than any reason, is why I'm hoping the X-Box pulls through and "makes it" among the video game platforms...
That's pretty impressive, guys. How big is that PDF anyway? I timed out with 7 replies showing.
First of all, do you spumrags even bother trying to read the links or getting some context before you go off half-cocked? Obviously not. Your message would be better informed if it said "Frost Pist Bitches!"
Second, it should be obvious to anyone with 2 working braincells that the security problem facing the XBox is not network security but instead security against the local user. Particularlly, preventing them from booting non-approved software.
Reverse engineering is legal under most circumstances. Prohibiting it would create a new form of intellectual property, which, unlike patents, would not have to be disclosed. Trade secrets are limited in scope; trade secret law is mostly about disclosure by people authorized to know the trade secret.
the "security holes" this paper are about refer to the authors techniques for breaking the protection of the "secret" boat loader that MS employs.
it's just his take on where the security could have been improved. all in all MS looks to have relied on the security through obscurity approach (hiding the true boot loader behind a dummy boot loader), just that their obscurity fails when you monitor traffic over a bus with a simple card.
PS: dreamcasts and playstations have always been hackable, as is the xbox, no real surprise there.
I have two answers to this.
1) Sure. Would you want some script kiddie to delete a saved game you've spent many hours working on? While it wouldn't be the worst thing in the world, it would be frustrating.
2) Microsoft intends the XBox to be the first of a larger presence in the family home. Imagine when everything in your house runs through the XBox (or similiar device) as MS ultimately envisions. Would you want B1FF to be able to get control over your home security system? Your climate control? Banking info? I wouldn't.
I like this part about MS guy:
The speaker at this talk also indicated that the kernel on the Xbox is a much-stripped-down Win2k derivative (from 12 MB to around 23kB).
(from their website)
He frequents the Xbox hacker msesage boards. Heres what else he had to say about Microsoft in this post...
... hmm...patent search turns up nil on the Xbox...guess we'll just have to reverse engineer it. (FTR, Nintendo has patented what looks to be the entirety of the N64 console, thus perchance making reverse engineering an N64 illegal--not yet court tested.)"
"To answer some specific questions:
no, I will not publish the encryption key or the boot block. That's Microsoft copyright material, and I respect their copyright.
Microsoft is not particularly happy about the paper, but they seemed to concede that well, reverse engineering is protected by law, so there's nothing they can do about it. Let's hope they don't change their opinion...they've been known to go back on their word before. "
also, from his website...
"You are actually allowed by law to reverse engineer copyrighted code so long as it is necessary to discover the ideas or functional elements behind the code (still, I'm not allowed to post copyrighted code for free distribution). Hey, microsoft...what are the ideas and functional elements behind your BIOS ROM?
the byproduct of years of oppression by the white man
...that we will be able to play NetHack on the xbox?
This post will enter the public domain 70 years after my death, unless Disney buys another extension.
Yeah, who would want a $200 general purpose computer wiuth built in ethernet and DVD capability? I mean, what are you going to do, get a keyboard working and have a $200 Linux machine that's comprable to most $800 boxen? Or get it to run DivX movies? Or network 5 of them into a $1000 Beowulf cluster?
It's not a gaming system. It's a computer that's been artificially limited to gaming. People want to break into it to remove those limitations, so they can have a very cheap, fairly powerful and flexible computer system.
The article -- the whole console hacking phenomenon -- is not about people breaking into your Xbox of ther internet. If you had read the article, you would have seen that it's about hacking the box to be able to boot custom code. There's no question of "reinstalling a few games" unless someone breaks into your house, reprograms the flash ROM in your Xbox, and turns it into a Linux machine.
-b
OK, I've skimmed the PDF, and while the words "security holes in the XBox" in the article may lead you to think about traditional software buffer-overflow-I've-r00ted-your-box types of security holes... this article is about HARDWARE!! The PDF talks about hacking the hardware and getting around the encryption on the bootloader to be able to load your OS of choice, for example.
Meanwhile I'm reading posts from people who are nearly soiling themselves afraid to plug their XBox into a network for fear of being r00ted. What a joke. I bet when michael saw the words "XBox" and 'security hole' in the same sentence, he became so excited and nervous that he could hardly move his finger to click the button on the mouse. Sheesh.
I got a grudging thumbs up, so to speak, from Microsoft on my Xbox reverse engineering work
I think I'd much rather he post what must've been a very entertaining conversation with a Microsoft spokesperson than the bios to the XBox.
I wasn't aware security was a big issue in gaming consoles.
It never has been, because:
a) Most systems only kept data related to the game in a very limited space. (On a memory card say or a cartridge its self in the past) - the X-Box is fitted with a hard drive, so there is access to alot of data beyond the scope of individual games since all the data is likely to be in one place.
b) Once you hook something up to the internet, (Which the X-Box plans to do, or at least a network of some kind) then it opens the door to the data stored on your system. This also means that as well as game data, users are likely to at the very least have emails stored on their systems.
I saw the light at the end of the tunnel... But it was just someone with a flashlight bringing more work.
In case you didn't know already, MS is selling Xbox's at a huge loss. Much to my suprise, MS did not get to it's current position by losing money like this. They're planning on making up the lost money by having a sucessful console that sells tons of games and makes up the money there (Sega anyone?), so I believe the "security holes" might be referring to little snafu's so you can put a different OS on it. Because we all know different OS won't run the games. Every time someone buys an Xbox hoping to turn it into a hella cheap PC, MS loses their money on that machine for good, because that person won't be buying any games for it.
A lot of the security features talk about rom encryption, flashing it with a new bios, accessing the hard drives, etc. All of these thing make it more difficult to turn it into a cheap PC, and supports my theory as stated above.
So no need to worry about DDoS or lost savegames. This is about playing unauthorized games, making a DiVX player etc.
Let's face it, who could resist the idea of getting a cool computer while at the same time losing Microsoft money? It's a fab idea!
Security is a huge issue in gaming consoles, particularly as they become similar in capability and more competitve with each other.
It's widely agreed that the making or breaking point for any console is the software library available for it. Console makers therefore spend a lot of time, money and effort attempting to win over software developers to their platform.
And regardless of how enticing an offer the developer receives, developers need to sell software to stay in business. The main advantage of the console market (as opposed to the PC gaming market) is that the platforms are closed and proprietary, and (ideally) make piracy virtually impossible without modifying the hardware. The main problem with the security holes isn't that malicious users can compromise a user's data; the problem is that even casual users will be able to pirate games.
This prospect scares the living hell out of developers, and rightfully so. Witness the demise of the Sega Dreamcast, which occurred a surprisingly short time after someone figured out how to boot CD-R's on the console.
The bottom line is that developers won't produce for a platform that facilitates piracy. That is very bad news for Microsoft, particularly in light of their bleeding money out of each console they sell.
Microsoft, not content with just SOFTWARE security holes, has now moved on to HARDWARE security holes.
I read that article and found it very interesting. It seems there's always a weakness in any security system, and a clever person with time on their hands can find it.
But then it hits me: this "security" is to keep THE OWNER, the PAYING CUSTOMER, out of the product he bought. This "security" doesn't protect my family, me, or my possessions from absolutely anything. It serves no purpose except to make work for somebody at Microsoft and then somebody at MIT. If they left it out, they'd save both parties a lot of effort. I'm sure someone will build on this article and figure out how to easily run arbitrary code on the Xbox, and so the security will be a total waste. So why is it there?
I would think that they'd want security in there to protect their trade secrets. If information like this gets out (oops) then people will be able to make unlicenced games, and that would trash Microsoft's console business model.
Does this mean I can hack into .. and upload a patch to display ... characters as completely nude, full-figured women?
No, but it does mean you can fabricate a little circuit board and solder it to tiny wires on the xbox, connect that to a FPGA and custom-program the FPGA to implement data collecting hardware (including a lot of hand-layout effort to make the FPGA able to collect at 200 MHz). It means you can implement a little state machine also in the FPGA to begin collecting at the right time, ignore a false reset pulse, and tag all collected data with sequence numbers of how many clock cycles elapsed between each data transfer and the CPU reset.
It also means you can spend a lot of time to do statistical analysis on the data and compare to patterns from the flash rom (which you presumably already extracted and read with your EPROM programmer). It means that once you've at least figured out which wires were which bits, you can begin wading through millions of data transfers and try to reconstruct an image of the code the CPU executed.
It means you can disassemble that code (remember, found from analyzing millions of bus transfers) and recognize that it implements RC-4 decryption. It means you can write a "brute force" attack to guess all possible 16-byte patters from the image you extracted and see if any of them decrypts the flash rom data to something other than white noise.
It means that, after all that, you have the algorithm and key used to decrypt the bootloader in the flash rom... and then you can write your own bootloader (by extracting the flash rom chip and changing its contents with an EPROM programmer) and make the xbox run your own code.
The author did mention that Microsoft put test points on the board to access the flash rom, so instead of physically removing the flash rom, you could build a "bed-of-nails" test fixture that you'd just place the xbox circuit board into to reprogram the flash rom (don't forget to design your own EPROM programmer in this process).
But as others have pointed out, the author has been in contact with Microsoft and they are aware of the problem, and they intend to fix it in future revisions to the xbox hardware.
So if you wanna pop up nudie pictures in the middle of someone's game, you'd better get started soldering now. Even after you do all this, you'd barely have your foot in the door. You'll need to do a massive reverse engineering job on the bootloader, and then the rest of the flash rom (which is presumably part of the win2k closed-source kernel). Somewhere along the way, you'll learn about the xbox hardware and MAYBE find a game-independent way to overlay some graphics on the screen. Maybe you'll even find some exploits in the kernel itself, maybe?
But to start, you MUST pull the flash rom chip and reprogram it with your own code. Better hurry before Microsoft changes the secret bootloader or even the hardware itself, now that they know of the weakness.
PJRC: Electronic Projects, 8051 Microcontroller Tools
I'm one of the sysadmins at the AI lab - we had a power shutdown in our building last night through much of today, but the site is back up and ready to get slashdotted.
He now understands the boot process, and can mess with it via hardware mods. But he has only the decryption key, which is the public key of the pair. To make a bootable disc, you need the encrypting (private) key, which is nowhere in the XBox. That key probably exists only in a vault in Redmond.
I don't really care all that much about the XBox, but if the RIAA and MPAA have their way, all audio and video equipment will be protected like this.
I guess I am naive here. What is the point of making the X-box or any other game console hard to hack?
I used to believe the old saw that compared game consoles to razors; lose money on the console, make up for it on the games. But I read something recently which seemed (to me) to prove that everyone except M$ was making money on consoles too. So although it might make sense for M$ to prevent hacking for use as other than a game console, why would others do so?
Is it to prevent people from playing ill-gotten copies of games?
Is it to prevent cheating while playing a game?
Is it to prevent reverse engineering of a game?
I guess I just don't get it!
Infuriate left and right
Well, for $400, you can get a Playstation 2 with hard drive, mouse, keyboard, ethernet, and an adapter to work with SOME vga monitors, and a copy of ps2linux. http://www.playstation2-linux.com/
From the paper:
"...it is an error to assume that a secret, distributed along with the information it guards, is never revealed."I don't know about that. It seems to have worked for the Word file format.
Then you have the marketing figures that say that these boxes are flying off of the shelves.
Yeah, but microsoft only makes money on the games / online service. Mircosoft may hype the sales, but gaming companies are still going to notice that the software isn't selling.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
My XBox web server is vulnerable? I guess I'll just have to download a patch from windows update!
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
Actually, while you're right... everyone (besides MS) does make money off their consoles... they also make a lot of money off something else: licensing. In fact, while you can make a pretty penny off your console, the main draw is that you get an even larger percentage from the license royalties off every game your console sells. You only sell one console per person. You sell lots of games.
Naturally, if everyone could write code for a console and burn their own CDs or DVDs, large game houses would have little reason to buy licensed development kits and publishing contracts with their respective console manufacturer, and thus you lose a lot of your revenue.
Interestingly enough, though, in the old days, unlicensed games happened every so often. I recall that Taito reverse-engineered the NES cartridge and put out their own games...
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
It might not be as much as you think.Microsoft recently told shareholders that the X-Box was just only losing 20% of what Sony was initially losing on the PS2. A friend put that to end up somewhere in the $20-$30 range. ...And the SEC tends to get a bit grumpy with companies that mislead investors...
Hopefully, you are a long way from wanting to do such a thing. For $100 or so, you can have a nice Athlon mobo with a 700MHz processor. Buying a used system would be even cheaper. Of course, any other option would be much less encumbered by silly things M$ likes to put on junk, like the serial number he found.
The point is that stupid M$ and others are working to make hardware that the user has no control over but fail. It's just another proof that Senator Holling's wet dream of control of all digital devices can only be implimented by foolish laws. Inailienable rights are those which require vast expendatures to violate.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
You have it backwards.
No, you have it all wrong. The Xbox encrypts the flash with RSA's RC4 symmetric cipher (i.e. not a public key cipher). The remainder of this post is (strictly) off-topic because the Xbox boot process does not use public-key encryption.
The private key decrypts.. the public key encrypts.
In a public-key secrecy scheme, you're correct. But in a public-key authentication scheme, the private key encrypts the hash into a signature, and the public key decrypts the signature for comparison with the hash.
He has the private key. And you can derive the public key from the private key.
No, you can't do that in (for example) RSA.
Will I retire or break 10K?
As was mentioned in several posts, this is bad (for MS) because it may allow two things - non-authorized software development and pirated software. (don't mark me as redundant yet, keep reading :)
That's why Nintendo stuck with cartridges and why they now have a non-standard format for Gamecube games. I am really surprised other console developers haven't done this.... the slight increase in costs to slow piracy is a good trade-off.
Anyone know if it would be possible to burn those mini-dvd's that Nintendo uses?
Robots are everywhere, and they eat old people's medicine for fuel.
Those are all wonderful points, but they all have the same flaw. While you may not allow Microsoft to control everything in your house, 90% of the world is running Windows, and MS is trying pretty hard to get them all to buy an X-Box. The problem is not that you're not going to buy all their products, it's that everyone else is. That's why it's important.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
...even casual users will be able to pirate games.
This prospect scares the living hell out of developers, and rightfully so. Witness the demise of the Sega Dreamcast, which occurred a surprisingly short time after someone figured out how to boot CD-R's on the console.
Unrelated. Think of, say, the mod chip for PSX. Sega had other problems.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
> I wasn't aware security was a big
:-)
> issue in gaming consoles.
Security has it's place in THIS gaming console
a) it's intended to be connected to the internet
b) it has a HDD
imagine someone writes a nice virus/worm with evil intentions (e.g. download a tiny linux distro, and then take over your XBox , store child pronography on you HDD or start a DOS on www.microsoft.com
No. The XBox is a PC designed to work like a console.
Basically it's a PC with these specs:
733MHz Celeron
64MB PC100 RAM
GeForce 2.5...halfway between GeForce 2MX and 3.
8GB HD.
cheap 10/100 base T NIC
non-standard USB (based on 1.1 spec) connections for controllers.
However, for all the efforts to try to hax0r the XBox...and I wish them all well...they are going to have to find a way to make a keyboard work with it. With the tweaked non-standard USB it's not gonna be easy.
Knowledge is power. Knowledge shared is power multiplied.
Amazing!
Don't piss off The Angry Economist
He does far more than reverse-engineer the XBox. Read this guy's project list. He's cranked out an incredible list of hardware projects. His own RISC CPU. A DES cracker. A controller for a midget submarine. An all-new design PBX for his frat house. Keyboard pedals for EMACS. A Linux-based computer that fits in a Star-Tac phone case (in progress.) Plus he's in a fraternity, plays guitar and violin, and has a blonde girlfriend. And all this while doing a thesis at MIT.
If there were a way of loading GNU/Linux or one of the BSDs onto the X-Box, you'd essentially have a working computer system subsidized by the company currently doing the most to harm free software.
Ironically it might even keep the platform "alive" for the users. The business model for the X-Box is screwed, and based on what MS *thought* other console manufacturers were doing rather than what they really are doing. Sony and Nintendo, and Sega for most of its life, sell consoles at cost, and make profits from the games. Someone somewhere decided that "at cost" meant "at a loss" and Microsoft thought that the success of console manufacturers apparently using an "at a loss" business model meant they could potentially succeed at it too.
Sega switched to the "at a loss" model, largely through desperation, and the consequence was that Sega became a publisher, not a manufacturer, because it couldn't subsidize the consoles, it didn't work. Microsoft may have deeper pockets, but few companies will chase an unrealistic business model just for the sake the chasing it, and Microsoft is left with a choice of continuing, and not gaining anything; selling the X-Box at cost in which case it will be substantially more expensive than its competition and probably will not achieve the type of market share Microsoft wants for it, or to drop the project for now and come up with a better idea.
Given Microsoft's past history, I'd say the last of these options is the most likely. This leaves current X-Box users with machines that will be quickly seen as "obsolete" and "unsupported", and while Microsoft will doubtless try to cut its losses by supporting them, I suspect it'll be more and more difficult to get X-Box support through means other than mail order as time goes on.
A project to open the X-Box, and turn it into a real PC, which is what getting the Linux kernel running on the X-Box could achieve, would help the end users, even if it wouldn't help Microsoft.
You are not alone. This is not normal. None of this is normal.
Xbox Live might be a closed network, but I doubt the internet protocol in the xbox forces it to work only on the Xbox Live network. I'm sure someone can write software that'll let Xbox browse the web, which means Xbox can connect to any site on the internet, which means it can participate in a DDoS attack. It's not like you get a special line installed that is directly connected to the Xbox Live network and not connected to anything else. It's still connected to the internet, so it can attack anything on it.
That's not really true. For legal reasons. You think people couldn't crack the original Playstation? Even if they could, people couldn't just ship playstation games without paying royalties.
No, don't confuse hw mammals with networking mammals. sha-ish
Sure - but one could easily argue that its main purpose is to keep pirates from running unauthorized (copied) programs on it
and to keep developers from building their own executables without real dev kits (and depriving ms of royalties)
and it keeps game hack systems out - like the gameshark and the codebreaker like devices from running.
And before you bitch and moan about MS being a bunch of bastards - almost every game system that ever came along has had some system to keep developers, hackers, and users from explointing the technology inside. Even Atari was that way - mostly through Atari not releasing all the specs for programming it so their games could look better in comparision - and they sued the first company who dared defy them (I think it was sierra).
I bought two of them, and they gather dust.
Why? Because Microsoft looses money on each sale.
I am confident that there will be a mod-chip for the
X-Box long before they are worth less than the $200
I paid for them.
-I like my women like I like my tea: green-
Then you have the marketing figures that say that these boxes are flying off of the shelves.
:-O
I disagree, I expect that if every slashdotter and their dog boycotted it still wouldn't make a dent in the sales figures. Most people couldn't give a shit about whether MS has a monopoly or not, these pwople will buy the xbox if they see it can run shiny new games.
Game producers will jump on the xbox bandwagon when they see the sales figures for the current games, not the sales figures for the xbox. Personally I'd pick up a few xboxes if they could run linux, turn them into a dvd/divx/mp3 player, whatever I felt like at the time. Come to think of it my dad needs a new PC, he's still got a P100
He who defends everything, defends nothing. -- Fredrick The Great
http://www.xbox-scene.com/xbox1data/news-archive-1 7-3-2002.php
Interact is putting this out. News bite is buried almost at the bottom of the page.
Knowledge is power. Knowledge shared is power multiplied.
Modifying a console entails a significant amount of risk, money and effort.
Gimme a break. You can get it done on a street corner for 20 bucks cash. I don't know a single person with a Playstation who hasn't gotten a mod chip.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
So it's possible? Sick!
// The fastest Alt-Tab in the West
Not that id would really say anything else, even if it had been cracked.
They sell that protection, along with the engine. If they said someone had figured out how to beat it, it wouldn't be worth much.
But, people have beaten it. There's a patch that makes a server not request checks from connecting clients. It was written to let anyone play but it has the side benefit of reducing that annoying lag that everyone notices when someone connects to a server.
I don't know if anyone has defeated the whole system yet, in such a way as to allow for the creation of a new serial number that is valid, or appears valid. It's fairly likely though, because you could either generate the rest of the numbers (possible if they weren't careful to hash them after generation and used a less than wonderful PRNG) or crack the key server and grab the master list. Or likely one of a few other ways.
Would id even be able to detect this, if it was used by a small (1000-5000) number of people. They get a duplicate-key message all the time, when someone connects to a server, disconnects, and joins another. And I know people who succesfully use one key on multiple computers. As long as they join a server a few minutes apart they're fine, supposedly even on the same server.
But in the end, the system is weak in the worst way. It's VERY easy to DoS it out of service and when the server isn't reachable they servers prevent anyone, anywhere, from playing, instead of allowing everyone. Would you buy a game that would refuse to let you play based on something a master server said? I wouldn't. I've played Q3 a few times at LANs, but I'll never spend money on, or even install, a game that I don't have control over.
Actually, the CPU is (usually) what does the decrypting, so there's no reason why data over the memory bus needs to be decrypted.