Slashdot Mirror


Lindows CEO Funds XBox Hacking Contest

Kai writes "PCWorld.com recently posted an article on how Lindows CEO Michael Robertson is funding the 'Linux on XBox Hacking Challenge'. He was previously annonymous donor who donated $200,000 to the project. His donation will be split in to two prizes, one to who completes part A of the challenge, and the other to the who completes part B. Part A, running Linux on the XBox, has already been completed, but Part B, running Linux on XBox with no hardware modifications has yet to be completed. Part A of the challenge can be downloaded from Sourceforge." Without a bios change, it seems like part B might be a bit tricky. T. adds: Tricky, but not hopeless. Eric C. writes "The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software."

269 comments

  1. Oh that's swell.. by Anonvmous+Coward · · Score: 5, Interesting

    The guy funding the Linux XBOX project is a direct competitor of MS. Kinda cheapens the whole thing, duddn't it? At least that's how I felt.

    I mean, if it works it works. But his motivations place him at MS's level.

    1. Re:Oh that's swell.. by NanoGator · · Score: 2

      "The guy funding the Linux XBOX project is a direct competitor of MS"

      What I'd like to know is why he's putting up 200k as a reward instead of just funding some people on his own. He could hire 4 engineers for a year to do that. Heh maybe he's sick of litigation.

      --
      "Derp de derp."
    2. Re:Oh that's swell.. by kasperd · · Score: 3, Insightful

      He could hire 4 engineers for a year to do that.

      But that would not give him any guarantee of reaching the result. By putting up the reward he will only have to pay if he gets what he wants.

      --

      Do you care about the security of your wireless mouse?
    3. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "What I'd like to know is why he's putting up 200k as a reward instead of just funding some people on his own."

      I wanna know how he can get away with encouraging people to violate the DMCA.

    4. Re:Oh that's swell.. by ideonode · · Score: 1

      a direct competitor

      Well, what did you expect - some entirely neutral benefactor who had no ideological or commercial bias against Microsoft? Of course the guy funding XBOX Linux is going to be 'anti' MS in some way.

    5. Re:Oh that's swell.. by Troed · · Score: 1, Flamebait
      The DMCA has no jurisdiction outside the US.


      You do know there are other countries except US, Afghanistan and Iraq, right?

    6. Re:Oh that's swell.. by pediddle · · Score: 1

      Did you pull that out of your ass? They are not cracking any "copyright protection" schemes, in that they are not cracking anything in order to copy the software. How does this fall under the DMCA? Yes, I have read the actual text of the law.

    7. Re:Oh that's swell.. by Jay+Carlson · · Score: 2

      I don't think it's cheap at all. Consider it this way: he's paying to open the hardware platform up for software platform competition. The stereotypical Evil Company would keep the ability to run 3rd party software on the box to themselves; he's willing to let the world have it.

    8. Re:Oh that's swell.. by blibbleblobble · · Score: 2, Insightful

      "I wanna know how he can get away with encouraging people to violate the DMCA"

      You consider it immoral to try and run the software of your choice on one of your own computers?

    9. Re:Oh that's swell.. by rmohr02 · · Score: 5, Insightful

      Technically the DMCA shouldn't apply in other countries, but US courts claim jurisdiction over the whole world.

    10. Re:Oh that's swell.. by sporty · · Score: 5, Funny

      And New Jersey.

      --

      -
      ping -f 255.255.255.255 # if only

    11. Re:Oh that's swell.. by Randolpho · · Score: 2

      Hates Microsoft? This guy has a history of leeching off Microsoft technology and this contest is just another example. I'd say this guy *loves* Microsoft. Without Microsoft, he has no product.

      Microsoft is the big fish. Michael Robertson is the lamprey attached to it.

      Incidentally, I submitted this very same story to slashdot last week, when the story first ran on CNN, and got it rejected. Go figure.

      --
      "Times have not become more violent. They have just become more televised."
      -Marilyn Manson
    12. Re:Oh that's swell.. by abe+ferlman · · Score: 2

      That's the thing about Microsoft getting into the hardware market though - now EVERYONE is a competitor with Microsoft.

      Someone pointed out to me yesterday that Sony's attempted buyout of Intertrust and its patent lawsuits were really just an attempt to get Microsoft to stay in the software yard and stay out of the hardware business.

      This is very similar- Lindows just wants a fair chance to compete on commodity hardware- instead of having to fight monopoly rents on proprietary hardware. To sink to M$'s level he'd have to first establish a monopoly then start sinking his warchest into strongarming the hardware market first through consoles (phase 1) then eventually through a ubiquitous computing strategy (phase 2), resulting in phase 3 (profit)(world domination)(benevolent dictatorship)(pick any two).

      Nothing cheap about it at all. Thank you Mr. Robertson. You may not know how to keep Walmart shoppers from being root all the time, but I'm 'root'ing for you :P

      --
      microsoftword.mp3 - it doesn't care that they're not words...
    13. Re:Oh that's swell.. by jsse · · Score: 2, Funny

      The guy funding the Linux XBOX project is a direct competitor of MS. Kinda cheapens the whole thing, duddn't it?

      Who else do you think would sponsor such contest? :)

      Frankly I was a bit shock to know that the man behind is not Larry Ellison. :)

    14. Re:Oh that's swell.. by tshak · · Score: 2

      Actually, he could hire about two. Salary ($60-$75K depending on location and competance) plus benefits, taxes, and other expenses would easily cost $200K for only two developers.

      --

      There is no longer anything that can be done with computers that is nontrivial and clearly legal. -- Paul Phillips
    15. Re:Oh that's swell.. by tetrad · · Score: 1

      Immoral or illegal? It's not always the same.

    16. Re:Oh that's swell.. by Anonymous Coward · · Score: 0

      > Incidentally, I submitted this very same story to slashdot last week, when the story first ran on CNN, and got it rejected. Go figure.

      Simple timing error, the story was too fresh. You needed to let it sit and ripen for a bit; that makes it stale enough to be a valid Slashdot story.

    17. Re:Oh that's swell.. by Anarchofascist · · Score: 3, Insightful

      "But that would not give him any guarantee of reaching the result. By putting up the reward he will only have to pay if he gets what he wants."

      Sort of a no-win no-fee arrangement. I can deal with that. Good luck to him.

      --
      Once more unto the breach, dear friends, once more, Or close the wall up with our American dead!
    18. Re:Oh that's swell.. by czion3 · · Score: 1

      I don't know what I am talking about but mod-chips were agents the DMCA because they made it possible to pirate games. They could also have legal uses such as playing import games. IMHO the same thing is true here, it makes it possible to play pirated games but has some legal uses such as being able to install Linux.

      sorry about the spelling

    19. Re:Oh that's swell.. by Xtifr · · Score: 2

      The guy funding the Linux XBOX project is a direct competitor of MS.

      Well, duh, I think we all sort of expected something of the sort. But he's not a competitor in the game console arena. Most earlier speculation about the mystery funding revolved around Sony.

      Kinda cheapens the whole thing, duddn't it?

      Uh, no? Rather, I would say that it makes it make perfect sense.

      But his motivations place him at MS's level.

      No, there's a big difference -- Robertson is engaging in competitive behavior. MS engages in ANTI-competitive behavior.

    20. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "You consider it immoral to try and run the software of your choice on one of your own computers?"

      I'm amazed that you got modded up for that comment. It has nothing to do with how I feel about software, period. It has to do with the 'no reverse engineering' clause in the DMCA that MS could (as far as I know...) attack the Lindows CEO with if he pays out.

      Whether or not I find it immoral has absolutely 0 bearing my comoment.

      For the record, I'm all for hacking the XBOX. My comment does not contradict that.

    21. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "The stereotypical Evil Company would keep the ability to run 3rd party software on the box to themselves; he's willing to let the world have it."

      The XBOX plays nothing but 3rd party software. What they're trying to do is make the XBOX deviate from playing games.

      The stereotypical Evil Company would keep the ability to run 3rd party software on the box to themselves; he's willing to let the world have it.

      Waste of time if you ask me, at least until they make an interesting use of it. Personally, I'd buy and mod and XBOX right now if they could have it play Divx .avi's on my TV.

      Work on some apps to maek this useful and worthwhile to do, and I won't be whingey.

    22. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "... it makes it possible to play pirated games but has some legal uses such as being able to install Linux."

      The concern that I have is that there is 0 good reason to install Linux on it. I mean, if there were a bunch of XBOX specific apps being built for it, I'd understand. I suggested the ability to play Divx .AVI's etc. For all I know it's in the works, but we never hear that. All we hear about is people wanting to install Linux on it. At best we hear about potential, but realistically it's not a computer of choice.

      These guys could make their case better.

    23. Re:Oh that's swell.. by Anonymous Coward · · Score: 0

      If you want to play DIVX's on a modchipped Xbox, get Xbox Media Player

    24. Re:Oh that's swell.. by intermodal · · Score: 2

      not competitor; ENEMY. MS has targeted Lindows for eradication. This equals corporate warfare.

      --
      In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
    25. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "not competitor; ENEMY. MS has targeted Lindows for eradication. This equals corporate warfare."

      Yeah, they're trying to eradicate them by having them change their name to something that doesn't sound so much like Windows. What other paranoid propoganda are you going to push?

    26. Re:Oh that's swell.. by intermodal · · Score: 2

      it's not paranoia. It's reality. It's been done before. Sue a small company in a lawsuit they can't really afford to fight. Remove their name. Ruin every cent they've spent on advertising by changing their name. It's nothing short of corporate terrorism.

      --
      In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
    27. Re:Oh that's swell.. by Anonvmous+Coward · · Score: 2

      "it's not paranoia.... Remove their name. Ruin every cent they've spent on advertising by changing their name. It's nothing short of corporate terrorism."

      1.) Um no, changing their name will not 'ruin every cent spent on advertising'. As a matter of fact, it's probably the best thing that ever happened to them because now everybody'll wonder what the stink is about and find out who Lindows is. MS knows they could have done more damage to them by just ignoring them rather than 'seeing them as a threat'. The problem is they have to defend their trademark. They are legally obligated to, end of story. P-A-R-A-N-O-I-A

      2.) Let's talk about 'corporate terrorism'. Lindows was intentionally named to sound like Windows. There are two possibilities here. Either they, as a company, are completely and utterly stupid or they intentionally picked a fight that MS would have to battle them over. That is corporate terrorism. Any time when you intentionally try to confuse the marketplace, you are guilty of that.

      I'm no fan of MS, but the Lindows case is hardly an example of MS doing anything wrong. Frankly, if I were a stockholder in the corp that makes Lindows, I'd be mad as hell that they picked that name. Fucking retards.

    28. Re:Oh that's swell.. by Anonymous Coward · · Score: 0

      http://www.xboxmediaplayer.de/newweb/info_project. htm supports Divx. Still needs a modchip, until people can get the xbox key thingy.

  2. Link... by pangel83 · · Score: 5, Informative

    somebody correct the SF link

  3. Link Problem by NightRain · · Score: 5, Informative

    lol. The article points to sourceforget.net, not sourceforge. Might want to fix that :)

    1. Re:Link Problem by rgsmith · · Score: 0

      This is a link to the SourceForge 'Xbox-Linux' project.

    2. Re:Link Problem by silvaran · · Score: 5, Funny

      I guess they sourceforgot to check their posts before submitting them to the front page.

    3. Re:Link Problem by msgmonkey · · Score: 1

      I've typed in sourceforget a number of times, until I remembered to not forget the correct spelling, ironic huh?

    4. Re:Link Problem by Randolpho · · Score: 2

      What's funnier is that this article was submitted by others with correct links and it was almost instantly rejected.

      Perhaps it's time have a little talk with the editors... :)

      --
      "Times have not become more violent. They have just become more televised."
      -Marilyn Manson
  4. And they said VC capital wasn't being misspent! by wackybrit · · Score: 0, Offtopic

    Haha. Nuh-nice to see someone is still, er, wasting the b-b-bucks even in today's financial climate! It brings a tear to my eye, reminds me of 1998.

  5. DMCA?? by fodi · · Score: 1, Interesting

    "The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software."

    Isn't that illegal in the US of A ???

  6. DMCA, anyone? by alpharoid · · Score: 5, Interesting

    I like the project... but is this feasible? Wouldn't cracking the X-Box encryption key violate the DMCA and put a lot of people in trouble? Microsoft could afford the lawyers, you know.

    Anyways, good luck to them.

    1. Re:DMCA, anyone? by warmcat · · Score: 5, Interesting

      Many people involved in the Xbox Linux project are not in the US, happily enough. The EUCD is late in .uk and .de.

      In any event, things are only 'illegal' when they transgress specific laws. As the DMCA and EUCD are concerned with copyright protection, I really don't see where the problem is if the key is somehow revealed and used to sign a Linux bootloader app. Where is the MS code that is being copied?

      Anyway I think the effort to find the key by throwing random numbers at it is practically impossible, however many clients you can muster. This is a 2048-bit number (256 bytes) that you need to factor correctly into two primes.

      Its much more likely that the second part of the prize will be won by a buffer overflow or other weakness in one of the games. There are a lot of games, written by people of widely varying experience and skill level. Can MS be sure that not even one of them exposes a buffer overflow weakness?

    2. Re:DMCA, anyone? by k-hell · · Score: 3, Informative
      From their FAQ:
      Is your project illegal? Doesn't forbid the DMCA all this?

      The DMCA forbids circumventing copy protection, but this is not our goal. We develop an alternative operating system for the Xbox gaming console. A side product could be the ability to run unsigned code, but this alone does not make it possible to play pirated copies of games. Nevertheless, if you live inside the USA or another country with a similar legislation, and you work on Xbox hacking rather than on Linux developing, you can of course join the project anonymously.
      If you are either a lawyer or a Microsoft representative, you are of course welcome to talk to us about any changes.
    3. Re:DMCA, anyone? by alpharoid · · Score: 2, Interesting
      Anyway I think the effort to find the key by throwing random numbers at it is practically impossible, however many clients you can muster. This is a 2048-bit number (256 bytes) that you need to factor correctly into two primes.
      No question about that. It took three years for the RC5 effort to brute-force a 64-bit key!

      Now, I am not a Real Programmer, but it appears the NT kernel used in the X-Box lacks a few features, including memory protection. Wouldn't this allow any running task to peek into any part of the X-Box memory space, and change things at will?
    4. Re:DMCA, anyone? by Anonymous Coward · · Score: 0

      Damn the DMCA. Don't be scared by it.

      Fear of breaking a law should not be your motivation for doing or not doing something. Right or wrong should be. That's a low level of morality, the first level if I recall Soc correctly. Motivation based upon consequences. I don't do this because I will be spanked.

      If you think it's wrong to violate a law no matter how wrong-headed it is, then don't do it. If you are an idealist (to paraphrase Robert Anton Wilson: The difference between idealists and cynics is, cynics think everyone is a no good shit, idealists think everyone but themselves are no good shits) then you should be motivated by your own morality.

      I keep leaving and coming back precisely because there's a lot of talk here, but no action. 100,000 people and only a few ever really do anything.

    5. Re:DMCA, anyone? by Uller-RM · · Score: 4, Informative

      Catch: Get a running task into the system. Your best bet to do this without modchipping would, IMO, be to emulate XBox Live or another download system for a game. You can open the box and plug the drive into a normal IDE system - but it uses the ATA protocol's password mode - meaning you either have to crack the key or hotswap the drive after powering it up in an XBox.

      Catch: Get the task running. The XBox is essentially a single-process OS due to its use of unified memory addresses for all hardware.

      Having looked at the problem for some time my suspicion for the best way to go about it would be a buffer overflow or other flaw in the saved game system, since you can put those on a memory card easily enough and copy it to the HDD. Tada, backdoor without requiring modchipping.

      In the XBox, once you've got control of the CPU, everything becomes possible. The catch is doing that, since the kernel will not allow you to load an unsigned executable. At the same time, I'm sure that MSFT has quite thoroughly checked the Dashboard XBE on the drive for exploitable bugs... ... hah.

    6. Re:DMCA, anyone? by gilesjuk · · Score: 1

      It doesn't matter if any laws will have been broken, people cite DMCA and sue you just to hamper what you are doing.

      Besides, it will be the people who use the information commercially that will be sued not the project members.

    7. Re:DMCA, anyone? by squiggleslash · · Score: 1
      A pendant notes: The DMCA outlaws circumventing access protection, not copy protection. These are not the same things.

      CSS, for example, is an example of an access protection layer. It doesn't prevent copying, it prevents (or rather, is meant to prevent...) unauthorized access to copyrighted content. In DVDs, that means that only a device authorised by the DVDCCA is authorized to pass through the access controls, and this means the DVDCCA can impose restrictions on what kinds of device they authorise: a device, for instance, must honour the region and Macrovision flags, for instance, as well as refusing to play an encrypted DVD from a disk that doesn't have certain keys stored in a part of the disk not normally accessable.

      Adobe's electronic book format also has an access control layer. The principle here is that in order for a book reader to be authorized to read a book, the reader must run according to Adobe's conditions. Again, no copying restrictions are imposed, but it's not necessarily possible to read a copied file with an authorized reader.

      Despite the pendantic note, I'm not sure this invalidates the FAQ's point in any way - no copyrighted content is being accessed, therefore no access controls, as defined by the DMCA, are being circumvented.

      --
      You are not alone. This is not normal. None of this is normal.
  7. Re:Wow! by Anonymous Coward · · Score: 0

    Capitalize the beginning of your sentence please.

  8. Lindows taking advantage of open-source R&D? by k-hell · · Score: 4, Insightful

    Geoff "Dissonance" Gasior at The Tech Report has made an interesting comment regarding how Lindows could potentially take advantage of open-source "R&D".

  9. The Neo Project by kasperd · · Score: 3, Interesting

    The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software.

    Unfortunately the server apears to be slashdotted. Let's hope that just means a lot of people want to help with that task. This of course makes me want to ask about the legality of doing this. Does people risk getting sued by downloading the client?

    --

    Do you care about the security of your wireless mouse?
    1. Re:The Neo Project by Artifex · · Score: 3, Insightful
      Does people risk getting sued by downloading the client?


      I doubt people will get sued for downloading it. Using it is another matter, and distributing the broken key is more different.

      Personally, I draw a line between the RC contests, like distributed.net participates in, and willfully trying to break a company's security.

      Sure, you bought the hardware, but I don't see you thinking that cracking keys (or generating faked IMSIs) for your GSM phone is legitimate. And most people will admit that screwing around with key card interceptors and other stuff for their DirecTV receivers in order to get free premium channels is illegitimate. So why do you think it's ok to do it to the XBox, except that you want to screw Microsoft?
      --
      Get off my launchpad!
    2. Re:The Neo Project by harks · · Score: 2, Insightful

      I think the difference between cracking xbox to run Linux and using descramblers to get premium channels on TV illegally is that with the latter, you are stealing a service.

    3. Re:The Neo Project by kasperd · · Score: 2

      So why do you think it's ok to do it to the XBox

      Because the purpose of doing it is to achieve interoperability between Linux and the X-Box. Had the purpose been to make pirate copies or something similar, it would have been an entirely different matter.

      --

      Do you care about the security of your wireless mouse?
    4. Re:The Neo Project by Anonymous Coward · · Score: 0
      Does people risk getting sued by downloading the client?

      I think they does.

  10. Re:DMCA?? who cares? by Anonymous Coward · · Score: 0

    details, details the only folks who'll care are those sued by M$.

  11. Re:Wow! by fodi · · Score: 0

    A comma before 'please', would be nice. In future, please don't write in the passive voice.

  12. Poor neo project by Rogerborg · · Score: 4, Insightful
    • We do not know if it is legal or not to participate in the Xbox challenge, we are looking for some legal advice as a donation to Neo.

    Welcome to a maibox full of "IANAL, but I play one on Slashdot, and..." messages.

    Also, the site is slashdotted, but from what I can make out, it seems to be a Windows client. Ironic, nes pas? Does anyone know if it runs under wine?

    --
    If you were blocking sigs, you wouldn't have to read this.
    1. Re:Poor neo project by FooBarWidget · · Score: 2

      "Ironic, nes pas?"

      Not at all. According to a Slashdot poll from a while ago, most visitors use Windows, not Linux.
      That (and the fact that pro-Windows posts often get modded up) also kills the myth that Slashdot is a pro-Linux anti-Windows site.

    2. Re:Poor neo project by rmohr02 · · Score: 2

      Well, I use both Windows and Linux on my computer, but Windows is my main operating system--I play games more than I do anything else, and games just aren't the same under Wine. Also, I didn't feel like logging out to vote twice.

    3. Re:Poor neo project by taviso · · Score: 2

      works great, fonts look a little messed up though...

      --
      ex$$
    4. Re:Poor neo project by Rogerborg · · Score: 2

      What question are you answering? I think it's ironic relying on a Microsoft product to run a project to allow Linux to run on a Microsoft product. It wasn't a Slashdot meta commentary.

      --
      If you were blocking sigs, you wouldn't have to read this.
    5. Re:Poor neo project by Anonymous Coward · · Score: 0

      No myth. The main reason I read /. is for the Microsoft bashing. And yes, I (still) use Microsoft Windows.
      There *are* a bunch of astroturfers (with mod points yet) attempting to do damage control. What's fun is to catch a story in the wee hours of the morning when the astroturfers are still asleep and watch the posts.
      Lindows may well prove to be Microsoft's biggest headache. The name looks like a Linux alternative to Microsoft WIndows. Not much of a Linux per se, but most likely quite adequate for its targeted audience. When and if Lindows proves to be too low-scale, you can count on a natural migration path to something like Mandrake.

  13. Re:Wow! by Anonymous Coward · · Score: 0

    No comma after "please" would be nice.

  14. Re:Wow! by Soporific · · Score: 0, Offtopic

    In future?

    I, can, put, a, comma, wherever, I, wish, and, remain, grammatically, correct.

  15. Re:Wow! by fodi · · Score: 0

    you're right.. I'm wrong... ...again.. fuck it. I'm gonna write it like I say it.

  16. Re:Pro-windows? Never! by Lord+Bitman · · Score: 2

    Most of what I see is Anti-WindowsBashing, basically the moderators saying: "Shut the fuck up, god kills 500 fluffy kittens every time you use a dollar-sign somewhere besides currency notation"

    --
    -- 'The' Lord and Master Bitman On High, Master Of All
  17. Re:Wow! by NanoGator · · Score: 0, Flamebait

    "A comma before 'please', would be nice. In future, please don't write in the passive voice."

    Only if you agree not to write in the assive voice over a comma.

    --
    "Derp de derp."
  18. mirrors wanted by Anonymous Coward · · Score: 0

    Could someone please post a mirror for the neo client? I would love to participate :)

    1. Re:mirrors wanted by Anonymous Coward · · Score: 0

      Here's a link to a client but i don't know if it's the latest.

      http://www.extremedc.com/neo/neo515.zip

  19. STOP with this Neoproject bullshit! by Troed · · Score: 4, Insightful
    The signing key used for Xbox executables is 2048 bit RSA.


    That's astronomically more than most BANKS use today .. i.e, there's no way - absolutely no way - you can brute-force the Xbox signing key. The Neoproject guys are complete morons without any knowledge about cryptography. This is the third forum in 2 days I've had to post in to put some sense into this.


    There are two places in the Xbox suspectible to a "no-modchip" attack - but with $100k being offered no real _groups_ of hackers are targetting this yet ..

    1. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      The signing key used for Xbox executables is 2048 bit RSA. That's astronomically more than most BANKS use today.

      Uh, yeah, but there's a 1 in X chance that the key is actually a really low number, fuckwit. It's worth a try at least.

      It's a bit like cracking ZIP passwords. Sure, you can use up to 16 characters.. but most people don't, they might just use 'a' or 'z' or something. This key might be 42.. crackable in minutes.

    2. Re:STOP with this Neoproject bullshit! by Si+F. · · Score: 2, Interesting

      Agreeded, but a private groups cracking effort is a nice way for someone at Microsoft to leak the key and get the cash.
      $100K must be pretty tempting.

      On the other hand, you could probably blackmail MS for more than $100K to keep the key a secret.

    3. Re:STOP with this Neoproject bullshit! by warmcat · · Score: 2

      Troed has it right. The other keys that we have recovered, RC4 keys, have been good quality random gibberish. MS have clearly hired proper cryptographers.

      Although 2048 doesn't sound much more than 576, these are of course powers of two we are talking about. I fear the people attacking it aren't quite imagining what these kind of numbers mean.

      Still, their chance of cracking it is definitely nonzero, although vanishingly small in a timeframe of a year or ten years: I wish them the best of luck.

    4. Re:STOP with this Neoproject bullshit! by Troed · · Score: 0, Offtopic

      ZIP is easy to crack. 3 32-bit keys - password doesn't matter.

    5. Re:STOP with this Neoproject bullshit! by Troed · · Score: 1

      These kind of keys are never available in the clear. A purpose-built "black box" has the key inside it, with no way of extracting it even if you work at Microsoft.

    6. Re:STOP with this Neoproject bullshit! by Hoe · · Score: 1

      Yes, i agree there are MUCH worthier distributed computing projects. folding@home and genome@home try to further medical science!

      Folding@Home
      Genome@Home

    7. Re:STOP with this Neoproject bullshit! by thogard · · Score: 1, Insightful


      While I don't know of a case where people have cracked RSA proper, there have been many systems that use RSA that have been cracked wide open. SSH and SET come to mind.

      RSA is rarely used in its described form and that always seems to intorduce weakneses. RSA requires that you have two true primes to generate they key but the problem is there is no known way to generate a 2048 bit true prime that can't be factored in the same about of time it takes to generate it. What gets used is pseudo-primes. These are primes that pass a large number of tests that indicate that the number is very likly prime. These tests are good enough that no one has broken a psuedo-prime in over a decade. The problem is some of the old tests to say a number is a pseudo-prime turned out to be wrong.

      As far as bruteforceing a 2048 bit key, forget it however there are several publications that indicate that the number of solid pseudo-primes that are 512 bits long is about 2^40 so its key strength is about the same as 40 bits. Since we are talking about a 4x as many bits, a good guess of the strenght of a 2048 bit pseudo-prime would be about as hard as guessing a 160 bit DES like key. Harder than modern hardware can scan though but not impossible. With some of the current nibble step attacks on DES, the 40 bit stuff falls though the vector units of a modern processor at rates Deep Crack could only dream of. 2^40 is 1e12 and modern CPUS are doing how many operations a second on a 4e9 hz cpu? Once you stop doing all the decrypto work, you can cut out many steps.

      If I was going to attack the key, I would get as many CPUs as I could find guessing at random numbers and hitting the fast prime tests with them and no coordination. A modern CPU can pick a random number, do a few simple psuedo prime tests and then do part of the factor operation to test very quickly if the key might be good. If it is then hand it off for a better check. A million guesses a second isn't unreasonable with the fastest of todays hardware but that still leaves something in the area of 4e38 hours of cpu time to try them all. Thats well inside the theoretical range of other problems like this that have been solved. It just took a few decades sometimes.

      What if the numbers involved aren't true primes? Then the number of other keys increases. If once is prime and the other has two facotrs then there are 4 keys that will work. If both numbers have two factors, then there are 9 other keys.

      I see this as a way that your computer can pick lottery numbers at random. Maybe it will come up but you can't win if you don't play and this doesn't cost you a $1 per set of numbers.

    8. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      Definitely agreed. Let's see, with a 2048 bit key, there are only 2^2048 possible combinations...so they should have it done right about never. If you remember back to chemistry when they were trying to get you to understand just how big a mole was - things like you could make one dot a second, all day, every day and still not be done before the sun burnt out. And that's only 10^23. This is 16^512.

    9. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      Uh, yeah, but there's a 1 in X chance that the key is actually a really low number, fuckwit. It's worth a try at least.

      Let's say anything less than 10^50 is a low number (and if they wanted to be done in less than 10 years, they'd have to check 317097919837645865043125317097919837645865 numbers a second). So the odds that the key is one of these "low" numbers is 10^50/2^2048. This is approximately 3/10^567. That's 3 divided by a 1 with 568 zeros after it. 10^567; there aren't anywhere close to that many atoms in the entire planet.

      Fuckwit.

    10. Re:STOP with this Neoproject bullshit! by Troed · · Score: 0, Troll

      160 bit DES is well over "not even if all atoms in the universe were parallell supercomputers would they've searched the keyspace since the beginning of time" limit.

    11. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 5, Informative

      God, where to start....

      "RSA requires that you have two true primes to generate they key but the problem is there is no known way to generate a 2048 bit true prime that can't be factored in the same about of time it takes to generate it."

      Wrong. Entirely wrong in fact. You should read the Handbook of Applied Cryptography (kindly made available online here). See e.g. section 4.3. Proving a 2048-bit number is prime (I think you mean 2x 1,024-bit numbers, but....) should take a minute or two - not excessive for a one-off operation!

      "forget it however there are several publications that indicate that the number of solid pseudo-primes that are 512 bits long is about 2^40 so its key strength is about the same as 40 bits."

      Erm, where do you get this stuff from? What's a "solid pseudo-prime"? ;) Also, the number of 512-bit primes is expected to be around 3.7x10^151 (see e.g. here).

      "Since we are talking about a 4x as many bits, a good guess of the strenght of a 2048 bit pseudo-prime would be about as hard as guessing a 160 bit DES like key".

      Hardly - Certicom reckon that a 128-bit symmetric key is equiv. to a 3072-bit RSA key. Don't forget that, with symmetric keys, the strength usually doubles with each added bit of key material - the same isn't true for RSA or DH keys as there is now a sub-exponential algorithm for solving these problems....

      The rest of your post doesn't get much better, but I'm off to eat sunday lunch now....Seriously, read HAC - it's good for you.

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    12. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 2

      MS have clearly hired proper cryptographers.

      They certainly have, check out the names here for example. Gollmann, Leyland, Needham and Petitcolas are all pretty well known in crypto circles. Which asks the question: how can MS employ such bright people and still churn out insecure crap?

      Although 2048 doesn't sound much more than 576, these are of course powers of two we are talking about. I fear the people attacking it aren't quite imagining what these kind of numbers mean.

      Don't forget that there are sub-exponential algorithms for solving RSA/DH - so adding a bit of key doesn't double the time to solve. 2048 is still currently impossible though!

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    13. Re:STOP with this Neoproject bullshit! by GalionTheElf · · Score: 1
      Thats well inside the theoretical range of other problems like this that have been solved. It just took a few decades sometimes.


      If it takes us several decades to crack, haven't they already won this round?
      --
      I'm going over here and I don't know why!
    14. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      They should just split the 2048 bit key up into 64 bit segments then decode each part. That way it could be done in months instead of millenia.

    15. Re:STOP with this Neoproject bullshit! by darkwiz · · Score: 3, Interesting
      Wrong. Entirely wrong in fact. You should read the Handbook of Applied Cryptography (kindly made available online here [uwaterloo.ca]). See e.g. section 4.3. Proving a 2048-bit number is prime (I think you mean 2x 1,024-bit numbers, but....) should take a minute or two - not excessive for a one-off operation!


      You aren't "proving" it. Miller-Rabin is a probabilistic algorithm. It doesn't guarantee anything (unless it indicates that the number is composite - non prime).

      The rest of your post seems correct though.
    16. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 2

      You aren't "proving" it. Miller-Rabin is a probabilistic algorithm. It doesn't guarantee anything (unless it indicates that the number is composite - non prime).

      I wasn't referring to Miller-Rabin (which indeed doesn't produce provable primes), but rather Maurer's algorithm (See HAC Algorithm 4.62 on Pg 153). Section 4.3 in HAC specifically discusses only true primality tests.

      Timings were thanks to a recent thread on sci.crypt entitled "Provable Generation of Primes with Maurer".

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    17. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      a mole is 6.02 * 10^23

      i had a chemistry teacher that burned it into our skulls as much as she could. as an aside, she had some weird record with a song about how big a mole is. there were all sorts of bizarre and mind-boggling numbers in it, for example,
      "say a mole of marshmellows fell upon the planet. that's a layer more than a thousand miles deep. do you think that you could stand it?"

      it got worse from there...

    18. Re:STOP with this Neoproject bullshit! by Fnkmaster · · Score: 2

      Fucking overkill anyway. Would you be happy with a less than 1x10^12 chance that a number isn't prime? Easy to do with Miller-Rabin. There's also a chance you'll get run over by a steamroller the second you walk out of your home this morning. It's less than that. The weakness with the fucking Xbox is not going to be had by brute-forcing a 2048-bit RSA key, I would guess, since there are surely easier ways to go about it, and weakspots that don't require a brute force of the key.

    19. Re:STOP with this Neoproject bullshit! by jonathanclark · · Score: 2

      First off, I know very little about the xbox boot process - however I know the amount of data it is able to calculate a hash for signature verification is fairly limited in size. Obviously it can't read the entire CD and use that as a hash or the user would wait forever. So it seems the best approach is to use the executable image from some already signed game/app and cause that to load your payload - by replacing data it reads with something that allows you to take control. Games are not designed to handle corrupted data so this shouldn't be that hard. The ideal game candidate would do as little as possible before allowing you to take control.

      MS cannot verify signatures mid-game because the process is to slow so further reads from the CD go unchecked.

      One possibility MS could employ to thwart this is by checking the signature of a few random block of CD data at startup. Most of the time it wouldn't catch you, but that 1% would be enough to discourage people from using this method.

    20. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 2

      I agree entirely - M-R is good enough for virtually all purposes....I just like picking up on crypto newbies who claim "there is no known way to generate a 2048 bit true prime that can't be factored in the same about of time it takes to generate it." ;)

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    21. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      a mole of marshmellows would overfill the universe.

      how "deep" is that when the earth is less than a speck of dust?

      your teacher should go back to school.

      (a mole is now accepted as 6.022 x 10^23)

    22. Re:STOP with this Neoproject bullshit! by Anonymous Coward · · Score: 0

      But why couldn't a known good header be stripped off of an existing program and slapped onto the code you're looking to run?

    23. Re:STOP with this Neoproject bullshit! by Tom7 · · Score: 1

      If the numbers aren't prime then they won't work for RSA signing/encryption. Coming up with keys for RSA is pretty easy. (Common mistakes, as I understand, involve the randomness used to generate the keys not being very random!)

    24. Re:STOP with this Neoproject bullshit! by Troed · · Score: 1
      Hash. Trust me - Microsoft did their homework.


      (On everything but the actual BIOSMCPX security .. that's why the v1.1 box is hacked)

    25. Re:STOP with this Neoproject bullshit! by thogard · · Score: 2

      Pseudo-primes a term that came from the militray crypto for primes that are above the size you can factor to prove they are prime. Take a look at Knuth volume 2. Mersenne primes (2^n-1) for large values of n are all examples of very good pseudo-primes. Picking a large random number that passes a number of the test but not all of them is an example of a poor pseudo-prime.

      Your 1st bit is about generateing pseudo-primes not real primes. The only way to generate a real prime is factor it. The tests should work but ever few years the tests are cleened up because they claim prime numebrs aren't prime.

      Are your other statements contradictory?
      Your 1st comment is that a the number of primes is in the realm of 3.7e151 however you cliam that Certicom claims 3072 bit RSA is about as strong as 128 bit symmetric keys which gives you a stab in the dark 1 in 3.4e38 chance of lucking into the key which implies its about 3.6e12 times easier to break a 3072 bit key than I thought it would take to break a 2048 bit one.

      Maybe after your breakfast you can pull out Knuth vol 2 and do the 1st 4 exercises on page 415 :-) Maybe for fun you can compare the current editions section on verifing primes to the 1st editions and see that things have changed.

    26. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 2

      Read Handbook of Applied Cryptography (pretty much the definitive source for number theory as used in cryptography) - Algorithm 4.6.2 is entitled "Maurer's algorithm for generating provable prime's" and disagrees with your point "The only way to generate a real prime is factor it".

      Oh, and how do you "factor a real prime"? ;))))

      Yes, Knuth vol 2 is a good reference - but it is lacking in this respect. It doesn't even mention Maurer's algorithm.

      I would suggest reading up on Maurer's paper and then writing to Mr Knuth. :).

      "number of primes is in the realm of 3.7e151" - yep, that's for 512-bit primes.

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    27. Re:STOP with this Neoproject bullshit! by thogard · · Score: 1

      Have you tried plugging 4 and 9 as the base primes into RSA and see what falls out? If they keygen doesn't complain (because you turned off that bit of code or it has a bug or was poorly designed), the rest will be happy. You can do RSA at 8 bit level but I don't recomend it to keep anything secure but its an interesting thing to play with.

    28. Re:STOP with this Neoproject bullshit! by thogard · · Score: 1

      The only way to be sure a prime is real is attempt to factor it. I've been using the prime tests for 20 years and things are getting better but every few years someone comes up with a new way and some of the numbers the old systems say are prime, aren't prime with the new way. That gives me doubt about how good the prime tests are.

    29. Re:STOP with this Neoproject bullshit! by ssimpson · · Score: 2

      The only way to be sure a prime is real is attempt to factor it.

      That's just not true (and hasn't been for 5 years or so!). Read the Maurer paper or HAC (you can even read the relevant chapter here).

      Maurer's algorithm prove's in a mathematical sense if a number is prime or not. It's not probablistic, it's definitive.

      I've give you the relevant links to bring you up to date and don't believe that posting further on this topic will provide usefull until you read the links.

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    30. Re:STOP with this Neoproject bullshit! by Physics+Dude · · Score: 1
      Maurer's algorithm prove's in a mathematical sense if a number is prime or not. It's not probablistic, it's definitive.
      That's statement is very misleading. Given a supposed prime number, Maurer's algorithm can't prove's in a mathematical sense whether that number is prime or not. It's only an algorithm to generate primes, not one to determine primality.
  20. The True Intention of Mike Robertson by cioxx · · Score: 5, Funny
    This man is very clever. As I understand, he funded the XBox hacking project for company's gain. Still with me? Good.

    The way it works is, once the hardware is hackable without any physical modification, Lindows Company buys mass quantities of Xboxes from Wallmart for $199/unit, loads Lindows OS on it, and sells it to consumers for a new low price of $59 dollars at the same Walmart chain.

    Sure, they will take a loss of about $140 dollars, but they're counting on the royalty fees from Click'N'Game warehouse with such titles as:

    Tux Racer Ultra

    Totally Real Tournament 2003

    Beyond Tetris eXtreme

    Revamped version of Minesweeper in 3d

    ...and finally, gnuCash.

    The most important feature in the upcoming Lindows XBOX of course would be the ability of users to CHANGE THE WALLPAPER and Play Music on it (MP3). Just think of the possibilities. This revolutionary "box" will change the way people experience mediocrity.

    Insiders tell me that Lindows, headed by genious Michael Robertson, is moving full scale ahead with this new business plan, plus more. And something about Colonizing Planet Mars and training chimps to be able to write clean C#, server side code for web applications in .NET .. but that's just a rumor iirc.

    1. Re:The True Intention of Mike Robertson by rmohr02 · · Score: 2

      Also, users wouldn't need to buy a monitor--generally the most expensive part of a really low-end computer--they can just use their existing TV.

    2. Re:The True Intention of Mike Robertson by yivi · · Score: 1

      This revolutionary "box" will change the way people experience mediocrity.

      Are you talking about television, aren't you?
      Or is it about computers in general?

      I'm confused.

    3. Re:The True Intention of Mike Robertson by vidnet · · Score: 3, Funny
      and training chimps to be able to write clean C#, server side code for web applications in .NET

      Hey now, let's not waste a perfectly good chimp!!

    4. Re:The True Intention of Mike Robertson by s1r_m1xalot · · Score: 1

      I always thought that gnuCash should be renamed "G-Money"

    5. Re:The True Intention of Mike Robertson by Anonymous Coward · · Score: 0

      Cool! Horrible flickery 50Hz display with a 640x480 maximum, if you're unfortunate enough to be using NTSC!

      Where do I sign up?

    6. Re:The True Intention of Mike Robertson by Anonymous Coward · · Score: 0

      I worked with Mikey Robertson @ MP3. He really hates it when he is called anything other than Michael. So please refer to him as Mikey as often as possible. :) He has serious issues with being taken seriously and calling him Mikey drives him nuts!

    7. Re:The True Intention of Mike Robertson by CSG_SurferDude · · Score: 2

      As long as they aren't taking chimps from the Undiscovered Shakespeare Plays and Sonets Project, then I guess it's ok with me.

  21. Re:stick it up your ass by Anonymous Coward · · Score: 0

    For a fag basher you certainly have a thing about rear entry.

  22. Linux Console? by MikeFM · · Score: 2, Interesting

    For $200,000 couldn't he have done something more useful like funded the design of an opensourced Linux-based console? I mean really if they could make some deals and get some good video and maybe wireless networking intergrated into a mini-ITX motherboard and put together a Dreamcast/GameCube sized case with a dvd-rom drive and room for a hdd they'd have something sweet. Really the current crop of mini-itx motherboards/cases are already nice for affordable music/video playback and work rather well for playing games a couple years old.. a lil boost to the video and you'd have things set.

    --
    At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
    1. Re:Linux Console? by Mr2cents · · Score: 1

      With 200k$, I guess you can pay microsoft to sign the linux executables? Or just let them sign the bootloader.. or some silly game with a very unfortunate bug on line 2.. The old 'can you quickly sign this'-trick might just work ;).

      --
      "It's too bad that stupidity isn't painful." - Anton LaVey
    2. Re:Linux Console? by SomeOtherGuy · · Score: 2

      For $200,000 couldn't he have done something more useful like funded the design of an opensourced Linux-based console?

      Ask the Eazel people how far 200K will get you....Err, or was that more like 20 Million...I like this (bounty) method because it attracts the hackers to work towards the goal and the marketing and advertising people are not interested. I think the whole "corporating" (Linux Gold Rush) thing was funny and hurt linux because it had all the real costs, yet none of the profits.

      --
      (+1 Funny) only if I laugh out loud.
    3. Re:Linux Console? by MikeFM · · Score: 2

      BS. If someone gave me $200k I could do it and I'm sure there are many more talented people out there who could do it for even less. You don't actually have to develop anything, you just have to make a couple mutially-beneficial deals. All the required hardware exists and just needs to be intergrated better which isn't terribly difficult technically.

      As far as case designs appropiate for a console there are already dozens of them designed for free by mod geeks. Designing a case isn't all that difficult.

      Eazel was a company that actually developed their own software. They had to deal with overhead that just comes with being a company and I'm sure their programmers were well paid. They had a lot of expenses that wouldn't even apply in this case.

      I like the contest sort of thing to a limit. I'd be fun to have a contest for best Linux based console that hackers could design. Several small prizes IMO would be better than two big prizes though. If you gave out 100 $2k prizes you'd probably get better results than 2 $100k prizes. Maybe score based on look n'feel, production price, size, weight, power demand, heat, and performance. I know I could build a decent console for $300 (the one I just built was $400 but you don't need that much hdd space in a default unit) so a $2000 prize would be a decent offering.

      --
      At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
    4. Re:Linux Console? by SomeOtherGuy · · Score: 2

      I think it would be cool if their was an "official (open) PC Console". That way companies could develop games suited for specific graphics sets, input devices, processor specs -- that would not change and that would be identical for everyone who owned a "PC Console" -- That is pretty much what the Xbox is. What would be neat is if some company with the kind of deep pockets Microsoft has (IE - can afford to lose millions for the years it takes to build up a market) would take an "open" approach at the console market. And YES since it was open (no encryprion), and built on standard hardware -- it would be trivial to install whatever OS you wanted. I guess the trick would be how to convince the game companies that their software was not going to be copied freely.....Beyond that I think the "porting" from their PC versions would be a simple thing.

      I.E. -- The frustrating thing about PC gameing is the fact that a game may or may not run on your PC's hardware. It will be buggy based on the fact that they try to support as much as possible and can't code to a specific chip set, etc..... The frustrating thing about console gameing is the inability to do the same type of things your PC can do -- even if the hardware is more than capable of doing so. This would solve both problems.

      --
      (+1 Funny) only if I laugh out loud.
    5. Re:Linux Console? by MikeFM · · Score: 2

      Take a Mini-ITX motherboard and change the built-in graphics to something more studly like a GeForce4 and you'd have pretty much what you need. Mini-ITX boards come with audio, video, ethernet, usb, etc built in and can either have a built-in processor (VIA x86 compat) or you can get one that takes your choice of x86 compat CPU's. The great thing about them is they are only like 6"x6" and everything on them works in both Linux and Windows. If you get the one with the VIA CPU they are pretty low power and don't need much cooling but the P4/Athlon options allow you to add power as needed for your project. Really you don't even need a built-in OS. Make the cd's bootable and use usb joysticks and maybe add a flash card reader in place of your average consoles memory card reader. Could always add modems, hdd's, etc as standard usb devices. Take a look at the e-Note as an ideal console-sized case.

      --
      At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
    6. Re:Linux Console? by JohnFluxx · · Score: 2

      Hell just use a pc104 stack - the one's we had at work were pentium III's - over 1ghz. They are only about 3"x3" (they stack on top of each other depending on what you want - for example we would put a pcmcia wireless card on the top stack, video card underneath that, and so on.)

  23. I find the Neo bit interesting.. by mcc · · Score: 5, Interesting
    I find the part about using an RSA-style collaborative project to crack the X-box permission-to-run keys interesing, in particular becuase it's good practice-- eventually, barring a sudden backlash of informed consumerism against microsoft or some other kind of miracle, we're going to be needing to do this with the Palladium keys. I particularly wonder about a couple things:
    1. How many bits are in the x-box "trusted software" permission-to-run keys? What about in Palladium? For these N-bit keys, what is the approximate difficulty of brute-forcing it as compared to, say, brute-forcing RSA?
    2. Distributed clients like this one, as far as i am aware, just get parcelled out random blocks of the "possible key" space, and send back which numbers they checked, right? Is there any way to PROVE those numbers were, in fact, correctly checked, besides asking multiple clients to check each individual block and hoping that at least one of the clients tells the truth? Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list? ((Well.. okay.. I can think of a way to do that.. but it would require actually USING Palladium, to ensure everyone submitting blocks to the crack-Palladium project is using an unaltered, approved, digitally-signed Palladium-cracking client. So, uh, that's right out.) I know previous distributed projects have had issues with clients lying about their results in order to boost statistics, but this is the first time i'm aware of there has been a massively distributed computational work in which there is a specific party with a vested, active interest in the project being actually sabotaged.
    3. Were the Palladium keys to be cracked, is there anything MS could do at that point? Is there any way they could just Windows Update all the Palladium installs out there to suddenly use some new backup key, and invalidate the old one? It would seem the answer is no, becuase it seems that would automatically mean all of the existing palladium software in the entire world would suddenly become "untrusted" and have to be re-compiled at the vendor with the new keys, or something, but maybe there's something i'm missing. Is there something i'm missing? And anyway, aren't the palladium keys going to be stored in hardware, in some special Intel chip? Or something? How is a Palladium app marked as "Trusted By The MS Signing Authority", exactly, anyway? I haven't been following this as closely as i should have been.
    I'm confused and ignorant. Please explain things to me.
    1. Re:I find the Neo bit interesting.. by gotak · · Score: 2, Informative

      Let me try to answer some of your questions. I might be wrong.. but lets see.

      The reason why this key needs to be cracked instead of found on some chip in the xbox is...

      There are two keys. Public and private.

      The Private key is used to sign or encrypt something. And this key is kept somewhere with MS.

      The Public key on the otherhand would be in the xbox. This key is use to checked that the correct private key would have been used to sign the software.

      The public and private keys are related by some math fuction that's suppose to tbe one way. So with the private key you can generate the public key. But with the public key you can't easily tell what the private key was. This has to do with the difficulty of factoring prime numbers.

      So to find the private key what you can do is use a random guess of the private key to sign a piece of data like "hello world" then check with the public key to see if the signature is correct.

      This guess and check method is quite time consuming as you can imagine. There are other ways but I am haven't learn about those yet.

      hope this answers your questiosn.

    2. Re:I find the Neo bit interesting.. by kasperd · · Score: 1

      Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list?

      Hurry up, mod parent down before anybody from Microsoft see it.

      --

      Do you care about the security of your wireless mouse?
    3. Re:I find the Neo bit interesting.. by zdzichu · · Score: 2

      we're going to be needing to do this with the Palladium keys.

      It suddenly stroke me... is Xbox security a playground for upcoming Palladium?

      --
      :wq
    4. Re:I find the Neo bit interesting.. by spacefight · · Score: 3, Insightful
      It suddenly stroke me... is Xbox security a playground for upcoming Palladium?
      One Word: YES.
    5. Re:I find the Neo bit interesting.. by damiam · · Score: 1
      So to find the private key what you can do is use a random guess of the private key to sign a piece of data like "hello world" then check with the public key to see if the signature is correct.

      The much easier method involves finding the factors of the public key, which can be reconstructed to get the private key. Factoring a number is much easier than testing every possible value for that number. It's still really hard, though (and harder to distribute).

      --
      It's hard to be religious when certain people are never incinerated by bolts of lightning.
    6. Re:I find the Neo bit interesting.. by EpsCylonB · · Score: 1

      and in other news... the Beatles have just split up!

    7. Re:I find the Neo bit interesting.. by grahamsz · · Score: 2

      The way that i believe distributed.net detect people who dont check and just send the block back is to hand out false positives. (i'm actually not sure they do this but it was discussed)

      That way the server can tell if a user has been cheating when they report that a false positive didn't contain the key.

    8. Re:I find the Neo bit interesting.. by mstyne · · Score: 2

      It suddenly stroke me...

      And where can I get this X-Box stroking add-on? Hoo-yah! Daddy like!

      --
      mstyne: real name, no gimmicks
    9. Re:I find the Neo bit interesting.. by Hylander · · Score: 1

      Distributed clients like this one, as far as i am aware, just get parcelled out random blocks of the "possible key" space, and send back which numbers they checked, right? Is there any way to PROVE those numbers were, in fact, correctly checked, besides asking multiple clients to check each individual block and hoping that at least one of the clients tells the truth? Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list?

      Well, the server-side can decide who gets given each key, so microsoft would need a lot of clients to ensure they were asked to check the real key. If the software allowed any client to return results for any key, that would be a pretty obvious hole.

      It would be standard practice to have everything checked at least twice anyway - even if only to ensure you are't bitten by a bug.

    10. Re:I find the Neo bit interesting.. by Erasmus+Darwin · · Score: 2
      "Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list?"

      It's a 2048-bit RSA key. The amount of time taken to crack this will almost certainly be longer than the 5 year life of the X-box. Microsoft would have to be moronically stupid to risk sending the real key to cracking people in an effort to derail the system.

    11. Re:I find the Neo bit interesting.. by Anonymous Coward · · Score: 0

      Force feedback pornography!

  24. Re:Lindows taking advantage of open-source R&D by warmcat · · Score: 2

    The linked article in the parent suggests that this is a sneaky way to deliver an Xbox version of Lindows.

    The Xbox Linux team have done the necessary work for any distro to be made to work with the Xbox, and you can download the necessary kernel patches from sourceforge.

    But the two main distros that have been made have been Debian, by Ed Hucek, and Mandrake 9, mainly by Michael Steil and Milosch Meriac (both of these distros are available from SF). So this kind of deflates the argument that this is somehow a wheeze to help Lindows.

  25. Re:Lindows taking advantage of open-source R&D by IamTheRealMike · · Score: 2
    I guess it's possible, but if they did crack the XBox in this way, Microsoft would just up the rev and new boxes would be secure again.

    Also of course, the XBox makes a pretty lousy computer. It was never designed for that.

  26. Re:Lindows taking advantage of open-source R&D by Troed · · Score: 1
    Andy, of course it helps Lindows. The patches done to get Debian (and Mandrake) running on the Xbox are virtually the same needed to get Lindows running.


    The real problem with the whole idea (in my view) is that 64Mb of ram is too little to make this worthwhile. I know Mr Robertson was interested in how to add 64 more (like the devboxes) but that's still a hardware modification and I can't imagine that working out when you look at the total cost of it.

  27. Re:Wow! by Anonymous Coward · · Score: 0

    Not, true. Does, this, sentence, make, sense? Hell, no!

  28. A triumph for Linux! by Anand_S · · Score: 5, Funny

    Mr. Robertson's project is indeed important, but am I the only one having trouble using vi with a gamepad?

    1. Re:A triumph for Linux! by Anonymous Coward · · Score: 0

      I have trouble using vi period. Does that count?
      :wq

    2. Re:A triumph for Linux! by edgrale · · Score: 5, Funny

      So use emacs :D

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    3. Re:A triumph for Linux! by Anonymous Coward · · Score: 0

      Use your control stick to select text.

      To enter text, switch to text mode by entering left, right, left, right, up, up, down, down, ltrigger, rtrigger, rtrigger, ltrigger.

      Unless using version 46.2.4.56, in which case the correct code is...

  29. Keys already found? by Raptor88 · · Score: 2, Interesting

    The article states: "Also, last June a Massachusetts Institute of Technology student claimed to crack the Xbox's security system, potentially allowing users to run any software on the system." Following the link... "Using a custom circuit board, made in spare time in a three-week period for a total cost of about $50, Massachusetts Institute of Technology student Andrew Huang was able to tap traffic between Xbox components and uncover the keys that unlock the device's protection," So does that mean the security keys have already been found? Why can't someone working for the NeoProject do the same thing that this guy did? It seems it would be more feasible to rebuild something that has worked in the past than it would be to try and brute force the key.

    1. Re:Keys already found? by gotak · · Score: 1

      I think they mean the public key has been found. I think we still need the private key.

    2. Re:Keys already found? by warmcat · · Score: 5, Informative

      The key that Bunnie found was an RC4 key that was stored in ROM. He snooped it being read by the CPU. It was this key that allowed the current generation of hacked MS BIOSes found in modchips.

      The key being discussed here is a 2048 bit RSA key used to encrypt a hash of executable contents. The executable file will not be run by the Xbox unless the decrypted hash matches that of the file being run. The effect of this is that only people who hold the correct encryption key can 'sign' executables so that the Xbox will run them. If you take a signed executable and change even one bit, the decrypted hash will not match and it will not run.

      The public key for the RSA encryption has been recovered from the MS code and is available in the Documentation section of the Xbox Linux site. The bruteforce attack on this will involve trying to decompose this 2048-bit number into two prime factors which were originally multiplied together to form the public key.

      If these numbers can be recovered then the owner of the numbers will be able to sign their own executables and the evil 'Microsoft Code Only' Xbox will have been definitively broken.

    3. Re:Keys already found? by NevDull · · Score: 1

      Too bad the distributed factoring client doesn't run on an unmodified Xbox.

    4. Re:Keys already found? by po8 · · Score: 2

      The key being discussed here is a 2048 bit RSA key used to encrypt a hash of executable contents. The executable file will not be run by the Xbox unless the decrypted hash matches that of the file being run. The effect of this is that only people who hold the correct encryption key can 'sign' executables so that the Xbox will run them. If you take a signed executable and change even one bit, the decrypted hash will not match and it will not run.

      Thus there are two obvious approaches: find the public key or find a hash collision. I am not an Xbox hacker, so I don't know: what hash function are they using, and in what mode? The public key signing is likely to be secure, but perhaps the hash function is not?

    5. Re:Keys already found? by warmcat · · Score: 2

      Its a very slightly modified SHA-1.

      You can find an interesting and clear writeup of the exact algorithm in a document by Franz Lehner, on the Xbox Linux site here.

  30. doesn't B Gates havechimps writing c code? by Anonymous Coward · · Score: 0

    I thought Bill Gates had the corner on the market for trained chimps and the like writing c code. Go back to Redmond and suck on the Gates Super Sugar Titty.

  31. next thing you know... by nuckin+futs · · Score: 2

    he'll want Lindows running on it without any modifications.
    Consumers see Dell, HP, Gateway, and other popular brands while Lindows is on a generic box. Maybe those K-Mart boxes aren't selling, so he wants a more popular box.

  32. Isnt this illegal? by nurb432 · · Score: 2

    Activly funding a project to reverse engineer something that is protected by the DCMA?

    Not that i agree with the law, but by doing this dont they open themselves up for legal action?

    --
    ---- Booth was a patriot ----
    1. Re:Isnt this illegal? by Anonymous Coward · · Score: 0

      Its DMCA you moron. Why the fuck does everyone say DCMA? Digital Copyright Millenium Act? Fucking idiots.

    2. Re:Isnt this illegal? by Anonymous Coward · · Score: 0

      Actually, this might well be called the Digital Copyright Millennium, so it's not that far off.

    3. Re:Isnt this illegal? by m1a1 · · Score: 2

      I don't believe that this falls under the DCMA because this encryption is not used for copyright protection. It doesn't prevent me from bit for bit copying a dvd (as I understand it). What this part of the encryption prevents is "untrusted" software from being run. It is Microsoft's way of keeping third parties from releasing X-Box software they do not approve of.

    4. Re:Isnt this illegal? by Strudelkugel · · Score: 1

      Michael Robertson worried about legal action?

      After losing the lawsuit the RIAA filed against MP3.com, then forking over 200 million dollars of MP3.com investor equity to the RIAA, do you think he really cares about legal problems? The funny part of this occurred when MP3.com sued their law firm for giving them bad advice. Huh, wonder what ever happened to that suit?

      --
      Imagine how much harder physics would be if electrons had feelings! -Feynman, maybe
  33. Collision is sufficient by ehack · · Score: 2, Interesting

    Absent Palladium, just generating a collision pwould probably be enough to get a bootloader through. A neat trick would be to add to some existing software which has already run the checksum . Of course, distributing such a disk would be a gross violation of Microsoft's copyright , and thus defeat the point of the exercise.
    However a patch might be a different matter, especially in countries that do not agree with the DCMA.

    There are LOTS of ways to get around protection when the hardware can be tampered with, even if you don't modify its structure ... just think of a server with an unknown root pasword sitting on your desk.

    --
    This is not a signature.
    1. Re:Collision is sufficient by warmcat · · Score: 4, Informative

      That's my understanding too: if you can make your edits to an already-signed executable, and then twiddle unused bits until the hash matches the original again then your modified executable will be accepted.

      Franz Lehner did have a look at this a while back, with a view to getting some guidence from the hash algorithm as to which bits to change where. The problem was that by design, the hash algorithm loses information in the form of arithmetic carries. It quickly becomes hopeless trying to keep track of what bits are known and what bits are Xs because of carry losses; very quickly the whole thing becomes Xs.

      Even so, it seems likely that even randomly twiddling bits looking for a hash collision is massively more likely to give results than the direct factoring method.

    2. Re:Collision is sufficient by Anonymous Coward · · Score: 0

      Really? Are you saying that the cryptographic hash that MS uses is actually cryptographic? Interesting...

  34. ISR comments are mandatory for... by Anonymous Coward · · Score: 0

    continued participation on Slashdot. Thus, here is your ISR comment:

    In Soviet Russia, the XBox hacks YOU!

  35. Zip is easy? by Anonymous Coward · · Score: 0

    Show me a program that does it quickly - AZPR took months to crack a .zip I had forgotten the passworded to, and that was only because the password ended up being rather short and almost all lower case.

    1. Re:Zip is easy? by Troed · · Score: 0, Offtopic
      http://www.password-crackers.com/crack.html


      I've used PKCrack, there seems to be other programs using the same method. What it does is to use 11 (or is it 14, my memory might be off here) known cleartext bytes - you almost always have these since most filetypes have known headers - and then bruteforce the 3 different 32-bit keys. 32 bits is nothing - you should be able to decrypt the archive within an hour.


      (There's an interesting story behind how this hack was achieved the first time around - it involves fake pirate Sky 0a satellitecard files .. )

  36. The whole point of any Linux distro... by dsfox · · Score: 2

    is to take advantage of open-source R&D. Why have open-source R&D if nobody takes advantage of it?

  37. MOD PARENT UP by Anonymous Coward · · Score: 0

    How did this get marked Redundant when the post BELOW it, which also points out that the Sourceforge link is incorrect, gets modded as Informative?

  38. For $200,000 by dsfox · · Score: 2

    you might get some nice drawings of such a console.

  39. French by Anonymous Coward · · Score: 0

    It's "n'est-ce pas." :-)

  40. 2048 bits to crack?? by harks · · Score: 1

    We need a distributed processing network like seti@home! call it xbox@home?

    1. Re:2048 bits to crack?? by mijok · · Score: 1

      RTFP!!!
      "The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software."

      --
      Karma. Moderation. Is my .sig good now?
  41. Re:Lindows taking advantage of open-source R&D by warmcat · · Score: 2

    Troed, this is what I say, that ''the necessary work for any distro to work with the Xbox'' has been done.

    My point was though that to date, Lindows has not been ported as far as I know. So the parent's idea that this is the Xbox Lindows project rather than Xbox Linux seems unfounded.

    Besides, it seems unlikely Lindows would release a commericial distro that needs a modchip to run. Although us tinkerers lose sight of it, only a tiny fraction of end users are going to open their box and fit a mod.

    Maybe if a way is found to run unsigned code without a modchip there might reasonably be a Lindows distro for the Xbox.

    But I don't think that's why the money is being offered. I think MR has his ''Fuck You'' money and has made a nice choice about telling who to fuck themselves.

  42. MOD PARENT UP by mlyle · · Score: 1

    Breaking 2048 bit RSA is likely to be much more difficult than a birthday attack on the hash algorithm.

    However, both are relatively hard; probably the most fruitful path is to search for an implementation error in the boot loader.

    One interesting path would be a vulnerability in an Xbox game-- as the Win2k embedded environment does not provide protected access to hardware. Any vulnerability in a game could potentially allow the execution of arbitrary code and thus bootstrapping Linux. Inconvenient, but nice.

  43. It's too bad none of you have actually have a clue by gmezero · · Score: 3, Informative

    He has said in interviews recently that he doesn't care which version of Linux is used to achive the goal. It just has to be repeatable. The idea is to prevent Microsoft from jumping ship from the PC to a closed MS hardware platform for PCs which would truely exclude other OSs from the marketplace.

  44. Re:Pro-windows? Never! by FooBarWidget · · Score: 2

    Then what are these?
    +3, Interesting
    +4, Informative
    Look pretty pro-Windows to me. And high moderated too.

    Or how about these highly moderated anti-Linux posts?
    Linux UIs suck
    Linux is too late
    XFree86 is a mess
    A long way to go

  45. Re:Lindows taking advantage of open-source R&D by Troed · · Score: 0, Offtopic
    Then we agree completely :)


    (Depending on if I have to be at work the next month I'm going to seriously look into external mods for the Xbox. There are two stacks worthy of probeing .. )

  46. LMAO by Anonymous Coward · · Score: 0

    "The public key for the RSA encryption has been recovered from the MS code and is available in the Documentation section of the Xbox Linux site. The bruteforce attack on this will involve trying to decompose this 2048-bit number into two prime factors which were originally multiplied together to form the public key.

    If these numbers can be recovered then the owner of the numbers will be able to sign their own executables and the evil 'Microsoft Code Only' Xbox will have been definitively broken. "

    You make it sound so easy!

  47. FWIW, here is his direct quote: by gmezero · · Score: 5, Informative

    http://www.forbes.com/newswire/2003/01/03/rtr83678 5.html

    "There is no business justification; that's not why I did it," Robertson told News.com of his rationale behind the contest. "I did it because I thought people should have the choice to run the software they want on the hardware of their choice."

    Robertson said that Xbox is designed much like a PC with a closed operating system run on Intel microprocessors. He argues that as it has done with PCs, Microsoft is trying to make its software the defacto operating system in gaming consoles.

    "I think Xbox sets a dangerous precedent," he told CNET News.com.

    1. Re:FWIW, here is his direct quote: by nalfeshnee · · Score: 1

      bollox. are the other gaming consoles now somehow open source? nintendo dolphin, sony playstation, etc., etc.?

      let's read between the lines here:

      "I did it because I thought people should have the choice to run the software they want on the hardware of their choice. Especially if that choice is LindowsOS, which only runs on PCs, and with which, according to our own hardware database, we only 'believe' most of the products available in the entire IT world are compatible, having obviously no time to check out important things like HW compatibility when cracking the Xbox would be more fun and gain more publicity (check out http://www.lindows.com/lindows_hwsw_compatibility. php?company_id=187&category_id=2 for example. Challenge: try and find a product which lindows.com actually KNOWS is compatible). Oh, and we also require you to connect to lindows.com to update the OS. So the OS is, in a sense, closed. Quote:

      "Can I use Click-N-RunTM to install software from the Click-N-Run Warehouse on machines not running LindowsOS?
      Because Click-N-RunTM relies on technology built into the actual operating system, it requires LindowsOS and its native web browser to operate.

      Where do the software titles found in the Click-N-Run Warehouse come from? Lindows.com simply provides the marketplace to house applications that others develop. "Publishers" place the software in our warehouse, decide how to describe the software program, what price to charge, and so on. (Visit http://publish.lindows.com for details on how you can publish software titles in the Click-N-Run Warehouse.)"

      as said, a load of bollox.

      Nalfy.

      --

      -- Despair is an operating system that ANY human being can run, sort of a psychological JAVA --

  48. Why? by miffo.swe · · Score: 2

    I know many nerds want to give MS a kick on the nose but all they do with this is helping them fine tuning the Palladium technology. If i want to play games i sure as h*ll dont buy an Xbox. If i want linux, well PS2 already have linux, why bother with the useless Xbox? Its just an old ancient PC by now, you can get one cheaply from Ebay.

    Pointless and stupid projekt, do something useful instead. Build an emulator for Xbox, that would be useful atleast.

    --
    HTTP/1.1 400
    1. Re:Why? by Anonymous Coward · · Score: 0

      Build an emulator for Xbox, that would be useful atleast.

      You're asking people to build an emulator for an NVidia GeForce chip. Think about that for a minute.

      No, you can't pull a WINE on it, since XBox games are statically linked against XBox-Windows.

    2. Re:Why? by WWWWolf · · Score: 1
      I know many nerds want to give MS a kick on the nose but all they do with this is helping them fine tuning the Palladium technology.

      "So they did the most amazing distributed computing feat of the millennium and cracked the key", says MS. "Let's just generate another key."

      Cracking 2048-bit keys is pretty hard - and I think that no matter how many computers try to crack the key, by the time that key gets cracked, the XBox platform is well obsolete. (I'm not a crypto expert. Was it before or after the universe was said to collapse?)

      DVDs were cracked because they invented their own algorithm that used too short keys. MS has picked good, proven crypto algorithms (RC4 and RSA) with absurdly long keys, which means they won't be cracked as easily. Palladium will undoubtedly be based on such state-of-the-art algorithms; there's really nothing left in Palladium to "tune".

      And as for "tuning", cryptography algorithms are not "tuned". Cryptography if anything is a black art in the grimmest sense of the word - If you don't know what you're doing, you'd better stick to the proven algorithms, and the algorithm isn't proven until it stands decades of analysis. You just don't invent a cipher and be done with it.

  49. Weakness in software/hardware? by Anonymous Coward · · Score: 0

    I don't actually know how palladium, or this authentication in xbox works, but I don't understand why the hardware/software would have the private key in them?

    My common sense says that all they need, is to send first some data to MS to be signed with private key, after that they can authenticate with that data, that is verify the data against the public key.. why wouldn't this work?
    No private key is needed, only some data that is signed with private key.

    1. Re:Weakness in software/hardware? by Spameroni · · Score: 3, Interesting

      This is true, however, the problem lies in what data must be signed by the private key. Code signing works by making a hash of the code (in this case, the OS loader or the like, which in our case would be the Linux loader) and signing that hash with the private key. The bootrom then uses the Microsoft public key to verify that the OS was signed by the Microsoft private key. Thus, the only ways that this could reasonably be done is by:
      1) Getting the microsoft private key
      2) Making the hash of the OS the same as the has of the MS OS (nigh unto impossible)
      3) Changing the public key in the bootrom (which isn't allowed for this stage of the competition, at least hardware wise)
      4) Somehow switching the OS after the initial code signing check is completed

      Here's a reference if you want to read more Code signing

  50. I have faith.. They will figure this one out by Mean_Nishka · · Score: 1
    I have no doubt our hacker friends will get to the bottom of the Xbox encryption.. Especially if $100k is involved. There's a lot at stake here especially for a guy like Robertson who's trying to make some bucks and bring linux to the desktop at the same time.

    And let's not forget this is a Microsoft OS for G-d's sake.. Its base OS is patched nearly every day to fix its gaping security holes. The $199 Xbox based PC will be here this year.

  51. Re:It's too bad none of you have actually have a c by anmpl · · Score: 1
    he doesn't care which version of Linux is used to achive the goal

    That's because if any one version of Linux is used and works, then all the other versions will work too.

    The idea is to prevent Microsoft from jumping ship bla bla...

    Nah, the idea is promotion. That's all.

  52. Re:Pro-windows? Never! by handsomepete · · Score: 1

    Are you high? What exactly are you trying to prove anyways? Not that I really give a damn what bias the slashdot crowd has (or about whatever little argument that's going on over here), but you've got to throw some better examples out, or at least label them better.

    Link 1: Certainly pro-Windows, but it seems their problems with Linux stem from this: "but Linux has been nothing but a problem for us here because the one person we have who can fix the problems is overloaded"

    Link 2: "Our radio consoles and recording system all use Windows NT and 2K. We KNOW it would be cheaper to use *nix. We KNOW the system would be more reliable." Using Windows out of necessity (propietary software for the system).

    Link 3: Skimmed it, but it seems to be offering suggestions for Linux to compete, not ripping it apart.

    Link 4: "There already is a Unix variant in the number two slot, and its called Mac OS". Anti-Linux? Maybe I need to read surrounding comments to get it.

    Link 5: Someone taking issue with X? I hardly consider that "Anti-Linux". The poster even admits that it works and most people, set in front of it, wouldn't be able to tell the difference between it and Windows. And hell, I'm not crazy about X either, but it's all I use.

    Link 6: "Linux has big strides to take before you can think about it surpassing Macs as the #2 desktop OS. I don't want to disparage Linux because if I weren't using a Mac I would most likely run Linux, but I see no way Linux will compete as a mass desktop OS until it becomes far easier for the average user. "

  53. Who dares wins... by gilesjuk · · Score: 1

    Microsoft wouldn't dare turn the XBox into a PC right now, it would be used against them in an anti-trust case.

    However I don't see why someone else can't do it? the Lindows guy has seen a gap in the market that he wants to fill.

    Even if they do suceed in getting Linux to boot on an unmodified XBox I would imagine that anyone who uses the information commercially will soon be in front of the courts facing DMCA. Microsoft would try to get sales of the OS stopped until the outcome of the case.

    1. Re:Who dares wins... by Anonymous Coward · · Score: 0

      > Microsoft wouldn't dare turn the XBox into a PC right now, it would be used against them in an anti-trust case.

      No doubt with the same devastating, action-restraining results as the last two such cases..

      ..oh, wait..

  54. Reality check by hyrdra · · Score: 4, Informative

    When the XBOX starts up, it loads the hash of the header into memory and decrypts a 2048 bit RSA signature and compares this to the header hash. If it matches, the program proceeds and it loads another section and does the same thing. There is no way to get around this either than knowing the private key or a hardware modification.

    The RSA signature used to sign/for comparison purposes used with Xbox execuatables is 2048 bits long.

    Common secure internet traffic, carrying thousands of credit card numbers as we speak, uses 128 bit keys (almost always).

    It's virturally impossible with today's computational power and methods to break a 2048 bit key. Even if you somehow had all the processing power of all the current distributed systems, it would still take many thousands of years to break using classical methods. You either need several thousand years or an optical/DNA computer whose concept hasn't been refined yet.

    In case some of your forget: it gets exponetionally harder as the length of the key increases. It's not like you just have to search a 128 bit key space 16 times. There are fancy methods where by you can get away with knowing some of the key like differential analysis, but when you increase the size of the key the performance of those tend to fall off also where you have no increase over brute force and man in the middle attacks.

    So don't even think about joining that futile brute force effort, because it will just waste your time. What Lindows should have done is hire a hit man/career criminal to break into Microsoft or a 3rd party who has the key and steal it. Or optionally pay off an Xbox developer or employee who has similar access. Either way, it would be both cheaper and actually give the real key, unlike all of this nonsense.

    --


    "I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
    1. Re:Reality check by Alex_Ionescu · · Score: 1

      Actually, the Private Key they are trying to crack is a "simple" 64-bit RC4 key.

    2. Re:Reality check by Anonymous Coward · · Score: 0

      Still, i think u should really read "applied cryptography" and then discover u are really writing senseless things cos' ure comparing public-key system with secret-key system, and that makes no sense.

    3. Re:Reality check by Alex_Ionescu · · Score: 1

      Nevermind, got mixed up with the first key that had leaked.

    4. Re:Reality check by Wonko+the+Sane · · Score: 2, Informative

      You are comparing apples and oranges. You are talking about 2048 bit symmetric key vs a 128 bit symmetric key.

      Public key systems (such as PGP/GPG) use an asymmetric public key (2048 bit) to encrypt a symmetric session key (128 bit).

      In any case, you can't compare the time needed to crack a asymmetric key to that of a symmetric key, since they are completely different types.

    5. Re:Reality check by ssimpson · · Score: 5, Informative

      The RSA signature used to sign/for comparison purposes used with Xbox execuatables is 2048 bits long.

      Common secure internet traffic, carrying thousands of credit card numbers as we speak, uses 128 bit keys (almost always).

      You are confusing symmetric and asymmetric ciphers. SSL (or "secure internet traffic", if you must) uses 128-bit symmetric keys coupled with larger (1,024-bits or greater usually) asymmetric keys.

      In case some of your forget: it gets exponetionally harder as the length of the key increases.

      "In case some of you forget" should be rephrased to "I'm going to state something authoritative now and hope I'm right". The 2,048-bit key you are alluding to is a asymmetric key (RSA). The fastest algorithms for factoring and computing discrete logs are sub-exponential!

      --
      "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
    6. Re:Reality check by Anonymous Coward · · Score: 0

      Can someone explain to me exactly why you can't just strip the header off some MS product that runs on the XBox and affix it to the program you wish to run?

    7. Re:Reality check by nathanh · · Score: 2

      The RSA signature used to sign/for comparison purposes used with Xbox execuatables is 2048 bits long.

      Common secure internet traffic, carrying thousands of credit card numbers as we speak, uses 128 bit keys (almost always).

      To beat the dead cliche, you are comparing apples and oranges. The 2048 bit keys used in the X-Box are asymmetric. The 128 bit keys used by SSL are symmetric. SSL negotiates the symmetric key by using the RSA algorithm: a method of using asymmetric keys to securely determine and exchange a random symmetric key.

      The 2048 bit key is not necessarily out of reach. 512 bit keys were breakable for less than $1,000,000 investment in 1997. It's likely that 1024 bit keys can be broken today with a similar investment. See what the experts have said about the feasibility of attacking these keys.

      In case some of your forget: it gets exponetionally harder as the length of the key increases. It's not like you just have to search a 128 bit key space 16 times. There are fancy methods where by you can get away with knowing some of the key like differential analysis, but when you increase the size of the key the performance of those tend to fall off also where you have no increase over brute force and man in the middle attacks.

      Asymmetric keys DO NOT get exponentially harder as the bit size increases. I'm not very knowledgeable about cryptography but even I can spot complete ignorance.

  55. Re:Pro-windows? Never! by FooBarWidget · · Score: 2

    "Are you high? What exactly are you trying to prove anyways?"

    That, in contradiction to popular belief, Slashdot is NOT an anti-Windows pro-Linux place. Duh.
    There are only very few pro-Linux-anti-Windows people, in spite of what you think. Ditto for "elitists", "zealots", or whatever people come up with tomorrow. They're like 5% of the entire community.

    "Using Windows out of necessity (propietary software for the system)."

    So? Still pro-Windows.

    "Skimmed it, but it seems to be offering suggestions for Linux to compete, not ripping it apart."

    But still pro-Windows. I never said those posts rip Linux apart, I said they are pro-Windows.

    "because if I weren't using a Mac I would most likely run Linux"

    "but I see no way Linux will compete as a mass desktop OS until it becomes far easier for the average user."

  56. Ever hear of typos? by nurb432 · · Score: 2

    My my, dont we have our panties in a bind.. GF didnt put out again for ya?

    Get a life.

    Notice i didnt resort to using insulting labels. Life is too short to worry about misplaced characters, or spending time insulting people while showing your low mental ability in the process..

    --
    ---- Booth was a patriot ----
  57. How DO you get your code authenticated? by Anonymous Coward · · Score: 2, Insightful

    Does anyone know how game developers get the codes to authenticate their executables? Do they just upload them to some secured server of Microsoft, and get the signature back?

    If that's the case, getting into that server might be easier than brute-forcing the key.

    1. Re:How DO you get your code authenticated? by Anonymous Coward · · Score: 0

      Yes, but that would be illegal, dumbass.

    2. Re:How DO you get your code authenticated? by Anonymous Coward · · Score: 0

      Yeah, and brute-forcing the key is any more legal than that... DUMBASS

    3. Re:How DO you get your code authenticated? by c0rruptc0d3 · · Score: 1

      This could nearly have been an intelligent thread if it weren't for children calling each other dumbass. The problem with this community is that for each great mind there are one thousand children.

    4. Re:How DO you get your code authenticated? by Anonymous Coward · · Score: 0

      Two points - 1. You are saying that you either are a great mind or you are a child. Somehow, that's not exactly how the world works. There are, of course, great minds, but there are also intermediates between geniuses and idiots. 2. You are establishing a ratio that only 0.1% of the /. community are actually competent under your black and white definition. According to that, I would have the competence of a 5 year old?

    5. Re:How DO you get your code authenticated? by benjamindees · · Score: 1

      I'm sure it's more like they mail MS a copy on CD and get it back the same way. B-Ga isn't dumb enough to put the private key on one of his servers directly connected to the 'net.

      --
      "I assumed blithely that there were no elves out there in the darkness"
    6. Re:How DO you get your code authenticated? by Anonymous Coward · · Score: 0

      It is in fact legal to brute-force the key. And posing as a game developer is also a ridiculous idea, as well as illegal.

      (dumbass)

    7. Re:How DO you get your code authenticated? by Anonymous Coward · · Score: 0

      diiiiiiiiiiiietttttttttt zzzz zzzz eeeeeee rrrrrrrrrrrrrr

  58. Re:Pro-windows? Never! by handsomepete · · Score: 1
    "Are you high? What exactly are you trying to prove anyways?"

    "That, in contradiction to popular belief, Slashdot is NOT an anti-Windows pro-Linux place. Duh. There are only very few pro-Linux-anti-Windows people, in spite of what you think. Ditto for "elitists", "zealots", or whatever people come up with tomorrow. They're like 5% of the entire community."
    Why are you trying to prove that? This seems to have become really important recently... I've seen several people trying this kinder, gentler we-accept-everyone slashdot idea on for size recently. Coinceidence, fiction or truth? I dunno.

    "But still pro-Windows. I never said those posts rip Linux apart, I said they are pro-Windows."
    Actually, you said they were anti-Linux, which they mostly weren't. And they weren't really pro-Windows (the last 4 that is) because all they talked about was Linux. Besides that, even if you could find some way to prove, outside of some poll (if you're using these numbers to do anything important, you're insane :) ) and poorly chosen quotes, that the comment posters of this site love Windows and aren't super freaky pro-Linux, that's still discounting the editors. Which stories the editors choose to post is what the bulk of the bazillion daily visitors see, although I'm sure Taco and company really appreciate your myth debunking.

    Like I said, I don't really care, I just thought the proof you presented was flaky. As far as I'm concerned there's definitely a Linux bias here, but it doesn't bother me. For the record, I voted for Windows on that poll because I was at work, but I don't actually have a Windows machine at home. Now, if you could figure out the number of slashdot accounts that are throw away troll accounts, then I'd be impressed (I'd guess there's ~9,000).
  59. Random Thought by Anonymous Coward · · Score: 0

    assume for a second that brute forcing the key is feasible...and u jus have to do p*q=K...
    who's to say microsoft didn't do something else in the process...

    1. Re:Random Thought by warmcat · · Score: 4, Informative

      We proved that the validation algorithm is fully known, by reverse engineering it and testing it on known good files.

      The C app incorporating the test can be had from CVS at:

      http://sourceforge.net/cvs/?group_id=54192

      The module name is xbedump. This was work from Franz Lehner and Asterisk, based on the dump app by Michael Steil.

  60. that poll might be a little bit skewed... by gimpboy · · Score: 1

    when i view slashdot, i view the stripped down version. most of the graphics and stuff are gone, just the stories. as a result the polls also dont show up. i wonder how many of the people who come to slashdot and use linux do so in a similar manner.

    --
    -- john
  61. FYI by tolan-b · · Score: 1

    the project to brute force the key isn't part of the xbox linux project.

  62. Re:Pro-windows? Never! by FooBarWidget · · Score: 2

    "Why are you trying to prove that?"

    Why are you asking this?

    "And they weren't really pro-Windows (the last 4 that is)"

    Sure, ignore the fact that I explicitly stated that the last few links are anti-Linux instead of pro-Windows...

    "Now, if you could figure out the number of slashdot accounts that are throw away troll accounts, then I'd be impressed (I'd guess there's ~9,000)."

    Urgh... make that 9,000 milion.

  63. I wasn't sure before... by handsomepete · · Score: 1

    You seem to have a perfectly normal posting history, but I'd swear you're trolling.

    The full quote from me was "Actually, you said they were anti-Linux, which they mostly weren't. And they weren't really pro-Windows (the last 4 that is) because all they talked about was Linux." This was in response to you saying, "But still pro-Windows. I never said those posts rip Linux apart, I said they are pro-Windows." after I quoted the third or fourth post (under the anti-Linux heading).

    You responded with "Sure, ignore the fact that I explicitly stated that the last few links are anti-Linux instead of pro-Windows...". What the hell? I surrender, I have been outwitted.

    1. Re:I wasn't sure before... by Lord+Bitman · · Score: 2

      I on the other hand would point out merely that some of the posts seem Anti-Linux, not Pro-Windows, but more importantly that this leaves all of 2 pro-windows posts that you managed to find out of millions of messages.

      --
      -- 'The' Lord and Master Bitman On High, Master Of All
  64. Just curious about two things.. by lobsterGun · · Score: 2, Insightful
    Is there any way quantum computing an be used to do this?

    Which of the following is smallest?:
    1. The length of time that it would take to break the key using conventional methods.
    2. The length of time it would take to build a quantum computer to break the key.
    3. The platform lifespan of the XBox.
    1. Re:Just curious about two things.. by Anonymous Coward · · Score: 0

      First question:
      Yes, using Shor's factoring algorithm.
      (See, for instance: "Quantum Computation and Shor's Factoring Algorithm."
      A Ekert and R Jozsa. Reviews of Modern Physics, pages 733--753, July 1996)

      Second question:
      If "convential methods" mean the methods currently available..
      I'd have to say 3. Definetly 3.

      If anyone wants to make a quick $200k, there's always the RSA challenge.
      The 2048-bit number has yet to be cracked.
      The 576-bit hasn't been cracked either, or anything in between.

    2. Re:Just curious about two things.. by CaptainBaz · · Score: 1

      I'd go for #3 without a doubt.

  65. "Too many secrets" by Idou · · Score: 2

    Ironically, Hollywood found an easier way to break any encryption in their movie "Sneakers."

    --
    Sdelat' Ameriku velikoy Snova!
  66. Mitnick would disagree by Anonymous Coward · · Score: 0

    No encryption scheme is foolproof as long as people are involved. Remember how the DVD region code encryption scheme was blown by a stupid company years ago? The same thing is bound to happen again.

    1. Re:Mitnick would disagree by Troed · · Score: 1
      I suggest you learn the subject we're discussing - then reply. Mitnick would very much agree with me - since people aren't involved. We're talking plain crypto here.

    2. Re:Mitnick would disagree by Anonymous Coward · · Score: 0

      Mitnick would disagree with your assessment.
      I suggest you remove your head from your ass, then reply.

  67. Isn't the key still ON the X-Box by etymxris · · Score: 2

    The key might not be put in an especially vulnerable place like the bus to calculate the hash. The hash may be computed in the hardware. But given the incredible size of the number (2048 bit), wouldn't it simply be easier to dissect the hardware and try to figure out the key that way?

    The X-Box runs, after all, in a "hostile" environment. It doesn't check up against MS servers every time it runs. So all the relevant keys used for encryption, public or private, have to exist in some form or another on the X-Box itself.

    I might be misunderstanding the issue. Anyone care to explain this for me?

    1. Re:Isn't the key still ON the X-Box by hobit · · Score: 1

      Isn't the key still ON the X-Box?


      Warning: IANAC - I am not a cryptographer.


      In a word, no. The joy of RSA is that the Xbox has a key (the public key) which can be used to decript the message, but can't to used to encript the message (for which you need the private key). A different key is needed for that. Now, if you could factor the public key you could recreate the private key.


      Hope that helps (and is right!)

      --
      As Nietsche famously said, "If you stare too long into the Abyss, 1d4 Tanar'ri of random type will attack you."
    2. Re:Isn't the key still ON the X-Box by tc · · Score: 2

      It's a public-key system. So although the public key is indeed somewhere on the box, so it can check the signature, the private key, which you use to sign the executables is (presumably) locked in a filing cabinet in a disused lavatory somewhere in the bowels of Microsoft with a sign on the door saying "beware of the leopard".

    3. Re:Isn't the key still ON the X-Box by Anonymous Coward · · Score: 0

      I think I've seen that room. It was in building 6 floor 6, but I can't seem to remember the room number.

  68. What a waste of time... by waltc · · Score: 2, Interesting

    Why would any sane person spend hundreds of thousands of his own dollars just to run Linux on an Xbox? I mean, why not just buy a $199 Lindows box from Walmart, instead?

    The plan at its heart is very simple:

    (1) If you want to run Xbox games buy an Xbox

    (2) If you want to run Linux on similar hardware buy a Lindows machine

    The guy is acting as if you can't run Linux on anything *except* an Xbox, and Microsoft is standing in the way!....What rubbish! You can run Linux on practically *anything*--hence there is no need or justification for this at all.

    Microsoft does not market, imply, or pretend in any fashion that the xBox is a general-purpose computer. It is manufactured and marketed as a game console. If people buy it under any other delusion--well, that's their problem as I see it. The won't be the first to try and turn a sou's ear into a silk purse.

    I have to believe, honestly, that the poor fellow is suffering mentally somehow, since there are far better ways to gain publicity about your products for the same amount of money. Interesting that you don't see Microsoft pulling boneheaded stunts like this--maybe that's why they've been successful (hint.)

    1. Re:What a waste of time... by Anonymous Coward · · Score: 0

      He probably wants to sell Lindows for XBox without paying MS to sign it.. although he'll prolly get sued.

    2. Re:What a waste of time... by CTho9305 · · Score: 2

      Well, XBox seems to be a precursor to Palladium. If he cracks it, then the break could be used as an example of the problems with such security measures, and it would have major repercussions (sp?).

      However, based on what my friends who understand crypto say, a 2048-bit key is pretty tough to crack, so success is unlikely even with a distributed project.

    3. Re:What a waste of time... by One+Louder · · Score: 1
      I have to believe, honestly, that the poor fellow is suffering mentally somehow, since there are far better ways to gain publicity about your products for the same amount of money.
      Given the complexity of the effort needed to break the key, I think his money is very safe - in which case the publicity came effectively for free. Sound like a pretty good deal to me.
    4. Re:What a waste of time... by m1a1 · · Score: 3, Interesting

      Fail to understand the use?

      First of all, as I recall the Lindows box from Wal-Mart is $299.

      The X-Box from Wal-Mart is $199.

      X-Box specs:
      Coppermine Pentium 3 processor (about 733Mhz as I recall)
      Nvidia gpu which falls somewhere between a Geforce 3 and Geforce 4 in power (according to anandtech)
      10GB hd
      64 MB of RAM

      By comparison the Lindows Box has
      800Mhz Via C3
      40GB hd
      onboard graphics (ugh)
      128 MB of RAM (I think PC133)

      It seems to me that the Pentium will probably outperform the C3, and know the X-Box GPU is far more powerful than what you have in the "Lindows Box." Assuming the extra hd space and RAM makes up for this (it doesn't) the X-Box is still $100 cheaper.

      Edge: X-Box

    5. Re:What a waste of time... by filmcritic · · Score: 1

      Yes, you are failing to understand the use. Call, write or fax ANY game developer who develops PC games and Xbox games. Ask them how "computer-like" the Xbox is. Listen in amazement as they debunk every lie ever spouted on this website. But then again, slashdot is known worldwide for their expertise in everything known to mankind, so of course "the developer would lie about the truth".

      It's been over a year since the Xbox debut and the pro-communist OS crowd is still trying to lie and confuse a non-issue. Real world folks do not care and are buying Xboxes to play games. Don't believe me? Read this and see what you think.

    6. Re:What a waste of time... by Anonymous Coward · · Score: 0

      People aren't doing this so they can run Linux. Jeezus, I already have 4 computers running Linux... it's not like I need another one. And, even if I did, I could build one that is better than the hardware used in the XBox. The reason that the Linux community is doing this is to say "FUCK YOU!" to Bill Gates and Microsoft. Anything that they can produce.... the Linux community can destroy! It is a pissing contest.

  69. He would be better off asking MS to sign it by codepunk · · Score: 3, Interesting

    Put together a boot loader and ask MS to sign it. If they do not turn around and sue them under the terms of the approved judgement and or a anti-trust suit.

    --


    Got Code?
    1. Re:He would be better off asking MS to sign it by Sleepy · · Score: 2

      >Put together a boot loader and ask MS to sign it. If they do not turn around and sue them under the terms of the approved judgement and or a anti-trust suit.

      Not likely. The boot loder is not a game title, it's (considered) part of the OS and part of the security. You are asking for control of the hardware, which is NOT the same as asking the hardware to run a title.

      Microsoft could easily defend against a request to shoot down their own security.

      Look at the version of Linux running on the Sony PS2: the Sony version runs Linux in a sandbox, which grants services to the Linux client. Microsoft would consider this LONG before signing some boot loader...

      Some folks could argue "it's Linux... who cares if you 'ask' vs. 'tell' the hardware what to do?" as long as MS signs for some virtual host application that could run Linux.

      Well, yeah. That's the issue. Personally I would *not* want a virtualized Linux (I mean... I like VMware, but I run it by *choice*... I still run Linux on the "bare metal").

    2. Re:He would be better off asking MS to sign it by bored · · Score: 2

      I've been thinking about this for a while. The trick would be to put a trojan in a real game. When the trojan activates, it exploits some security hole in the Xbox OS to gain full control and then run a boot loader. That way you buy the game for the price M$ charges for the licence fee, hold down some button, which activates the trojan/boot loader and then swap in a CD for your favorite OS.

    3. Re:He would be better off asking MS to sign it by Sleepy · · Score: 2

      >I've been thinking about this for a while. The trick would be to put a trojan in a real game. When the trojan activates, it exploits some security hole in the Xbox OS to gain full control and then run a boot loader.

      I still don't think that would work.

      First, X-Box is a training ground for the eventual Microsoft PC, which Dell etc. will "resell" or license. The Xbox security is a prototype of Palledium, and I suspect that everything has it's own memory space. Overflow the game loader? Great.. you crash that segment but not the OS.

      This is why people run network daemons as non-root users... you can overflow one, but gain no elevated privleges over the current UID. You CAN elevate yourself, but you need to find a second, elevated account or process to attack.

      Microsoft is going to be MUCH more concerned about locking down their profits... I suspect a LOT of testing going on with overflows. This does, after all, affect their bottom line, which makes it more critical than say customer data integrity (which as a monopoly they can ignore)

  70. ahem by Hubert_Shrump · · Score: 2

    Then where has my 200,000 dollars gone?

    --
    Keep your packets off my GNU/Girlfriend!
  71. Instead of hacking... by WetCat · · Score: 1

    ...isn't it better to try to find a turing-complete machine inside of already signed by Microsoft applications... and install Linux on that machine!?
    Or incorporate that machine in some cool game
    and sign that game by Microsoft.

  72. fips by JDizzy · · Score: 3, Insightful

    Its strange to consider that Microsoft didn't protect parts of the hardware with fips rated hardware like some crypto cards are. In case you don't know what FIPS means, it is "Federal Information Protection Standard", and parts of it covers secure hardware. Stuff like crypto accellerator boards that self destruct if you attempt to x-ray, or break the hermetricly sealled gel enclosures. Stuff like that protects the boards from people who would attempt to reverse engineer hardware. Microsoft *did* do some things to make life hard for hackers with the way the HDD works. Microsoft does stuff that is more anoying than a barrier to reverse engineering.

    Locating the private keys for the games would be the best way to hack an xbox. Considering a modified xbox will not jive with future xbox games, and or network servives... the hardware mod is not desireable.

    Further more, hacking contests should be managed by the original vendor, in this case Microsoft. Think of the RSA crypto challenges. Those are fair contests, that actually interest crypto folks to invest serrious effort, and brain power.

    --
    It isn't a lie if you belive it.
  73. How about by Anonymous Coward · · Score: 0

    I have the key but can't fit it into this small text submisson box.

  74. Re:Pro-windows? Never! by Anonymous Coward · · Score: 0

    I would say that Microsoft is pretty deeply disliked here -- but it's in the same sense that people dislike the government. Everyone complains about them, but everyone pays their taxes and cashes their social security checks and runs Windows. Here and there there's a few real revolutionaries waiting for their time.

    For the most part the "Mickey$oft" and "blue screen huhuhuh" crowd gets away with naked, unsubstantiated M$-ba$hing and is often rewarded for it. If this was a "pro-Windows" site, those folks would be moderated out of existance.

  75. Whatever. by Anonymous Coward · · Score: 0

    Dumbass.

  76. the xbox knows the key right? by Anonymous Coward · · Score: 1, Interesting

    the xbox knows the key itself right? why cant they key be extracted from the xbox?

    1. Re:the xbox knows the key right? by benjamindees · · Score: 2
      You should have read one of the other ten posts that explain this question. The XBox knows the Public Key, which can only be used to verify that a piece of data was in fact signed by the Private Key, which is locked in a vault in Redmond. In order to sign (and run) code, we need the Private Key. The Private Key can be deduced from the Public Key, but it takes a massive effort such as the one described.

      Everyone who is interested in this should read the excellent book "The Code Book" by Simon Singh. It explains the complete history of cryptography in terms that anyone with a basic understanding of algebra can understand.

      --
      "I assumed blithely that there were no elves out there in the darkness"
    2. Re:the xbox knows the key right? by Duds · · Score: 2

      Incidentally as I'm sure the parent poster knows, this is exactly how PGP works.

      You have someone's public key, so you can decrypt their stuff, but you don't have the private key so you can't encrypt stuff to make it seem like they wrote it.

  77. I feel a story coming on... by technoCon · · Score: 1

    What Lindows should have done is hire a hit man/career criminal to break into Microsoft or a 3rd party who has the key and steal it. Or optionally pay off an Xbox developer or employee who has similar access. Either way, it would be both cheaper and actually give the real key, unlike all of this nonsense

    I'm wearing my novelist hat: Let's suppose he's already done this. If he just releases the number, it'll be suppressed as stolen goods.

    Suppose instead that he instigates a hopeless distributed cryptographic attack that just happens to get remarkably lucky.

    he maintains plausible deniability.

    if he spoofs J Random User's client connection, he's got an unwitting cutout
    in JRH.

    In fact, a cunning villain will choose the teenage son of someone with sizeable political moxie to defend the lad.

  78. It's too late to stop global warming... by Anonymous Coward · · Score: 0

    ...so why don't we ask the japs to hand over the ASCII White this group?

  79. Re:Lindows taking advantage of open-source R&D by jhoffoss · · Score: 2
    I don't see how "upping the rev" would achieve anything. If that key is cracked, anything can be made to appear as though it were signed by MS. If MS releases a revision of the Xbox with a different key, every old game would not work with the new Xbox, which wouldn't fly at all. So they have to still allow code signed with that key to be run, which means you can run anything if you have that key.

    And yes, the Xbox may not be the best computer, but think about what you can do with it; USB ports, built in network, TV outs, and a USB Video Capture module made by hauppage (I think) means you could get your Xbox to run as a PVR. On top of that, a website could be developed so your Xbox PVR can connect and get television schedules and programming information so your PVR isn't like a very old VCR where all you can is press 'record'.

    Now not only do you have a halfway decent gaming console, but you have a $200 TiVo with no advertising. (Well, $300 or so including the cost of the vid capture unit.) That alone is motivation enough for me to hope this offered reward brings forth a solution.

    --
    Linux: The world's best text-adventure game.
  80. I know Michael Robertson by Anonymous Coward · · Score: 0

    And knowing him as I do, trust me, he did this probably just to tweak MS.

    Right on!

    MF

  81. God damn it by Rogerborg · · Score: 2

    This wasn't a Slashdot meta comment. I don't give a snot what OS's you lot are using to view this site, I'm commenting that it's ironic that a project to run the Linux OS on a Microsoft product relies on a Microsoft OS. Not every comment on Slashdot is self referential.

    --
    If you were blocking sigs, you wouldn't have to read this.
  82. Another false crypto-expert gets karma by Anonymous Coward · · Score: 0

    Check your facts before posting as an authority. You compare the 128 bit security on your browser to the 2048 bit key on the xbox - THEY'RE DIFFERENT CIPHERS! There is no direct relation. By loose comparison, they are probably of similar strength.

    If you're willing to set RSA/etc to 128 bits, you are NEVER using the browser on my computer...

  83. No... Really? by Anonymous Coward · · Score: 0

    A Linux system with messed up fonts? Now THERE'S a fucking surprise.

    I hope someone close to you gets cancer so you can watch them die.

  84. Re:Lindows taking advantage of open-source R&D by timeOday · · Score: 2
    I guess it's possible, but if they did crack the XBox in this way, Microsoft would just up the rev and new boxes would be secure again.
    We've already seen a test case - DVD. They can't re-secure css without invalidating all the old keys, which is very problematic.
    Also of course, the XBox makes a pretty lousy computer. It was never designed for that.
    How so? The CPU is a P3, and there's nothing special about the RAM and HDD afaik. So what's the problem?
  85. Re:It's too bad none of you have actually have a c by Anonvmous+Coward · · Score: 2

    " The idea is to prevent Microsoft from jumping ship from the PC to a closed MS hardware platform for PCs which would truely exclude other OSs from the marketplace."

    I'd buy that if he remained anonymous. Now he's the little guy who'll become a martyr when MS crushes down on them. He basically bought off the Slashdot community.

  86. this was posted TWICE by me 2 days ago. by crhylove · · Score: 1

    because i thought it was important pertinent information for the many coders that *i* know personally troll /. why wasn't my article posted? how did kai get props for this? why wasn't it posted FORTY EIGHT HOURS AGO?!?! /. editors SUCK!

    --
    I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
  87. Reverse engineering is OK even under the DMCA by yerricde · · Score: 2

    It has to do with the 'no reverse engineering' clause in the DMCA

    Actually, there exists a clause in the DMCA (17 USC 1201(f)) that specifically exempts reverse engineering, to the extent that it is required for interoperability, from the circumvention ban. (The DeCSS ruling turned out the way it did because Johansen put the cart before the horse and published a DeCSS program before a UDF filesystem for Linux or BSD was finished, making copying DVDs the "most apparent use" for DeCSS.)

    --
    Will I retire or break 10K?
    1. Re:Reverse engineering is OK even under the DMCA by Anonvmous+Coward · · Score: 2

      Ah.. glad ya clarified that for me. :)

      Thank you.

  88. High-level emulation by yerricde · · Score: 1

    No, you can't pull a WINE on it

    Are you so sure? Many Nintendo 64 emulators effectively "pull a WINE" on N64 programs through a process called "high-level emulation" (HLE). In essence, the emulator recognizes common code fragments and implements them in native code. It's like dynamic recompilation with an "opening book". The compatibility isn't as great as straight emulation, but it does run select titles, which use the most common graphics engines, with a higher FPS.

    --
    Will I retire or break 10K?
  89. Michael Robertson works for MICROSOFT!!! by CSG_SurferDude · · Score: 1

    Don't do it! Do not work on this project!

    Michael Robertson works for MICROSOFT!!!

    Think about it for a minute....

    1. Microsoft hires Michael Robertson for XXX dollars, with a contractual obligation to not reveal that he works for MS.
    2. MS then supplies Michael Robertson with $200,000 to offer as a reward for this project.
    3. Hackers everywhere try to crack the Xbox...
    4. When the hackers succeed, then MS uses that knowledge to tighten down Xbox Version 2, and to (More importantly) fix Palladium/DRM, for a much lower cost than MS could do in the first place.

    In conclusion, don't do this, and you help fight against MS, do this project, and you help MS take over the world.

    < /paranoia >

    Note to moderators: It's FUNNY, darn it!,/I>

  90. Wrong, p and q must be prime for RSA to work!! by Tom7 · · Score: 2

    OK, I'll take the bait, using the terminology from Applied Cryptography.

    Let p = 4 and q = 9, as suggested.

    Then, n = 36.

    Choose e=65537 as the encryption key. (Common practice is to use a fixed e;
    (p-1)(q-1) and 65537 are relatively prime.)

    Now we need d such that ed === 1 (mod (3*8)),
    so 65537*d === 1 mod 24.
    d = 17.

    Now let's encrypt m = 6.
    c = 6^65537 mod 36 = 0 (!)

    Now, let's decrypt.

    t = 0^17 mod 36 = 0 (!)

    The process will often fail in keygen as well (inability to find a decryption key, for instance), but encryption and decryption require that p and q are prime in order to work. Why would you say something like this? It's claims like yours that make slashdot a breeding ground of misinformation.

    1. Re:Wrong, p and q must be prime for RSA to work!! by thogard · · Score: 1

      You can't use RSA to encrypt 6 if the both p and q are that small but your right 4 and 9 were a lame example. Its been years since I messed with this stuff...

      However my mistake there doesn't go agisnt my point that a number thats not prime but somehow passes the prime tests will give other solutions to the RSA puzzle. A simple example is E=17, P=61, Q=123. That gives some interesting results even though q is 3*41.

      If we take this:
      This example we can see for P=61, Q=53 and E=17
      we can generate a key tuple of (17,3233,2753) which will encrypt 123 as 855. The odd thing is that the key tuple of (17,3233,5873), (17,3233,8993), and (17,3233,124433) also decode (or encode) data the same way. A slow perl program to show this is here.

      If you pick the wrong prime, there are other solutions. It appears if you pick the right prime, there also might be other solutions. The whole point of my original point is that you don't need to find one number in a 2^2048 haystack, you just have to find a number that also works.

  91. What a nut job.... by Anonymous Coward · · Score: 0

    Here is a guy who is throwing away money when he should be saving it because his OS will never make a profit. I will laugh at his stupidity when I see it on FC.

    Moron