Slashdot Mirror
Lindows CEO Funds XBox Hacking Contest
Kai writes "PCWorld.com recently posted an article on how Lindows CEO Michael Robertson is funding the 'Linux on XBox Hacking Challenge'. He was previously annonymous donor who donated $200,000 to the project. His donation will be split in to two prizes, one to who completes part A of the challenge, and the other to the who completes part B. Part A, running Linux on the XBox, has already been completed, but Part B, running Linux on XBox with no hardware modifications has yet to be completed. Part A of the challenge can be downloaded from Sourceforge." Without a bios change, it seems like part B might be a bit tricky. T. adds: Tricky, but not hopeless. Eric C. writes "The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software."
The guy funding the Linux XBOX project is a direct competitor of MS. Kinda cheapens the whole thing, duddn't it? At least that's how I felt.
I mean, if it works it works. But his motivations place him at MS's level.
I like the project... but is this feasible? Wouldn't cracking the X-Box encryption key violate the DMCA and put a lot of people in trouble? Microsoft could afford the lawyers, you know.
Anyways, good luck to them.
The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software.
Unfortunately the server apears to be slashdotted. Let's hope that just means a lot of people want to help with that task. This of course makes me want to ask about the legality of doing this. Does people risk getting sued by downloading the client?
Do you care about the security of your wireless mouse?
- How many bits are in the x-box "trusted software" permission-to-run keys? What about in Palladium? For these N-bit keys, what is the approximate difficulty of brute-forcing it as compared to, say, brute-forcing RSA?
- Distributed clients like this one, as far as i am aware, just get parcelled out random blocks of the "possible key" space, and send back which numbers they checked, right? Is there any way to PROVE those numbers were, in fact, correctly checked, besides asking multiple clients to check each individual block and hoping that at least one of the clients tells the truth? Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list? ((Well.. okay.. I can think of a way to do that.. but it would require actually USING Palladium, to ensure everyone submitting blocks to the crack-Palladium project is using an unaltered, approved, digitally-signed Palladium-cracking client. So, uh, that's right out.) I know previous distributed projects have had issues with clients lying about their results in order to boost statistics, but this is the first time i'm aware of there has been a massively distributed computational work in which there is a specific party with a vested, active interest in the project being actually sabotaged.
- Were the Palladium keys to be cracked, is there anything MS could do at that point? Is there any way they could just Windows Update all the Palladium installs out there to suddenly use some new backup key, and invalidate the old one? It would seem the answer is no, becuase it seems that would automatically mean all of the existing palladium software in the entire world would suddenly become "untrusted" and have to be re-compiled at the vendor with the new keys, or something, but maybe there's something i'm missing. Is there something i'm missing? And anyway, aren't the palladium keys going to be stored in hardware, in some special Intel chip? Or something? How is a Palladium app marked as "Trusted By The MS Signing Authority", exactly, anyway? I haven't been following this as closely as i should have been.
I'm confused and ignorant. Please explain things to me.Irritable, left-wing and possibly humorous bumper stickers and t-shirts
This is true, however, the problem lies in what data must be signed by the private key. Code signing works by making a hash of the code (in this case, the OS loader or the like, which in our case would be the Linux loader) and signing that hash with the private key. The bootrom then uses the Microsoft public key to verify that the OS was signed by the Microsoft private key. Thus, the only ways that this could reasonably be done is by:
1) Getting the microsoft private key
2) Making the hash of the OS the same as the has of the MS OS (nigh unto impossible)
3) Changing the public key in the bootrom (which isn't allowed for this stage of the competition, at least hardware wise)
4) Somehow switching the OS after the initial code signing check is completed
Here's a reference if you want to read more Code signing
You aren't "proving" it. Miller-Rabin is a probabilistic algorithm. It doesn't guarantee anything (unless it indicates that the number is composite - non prime).
The rest of your post seems correct though.
Put together a boot loader and ask MS to sign it. If they do not turn around and sue them under the terms of the approved judgement and or a anti-trust suit.
Got Code?
Fail to understand the use?
First of all, as I recall the Lindows box from Wal-Mart is $299.
The X-Box from Wal-Mart is $199.
X-Box specs:
Coppermine Pentium 3 processor (about 733Mhz as I recall)
Nvidia gpu which falls somewhere between a Geforce 3 and Geforce 4 in power (according to anandtech)
10GB hd
64 MB of RAM
By comparison the Lindows Box has
800Mhz Via C3
40GB hd
onboard graphics (ugh)
128 MB of RAM (I think PC133)
It seems to me that the Pentium will probably outperform the C3, and know the X-Box GPU is far more powerful than what you have in the "Lindows Box." Assuming the extra hd space and RAM makes up for this (it doesn't) the X-Box is still $100 cheaper.
Edge: X-Box