Lindows CEO Funds XBox Hacking Contest

Kai writes "PCWorld.com recently posted an article on how Lindows CEO Michael Robertson is funding the 'Linux on XBox Hacking Challenge'. He was previously annonymous donor who donated $200,000 to the project. His donation will be split in to two prizes, one to who completes part A of the challenge, and the other to the who completes part B. Part A, running Linux on the XBox, has already been completed, but Part B, running Linux on XBox with no hardware modifications has yet to be completed. Part A of the challenge can be downloaded from Sourceforge." Without a bios change, it seems like part B might be a bit tricky. T. adds: Tricky, but not hopeless. Eric C. writes "The Neo Project recently updated its client so users can use free processor cycles to try and crack the private key that Microsoft uses to sign Xbox software."

Comments

Oh that's swell..

[Anonvmous Coward]

The guy funding the Linux XBOX project is a direct competitor of MS. Kinda cheapens the whole thing, duddn't it? At least that's how I felt.

I mean, if it works it works. But his motivations place him at MS's level.

DMCA, anyone?

[alpharoid]

I like the project... but is this feasible? Wouldn't cracking the X-Box encryption key violate the DMCA and put a lot of people in trouble? Microsoft could afford the lawyers, you know.

Anyways, good luck to them.

Re:DMCA, anyone?

[warmcat]

Many people involved in the Xbox Linux project are not in the US, happily enough. The EUCD is late in .uk and .de.

In any event, things are only 'illegal' when they transgress specific laws. As the DMCA and EUCD are concerned with copyright protection, I really don't see where the problem is if the key is somehow revealed and used to sign a Linux bootloader app. Where is the MS code that is being copied?

Anyway I think the effort to find the key by throwing random numbers at it is practically impossible, however many clients you can muster. This is a 2048-bit number (256 bytes) that you need to factor correctly into two primes.

Its much more likely that the second part of the prize will be won by a buffer overflow or other weakness in one of the games. There are a lot of games, written by people of widely varying experience and skill level. Can MS be sure that not even one of them exposes a buffer overflow weakness?

I find the Neo bit interesting..

[mcc]

I find the part about using an RSA-style collaborative project to crack the X-box permission-to-run keys interesing, in particular becuase it's good practice-- eventually, barring a sudden backlash of informed consumerism against microsoft or some other kind of miracle, we're going to be needing to do this with the Palladium keys. I particularly wonder about a couple things:

1. How many bits are in the x-box "trusted software" permission-to-run keys? What about in Palladium? For these N-bit keys, what is the approximate difficulty of brute-forcing it as compared to, say, brute-forcing RSA?
2. Distributed clients like this one, as far as i am aware, just get parcelled out random blocks of the "possible key" space, and send back which numbers they checked, right? Is there any way to PROVE those numbers were, in fact, correctly checked, besides asking multiple clients to check each individual block and hoping that at least one of the clients tells the truth? Like, is there anything to prevent Microsoft from just randomly calling up the project with a bunch of dummy clients that submit the REAL x-box key a couple times to the "i've checked this and it's not the key" list? ((Well.. okay.. I can think of a way to do that.. but it would require actually USING Palladium, to ensure everyone submitting blocks to the crack-Palladium project is using an unaltered, approved, digitally-signed Palladium-cracking client. So, uh, that's right out.) I know previous distributed projects have had issues with clients lying about their results in order to boost statistics, but this is the first time i'm aware of there has been a massively distributed computational work in which there is a specific party with a vested, active interest in the project being actually sabotaged.
3. Were the Palladium keys to be cracked, is there anything MS could do at that point? Is there any way they could just Windows Update all the Palladium installs out there to suddenly use some new backup key, and invalidate the old one? It would seem the answer is no, becuase it seems that would automatically mean all of the existing palladium software in the entire world would suddenly become "untrusted" and have to be re-compiled at the vendor with the new keys, or something, but maybe there's something i'm missing. Is there something i'm missing? And anyway, aren't the palladium keys going to be stored in hardware, in some special Intel chip? Or something? How is a Palladium app marked as "Trusted By The MS Signing Authority", exactly, anyway? I haven't been following this as closely as i should have been.

I'm confused and ignorant. Please explain things to me.