Slashdot Mirror
Security Concerns When Consoles Go Online?
VonGuard writes "I've written an article for Security Focus about the security concerns that having an Xbox or Playstation 2 on your network might raise. The article, entitled Welcome to the Jungle was an interesting experience to write. I really think that Sony will end up having some trouble from their stance on third party security design, while Microsoft might end up smelling like roses. Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio."
someone just hacked my game of gta3, i lost my saved game. oh damn.
People on this site always have to get in their Microsoft bashing. It is pretty shameful. Why can't you just make do with what is out there? That article had nothing to do with the Nimbda virus, but the poster had to throw it in there cause Microsoft didn't look bad in that article. Awful.
Come on. This really looks childish. That's an irrelevant story. Just let the facts speak for themselves or you lose credibility.
I used to bulls-eye womp-rats in my pants
Its interesting to note that in this case the closed network MS have been building for X box might be the best thing in the circumstances as it should prevent DDOS usage of the things.
but is this really going to be a major issue ? in reality how much time will these boxen spend on line when not playing games ?
have MS written in code to the os to identify what is and is not and X Box for example? and what about servers - can they be run ?
Thought provoking.
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
"Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."
Now I try not to MS bash but come on this just seemed funny to me that is all
man
No manual entry for
X-box will have better security you say? Right... man, I can't WAIT till consoles are on line... I love laughing at security holes in all the crap I don't use, or know how to use properly.
m l
X-Box was already cracked. It didn't get much press covereage... Eweek did a story, here's the reg's:
http://www.theregister.co.uk/content/3/25568.ht
People are going to hack their consoles. Hell, the first thing I did with my TiVo was to take it apart. Don't think I'm not tinkering with my xbox, it's potential as a cheap Apache webserver or slave in a rendering farm begs experimentation.
It's good that Sony is supportive of the curious developer. It means their platform will spread wider. At $199 apiece, there's no reason not to mod consoles.
I don't doubt a lot of consoles are going to be 0wn3d. Whether it's Microsoft first or Sony will depend on the hobbiest - or on a corporate uh-oh. After all, Microsoft did ship Nimda to Korea with Visual Studio .Net. I'm not crazy about Microsoft's decision to close their gaming
community, but I'm not surprised either.
Blizzard does the same thing (and are villified for it). But I'm less troubled by Blizzard's motives than by Microsoft's.
http://web.mit.edu/bunnie/www/proj/anatak/xboxmod. html
There's an Xbox mod. How long before kiddies start buying mod kits that have holes (as if there aren't holes not yet found.) Another poster asked how often consoles will be online while not playing games... why couldn't a trojan take up bandwidth while a game was being played? And with broadband, they'll likely be left on. No, the internet is a dangerous place and you don't have to be named Gibson (www.grc.com) to be paranoid.
. This sig unintentionally left blank. I meant to put something here, but I'm busy.
Yeah right, try shrugging it off when somebody deletes your Phantasy Star Online characters after 50 hours of gameplay (this actually happened to many many people playing Sega's first online RPG).
Good points and i was wondering about it - but the issue is present with every console isnt it..?
And the broadband applies to the states but what about other countries ? in Australia at the price of broadband i cant see many people getting it just for their X Boxen.
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
Isn't that how it works with PC Gaming? The security of the game and ultimately the PC lies in the hands of the Game developers and things for the most part work out "O.K".
The same methodology for the PS2 will work. "Why Fix it if it ain't broke". If a PS2 Developer House wants their game to flourish online they know they will have to do their best to curb cheating and most certainly avoid security holes in their games at all costs.
I fail to see how having Microsoft hold all the cards for the security of the XBox is a good thing. That's how it is with their OS and well... look at it.
Power to the Third parties!
Microsoft decided some time ago that the best way to create a good online gaming experience for a console is to maintain a console's three biggest advantages over PC gaming.
No Cheating
No Viruses
And no Cheating
Cheating in online games has reached such epidemic porportions on the PC that many have given up on it completely. Others just slug it out and learn to deal with it.
Microsoft wants to offer 3rd party mods and the like to its customers. Since they get a cut of every game sold for the Xbox, it makes sense for them to freely distribute mods that increase the value of the games and the console. But they want to check to make sure the mods aren't buggy, virus infected peices of shit that are going to screw up a few million Xboxes.
They want to take all the mods, pour over them, check them for cheats and viruses then let you d/l them. All the while monitor for cheats in use.
If they can do it, more power to them.
If not, the Xbox is in trouble.
I give them 50/50 odds.
I'm sure a lot of people are like "OMG, Microsoft, evil, evil evil! They can't do anything right!"
Well, they are evil (so are Nintendo and Sony in their own ways) and they do screw up more than they succeed. But they do have divisions which score a win on a regular basis.
The Macintosh Business Division was created when it became clear that teaching some Windows guys the Mac's APIs and sitting them down to port Word or something was a complete disaster. A small team of people who Knew What They Were Doing sat down and without interference from the rest of the company, were allowed to do their own thing.
The result? The versions of Office, IE, Outlook and other Microsoft apps are lightyears ahead of their Windows counterparts. They pick up the latest APIs and exploit them before anyone else. Their products tend to be stable, well-thought out and actually useable.
How has the community reacted? The MBU averages 1 Billion+ dollars in revenue every year.
Could the X-Box division do the same thing? Yes
Is it too early to tell? Yes
Does it look promising? Yes
They've already made a number of good decisions with the Xbox. Excluding the bizzarely unreliable store models, they are stable and reliable machines that can be left on for ages. The hard drive didn't bring patches for games, but only free expansion discs, personal game soundtracks and the end of memory card hell. The money I've saved in memory cards has nearly paid for games I own.
The breakaway cables have saved me about half a dozen destroyed Xboxes.
The DVD kit saved me when an out of warranty DVD player turned to crap.
The Xbox has some issues, but it doesn't have the "too many hands in the pie" problem that Windows and the PC versions of IE, Outlook and Office do that lead to bloat, instability and security problems.
They can make it work. It's their call wether they do or not
can be found at news.com and of course there is that little article I wrote for Game Developer (which has already been covered twice here) at gamasutra.com
-Matt Pritchard
Just about ALL games that combat online cheating have to do so through online updates. With these consoles still largely running off their read only media, attacks on them are likely to last longer than with their PC counterparts. I'll stick to my PC games, thank you very much.
[donning flamesuit] /. - sometimes it's deserved and sometimes it's not. Mostly the former.
Yeah, there's a lot of Microsoft bashing on
MS touts it security while its insecurity stands frozen in the stark daylight. It's kind of like trying to be all suave and debonair with your fly unzipped. It's funny.
Now I'm all for using the right tool for the right job. It just turns out that Linux is cheaper, breezier, and more stable most of the time. For LAN parties, it's Windows 2000 hands-down. For console gaming, I like the XBox - mostly for its hacking potential. But I plan to get a Playstation 2 as well.
Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio.
.NET team does something poorly, they deserve to get slammed. But the Xbox team does not need to hear about the mistakes of the .NET team. You wouldn't say that the Playstation 2 sucks because Sony supports copy protection on its CDs, would you? That was un-called-for.
Now, wait a second. These are two completely unrelated parts of the company. If the Xbox team does something well, they deserve praise, and if the
Lack of eloquence does not denote lack of intelligence, though they often coincide.
You know, it almost seems that Micro$oft might be coining yet another totally ambigous term to be used by the all-knowing press when discribing 'computer things'.
It reminds me of the wonderul unit of measurment we have come to know as the 'Library of Congress' that renders such wonderfully discriptive stories such as:
HEADLINE - 1000000GB Ethernet spec being reviewed!
Transfers 4324231124 LoC's per / second!
Or maybe the use of number of songs an MP3 player can hold....(instead of MB of storage)
Just makes me want to find out exactally what this 'military grade security'. Just remember, they didn't bother specifying which military. If their idea of militrary involves a bunch of monkeys, then it might not be so good...
Yes, I know its off topic but I couldn't help myslef...
Still, I hope they live up to their claims for the sake of the net. After all, they've come a long way since they couldn't get "ping" right (eg. the ping of death attack which could bring a server down with one command).
Waking up one morning and finding out that you XBox which you left online playing HALO was turned into an FTP server, by a couple of script kiddies.
"It takes many nails to build a crib, but one screw to fill it."
that the news.com article focuses mostly on the "cheating" side of the problems and barely touches the more general purpose "hacking the console game via the new".
However, if you hack the console, cheating is a automatically a problem by definition.
It's interesting that the definiton of online cheating has expanded to included a myraid of things a person can do disrupt the game, host systems, or even the network connections of other players. All that seems to matter is hurting another player in some way.
Console systems will be vulnerable to the standard problems (buffer overflows, poor design, etc), but just how much can you loose? On the Xbox, it will be necessary to save executable code to the hard-drive to make a hack persistant, and I'm not sure that a game currently running is even allowed any access to those paritions. On the PS2, what if the hard drive isn't even present? Just reboot and reset.
On the flip side - it's a royal pain to patch a console game. You have to issue new disks.
-Matt Pritchard
They say it's not such a big problem, because a hacker could only either cheat in an online game, or perform a DoS attack on the user. "If someone hacks you, shrug shoulder's, hit reset. You've only lost time."
But the real problem is that eventually these consoles will also serve functions other than just gaming. Both Micros~1 and Sony want your living room for more than games, they want to provide other services such as movie/music downloads, general web surfing and online commerce.
That means that the HDD (standard in Xbox, optional in PS2) will contain potentially valuable information, such as content you've downloaded, or maybe your CC number you used to buy the extra content in the first place. So if hackers could get at that data, they're potentially ripping you off.
While this problem exists on PC too, consoles are an easier target because each one has exactly the same OS (non-upgradeable/non-patchable). If game Foo comes out with some vulnerability that allows hackers to access the contents of the HDD, then the game developer won't be able to send out a patch for Foo...
Yeah, I'd be worried.
lets take the track record for Asheron's Call, currently microsofts highest premium on-line game. If you are looking for an example of MMORPG where massive cheating and hacking is allowed this is it. While developed by an outside company, which created a great game, Microsoft controls the rules and Code of Conduct. Microsoft could careless about the cheating and does minimum amount of taking care of people who just play to cause problems for other people. Thing is thier is no reason to believe that microsoft will change with the X-Box network. Based on microsoft's current track record thier is no way I would purchase an x-box for on-line gaming and believe that microsoft will take care of the security, hacking, and just plain trouble making people.
Yea. It looks childish. But that doesn't mean the event has no relevance here. Let's look at this a bit deeper.
Data integrity is often one of the goals of an organization's infosec posture. This is more than simply ensuring the data is not improperly accessed and is available. It is also ensuring the data has not been altered without authorization.
In this case, Microsoft's data being offered to its customer had its integrity violated. Malicious code made its way in to an external distribution; not obscure code but a well known virus. Now, Microsoft is not the only one to suffer the embarrassment of distributing a virus. But it does highlight a breakdown in Microsoft's internal infosec practices. And that comes at a very inopportune time for Microsoft.
So the question would then be - how does this apply to the security of the XBox? Microsoft has a long history of troubles not only with security, but an almost arrogantly blatant disregard for security practices and concepts. This has eventually backfired on Microsoft and they have been faced with a growing PR issue. The answer to this situation has been Trusted Computing - a bottom-up change in Microsoft where everyone has been trained in infosec concepts and practices. If Trusted Computing pans out, Microsoft's security woes are behind them.
The cynical in the infosec / IT industry have already noted that they've heard this song before. Microsoft's PR and Marketing departments constantly promise security - especially after incidents that focus on MS products. Furthermore, experienced infosec workers know that addressing infosec issues often requires a complete change in methodology and outlook. And this translates in to changing Corporate culture. Microsoft may be nimble, but this change may be too demanding for even Microsoft to accomplish.
The relevance of Nimda appearing on a Microsoft software release is the question of whether this incident was a simple embarrassment or an indication of a continued lack of understanding for infosec issues within the Microsoft culture. And that certainly has a bearing on the question of Microsoft's concepts of information security and the XBox.
The other issue is that somebody might figure out how to crack these boxes from afar (and, because they're all identical, once you've got one you've got them all). Now, people don't keep commercially-sensitive data on them, so the worst that can happen from the owner's POV is that the box is rendered unusable and they have to take it back to the store. However, they'd make a really good place to run DDoS's from.
The best way to make this harder, IMHO, would be to require people using these boxes to use special broadband connections that have been firewalled upstream to let only let normal traffic in and out - nobody should be trying to establish connections with these consoles, and the only things they should be trying to connect to are the game servers. Anything else should be firewalled off. The firewall would presumably be carefully monitored.
One wonders also whether game code runs "as root" on the XBox. Obviously such code should have direct access to the video hardware, but whether it has unfettered access to the file system is another question. Surely it's possible given the restricted functionality available and given an unmodified XBox, that only code signed by Microsoft can alter certain key files? (In other words, avoid "local root exploits" in services runnable by game code). That way, even if a game has a buffer overflow or the like in its network code, nothing too serious can be compromised and the problem presumably goes away on power-cycle when the whole game is reloaded fresh from DVD.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
... this will be an intersting experiment.
Can anyone remember when in Internet history this many nodes have gone on-line in such a short period of time?
I don't know what sort of bandwidth these games will require, but what if any effect will there be when potentially hundreds of thousands of consoles start accessing the 'net within a period of a few days, on top of the normal growth?
Article X: The powers not delegated... by the Constitution...are reserved...to the people
From the article:
"I don't always cheat. I'm pretty good playing straight," he insists. "Cheating makes me a god."
Ok, if you are "pretty good" playing straight, why cheat? Seriously. It's a game. People cheat all the time, but I for the life of me don't understand the need to have an edge like this.
IMO, part of the fun is seeing how you truly match up against people and watching yourself progressively get better. This I feel like God crap is worthless. Besides, doesn't he get tired of it?
I know there will be plenty of people saying it's just human nature to do this, but really, is it? The vast vast majority of people are not like this, so what causes people (in Counter Strike and other online games I mean) to do this. Notoriety? Fame? (It's a fucking game!) Fortune? I don't think so.
I guess my final take on this is yes, he may indeed think he is a God, but all he is doing is cheapening himself in the eyes of people like me. And I believe there are a lot of us out there. Do unto others as you would have them do unto you.
Sent from your iPad.
its linux and you need to secure it as any other box
No, you don't. You might want to patch or disable some of the buggy programs that are distributed with it, but Linux itself (the ekrnel) is fairly secure. Probably more so than any other OS kernel (well, apart from some things like Solaris maybe), due to the amount of people and experience put into it.
Follow me
In fact, this looks very much like the Unix-Windows security arena. Unix has been traditionally open. All the protocols are open, and, especially, the implementations never assume that they know who or what is on the other side. This, in fact, is one of the critical aspects of security. Never trust the remote. Ever. Always assume that things can be spoofed, always assume that all and every piece of data you receive has NOT been validated by the remote. This is the Unix way of doing things. This, in fact, is the right way of doing things.
Alternatively, you can start "trusting" the untrustable. You can build a single platform network and assume that all data sent from the remote is "good data". This is naive, and leads to disaster.
Remember the "ping of death" vulnerability that existed on Windows machines: why did it exist? The simple answer is that it was there because the ICMP stack was badly coded. Right. But that's only half of the story. In fact, it was there because of Microsoft's way of thinking. Microsoft always assumes that things are under full control. The ping of death vuln existed because the Windows version of "ping" did not allow for larger-than-a-given-number packets to be sent. And the Microsoft way of thinking is "if the client can not send it, the server can neglect checking for it". That way of thinking has lead to many of the security flaws in Microsoft products.
The truth is, things are not always under full control. The XBox can be hacked locally, changed into allowing modifications to be performed on the "Microsoft trusted" software components. Other kinds of machines can be connected to the network and made to pretend to be XBoxes, while still allowing full control by the owner on what gets sent and to where.
In short, by choosing to create an "XBox-only network", Microsoft has taken the step that will make its network fundamentally insecure. If you still can't see why, think of it in the Disneyland way Microsoft suggests. What they are in fact saying is that "since the Disneysoft is secure, you can trust everyone there". The things you normally tell kids to do, like "never take candy from strangers", are no longer in effect inside the Disneysoft. Inside Disneysoft, you can take candy from anyone. What is the rationale behind this?
That "bad people" can't go inside? Wrong.
That "bad people", once inside, can't give you candy because "giving candy" is not an option? Wrong - if you own the box, everything is an option.
That if "bad people" do this, they will be expelled? Sure. They can expell all they want. That won't prevent them from coming back, and it certainly won't prevent your kid from being dead.
A last thought: People go around saying "what can happen? someone steals your save game? so what?".
Well, on one side, the XBox is being touted as a future "computing/internet/browsing platform". That means all kinds of sesitive information is going to get stored in its hard disk. And while having your save game stolen can be little more than a nuisance, having your personal data, personal files and credit card information stolen can be a bit more serious than that.
On the other side, the XBox has a network adapter. And guess where it is going to sit? Right on your home network. Together with your PC. Together with your other local devices. Probably inside your firewall? Great target for a hacker to attack and, from there, jump on to your private network. Sure, you can always firewall it, put it on a DMZ. Sure... Microsoft does not have a good security record.
free the mallocs!
eweek is linking to a report (PDF format) from a student at MIT detailing how Microsoft is using a hardware-based encryption key in the Xbox. The bad news? The key is identical in every unit.
"For every right, an equal responsibility..."
Everyone seems to forget that XBoxLive is a subscription service. How about I hack your box and steal your password? Now I can play as you.
Even worse when MS truly implements passport as a "single sign-on" service.. then I'll be able to become you wherever there is passport. Perhaps I'll log in and place a few bids on ebay for you.. you did want a gamecube and PS2 didn't you? Well guess what lucky bidder, you just paid $800 for them!
From the linked article:
Closing their service to outsiders increases the security of their system overall and "prevents hackers from scaling beyond one machine," the company claims. "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."
So they couldn't make their OS with mititary grade security, but their game console is good to go? Yeah, right.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Security is one of the reasons Microsoft is building its online service as a closed, Microsoft-only system.
'Cos for sure no one has ever made a clone of battle.net or Everquest
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Could I read just one article on Slashdot that doesn't rehash Microsoft bashing (the Nimda thing) that's old news?
I'll stop bringing it up when I get less than a 200 Nimda attempts a day on my server, OK?
Now for the coup de grace. Apache finally gets an exploit. Assuming unpatched on 32-bit Linux or BSD, he will get more trouble from the Nimda attempts than from Apache attempts. (Windows and 64-bit UNIX do need to be patched.)
Section E of the warranty (page 18) says "Exclusions from limited warranty. This limited warranty shall not apply and Microsoft has no liability ... if the Xbox Product:" ... (section E5) "is damaged by programs, data, viruses, or files, or during shipments"
Not that you'd ever get one with the military grade security, but it's reassuring that Microsoft has no responsibility to do anything...
HIV Crosses Species Barrier... into Muppets
How is that not an update?
"for a situation where a new kernel has something you need but dont have... you dont ever need to recompile your kernl if everything works ok..."
That sounds exactly like an update to me. You had no need to update windows if 3.11 had everything you needed.
I'm sure the security on the X-Box is up to the military standards of say, Tuvalu or Somalia.
Think of ring 0 as the hardware version of root priveledges. Infact, the software protections that enforce the system security policy would not be possible without all of the user's code running outside ring 0.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
Closed global broadband network. Bwahahahahahahahaha!A HAHAHAHAHAHAHAHAHAHA!!!
Bwahahahaahahahahahahahahahaha!
BWAHAHAHAHAHAH
Contrary to the popular belief, there indeed is no God.