Xbox Linux Made Possible Without a Modchip

An anonymous reader writes "Free-X have released an exploit for the Xbox that will let you get Linux on the machine without any hardware mods at all... Microsoft is already threatening them with legal action. Here's the Free-X statement. Free-X say they had been trying to contact MS for a month but were ignored, which is why they've released the exploit. Should be interesting to watch this one."

Comments

Woops, too late

[Iscariot_]

Too late for Microsoft. It's been released. No way of stopping it. Just like Nintendo had no way of stopping UltraHLE.

Re:Woops, too late

[RTPMatt]

go them, its M$ own fault. they tryed. as i have always said, support http://anti-dmca.org/ LEARNING IS NOT ILLIGAL!

PS: be sure to save the page, ya never know how long it will be up for

Re:Woops, too late

[Anonymous Coward]

Learning is not "illigal"?
Perhaps you should exercise your "rite", then.

Re:Woops, too late

[tankdilla]

I find this amusing and interesting. It's yet another example of the wild-wild-west type environment that the Information Age is in now. People come up with ways to beat the system, and corporate comes back with litigation (ie RIAA comes to mind). And every once in awhile litigation works, but other times it doesn't work, and thus people will continue to find cracks in the system. There are many analogies that can be drawn from this (and i know this isn't really new news, since the Xbox has been cracked for awhile now), but I'm wondering when these big companies will get tired of waging war through litigation and just start playing hardball with the rest of the Internet. At some point Microsoft has got to get tired of all the stuff they go through and deploy some hackers themselves, to protect their interests. And this idea isn't really too far-fetched. Just today, the US government put a bounty on Saddam's head. That is an outright act of desperation to get him. The gov'ment uses spies just like other countries to gain counterintelligence. And they do it in a sneaky way, making sure the press just reports the official business, but never questioning where intelligence or 'fortunate victories' come from. Eventually these corporations will need to take a hint and start some black/grey hat work of their own to support their interests. Most likely it is already going on. But if it is, I can't tell. They keep getting caught with their pants down so much to the extent that we're barely even suprised anymore. It's almost expected at this point.

Re:Woops, too late

[GMontag451]

No, they didn't have to exploit anything. IBM published full documentation on the BIOS. All they had to do was "clean-room" engineer it. In other words, they had some guys paraphrase the documentation, and then had some other guys who had never seen the documentation implement a BIOS that did all the same things.

Re:Woops, too late

[zerocool^]

As the wise man once said,

"You can't un-ring a bell"

~Will

Re:Woops, too late

[Anonvmous Coward]

"go them, its M$ own fault."

MS's own fault? They have no obligation to fill that request. They do, on the other hand, have reason not to comply as their units are sold at a loss. On top of that, the way MS was approached was lame. "Give us what we want that's not in your own best interests or we'll tell people how to break your machine and potentially lose more money by having people buy XBOXes for uses other than buying the games that make them money."

Frankly, I don't see how Free-X would have felt that they were approaching MS in a reasonable way. Their handling of this situation was irresponsible, and trying to sound like the victim here makes things worse. They've essentially validated the need for the DMCA. All MS has to do now is post a loss as a result of it, and the courts will have to factor that in their decisions.

It would be a really good idea to make sure that whatever comes of Linux on the XBOX encourages people to continue using their XBOX as a game machine. Use it to do stuff that doesn't get in the way of playing games. Playing movies or MP3s is good, they can pop their game disc in and play. Using it as a server is bad, they want it up all the time and don't want to interrupt it.

I'd feel a whole lot better about this situation if the people involved were trying to expand the use of the system instead of just flipping off Microsoft. (I'd also feel better if uses for this machine running Linux weren't better served with a cheapy PC.)

Re:Woops, too late

[gclef]

At some point Microsoft has got to get tired of all the stuff they go through and deploy some hackers themselves, to protect their interests.

Microsoft is already doing this. One of the guys I used to work with in the security realm is now at Microsoft, checking for exploitable code & paths in Palladium. I expect he'll to see this & prevent it in any Trusted system release.

Re:Woops, too late

[EzInKy]

Though I agree with some of what you say the bottom line is the purchaser of an X-Box owns the machine, not Microsoft. He can do what ever he wants with the hardware once he has the sales receipt in his hand.

Re:Woops, too late

[baldvin]

(I'd also feel better if uses for this machine running Linux weren't better served with a cheapy PC.) Xbox is silent. And it is very cheap, considering how much does it take to buy a pc that is this silent. I, and lots of others, do not have separate room where I could put that cheap pc. If Xbox is mine, I'd like to use it... because I need it. That means, there is a valid reason to use it for a different purpose, as a server, even if you didn't see it.

Re:Woops, too late

[Dr. Evil]

"Give us what we want that's not in your own best interests or we'll tell people how to break your machine and potentially lose more money by having people buy XBOXes for uses other than buying the games that make them money."

It's a little more like:

"You know that problem you wouldn't help us with? Well, we figured it out, but we don't think you'll like the solution. Can you help us with an alternative solution which is in your best interest? No? Ok, then we'll just do it our own way."

Re:Woops, too late

[Clansman]

Actually, I think this is not much like the wild west - which was anarchic and open - you could disappear if you wanted and control was intermittent and defeatable/corruptable.

No, this is too intimate a battle - far more like living within a 1984 type stalinist or fascist regime with the oligarchy constantly scheming and blocking the underground who are always on the run. The Matrix perhaps, too.

This ain't no wild west

Re:Woops, too late

[acebone]

What he said was:

> Eventually these corporations will need to take a hint and start some black/grey hat work of their own to support their interests

Could the words 'Eventually' and 'will need to' be replaced with 'Often' and 'do' respectively ? I am afraid so...

Re:Woops, too late

[MrLint]

It's yet another example of the wild-wild-west type environment that the Information Age is in now

Well the information age has become the age of the consumer, by default, is a criminal. So really the wild west analogy makes some sense here. If this current trend keeps up of "protecting" big business from all of their paranoid delusions there wont be anyone but 'criminals' left. We know full well that the RIAA/MPAA would ban what we know as 'fair use' in a heartbeat if it meant more sales. They wish to control sales, distribution and methods of consumption. Don't consume your music in fashion they want? You are a criminal.

Re:Woops, too late

[dissy]

While its not MS's fault that they didnt cave to these demands, and I do aggree their last demand made them look childish, plus the fact we didnt get to see their previous 'talks' with MS (They could have made nothing but this one childish demand for all we really know)

But saying that MS sells their stuff too cheap is NOT our problem or fault nor should matter in anything at all.

Snippits from your post:
> They do, on the other hand, have reason not to comply as their units are
> sold at a loss.
and
> All MS has to do now is post a loss as a result of it, and the courts will have
> to factor that in their decisions.

By this reasoning, little Jimmy that bought an XboX and one game is costing MS money, so MS should be allowed to sue him for loss of profit.

Or maybe I bought an XboX waiting for one particular game to be released, and it keeps getting delayed.. Uhoh, I'm costing MS money! Time to get sued.

No.

MS selling stuff too cheap is their fault, and their stupidity.

If the courts aggreed with you, any loser on ebay that sold something cheap and later realized it was worth alot more money could sue the buyer.

When a person or company sells something for alot less than its worth, its called stupidity and stupid people deserve what they get.

If you sold something to me for $10 that cost you $50 to make, you have no legal or moral grounds to bitch and complain about it. The deal is done. it was your fault for not looking into what price to set.

The future isnt garneteed, nor do any laws care about the future.
Doing something stupid now under the asumption you will get money in the future is called gambling which in most states is illegal.

An example is buying a lottery ticket. You are paying for a piece of paper that is worth probably $0.05 in paper product, yet will cost $5 or more.
That is stupid.
But its stupidity in the hopes that you will get alot more money in the future.
Its a Gamble.

You dont hear "The state lottery cost me money, i bought the ticket knowing it was at a lost cuz i planned on getting money from the winnings!"
(Well maybe you do, but you dont listen to it)

MS doing this is the same thing.

They are gambling that they will possibly make money after selling the xbox at a lost stupidly and now are bitching and moaning that they lost that gamble.

Aww.

Lets also not lose focus.
When a razor company sells you a razor, gambling that they will make money on the blades, do you see them trying to pass laws to make it illegal to do anything with their razor other than what they want?
There is a reason for this.

With MS it is no different. Yet they want to pass laws (and pretty much seems like they are going to get away with it)

If i was to buy an XboX, its MY hardware to do with as i please, which includes replacing your copyrighted software with myown.

Copyright does not mean im not allowed to delete your crap and use my own. Only that i cant give out your copyrighted code (Which noone doing these mods has any reason to do, nor should they if you still believe in copyright)

If i buy a book and feel like dipping each page in whiteout and using it as a diary, the book publisher cant say squat about it!
Nether can MS.

Then if you look at the REASON they sell the console at a lost, its even worse.
They only do that so they can actually compare in price to their competition!

Notice how macs dont charge prices similar to home build PCs? Yet they still sell? Its because the people that buy macs feel they are worth the extra money.
Is MS out right admitting noone would ever buy their xbox due to technology alone? Well, that wouldnt be surprising, but it seems even MS aggrees here, or they wouldnt NEED to sell it at a lost!

If their business plan includes losing money on a crappy hardware product which they want to control every aspect of after

Re:Woops, too late

[flyneye]

Aw c'mon punkin'.
I dont think anyone buys into the belief that if they purchase a tangible piece of equipment,that its still controlled by the whim of its creator.
No matter how many unread agreements they clicked,signed or were implied.
Put simply Microsoft is stupid for their "now you own it now you dont"business model.NO ONE and i mean NO ONE but anal lamers would agree let alone comply(remember this is the real world)
Best off if all remember: once i hand you the money and walk off with the merchandise,you have NO say so about what i do with it no matter how many lawyers you hire,no matter how many legislators you bribe.Its mine and if you want it back you better be able to fight with your hands.
That thought spent,I would also like to call up a lil history where wild bill gates sold mail order software for a "poplular electronics kit computer" and then stomped around and shook his fists when the code was copied and shared LONG BEFORE MICROCRAP EXISTED.Most people quit banging their head on a brick wall after the first strike but not a pinhead like Bill Gates!He instead makes a career out of flattening his pointy head.
So,with that in mind feel free to do whatever you like with whatever you bought and feel justified in knocking the teeth out of the losers who would play stupid games with IP.
Hey world i got news for you, if you want to keep IP secret,dont tell anyone,dont implement it and dont sell any examples.Anyone is allowed to make money from their ideas but like helium in a balloon,once its out,its out(no matter what non workable laws ignorant politicians write to increase their legacy.)
Damn,if only people would use common sense and their knowlege of people and the way the world is,instead of trying to force their unworkable fantasies of how it should be into effect.
In short:Screw Microsoft,we've no pity left for the bruise on his forehead.

Re:Woops, too late

[Geek of Tech]

Did Parent actually read any of the articles? I believe in Free-X's statement said...

/* Beginning of quote */

Since our attempts to contact Microsoft have become public knowledge our team has been accused of attempting to extort or blackmail Microsoft, this is not true as we have made every attempt possible to make contact with Microsoft to offer the following:

- A complete summary of all hacking technologies (many of these technologies have not been released).
- Source Codes.
- All attacks which have been developed but not yet released.
- To sign a Non-disclosure Agreement regarding our discoveries.
- Further research on exploits, which would be exclusive to Microsoft.
- Full names of all hackers involved upon agreement of legal protection from Microsoft.
- Assistance in the development of future security for the XBox by working with Microsoft.

For the exchange, we were requesting but not demanding the following:

- Complete access to all documentation (chipsets, video etc.) to assist in developing a better Linux for the XBox.
- A signed Linux loader.
- Protection from Microsoft or support if any organisation/government attempted to prosecute members of our team.
- Refunding of the cost occured during the agreement period.

/* End of Quote */

I think the threat went more like You listen to us tell you about the security vulerability that would probably tick off content creators or we'll tell everyone else in hopes to get you to fix the code.

Do you get mad when someone discovers a flaw in Internet Explorer? Oh, but this is different, they're blackmailing Microsoft...

Once again quoting - "For the exchange, we were requesting but not demanding the following:... A signed Linux loader.

From Parent - Frankly, I don't see how Free-X would have felt that they were approaching MS in a reasonable way. They offered to give microsoft all the code and to sign a non-disclosure agreement. They requested in exchange a linux boot loader. They asked. They didn't say "Give us what we want that's not in your own best interests or we'll tell people how to break your machine and potentially lose more money by having people buy XBOXes for uses other than buying the games that make them money." The bootloader was optional. They would give Microsoft the code either way. Microsoft wouldn't even listen. So what part was unreasonable? Disclosing the code, because Microsoft wouldn't listen? People do that all the time. Asking for something in exchange for work? Oh yeah, that unreasonable. Especially when you relize they were just asking.

Re:Woops, too late

[Famatra]

Up the Mod of the parent since it is entirely correct.

They did not "blackmail", as the last Slashdot article ad-libbed in its summary, Microsoft but gave them every opportunity to cooperate in creating a signed Linux loader.

As well the released code by X-Free does not allow you to pirate games. (Although by modifying their release and using their same technique it could be.)

As well it must be remembered that there is no EULA for hardware, we are freely able to use hardware we bought anyway we choose to. As well, people are legally able to reverse engineer the hardware, much the same way that other game consoles (NES, SNES, N64, PSX) were reverse engineered to create emulators like BLEEM.

P.S. Remember that it is likely the computer you are using now (IBM-CLONE) would not be here without the work of people reverse engineering the original IBM desktop computers.

Re:Woops, too late

[EvilAlien]

As far as I'm concerned, the XBox is a "cheapy PC".

What are the odds of the courts saying the following to Microsoft?

"You sell your systems at a loss... that is a bad business decision, and it is not the court's responsibility to protect you from the consequences of your mistakes. Its a business gamble to rely on sale of an accessory to a product to make that business unit profitable. The consumer owns the product when purchased and has the right to decide how they use it, you are infringing on their rights but limiting that choice. We will not protect your poor business model."

In other words, "suck it up, princess".

Re:Woops, too late

[renderhead]

Actually, it seems to me more like:
"Spend money developing a solution that only a handful of 1337 h4x0r5 care about, or we'll release it ourselves at no cost to you. In fact, we'll make sure to put ourselves in a position that leaves us vulnerable to a lawsuit in the process so that you can collect money from us. All right now, we're waiting!"

Okay, so it wasn't blackmail, but only because the threat was really lame.

Re:Woops, too late

[Twanfox]

What 'intellectual property rights' are you refering to that could be posessed? What rights are missing from patents and copyrights? Besides, are you seriously trying to say that smashing a device with a hammer violates a hardware patent? Notice, in this modification, the hardware was completely untouched, the case not even opened. The only thing in doubt is does this violate the DMCA (or other copyright laws). Only way I can see it could is 'circumvention of a copy protection system', and I'm not even sure that applies because the hack basically wipes and discards the software originally loaded in order to run something else, not make copies or gain access to protected material.

After reading the articles...

[RobPiano]

It seems we've had a lot of false and misinterpreted information about this team and their exploit. I don't have an x-box and only somewhat understand why their exploit would work (integer underflow..?), but it atleast sounds interesting. Anyone on slashdot who gets it working please post a verification.

As far as the team... I think they should have submitted their findings to a legal firm of some kind instead of this not-so-holy covert behavior. Their behavior will only lead to troubles in court.

Atleast they'll have $100,000 to help them out, I think they'll need it.

Rob

Re:After reading the articles...

[ziplux]

How is releasing information about a bug going to land them in court? Microsoft had plenty of time to respond, but they didn't.

Re:After reading the articles...

[Farrell]

It's too bad they probably won't get the 100k. In order to get the files onto the xbox, you need to use a prior exploit that DOES require something(007 save, swapping HDD etc).

Re:After reading the articles...

[Kaeru the Frog]

The DMCA. Circumventing a copyright protection system is illegal.

Re:After reading the articles...

[RobPiano]

> How is releasing information about a bug going to land them in court? Microsoft had plenty of time to respond, but they didn't.

You can sue over basically anything. They could bring them to court simply to say they thought their assertion of demands/requests resembled black mail. They have the weight/money/political connections to bring a very trivial detail into the court room.

You should never challenge a powerful company like this. Have a lawyer draft up all communications, keep complete records of all activies and communications within the group, and do not volunteer any information without council present.

Having help doesn't make you look guilty, it makes you look prepared and intellegent. The way these guys handled their communications (spelling errors and all) makes them look like out of control destructive teenagers.

Rob

Re:After reading the articles...

[Eyston]

why their exploit would work (integer underflow..?)

It looks at the file. The first four bytes are how big the file is, including its own size. So if the file is 16 bytes long, that is 4 bytes of the header and 12 bytes of data. That first four bytes reads 16.

So the XBox reads in the first four bytes (16), takes 4 away and then knows to look for 12 more bytes (16-4).

Apparently it uses those first four bytes (16) to allocate the memory. It then takes 4 away from that value (4 from 16 is 12) and reads those bytes (next 12) into memory.

Well, if you feed it 0..3 instead of 16 in that example, you get an underflow. It sees those first 0..3, takes away 4, and gets a very large number (whatever the maximum is, assume 8^4). So it then writes large amounts of YOUR data to memory even when only 0..3 bytes are allocated (or it is smart and will only do 4). So now you have YOUR own code/data in memory that isn't for that file.

I think. Fuck if I really know.

-Eyston

Re:After reading the articles...

[smashr]

It's too bad they probably won't get the 100k. In order to get the files onto the xbox, you need to use a prior exploit that DOES require something(007 save, swapping HDD etc)


Not at all. You do not need to make any modifications to the hardware to use the 007 hack. If you have a memory card with the savegame on it, then you can simply copy that to the HD and load the game. This boots linux with an ftp server. You do NOT need to open the box or solder the pins; you only need to do that if you want to flash the TSOP and effectively mod the bios. Once you use the 007 trick you have temporary ftp access to the box - you can ftp over and replace the font files. Now the box is as good as modded and no one will know the difference. In addition this is safer than flashing the TSOP because the BIOS is simply intercepted in hardware.

So in short - you can have a completley modded xbox without ever opening the cover.

Re:After reading the articles...

[ethx1]

Getting 007 from blockbuster is a lot cheaper than a mod chip tho.

Re:After reading the articles...

[Kaeru the Frog]

Because it could be used to circumvent copyright. Of couse anything could be used to circumvent copyright protection. That's only one of the reasons why the DMCA is a bad law and every time a case concerning it appears in court I hope it is the one that kills the DMCA.

Re:After reading the articles...

[BiggerIsBetter]

"You should never challenge a powerful company like this."

Nope. I gotta disagree with that.

I for one do NOT believe "powerful" aka rich companies shoudn't be challenged. Having money should not mean carte-blanch authority to steamroll customers over trivialities and the greater business community should be wary of any organisation that grows unchecked. It may be difficult (especially if the court is swayed by financial contributions) but powerful companies should ALWAYS be challenged.

Re:After reading the articles...

[sheimers]

Who cares about the DMCA. Most of the six billion world population lives outside the USA.

Re:After reading the articles...

[s0meguy]

The DMCA? Last time I checked American law wasn't a global thing.

Re:After reading the articles...

[rking]

Having help doesn't make you look guilty, it makes you look prepared and intellegent. The way these guys handled their communications (spelling errors and all) makes them look like out of control destructive teenagers.

I would have been interested in your opinion, but your spelling error made you sound like an out of control and destructive teenager. Okay, maybe one error means you could be in your twenties, posibly with some slight degree of control, but the destructive tendencies are undeniable. Could you submit a longer writing sample for analysis?

Re:After reading the articles...

[wiggles]

Also from the DMCA:

(f) Reverse Engineering. -

(1)

Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.

Re:After reading the articles...

[fucksl4shd0t]

Who cares about the DMCA. Most of the six billion world population lives outside the USA.

They don't have computers. They're all pagan filth and terrorists.

Re:After reading the articles...

[fucksl4shd0t]

Can't pass this one up. Emphasis mine.

I would have been interested in your opinion, but your spelling error made you sound like an out of control and destructive teenager. Okay, maybe one error means you could be in your twenties, posibly with some slight degree of control, but the destructive tendencies are undeniable. Could you submit a longer writing sample for analysis?

Enough said.

Re:After reading the articles...

[evilviper]

It's very simple... According to the DMCA, you point at something and call it "copyright protection", and if anybody does anything to it, you sue them to holy hell.

Quite simple really.

For instance, if I was to make a CD that doesn't play, I will call it copy protected, meaning it works (because I say so) and you don't get your money back. Then, when someone figures out how to make it work, I sue them into submission.

It has other purposes as well. For instance, it can be very useful in extorting money, and bending people to your will.
You see, what you do is invent a copy protection scheme (we'll call it CSSS) and make it standard on some multimedia format (that we'll call DVDDs). Unfortunately, no copy protected device has ever gotten popular, so to make sure yours gets popular, you make CSSS so crappy that a 5-year old could break it. Now, your DVDD format will get popular, because people can all copy the DVDD discs.

Then, when anyone want's to make a DVDD player, they can't, unless they get permission to use CSSS from you. Before you allow them to use CSSS, you simply require a huge ammount of money, and force them to sign a contract saying they will do everything you tell them to, and include nothing extra on their CSSS players that you don't like.

Now, you are raking in the money, and you control the entire DVDDs player market, because the DMCA doesn't allow anyone to get around your crappy CSSS without your permission.

Re:After reading the articles...

[Anonymous Coward]

..Circumvention only used for interoperability, which is allowed by DMCA.

Guess you didn't think of that before you vomitted up the troll label. Or maybe you're just "thick".

Re:After reading the articles...

[GunFodder]

Judging by the results of the Independence Day poll it looks like most of the Slashdot readership lives inside the USA. This gives the DMCA relevance. And if you think your backwater of the globe will never have any similar laws, think again. The future of property is ideas, and the rich and powerful need laws like the DMCA to protect their property.

Re:After reading the articles...

[More Karma Than God]

> The DMCA? Last time I checked American law wasn't a global thing.

We're working on fixing that.

Re:After reading the articles...

[BiggerIsBetter]

I took that line slightly out of context - "like this" probably refers to the manner of the challenge, rather than companies like MS, but the point was made.

I hesitate to get started, but if sacrifices aren't made (like these guys getting toasted in court) then corporations and by extension, the governments they pay for, WILL walk all over the people. I hope the X-mod guys don't get fubared over extortion-type claims, but if they do, I think there will still be a greater benefit from pushing the point of "consumer" rights to use things they payed for - eg, an X-Box.

One thing I think they forget, is that away from work and outside their industry, they too are "consumers".

Re:After reading the articles...

[staticdragon]

reread the article.
Austria != Australia
One is in Europe the others somwhere way the hell on the other side of the globe.
One has kangaroos, the other has... what the hell does Austria have, except apparently good hackers?

Re:After reading the articles...

[BESTouff]

Having money should not mean carte-blanch authority

You're not from the US, are you ?

Re:After reading the articles...

[darien]

Actually, the EU seems to be heading in the opposite direction - while the US passes laws that make it easier for companies to get rich off individuals, the EU keeps issuing "statutory instruments" that make it progressively harder for businesses to enforce anything at all. And even if you are convicted of some sort of made up IP crime, you can always take the matter to the European Court of Human Rights, which pretty much always finds for the individual, because the EU Convention on Human Rights is a very broad and generous document.

Re:After reading the articles...

[KAMiKAZOW]

Sadly this is not funny, it's true. There's the new Copyright Directive in the European Union and the USA is ''exporting'' the DMCA to other countries like Singapore.

Re:After reading the articles...

[jobeus]

A Xerox machine _could_ be used to violate copyrights too... Does that make it illegal now under DMCA?

Re:After reading the articles...

[Anonymous Coward]

This might sound off-topic, but I am reminded of the FCC and its recent ruling in favor of giving the most powerful media companies even greater monopoly power. (Most Americans aren't even aware that Colin Powell's son heads the FCC.) The problem has even gotten to the point that the media was powerful and arrogant enough to censor anti-war broadcasts. Remember also when Dan Rather granted Saddam an interview just before this second war, but this so bothered a White House staff bent on coercive social engineering that they blitzed every major TV station with broadcasts of the Pres.

One just gets the feeling that more and more, law and government are in bed with the largest conglomerate corporations to control and screw the lowly individual. That is what unchecked capitalism brings, and what we are trying to force upon the entire world.

Full text of article in case of /. effect

[Anonymous Coward]

Official statement from Free-X regarding exploits.
Dear Public,

Today is a very said day for Microsoft.

One month ago, we began an attempt to make contact with Microsoft, we did this because the first software only mod-chip solution was developed and proved working. This solution meant that there was no need to open the XBox anymore.

The modification only needs to be installed once and all existing XBox consoles are able to be modified to use this exploit, only new consoles with an updated Firmware could lock out this exploit.

After discovering this exploit a Team was formed known as the "Free-X (box)" team.

Members of this team have made many attempts to initiate discussions with Microsoft by various means including:

1. Contacting certified XBox game developers requesting that they contact Microsoft to facilitate discussions about our discoveries.
2. Contacting major web-based news sources requesting that they contact Microsoft on our behalf.
3. Direct contact with various Microsoft departments globally.
4. Direct contact with Authorised XBox distributors globally.

Since our attempts to contact Microsoft have become public knowledge our team has been accused of attempting to extort or blackmail Microsoft, this is not true as we have made every attempt possible to make contact with Microsoft to offer the following:

- A complete summary of all hacking technologies (many of these technologies have not been released).
- Source Codes.
- All attacks which have been developed but not yet released.
- To sign a Non-disclosure Agreement regarding our discoveries.
- Further research on exploits, which would be exclusive to Microsoft.
- Full names of all hackers involved upon agreement of legal protection from Microsoft.
- Assistance in the development of future security for the XBox by working with Microsoft.

For the exchange, we were requesting but not demanding the following:

- Complete access to all documentation (chipsets, video etc.) to assist in developing a better Linux for the XBox.
- A signed Linux loader.
- Protection from Microsoft or support if any organisation/government attempted to prosecute members of our team.
- Refunding of the cost occured during the agreement period.

To prove our discoveries we offered to make available an exploited dashboard for Microsoft to validate our claims.

Our team was more than willing to co-operate with Microsoft and would have most likely accepted most of the terms of agreement coming from our discussions.

If Microsoft had agreed to sign Linux then it would have been possible to generate a signature for the Linux, which would only work on current XBox consoles and able to be stopped in future revisions. It would also be possible to prevent the illegal use of pirated software.

Our team was of the belief that our attempts to initiate discussions with Microsoft would have been welcomed.

Members of our team contacted Microsoft quickly, but then suddenly Microsoft ceased responding to our enquiries. Third parties contacting Microsoft on our behalf also proved to lead to a dead end, is the giant Microsoft's reaction just incompetence or intentional??

Following the public release of this request for communication on the ZDNet/CNet network, Microsoft promised a formal response and as yet we have not seen one.

Is it possible that Microsoft's lack of co-operation in this matter could be because they believe that:

1. Mod-chips are good for business as they increase the sales of the console hardware and that they see them as an important part of there business model.
2. The Exploit can be fixed in future software updates.
3. This is purely a hoax.

A team member called a Microsoft representative again (Mr. Thomas Kritsch of Austria) and offered a presentation.

This presentation was scheduled for 20th June, but Microsoft cancelled it on 19th June. During a phone discussion on this day Mr Kritsch a

Re:Full text of article in case of /. effect

[jeffkjo1]

There's definitely a big risk of zdnet going down, as it's hosted by a 14 year old with a 333 running Apache in console mode (Win98sr2) on a dsl connection and all...

Re:Full text of article in case of /. effect

[Angry Pixie]

Actually, it is blackmail. Several of the things they request do have a quantifiable monetary value to them, and to others in similar situations. This includes the creation of an authorized product, refund of costs incurred, legal indemnification, and access to product designs and specs. It doesn't matter if they're willing to sign an NDA. Blackmail isn't limited to just the "give me X dollars or I will do something nasty you won't like." Any argument that Microsoft won't be harmed financially due to the release of this exploit is weak because Microsoft doesn't have to show actual financial damages from this. But that's just the civil suit. These guys will have more to worry about from the Justice Department in the criminal case.

This is not a step forward for the Linux community. It is an embarassing set back that could further strengthen arguments against using Linux and supporting the Linux community. It's just damn irresponsible of them.

Re:Full text of article in case of /. effect

[abradsn]

Pointing out that we are infringing on one copyright agreement in order to perpetuate Linux interests is a bad move. The Linux community should desire to keep away from negative aggressive behavior, less we become more like our adversary.
Also, should we not leave the bully (ie. blackmail) tactics to those inside the corporate sphere?

Re:Full text of article in case of /. effect

[Alsee]

how can such exploit be legal? If your door lock is easy to tamper with, is it implicitly legal for me to break in?

It is perfectly legal for you to "tamper" and "break in" if it's a lock on YOUR OWN DOOR. It doesn't matter if Microsoft built the lock, you bought the house.

The people using the exploit are using in on a machine THEY OWN. They can do anything they like with it. They can smash it with a sledgehammer or toss it in a blast furnace and vaporize the sucker. Of COURSE they can "pick the lock".

-

Re:Full text of article in case of /. effect

[jwilson]

Mirrored all three links:

full-disclosure

zdnet

statement

Be kind. Rewind.

Laren

Re:Full text of article in case of /. effect

[1u3hr]

We just broke into your house, so can we have the key now?

We just broke into OUR OWN house that we bought from you, and found that your lock is very easy to pick. We can help you to improve the lock....

Re:Full text of article in case of /. effect

[Daniel Phillips]

This is not a step forward for the Linux community. It is an embarassing set back that could further strengthen arguments against using Linux and supporting the Linux community. It's just damn irresponsible of them.

Indeed. But let's not miss the irony of Microsoft complaining about what they perceive as an attempt to blackmail them, when it's a matter of record that Microsoft has regularly used similar tactics or worse in carrying out their own business. Three words: "knife the baby".

Pot. Kettle. Black.

Typical

[coolmacdude]

Free-X say they had been trying to contact MS for a month but were ignored, which is why they've released the exploit.

MS before: Screw them, we haven't got time to deal with annoying flies on the wall like that.

MS after: Shut up! Sue them! This kind of thing is why we hate open source. They want to take our intellectual property and turn it into an experimental plaything.

Re:Typical

[mausmalone]

even though I have no stake in this, I've gotta admit that I'm really disappointed in these guys. Normally, they'd only have to worry about the DMCA. Hacking an unshared system you own is not a crime in any way. Telling people about your experiences isn't either. The only concern is that this technology can circumvent systems designed to enforce copyrights, thereby making it a violation of the DMCA. It does have significant legal uses, and is only presented in such a manner.

Then they go and do this whole threaten/blackmail/extortion thing... doesn't really paint them in a good light. They'd be able to really champion this cause, if they didn't have to go and act like a bunch of script kiddies. Getting Linux on the X-Box without any hardware hacks is an amazing accomplishment, worthy praise and acknowledgement. Unfortunately, anyone who reports on this is gonna focus on the offensive stance they took and paint them as menaces.

And before I complain about them having egos anymore, I should digress and say that if I was good enough to hack an x-box with just software, I'd be pretty self-assured, too.

Re:Typical

[evilviper]

MS after: Shut up! Sue them! This kind of thing is why we hate open source. They want to take our intellectual property and turn it into an experimental plaything.

Then next time, don't demand a Linux loader, demand a FreeBSD loader... They are always saying how much they love the BSD license, and they have a track record of using FreeBSD themselves. Then they couldn't use that arguement at all.

Watch out for the secret weapon.

[Roosey]

Trust me, these guys will go down for the count if Microsoft hires a female lawyer.

Re:Watch out for the secret weapon.

[sc00p18]

that may be tough, I don't know many women who would work for this guy.

Why don't they fix the exploit?

[hashish]

Ohh, wait, no-body applies security patches to game boxes, what was I thinking :)

Re:Why don't they fix the exploit?

[Student_Tech]

Actually, they update the dashboard (what the exploit plays with) when you install the Xbox Live stuff, they could just set it up to do that when someone connects to Live, or on major game release have it auto-check and offer to update it.

At least this is my understanding (and yes the Live stuff does play around with the dir structure on the Xboxes I have seen.)

Re:Why don't they fix the exploit?

[Babbster]

You're right about the Xbox Live changes to the dashboard, and there are more coming with Xbox Live "2.0" that's been announced. Then, you've got their music visualization/media player program (Music Mixer) which is very likely going to make some changes to the dashboard.

Of course, even beyond all that is the fact that every time you activate a connection to Xbox Live, it checks the XBL software and updates it if there have been any changes. It would be a trivial matter for them to use this feature to either incorporate a check to detect/disable the hack and /or implement a security fix to do the same even if the hack isn't already in use.

The moral of the story? Probably not a good idea to use Xbox Live if you intend on using this particular exploit.

The secondary moral? Microsoft really was thinking ahead when they decided to go with their own closed service for "all" (quotes added to acknowledge XBConnect, Gamespy Tunnel and the rest which use the system link functionality to get people hooked up over the net) online games.

Re:Why don't they fix the exploit?

[Alsee]

Actually, they update the dashboard (what the exploit plays with) when you install the Xbox Live stuff

Any attempt to update the XBOX is merely a request from an outside source for the XBOX to update itself. But once you have control of the XBOX you can program it to ignore that request to update itself.

When you connect to XBOX Live they check to see what version you are running, but all they can find out is what the XBOX tells them. If you control the XBOX you can have it tell them anything you like.

They are going to run into the exact same problem with Palladium and TCPA. Once someone digs the key out of the hardware, or finds any other vulnerability, then they own their system. They can run an undetectable virtualized system. They'll have "god mode" over it and af far as the rest of the world can tell they are running a secure and "trusted" system. Hell, the security situation could wind up being worse because they are pretty much going to force you to "trust" other people running the system. It just means you're going to get screwed over worse when a computer you were forced to "trust" isn't in fact secure.

-

Mr. Bush Announces ....

[Snoopy77]

"From now on today will be known as XBox Independence Day!"

What the.. ?

[rampant mac]

From the article:

Dear Public,

Today is a very said day for Microsoft.

Especially if you're using their spelling / grammar software.

Re:What the.. ?

[donutello]

Give them a break. They're Australians. It's not like English is a first language fo... oh, damn.

Re:What the.. ?

[Michael Hunt]

English, not American, is the first language of Australians ;)

These guys seem european, however, as there's no references to shrimps on barbies, or Fosters.

Re:What the.. ?

[ziplux]

I think you mean Austrians?

Re:What the.. ?

[E-prospero]

These guys seem european, however, as there's no references to shrimps on barbies, or Fosters.

Three minor problems:

1) What the US calls a shrimp, Australians call a prawn.

2) Australians, on the whole, don't put prawns on a barbie. Barbies are Snaggers and Chop territory.

3) Nobody - and I mean Nobody - drinks Fosters. Seriously. An Australian psycopath wanting to perform torture wouldn't force his victim to drink Fosters.

So, the only role played by the phrase "Pass the fosters, throw a shrimp on the barbie" is to identify an american who wants to sound Aw-stralian.

Russ %-)

Re:What the.. ?

[Michael Hunt]

Yeah, note heavy sarcasm :) - I'm from Melbourne.

I agree with your sentiments about local Fosters; it's shite. VB is likewise shite, however; most of the people I know drink either Boags or Cascade, as it is plentiful and relatively cheap (3 bucks odd for a pot, about 5 for a stubbie, bar prices.)

Apparently export fosters is quite good. I'll have to go to america one day just to try it.

I've barbequeued prawns before, the result is not worth the expense. I have no idea how prawns are meant to be cooked, but barbequeueing em just made black, crispy, carcinogenous prawns that tasted like arse.

honestly...

[mrscorpio]

...did they really think Microsoft would give in to their "demands" AND legitimize X-Box hacking at the same time? Give me a break. Why would it make sense for Microsoft to encourage Linux installs on a product solely meant to play games and movies, when it doesn't even port it's cash cow software for the real desktop OS? I hate to make this comparison (because of the can of worms it's sure to open), but it's like terrorists who try to bargain hostages for freeing their buddies. You CAN'T bargain with them, because it simply encourages others to follow in their path.

Congrats to the guys for the hard hacking work, but get a little business sense and in the meantime, better get a lawyer. This ain't gonna make the boyz in Redmond none too happy.

Chris

Re:honestly...

[Malcontent]

"Give me a break. Why would it make sense for Microsoft to encourage Linux installs on a product solely meant to play games and movies, when it doesn't even port it's cash cow software for the real desktop OS? "

To sell more xboxes?

Think about it, even if MS lost money on every one sold they would have bragging rights. They could go araound saying that the Xbox is most popular game system and spread FUD around like peanut butter on rye toast.

They have 40 billion in the bank and can afford to lose tens (if not hundreds) of millions dollars to gain a monoply on the game console market.

Also with each passing day the cost of a Xbox goes down and eventually they will actually make money on the thing.

Re:honestly...

[grahammm]

Why should a hardware supplier have the right to dictate what the hardware is used for? There have been many instances of things being put to uses which the manufacturer did not even imagine when the product was first released, and sometimes these uses have become more popular than the original purpose of the item - and have increased sales of the item.

This is NOT the same as gaining access to / duplicating copyright works.

Re:honestly...

[mrscorpio]

You realize how little market share Linux has, right?

A significant number (to Microsoft) of people are not going to rush out and buy X-Boxes to install Linux on it. Maybe a few thousand worldwide, MAYBE. That's not going to put them over the top against Sony.

Chris

Re:honestly...

[CrowScape]

But the idea isn't to make money off of selling the hardware, it's to make money off of selling the software. By hacking the X-Box so that you can run software that Microsoft isn't getting a royalty on kinda defeats the purpose. As consoles become more and more expensive to manufacture you'll see more emphasis placed on the profits produced by games while the manufacturers become willing to almost give the thing they spent $200 building away. This kind of hacking, if it ever begins to saturate the market, only serves to undermine consoles in general.

Re:honestly...

[Anonymous Coward]

Because you buy an Xbox with a license. If Microsoft decided you could only use an Xbox while wearing fluffly bunny slippers they have that right, and if you buy one after agreeing to do so and fail to do it then you have broken the law and deserve everything that happens to you.

Your fanciful idea that subverting the license might help Microsoft is irrelevant, not to mention stupid. It doesn't matter if it hurts them or helps them, Xbox owners agreed to a license and are bound by it.

When you produce a product of some kind you have the right to dictate its use also, not that a lame pom could ever produce anything people would pay money for.

Re:honestly...

[sweatyboatman]

and the argument is that this is a flawed business model. purchasing the XBOX should allow me to run whatever I want on it. I'm not leasing it. It's my property. I don't own the software or firmware, but I definately do own the hardware.

If I can make the firmware do what I want, then how could that be illegal? Once I pay for it, MS no longer has a say in how I use it.

If I hollow out the case and use it as a planter, is that an illegal modification? Can Microsoft sue me because they're not making their royalty money on the plants I'm growing in my XBOX?

Re:honestly...

[Zork the Almighty]

I've never seen this licence you keep referring to. Software is sold under licence, since otherwise you could run multiple copies of the program (note : this has nothing to do with distributing the program to others, which would be copyright infringement). I can't think of any physical goods offhand that come with a licence. I think you get to "own" them.

Re:honestly...

[rpresser]

The hardware is mine . There was no license governing my use of the hardware. There was, instead, a license governing the use of the software associated with that hardware.

Suppose I decided that I really, really liked using Xboxes as boat anchors. Is it your belief that such use would be against some license and that I would be technically in violation of it? Wrongo.

Re:honestly...

[dekashizl]

If I hollow out the case and use it as a planter, is that an illegal modification? Can Microsoft sue me because they're not making their royalty money on the plants I'm growing in my XBOX?

Dude... What kind of plants are you growing in there?

Re:honestly...

[Jarlsberg]

If Microsoft decided you could only use an Xbox while wearing fluffly bunny slippers they have that right.

Are you mad?

Re:honestly...

[EzInKy]

Because you buy an Xbox with a license.

Only the X-Box code is licensed, and getting rid of the is the whole purpose of the exploit.

Re:honestly...

[Avakado]

In many countries, and I believe in USA too, you don't have to accept a license you haven't signed. If you don't sign the license, you only have the rights copyright provides you, which for closed source software for home use usually is better than what the license provides you. These rights includes installing the software on every computer in your home, but not every one in your company. This means you're "owning" your copy of the product. I attended the trial against Jon Johansen (co-author and distributor of DeCSS), where he explained they had used an uncompression program rather than the installation program to install the Xing DVD tool, in order to avoid accepting the click-through license. The prosecutor accepted this reasoning. The defender later stated that restrictions printed on the outside of DVD covers were invalid as long as the buyer didn't sign an agreement in the store. This was also undisputed by the prosecutor.

And the floodgates open..

[freeweed]

Looks like it's open season on the Xbox now, but I'm a bit confused. The ZDnet article mentions the $100,000 no hardware mod prize, yet right in the exploit description it states:

Q1: How do I get the files onto the harddisk?

A1: There are several ways. You could f.e. install the files with the Mechassault or 007 hacks. This requires one of the games and the files on a memorycard. The other way is to open the box and do the harddisk swap trick which is described all over the net.

So if you need to use an existing hack to do this, and those hacks didn't qualify for the prize, how could this one? Any Xbox experts care to comment?

Additionally, isn't it nice to see that companies are now suing on a regular basis for exploit publication. Good that they only want black hats posessing this sort of information.

Re:And the floodgates open..

[Kris_J]

So if you need to use an existing hack to do this, and those hacks didn't qualify for the prize, how could this one? Any Xbox experts care to comment?

The other weren't permanent, this one is.

Re:And the floodgates open..

[Hast]

To clarify the parent (which was completely correct AFAIK).

The first hack allowed you to run unsigned code. You do this by loading a comprimised save game in one of the vulnerable games. ("007 Nightfire" or "Mechassult") This requires a memory card which has been altered on a PC, or that you have removed the HDD of the XBox which you want to compromise. (Obviously the memory card is easier, but they cost a few bucks.)

In the compromised save game you put code you want to execute. In this case you could have it open an FTP server on the XBox. (This is the old hack.) After this you hook up the box to a PC and copy the files over using the FTP server. (This is the new hack.)

Now reboot and you have a compromised XBox. (The first hack would require you to redo the hack each time you wanted access to the "backdoor".)

Same as this exploit?

[Anonymous Coward]

I wonder if it is the same exploit posted here:

http://archives.neohapsis.com/archives/vulnwatch /2 003-q3/0008.html

This is also an exploit dealing with the X-Box dashboard.

This was initially posted in replies to another story in the gaming section by another AC.

XBOX Security

-= Security Advisory =-

Advisory: XBOX Dashboard local vulnerability
Release Date: 2003/07/04
Last Modified: 2003/07/04
Author: Stefan Esser [senopiracy.de]

Application: Microsoft XBOX Dashboard (up to today)
Severity: A vulnerability within the XBOX Dashboard allows to
totally compromise the security features of the XBOX.
Risk: Critical
Vendor Status: Vendor is not willing to talk about XBOX vulnerabilities.

Overview:

The XBOX Dashboard is what appears when you turn the XBOX on without a
disc in the DVD drive. It will let you adjust system settings, manage
your save games, play and rip audio CDs and configure your XBOX Live
account. It is the heart of the XBOX and its most vulnerable point,
because it lacks several security restrictions which are enforced on
games. This includes the lack of the reboot-on-eject-button "feature",
which is obligatory for all games.

The existance of an exploitable vulnerability within the dashboard could
totally compromises the XBOX security system. It will make the box
independent from Microsoft signed code and therefore this information is
released to the public now on the 4th of July 2003, the day of the XBOX
Independence.

They provide what they claim is working code to exploit the vulnerability.

Re:Same as this exploit?

[Daetrin]

I think you meant http://archives.neohapsis.com/archives/vulnwatch/2 003-q3/0008.html (ie without the extraneous space) but yeah, given that they're 100% identical to each other, including the name of the author, i'm guessing that they just _might_ be the same exploit.

Blackmail

[Anonymous Coward]

our team has been accused of attempting to extort or blackmail Microsoft

From the article, seems that is exactly what they tried to do:

For the exchange, we were requesting but not demanding the following:

- Complete access to all documentation (chipsets, video etc.) to assist in developing a better Linux for the XBox.
- A signed Linux loader.
- Protection from Microsoft or support if any organisation/government attempted to prosecute members of our team.
- Refunding of the cost occured during the agreement period.

Not demanding? Why would Microsoft politely offer any of those things?

Re:Blackmail

[BurritoWarrior]

I like how the Free-X (box) team thinks. Let me try this out:

I am requesting that my post be moderated up to +5 or I will release pictures of Slashdot moderators in compromising positions with various farm animals.

Please note this is just a request, not a demand.

Re:Blackmail

[Anonymous Coward]

Yeah, like you have anything that hasn't already been posted to alt.binaries.pictures.erotica.slashdot.barnyard

Re:Blackmail

[WanChan]

...well, it's at +4 now, so somebody has something to hide :)

Re:Blackmail

[mikeybee]

I've moderated recently, and I'm concerned.

How did you get a camera into the stable without me or the pregnant dwarf noticing?

Re:Blackmail

[fermion]

Honestly whether is blackmail or not is moot. It is, in the end, normal business. MS does this with it's customers, giving them a choice between upgrades they don't need or massively expensive full version later on. The car companies, and most recently the airlines, have done this with the U.S. government demanding massive welfare payments to the corporation in exchange for not having massive RIFs. Consumers to this all the time, threatening to post bad reviews if their complaints are not solved.

It seems to me that all these kids wanted was a job. They proved their technical skill to do the work, they showed the perseverance, and appear to be rather clever. Sure the could just send a resume to MS, but who would have looked at it. We are told to be aggressive when looking for a job, but when someone actually is they get accused of blackmail.

I think this will make Xboxen much more popular.

[mikeophile]

At least until the new patched models are released.

Microsoft shouldn't fight this too much. More Xbox loss leader sales will mean more game title sales, even if (or because of) piracy increases.

Who am I kidding? Bend over Bill, here comes the Penguin!

too bad for microsoft

[DJF-Me33]

Hopefully with the release of this exploit Microsoft will stop ignoring the homebrew community. The way I see it they knew about this before it happened and they should have taken the actions to communicate with the hackers and try to settle this. Now that they refused to negotiate people can freely pirate games causing not only Microsoft to lose money, but also the game developers. If they had negotiated only linux would be running on the xbox. :) Too bad for them. Maybe they will learn to listen to us ... maybe not.

Too Late for Microsoft

[aerojad]

Microsoft is already threatening them with legal action.

Too late. Just ask AOL at trying to stop WASTE when it came out. Up for a day, and mirrored more times then they will ever be able to count.

Microsoft lost right at the point they decided to not talk to them beforehand. They can shut these people down, but it's out there now, game over.

Re:Too Late for Microsoft

[Anonymous Coward]

game over

Oh no, owners of existing X-Boxes and games will use this to boot linux after Microsoft et al have already profited from them. Some people might start using X-Boxes for non-game-playing purposes, and more than 100,000 people will want to use their X-Boxes (and buy more X-Boxes) exclusively for this because hacked sub-PCs are the platform of choice for stability and reliability. Some authors will even make unauthorized games for the X-Box which will sell like hotcakes because the authors are so good that real game companies refuse to hire them for fear of them taking over.

And there is no possible way for Microsoft to fix this issue in future releases of its hardware or games or its online feature.

This is a great loss to Microsoft and will undoubtedly drive them out of business altogether.
</sarcasm>

Get over yourself.

-M5B

You're seeing history here, folks!

[RLiegh]

This is the EXACT kind of case the the corporations have waited to have fall into their lap. Expect this case to be rationale behind a storm of anti-OSS legislation in the VERY near future.

In short, we're even more screwed than we were before!

isn't this already possible?

[shird]

Isn't this possible already using exploitable games such as 007? Basically he is just running arbitrary code by exploiting a default application (the dashboard) instead of a '3rd party' application (007).

I suppose the main difference may be that it happens on 'boot' rather than in the middle of a game - this may be related to the 'reboot on eject' 'feature' he talks about, but I'm not sure. Anyone care to explain further?

Re:isn't this already possible?

[shird]

Yeah it did, and it would also be the case for this exploit as well. But thats only if you want to actually write to the bios. If you just want to load linux then it shouldn't be necessary - it just means you have to load up 007 and exploit it every time you want to boot linux, rather than exploiting the default dashboard.

The ability to write to the bios is a physical restriction which is very unlikley to ever be overcome without some solder. The compononents simply _can't_ write to the bios without the wired connection.

Increasing weirdness

[warmcat]

From the 'statement' link:

Since our attempts to contact Microsoft have become public knowledge our team has been accused of attempting to extort or blackmail Microsoft, this is not true as we have made every attempt possible to make contact with Microsoft to offer the following:

- A complete summary of all hacking technologies (many of these technologies have not been released).
- Source Codes.
- All attacks which have been developed but not yet released.
- To sign a Non-disclosure Agreement regarding our discoveries.
- Further research on exploits, which would be exclusive to Microsoft.
- Full names of all hackers involved upon agreement of legal protection from Microsoft.
- Assistance in the development of future security for the XBox by working with Microsoft.

For the exchange, we were requesting but not demanding the following:

- Complete access to all documentation (chipsets, video etc.) to assist in developing a better Linux for the XBox.
- A signed Linux loader.
- Protection from Microsoft or support if any organisation/government attempted to prosecute members of our team.
- Refunding of the cost occured during the agreement period.

Disclaimer, until a few weeks ago I was very active in Xbox Linux.

This just seems to me to be a cheap attempt to chisel money and personal advantage under the cover of pretending to be doing it for the benefit of Xbox Linux. "Assistance in the development of future security for the XBox by working with Microsoft" indeed!!!!

Anyone who has spent any time with the Xbox Linux project will immediately recognize the author of the "statement" by its novel spelling and tone. It'll be interesting to see just how what goes around is going to come around.

Re:Increasing weirdness

[Eyston]

This just seems to me to be a cheap attempt to chisel money and personal advantage under the cover of pretending to be doing it for the benefit of Xbox Linux.

Yah, releasing it free on the internet is indeed a very cheap attempt to get money.

-Eyston

Re:what a "habibi exploit"?

[Michael Hunt]

007 Agent Under Fire contains an exploit in the save-game loading routine which can lead to a local-root compromise on your X-box with a specially corrupted save game file.

This can be used, for example, to boot Linux, or flash the BIOS.

The reason that this didn't win Mike Robertson's 100 large is because you still need to rip the lid off the box and solder a pair of jumpers (or use conductive pen) in order to enable 'write' on the flash rom.

Re:You can already put linux on PS2.. so why not x

[Farrell]

because Microsoft feers it.... Actually, the reason Linux is on the PS2 is for development reasons, originally. The software running the PS2 is based on linux iirc, so they put out a whole distro or something to work on PS2. Only problem with this is, it's a specialized distro, and I don't think there are any others that boot on PS2(some proprietery program used during boot or something so they didn't have to release the source to it) As for why no XBox.... well, it's Microsoft, I mean, come ON, would you let people change the operating system on your video game system to one that causes problems?

Re:Just wondering...

[randyest]

It's a base-64 encoded proof-of-concept font and loader program. Base-64 is sort of like uuencode -- it's just a reversible way to represent a binary file as ascii code. The line "begin-base64 644 dayX.tgz" is the header that includes the encoded filename (dayX.tgz). Ask google about it for more info. Google knows all.

Integer Underflow:

[Kelmenson]

You understand overflow, right? There is a maximum integer that can be stored in a variable, and if you "overflow" this maximum amount, the number wraps around. So 0xffff + 0x0003 = 0x0002.

Underflow is the same, but opposite, making it so you wrap from near zero to a very big number... You say the font size is 0x0003, and the X-Box subtracts 0x0004, and ends up thinking it needs to read in 0xffff more data from the font file...

Both just involved wrapping around the maximum/minimum values a variable can hold.

Re:Integer Underflow:

[whaley]

That's buffer overflow. A buffer is some storage in memory with limited space. Overflow occurs when the program (is forced to) write data after the actual buffer. An integer is a number, and in computers numbers are represented by a limited amount of space (e.g. a byte, or a few bytes) so they can also overflow and underflow. Say the highest possible number is 65535, then adding one more will get you back to 0. Similarly, subtracting one from 0 will then get you 65535.

Looks like they weren't bluffing

[gibbo2]

A popular opinion when they threatened to release this was "they're just blackmailing Microsoft, but they've got nothing".

Looks like a different situation now that they've laid their cards on the table.

Good work guys.

Re:Looks like they weren't bluffing

[kfg]

Yeah, now it looks like they were just blackmailing Microsoft. :)

KFG

crap!

[mschoolbus]

Really sucked reading this article as I was finishing up installing a mod-chip into my friend's XBOX with him...

Its now linuXBox !!

[supersam]

MS: Damn it! Doesn't Free-X know we made XBox so that people could play games on it.

Free-X: Err... yes we did just that. We played on it a bit and voila!... its now linuXBox!! *grin*

MS: @#!**@###***

Re:Its now linuXBox !!

[burns210]

"its now linuXBox!! *grin*"

ahem. that is GNU/linuxXBox, please. :)

Base 64 encoding

[Stonent1]

Since it is on the website, google will probably cache it meaning it will not be lost. :) And even if MS orders to take their site down, google will still have it.

Re:I think this will make Xboxen much more popular

[Captain McCrank]

This is was a huge mistake. These people have just poked what will turn out to be a very violent and angry grizzly bear. It is well known that Microsoft loses money on each Xbox sold. Microsoft sells Xboxes at a LOSS(!) in the hopes of getting you into the additional content and features like Live. Why in the world would they want people to buy an Xbox, only to install Linux on it and never again be able to play another Xbox game on it???

People who buy Xboxes to install Linux do not buy more Xbox games!!!

This is a Bad Thing because it is only a matter of time before someone starts using this approach to hack Xbox Live. These Assholes were treated way too kindly in the Penny Arcade Comic. All I can say is I loathe these guys the same way I loathe the bored programmers that ruined Quake 1, Quake 2 and Counterstrike. The actions these zealots have taken will inevitably lead to cheating on Xbox Live, which is a real shame. To me, part of the point of paying for Xbox Live is so that I don't have to deal with the same fecal coated cheaters online- if you're caught, you're banz0red. Why is it that some people can't just rub there 2 486s together and be frigging happy w/ their beowulf cluster?
This is a terrible day for gamers.

Microsoft Dumping X-Box

[Anonymous Coward]

The only reason Microsoft has to care about putting another operating system on x-box is because they are dumping them.

Dumping things undervalue as a monopoly is unethical and illegal in many places. I'd like to see that in some news stories, instead of no explanation why microsoft would care at all what someone did with their own bought hardware.

Waste of GNU, gains for MS....

[jkrise]

The chief reason for the success of GNU, Linux and indeed saome flavors of BSD, is that the hardware is a commodity item and available from multiple vendors. Thus the hardware is an open platform and true competition drives down prices to make it affordable, viable and immune to monopolization.

Now, the XBox is a proprietary piece of shit, and is controlled by a single gorilla (of course, with contributions from a few chimps). What's the motivation of getting GNU and Linux running on this proprietary junk?

MS loses money since they make losses on hardware? Crap! Unless the XBox is sold for under $50, this assumption is ridiculous. Geeks get a sense of revenge when they try to annoy MS? Sorry - MS is too smart for that. If they felt XBox hacks were truly threatening their margins, they'd have let loose SCO or some other SCUD litigation.

Doing geeky things is not the primary or only objective of the GNU connosieurs - the more important reason is to make the software AND the hardware free of encumbrances and/or lock-ins.

The best hacks for the XBox will become meaningless if MS comes out with a new design. The devious statements and logic emanating from the press about the XBox and the hacks - does in fact indicate that some kind of social engg. is at work.
It's like all the brouhaha about the latest Harry Potter - how it's getting stolen, how many millions have sold in the first week, how some cheap folks are trying to obtain illegal copies, etc. It's promoting by making an appeal to criminal insticts.

Cracking an XBox to run Linux is like using a 500MB word-processor to write a 1 page letter. Waste of resources and effort, it profits only MS. Better contribute to some useful GNU projects, such as AbiWord - there's many of them out there that need attention.

Please stop trying to use common sense

[Anonymous Coward]

This is the law were talking about here. There is no room for such concepts..

Download this while you can.

[Anonymous Coward]

Select and copy the uuencoded bit of the message in your browser, then pop open an xterm.

$ uudecode
(shift-insert or third mouse button)
(return)
^D

This will give you dayX.tgz

You don't know when someone will laywer their way into taking this thing offline. Make it as available as you can.

Re:Download this while you can.

[Anonymous Coward]

It's not uuencoded, it's base64. But the uudecode tool will still know how to decode it.

how Bill could force a "fix" down your throat

[frovingslosh]

They could force a fix a number of ways, including if you ever "go live" and connect to them on the internet, but they could also make all future games include a dashboard "update" that would install itself whenever the game is run. So as long as you only run Linux (and they don't sneak anything in through Linux software with a trojan), you might be safe, but if you or anyone else ever plays a game on the x-box that was manufacturered after this date, they could get you.

Re:I think this will make Xboxen much more popular

[mikeophile]

Q4: Is it possible to play "backed-up" games with this?

A4: Yes it is possible to play pirated games by using this vulnerability but my proof of concept code will not allow this. You have to change the exploit to patch the kernel in memory. This is not very hard and I am not going to help you with this.

It seems that eventually the modded exploit will become available as well. So you'll have Linux plus the ability to play Xbox titles.

As far as cheaters go, yes they suck.

Wouldn't you rather be able to run your own Xbox Live server though?

For free?

No DMCA in Austria

[janolder]

Fortunately, the DMCA has no teeth in Austria where these guys seem to live. Note the reference to a Mr Kritsch working for MS Austria and the somewhat awkward choice of words, mediocre grammar and poor spelling.

If the DMCA continues to be used to shut down what used to be considered fair use, we'll see more and more open source endeavors moving out of the US. Here's to fervently hoping the MPAA/RIAA doesn't manage to implement DMCA clones in all countries on this planet. They seem to be doing a pretty good job at it in Europe.

Re:No DMCA in Austria

[breon.halling]

... the somewhat awkward choice of words, mediocre grammar and poor spelling.

So you're saying they post on Slashdot? ;)

Re:No DMCA in Austria

[BESTouff]

Fortunately, the DMCA has no teeth in Austria where these guys seem to live. Note the reference to a Mr Kritsch working for MS Austria and the somewhat awkward choice of words, mediocre grammar and poor spelling.

Wow, I always thought there was a majority of True Americans on /. and now you tell me all these poorly spelled posts are from some european bastards ?

Re:No DMCA in Austria

[infolib]

the DMCA has no teeth in Austria where these guys seem to live

The european version of the DMCA, the EUCD came into force in Austria on July 1st. (I even think the directive could be used against them before that, though it hasn't been transcribed into austrian law). The mailing list message was sent on July 4th. (quite symbolically...)

On the other hand, the picture's pretty murky anyway. The EUCD doesn't change the status for computer programs, and that's what we're really talking about here. It's also important that this exploit has several effects. It may be used for playing pirated games, (nono) but it is also a tool for using the X-box for quite legitimate purposes, like building a home media system etc. Also, the exploit is not done on the programs themselves, but on the platform. Then there is the issue of changing the font files. I don't quite get whether they used changed MS font files or rolled their own. If they use changed MS files, MS might be able to go after them on their "artistic rights".

I recommend finding an austrian lawyer. (And a sympathetic judge...)

Opera gives blacked-out page

[Empiric]

If any of you Opera users find the "Free-X Statement" link akin to a Spinal Tap album cover, the site hasn't been defaced or removed. Try another browser, Opera 7.0 appears not to render their page readably. Undoubtedly the site's fault, not Opera's, of course.

(me.)

To prevent being sued

[Argonath]

..all xbox hackers should use freenet to publish their discoveries. That would give them total anonymity and good night sleep without getting burdened by possible lawsuits.

Re:Woops, too late? This is what MS wants....

[jkrise]

Getting Linux on the XBox without modifications, could very well be an MS effort to compete with HP IBM and possibly even Dell, on the desktop hardware platform. So far, they've made only unwieldly mice, broken keyboards and complicated home WiFi gear in hardware.

The XBox so closely resembles the PC architecture, it could be an MS attempt to make BIOS, motherboard and PC makers superfluous. MS would package the XBox for $100 and offer Linux on a desktop PC! All this subterfuge and publishing hacks is just a way to generate some mometum behind the development of their proprietary piece of junk into a viable desktop platform.

Too late, yes... the industry has moved along, users and partners have become smarter to MS tricks, and the game is up. Sorry MS.

Lindows on Xbox

[HanzoSan]

In a few days Michael Robertson will announce Lindows Xbox Edition.

New features? The ability to completely hiijack a competitors hardware technology.

Re:Lindows on Xbox

[Rogerborg]

>The ability to completely hiijack a competitors hardware technology.

Funny, I don't recall leasing an XBox from Microsoft. When I put that money down, as far as I'm aware, I bought it. It became my property.

I wonder, what goods or services am I stealing from Microsoft by running lunix on my XBox?

Their attitude seems to be that after you buy an XBox, you owe them more money in games sales.

Re:Lindows on Xbox

[Grishnakh]

When did anyone ever agree not to tamper with the Xbox? This is a hardware product, not licensed software. You buy it, you own it. After you've paid for it, there are no legal restrictions on what you can do with it--smash it, put it in a closet and never use it, run Linux on it, etc.

Are you an MS employee? Your post is so full of blatant lies I don't see any other possibility.

Re:The linked article is confusing

[Nucleon500]

You either need 007 or a screwdriver. You just replace some files, which you can do either by using the 007 hack or switching HDs. Once the files are replaced, put the XBox back together, and it'll load whatever you want.

Dude, they're in AUSTRIA ..Where the hell is that?

[Viewsonic]

And that's exactly what the Microsoft chimps are thinking right now. How the hell are they going to be able to sue someone if they dont even know where the hell it is? I mean, come on, who REALLY knows where Austria is that hasn't been there already? (Looks around) My point exactly. Hell, half the posters on here think its AUSTRAILIA.

Thoughts

[knightPhlight]

New or old hat? :: This exploit, having been long awaited by linux hackers and warez kiddies both is different from both the 007 and MechWarrior hacks. It doesn't require the retail games making the hack free as in beer. Additionally, both require that the game is executed and a save is loaded to cause the overrun. To do this the disc must be in the DVD drive. Because the Xbox (without a third party BIOS) will reboot when the eject key is pressed, this severely limits what the DVD can contain (such as a bootable linux partition).

Patchable? :: Furthermore, Microsoft cannot permanently patch this hack through an Xbox Live update. Version 1, v1.2, & v1.3 Xboxes will always execute the current vulnerable code. Should they remotely update the dash; one would simply open the Xbox, write an old image to the hard drive, and reboot. In the process it would be trivial to add bert and ernie (the modified fonts). Xbox Live BIOS updates are not possible due to M$ imposed hardware limitations. Of course, third party BIOS updates are not a problem for those willing to open the case and get crazy with a little solder.

Availability? :: Legal or not, at this point it's not an issue for the end user. The base-64 posted by Mr. Esser isn't going away. Proof? Try this...

X-Prize? :: Probably not. This cannot be executed or copied from a third party memory card ala 007. So opening the box is required. Partial payment maybe.

Re:Thoughts

[tfoss]

This cannot be executed or copied from a third party memory card ala 007. So opening the box is required. Partial payment maybe.

Um, maybe i'm misunderstanding, but doesn't the 007 trick let you run an ftp server on the box? And the current hack involves adding & adjusting some files on the HD (such as with the ftp server) which then allows you to load whatever. So, after the first use of the 007 ftp trick, you have a totally modded system....or am i missing something.

Like this comment says...

-Ted

Re:Off topic...but...

[mcp33p4n75]

There's other linux distributions that are runnable on the PS2, but honestly, why not just buy the kit? It's reasonably priced, and you won't be able to install GNU/Linux on your PS2 without the hard drive, anyway. Also, you're supporting a company that decided to open up their system somewhat.

Be Careful

[acxr is wasted]

You Slashdot guys ought to be cautious about posting links to stories containing the exploit at hand. Remember what happened with the DVD encryption scheme and 2600?

This is great, but...

[mcp33p4n75]

Does this mean you are able to install a hard drive without having to add a mod chip? Running GNU/Linux on the XBox is great and all, but a 8/10GB hard drive just doesn't cut it, especially when you're intending for it to be a media hub. It's even worse when you want to both use Linux and play games on the machine. So... will this allow me to use a different hard drive? Explain why or why not this is possible...

in case MS makes /. remove this

[cyborch]

As seen before microsoft does not like people who publish exploits. So I have made an off-US mirror in a country where releasing exploits to the public is still legal...

Well, the damage is done..

[NanoGator]

.. I would *strongly* recommend that the Slashdot Community who's been all over this 'Linux on the XBOX' bs start doing something interesting with it, and I mean fast. It would look plenty embarrasing for MS if they went after them for releasing the exploit and then people started making good (and legitimate) use of it. If everybody just wants to play MAME on it with questionably legal ROMs, that won't help Free-X.

Might I suggest a DivX based media server that can rip DVDs? I know that seems to fly in the face of what I just said about MAME, however, its a good use for the XBOX, plus you'd only be ripping DVDs you own and with good reason. "I just wanted to have easy access to my library." Another suggestion would be to set up an XBOX as a TV based info center. It stays on-line all the time on Input 2 (or whatever channel your XBOX is on), when a commercial pops up, flip the channels and get your messages. Heck, set up a browser so that it cycles through your favorite news sites every 30 seconds and scrolls them or something.

At least with something like that, something that the XBOX is better at than a cheap-o PC, the case can be made for wanting to make these mods to the unit. That'll weaken MS's case (they'll probably try to say that copy protection is bypassed or something), plus it'll take a few pokes at the DMCA as well.

I hope are people listening. MS has got an army of lawyers.

Re:Well, the damage is done..

[Zork the Almighty]

Those are some good suggestions. Here's my (ordered) list of Xbox Linux Killer Apps :
Tivo / media server
MAME/Console emulator
Region Free DVD player
highly portable internet game server
video phone (with a USB camera and broadband)
digital camera / MP3 player software (so you don't need a PC)

I don't understand

[sweatyboatman]

I think calling this blackmail is a little over the top.

These guys discovered a flaw in the XBOX that Microsoft was unaware of. They contacted Microsoft and informed them of the flaw. Microsoft was not interested. MS refused to discuss the flaw. It's clear from the statement that they tried to talk to MS. MS could have said "We want the information and we want you to sign an NDA and we wont even give you a thank you." But they didn't. Informed of the issue, they ignored it.

The information about the flaw is not Microsoft's property. Nor did Microsoft ever suggest otherwise. The people who discovered it can do whatever they like with the information. In this case, they released it to the public over the web. I don't see how this is blackmail as it is common practice to report bugs (and their exploits) publicly.

Re:I don't understand

[aziraphale]

It's one thing to phone up MS and say 'I've found out something you might like to know about and keep secret', and another to phone up and say 'I've got some information you might like to know about and keep secret - and I'd like you to pay me money, indemnify me against legal consequences, and give me a job - or I'll release it to the public'.

The fact that when they were ignored, they carried out the implicit threat of releasing the information (implicit in their suggestion that they'd sign an NDA in exchange for money), makes it look like blackmail to me.

It's the demand for personal gain that makes the threat of disclosure into blackmail.

Re:I don't understand

[ahoehn]

I agree that this is a form of blackmail. We all have dirty little secrets we would like hidden from the general public, and that's why we're disgusted by personal blackmail. But companies have no such protection. We expect full disclosure; if there's anything that can be used as blackmail against a company we invest in, we want to know about it. There's a big difference in the sleazyness factor of corporate and personal blackmail.

That said, I don't like the way they tried to profit from their discovery, but I don't think it's as nasty as when similar things happen in the personal arena.

Re:I don't understand

[Angry Pixie]

Reporting bugs to the public is a good thing. As a Windows user I more than appreciate every bug report that was made possible by a little reverse engineering.

And yes that knowledge the group created from their effort is theirs. Where there are problems is in the way in which the group handled this. They interpreted Microsoft's decision not to entertain them further as a greenlight or disinterest. This was a stupid mistake. They asked for personal rewards for having this information and sharing it with Microsoft. Their indication was that if Microsoft responded in a timely matter, the group would not release the exploit to the public, but would instead keep it under wraps in proviso Microsoft sponsored the development of a Linux product. This is the blackmail aspect. Had Microsoft complied, the group would not be releasing the exploit. We as the consumer or game developer would be ignorant to this horrible security flaw that could enable software piracy - as they put it.

I really wish these kids spoke with an attorney first and gotten advice from some of the more credible members of the Linux community. What they've done is cool and certainly valuable, but it may prove personally devastating.

Right now, I'm really hoping that either I'm wrong or that Microsoft has developed a sense of humor about these things.

Re:I don't understand

[aziraphale]

Read ALL of the words in their demands. They asked to be kept indemnified in case of legal proceedings against them - that's a big deal in itself. They asked for Microsoft to pay them money. They asked for jobs, for crying out loud.

Yes, they asked for MS to acknowledge open use of the XBox platform, too, but that was only one of their demands.

It's little different to approaching Coca Cola saying you've found out their secret recipe, and you've worked out how to make it taste better (although you had to operate an unlicensed particle accellerator to do some of your technical analysis, so the government might not be too happy with you). At this point, you ask for reimbursement of your expenses, indemnification against the potential government prosecution, and a job on their food science team helping them improve their recipe. Or you'll blow the whole gaff and go public with the secret recipe - and the trick for making it better...

The thing is, in that situation, you could get what you want, but you won't get it by threatening them.

Re:I don't understand

[NewtonsLaw]

It's not necessarily blackmail.

For example, I uncovered a very significant security flaw in the online banking system of a local bank.

It took me some time to determine the scope, cause and effect of the problem -- and my time is money.

I then contacted the bank I advised them that they had a problem which, if not fixed, would almost certainly be picked up by others -- some of who might not be so benign.

I offered to hand over the results of all my work in return for payment for the time I'd spent (at my normal hourly rate).

They agreed and were most satisfied with the transaction -- since it most likely saved them a small (or large) fortune.

Was I blackmailing the bank?

After all, I wasn't about to hand over the results of my investigation without payment.

No, of course it wasn't blackmail. It was just the same as a plumber saying "I won't fix your toilet unless you pay me."

Of course there was no "threat" involved in my offer -- although if they'd chosen not to pay and fix the problem I may have informed the media that there was *a* problem (customers surely had a right to know if it wasn't going to be fixed)

In the Xbox case, Microsoft were offered a business transaction. The price would have been a signed version of Linux for the Xbox in return for the chance to close off the vulnerability and delay public awareness that it existed.

Clearly Microsoft decided that the price was too high -- after all, they've got to pay that building full of lawyers whether they're actually suing people or not so why not just resort to legal action instead?

Re:I don't understand

[Daniel Phillips]

Clearly Microsoft decided that the price was too high -- after all, they've got to pay that building full of lawyers whether they're actually suing people or not so why not just resort to legal action instead?

Not quite right. Microsoft decided that the opportunity to paint the Linux community as a bunch of blackmailers was what they really wanted. They adopted a course designed to get the Free X team to make themselves look as bad as possible, however, to Free X team's, I do not think they took the bait to the extent Microsoft hoped.

Like all of Microsoft's attempts to beat Linux in the court of public opinion, this one will also backfire, and just result in more widespread adoption of Linux.

The Free X team may not fare as well, it's hard to say. If Microsoft attempts to press their claims of blackmail, it's hard to see how they will be successful, given that you can characterize their own business practices as the same or worse. Essentially, they'd have to argue that their own business practices are illegal (which of course they are, as has been established, but that's not something Microsoft wants to draw attention to).

As well, Microsoft could be forced to argue that running Linux on the X-Box is illegal. That would most likely backfire horribly. They wouldn't like it at all if they ended up being compelled by the courts to support Linux on all their hardware. Not just allow it, but actively support it.

In the latter case, I suppose Microsoft could always accuse the judge of blackmail, but I doubt that argument would get very far :-)

See you in jail, script-kiddies

[blair1q]

Free-X made a threat, and requested valuable consideration to forestall the threat.

bing-bing-bing-bing-bing-bing!

extortion

Hope you like green baloney, chillun.

Geography anyone?

[Lispy]

For your Information:
Austria

Australia

Re:Geography anyone?

[Kris_J]

Is this the "Australian" group that's been blackmailing Microsoft that I've been hearing about for a few days now? With an email address ending in .de? No wonder I was so damn confused. Thank you.

Bush: We will not bend to these terrorist demands.

[CaptCanuk]

These poor guys will be the next to be blown up when 120,000 troops jump them on their way to work. Seriously though, reading their demands, they are very close to blackmail. Microsoft took the same position that the US took in "Air Force One": We will not bargain with terrorists. Sure, they didn't blow anything up or there isn't some ISO you can burn and stick in the XBOX and poof, no security, but they did hold a list of demands that most corporations would have a hard time filling. Video Game Console manufacturers make money on software game title sells (as opposed to losing money on hardware).

"For the exchange, we were requesting but not demanding the following:
- Complete access to all documentation (chipsets, video etc.) to assist in developing a better Linux for the XBox.
- A signed Linux loader.
- Protection from Microsoft or support if any organisation/government attempted to prosecute members of our team.
- Refunding of the cost occured during the agreement period."

Since they requested the following, they were turned down on all accounts. I sincerely hope their lawyers are good enough to stave off microsoft's (who will be working on july 4th all day i'm sure). I also hope this is a first step to sticking in and loading a bootable Suse or Mandrake install CD.

yes

[SHEENmaster]

Because he doesn't realise this is just a small step for XBox customers.

When Linux first booted on an XBox, that was a big step. Everything since then has been a small step, and will continue to be so until we can just drop a disc into an XBox and boot straight to Linux.

I wish that M$ had given into the demands, or at least an authorized Linux bootloader. That would make things easier for Linux fans everywhere, and it would've prevented the easing up of piracy.

Too easy...

[borgdows]

It's time now to hack a *real* protection system made by a *real* console maker -> Nintendo Gamecube.

good luck everybody! (and you'll need it)

Usual hypocricy

[TheCabal]

I submitted a story about these guys a day or two ago, but of course it was rejected because it painted them in a less than favorable light (blackmail and all).

I'll ask the question again: Is this how the Open Source movement is going to seek legitimacy? By attempting to blackmail people?

Re:what a "habibi exploit"?

[rpresser]

1. You don't need to flash the rom to use the habibi 007 exploit. You can use the savegame, plus a USB memory card, plus a USB-to-xbox cable, to run linux on your xbox whenever you like. You have to boot 007 first in order to load linux, but that's merely an annoyance.
2. Once you're in linux, IF you've soldered the motherboard, you can use a utility to flash the ROM. This is logically equivalent to installing a mod chip and flashing that; it just requires one less piece of hardware.
3. The new hack's purpose is to have linux load instead of the dashboard when the xbox starts up, thus removing 007 from the step. Logically, however, we're still using a hack as a linux bootloader; the difference being that the dashboard itself loads the hack, rather than the 007 game.
4. The 007 hack is one of a few possible springboards to implement the new hack; it happens to be one that does not require opening the case.
5. Footnote: there is actually another game besides 007 Agent Under Fire -- MechAssault -- which has a similar vulnerability. So you have a choice of 3 linux bootloaders.

How about Windows?

[Jarlsberg]

I love linux as much as the next guy, but tell me -- does this hack mean that I can only install linux on the thing, or can I install any OS I want? I think that for MS, it'd be more embarrassing that you need to hack the machine to get an installation of Windows 9X/XP up and running. :)

Re:How about Windows?

[rpresser]

The OS will need lots of driver support. It's barely conceivable that you could get Windows 9x running from the dashboard hack, but it would take quite a bit of doing.

Far easier is installing linux on the thing, then using bochs or vmware to run a virtual machine in which you install Windows.

Re:How about Windows?

[M3wThr33]

That's what this exploit is doing. It's going to allow a lot more people to tinker around with the XBox. I'm really excited about this, because for a small memory card(I can borrow someone else's) and $180, I can have a Divx player or virtually anything. It's only a matter of time before the BIOS can be flashed without touching a screw...

Re:Woops, too late? This is what MS wants....

[CaptnMArk]

People, just buy an mini-itx system. It's much more open, hackable and flexible.

This is why Microsoft should be broken up

[Realistic_Dragon]

If Microsoft Entertainment was a seperate company, they would probably be encouraging Linux on the XBox to increase the flexibility of their product and drive up sales - it's working for Sony, SCEE are even hiring staff to help with development of Linux for PS2!

However because they are tied to a company with no interest in seeing Linux get anywhere, they are forced to take every possible anticompetative measure to stop it suceeding.

It's the same with other MS products - the don't produce phone or PDA sync software for Linux... why exactly? Wouldn't it be nice to have access to those extra customers? Oh... but I forget... then they might not need to buy Windows. How about office? If it had been split off at the time of the antitrust trial, and given the level of interest of corps in the Linux desktop, don't you think that there would have been a Office-for-Linux by now? But then you might be able to avoid buying Windows desktops and Windows servers...

They leverage it the other way too, making it easier to use MS products on Windows than anything else - look at the level of integration they have with Outlook. I talked to a guy from Sharp about their Outlook connector for the Zaurus and they said they had a hell of a time getting it to work because Microsoft wouldn't release the lower level APIs to the developer of a Linux PDA.

It's hard to believe that a whole company could be evil, but MS seem to be trying hard.

Very first line pretty much sums it up...

[NoCashValue]

"Today is a very said day for Microsoft."

If they can't even spell correctly in the opening sentence of their world-shaking statement, how the hell are people supposed to take them seriously?

Bah.

Re:honestly... reverse social engineering

[rpresser]

You are assuming:
1. Your hardware will work and/or be supported in it's present form, indefinitely by Microsoft.

Since I have not made any hardware modifications to my xbox, my warranty is intact. When that runs out, I run the same risks of non-support that I would if I used the xbox only as a console.

I am not insane; I don't expect indefinite support. Chances are good that when this hardware wears out, I will be happy to simply junk it.

2.You'd rather wait for these and better hacks to run Linux, rather than spend $200 for a Walmrt Linux box with warranty.

In my own situation, I have no real need for a Linux box. I have this xbox. Running linux on it is of equal if not better entertainment value to playing games on it.

3. A large number of people get these XBoxes as a gift.

To repeat myself, I am speaking only of my own situation. I don't have any answers for other people.

As Microsoft says often, think 3 years down. XBox may be cheap to acquire, but who supports the Linux?

In my own situation, linux is "supported" by thousands, across the globe, who publish their support. I have little need for immediate support. The little need I have has been met to date by informal IRC conversations.

Again, I have no answers for others. I would not recommend to a corporate entity that they run a mission-critical web server on an xbox!

Why should GNU coders take interest in a proprietary plaform controlled by the gorilla they love to hate?

The fact is, they do. As long as they do, I am grateful.

"You should never challenge a powerful company..."

[cliveholloway]

Right, you mean like these two did?

Terrible waste of time, eh?

.02

cLive ;-)

INTEGER UNDERFLOW for dummies

[Alsee]

integer underflow..?

Here's a completely non-technical explanation:

Think of it like a clock. The XBOX loads a number expecting it to be something like 10 minutes. It then subtracts 5 minutes and uses the number. But instead of giving it a number like 10 minutes you give it a number like 2 minutes. Then when the XBOX subtracts 5 from 2 it gets an underflow. It doesn't know about negative numbers. So what is does is it wraps around like a clock. If you look at the 2 minute mark on a clock, then count backwards 5 minutes where do you end up? You end up 3 minuts before the 12. That's 11 hours and 57 minutes. So XBOX thinks that 2 minus 5 equals 11 hours and 57 minutes.

So by giving the XBOX a smaller number than it expects, and letting the XBOX make the number even smaller, it underflows - wraps around - to a really big number. That really big number tells the XBOX to load a HUGE amount of information. More than it's supposed to load. That means you can feed the XBOX any program you want and the XBOX will suck it up and run it.

-

Re:Wilkins' "universal" language is English?

[smithwis]

I don't understand how to do that.

another way(assuming you have acess to some basic Unix/linux tools) is to...

1. copy and paste the whole thing begining with:
   "begin-base64 644 dayX.tgz..."
   ..and ending with:
   "===="
   into emacs(or whatever your prefered editor is(so long as it doesn't insert it's own formatting)) and save it as something like xbox.64
2. execute uudecode like such:
   $uudecode
3. And to wrap it all up execute tar in the same directory.
   $tar xzvf dayX.tgz

There you go. As easy as 1,2,3.

Say hi to Bert and Ernie for me.
-Steve

Re:Wilkins' "universal" language is English?

[smithwis]

execute uudecode like such:
$uudecode

ouch, again, not double checking enough has bit me again. That should read

$uudecode < xbox.64

linux on xbox?

[x0n]

Anyone arguing that allowing Linux on an XBox is going to sell more Xboxen is clearly deluded. The only reason people want to put Linux on an XBox (or any other device that is not sold for such purposes) is for reasons of pure hacker fun (weee, look! linux on xbox! take that m$) and also because we all feel we're poking billg in the eye at the same time. Admit it. I do.

- Oisin

Swallow the party line and try not to think

[nagora]

By attempting to blackmail people?

It's not blackmail, although MS have painted as such and quite a few people have failed to actually think about it. These guys told MS that they were going to run Linux on their Xbox and it would be easier for everyone, including MS, if they simply had a normal Xbox signed binary. But, they knew they didn't need it if MS didn't want to help.

In other words: We're going to do this the easy way or the hard way, but we ARE going to do it.

MS, no one else, picked the hard way. They had nothing to lose by going the easy way and the fact that they now have a compromised Xbox situation is entirely their own fault.

After all, when MS tells people that they will sue them for running their own software on their own hardware, who exactly is doing the blackmailing? And that question is exactly what open source is all about.

TWW

Come on!

[Martigan80]

- Refunding of the cost occured during the agreement period.

So you are telling M$ that you want to be reimbursed for your work? Technically you are reverse engineering the product. So according to current laws you want to be reimbursed for acting illegally?

I'm just saying that even though we don't like the laws, we are still accountable for them. So they acted willingly to break the laws and then want rights to the design and money?!?!?!

I am all for the advancement of Linux, but come on people.

Re:Do you understand what "popular" means?

[TheMidget]

The question was what do Australians drink and the answer is that they drink more VB than any other beer. VB alone accounts for 25% of Australias beer market.

That doesn't mean it's the best beer.

Correct. Probably more people program in Visual Basic than Java, Perl and Php combined.

That doesn't mean VB is the best programming language, either...

Sounds typical

[The Master Control P]

Reminds me strongly of the way typical bug-in-your-code exchanges go with companies:

"There's a flaw in your code."
"There's no flaw in our code."
"I'm telling people there's a flaw in your code."
"Alright, there is a flaw, but we're not fixing it."
"I'm telling people how to exploit this flaw in your code."
"Ok! Ok, we'll fix the bug."

These guys have been telling Microsoft that they can run Linux on an Xbox without a mod chip for months. Microsoft has ignored their warnings about the "flaw" in their "code," so we've now arrived at "I'm telling people how to exploit it." Unfortunately, because the majority of people on capital hill are mildly retarded and/or (emphasis on the "and") corporate bitches, Microsoft will NOT be forced to fix the error, but will simply sue the people who publicize the flaw because it involves encryption.

For those to whom it is NOT already patently obvious, THIS is the danger of the DMCA: Companies that provide defective products involving encryption are NOT forced to repair the error or lose business, they now have the option of silencing the white-hats who try to warn them, and trying to ignore the hordes of black-hats who are now working to duplicate the exploit.

Naturally, when involving open-source software, the DMCA becomes irrelevant, because anyone can see and fix the code: We do not have to wait in the hallowed corporate halls waiting for a magic trinket, and that is what they (in reference to greedy CEO's and their ilk, for whom the pursuit of money has become a late-stage cancer) fear.

Ok, I am done rambling. You may now resume your regularly scheduled indoctrination.

Re:I don't understand being a lackey for the man

[quintessencesluglord]

Why is it that when some non-corporate entities have the audacity to ask for a finder's fee from a business, it's blackmail? And when a company threatens to litigate unless the peons pipe down and do as they're told, it's just protecting your business interest?

Could you bend over a little more please? Your head isn't as far past your ankles as I would like it to be. Shhheessh!

Beer howto (off topic)

[mobileone]

Local Fosters; it's shite. VB is likewise shite, however; most of the people I know drink either Boags or Cascade

Never mind the brand. Most of the industrial stuff tastes the same anyway. Real issue is how to effectively order a beer in a crowded bar:

South Australia: A heawy scooner please will cause the bartender to serve you half a liter of West End Super. This however does not work in the rest of Australia where you have to order by Pot (Qld and Vic) or Middie (WA and NSW).

Germany: Ein pils bitte will, after a tapping delay of approximately 5 minutes, get you a local brew from the tab. Due to the latency it is recommended to pipeline the process: Order the next beer when the current beer is delivered. This will guarantee you a new beer every 5 minutes.

Sweden: En stor stark (a large strong) will give you half a liter of 5% beer. For heavy drinking tax-free party ships to Tallin, Gdansk or Oslo are recommended.

Soviet Union Beer was usually out of stock. Vodka or spirt (99% Ethanol) could be bought from the nearest taxi driver. Also good as a substitute for windshield liquid which was also hard to get hold of. In current times I recomment Nevskoe for the St. Petersburg area, although Baltika is usually easier to get hold of.

For better taste you should try Budweiser Budvar from the Czech Republic (Don't confuse this with the cheap US copy of the same name)

Statement from Bill Gates...

[JFMulder]

"640k underflow should be enough to hack an Xbox."

Summary of MS's attitude

[Rogerborg]

You only leased that XBox. It still belongs to us, in principle, if not (yet) legally in fact because we chose to sell it at a loss. You're not allowed to do anything to it that we don't want you to, nor to tell anyone how to do anything to such things. Ever. Running Linux on it is stealing from us. You owe us more money in games sales, you thief.

Next week: Gilette to sue people who buy one of their razors and then figure out or tell anyone how to remove and resharpen the blades rather than buying more.

Next month: Coca Cola Enterprises Ltd to sue people who buy a bottle of Dr Pepper, drink it, then use it to fetch water from the office water cooler. Damn, that's me busted.

Let's face it, we're only valued customers as long as we're meeting our implicit obligation to continue consuming. The instant we try and (ab/re)use a product without paying more money to the manufacturer, we bcome heartless thieves, possibly communists, maybe even terrorists.

Linux user, why do you hate America so much?

"not negotiating with terrorists"

[Imperator]

That's a lie they love to tell. The US negotiates with terrorists all the time. Right now the Bush administration is engaged in intensive negotiations with several Palestinian terrorist groups. (And I'm not calling them terrorists because it's the US-Israeli line, but rather because they detonate bombs in places crowded with civilians.) We negotiate hostage exchanges, "disarmament" (cease fire) agreements, and much more. It all depends on how much we want the terrorists to cooperate. The US (and most other countries) have never had serious policies against negotiating with terrorists, no matter what their propaganda campaigns would like you to believe.

And we are not suprised

[cluge]

If current copyright and IP laws and the interretation thereof were in affect in the mid - 80's what could we expect?

1. PC's would still cost thousands of dollars

2. The only companies to produce BIOS codes would be IBM, and people that paid IBM royalties

3. The Internet would only be available to people in colleges and government - and the content would be heavily censored

4. The only PC manufacture would be IBM and all others would be "illegal copies".

5. All operating systems that ran on PC's would have to be liscenced from Microsoft

6. 20" Rims would have to be liscenced from GM as the own the IP for "the oversized sport tire package"

7. Performance exhaust systems are a Ford product exclusively.

8. CD-R's would have been outlawed and require a liscence to buy or own

9. There would only be 1 word processing program

10."Reverse Engineering" would be a legal term used at your prosecution.

You think it's crazy? Saying that you can buy a game/toy and are not allowed to open it up under penalty of jail - THAT is crazy. Why doesn't MS tell the truth, you didn't BUY anything except the right to use your toy. In actuality, according to their liscence (or my interpretation) that box that you plunked down 200 bucks for isn't even yours. Get used to it, unless there is a revolt, it is the way of the future. You will own nothing - but you will be allowed to use things, provided you pay enough $$$.

Re:And we are not suprised

[dafoomie]

2. The only companies to produce BIOS codes would be IBM, and people that paid IBM royalties

Compaq secretly agreed to pay IBM royalties on each PC they sold, so IBM would drop the suit. The agreement's existance was a secret until recently.

8. CD-R's would have been outlawed and require a liscence to buy or own
Some countries charge a "tax" on each CD-R sold that goes to the RIAA, because that CD "might" be used to pirate their music. I think Canada and Sweden do this, among others. If they get money on each CD-R, that should constitute a licence to fill it with downloaded music. But I think a lot of crazy things.

5. All operating systems that ran on PC's would have to be liscenced from Microsoft

Refer to the "Microsoft Tax" on most PC's made by the big companies, no matter what OS is on them.

You're dead on though... It's scary to see how much of that is actually going on today.

Two wrongs don�t make a right

[Anonymous Coward]

I think MS shouldve been told about the vulnerability regardless. And the exploit shouldve been released only after at least one month had passed. Asking Microsoft to support Linux under the threat of immediate disclosure of a vulnerability is just plain wrong and we would all cry foul if this was done to Linux, FreeBSD or Apache.

By the way, I think MS can fix the vulnerability for new systems. For existing users attached to XBox Live, Microsoft can even send a patch thru the net. And for the rest, a CD in the mail would do the trick (with a few extra perks just to get people interested).

is it really illegal

[metallikop]

How illegal is it what the Free-X group is trying to do? Microsoft's Xbox is not much different from a Dell Dimension in most respects. The Xbox is a fully packaged PC with an OS built in. So is a Dell that you buy purchased with WindowsXP.

Say I don't like WinXP on my Dell. I remove it, repartition and install linux. I can do that because I OWN the box. I'm entitled to do whatever I want with it.

Now look at the Xbox. The Xbox is a system much like a Dell with windows, the only difference is you can't easily uninstall/repartition... until now. Why is this illegal? I bought my Xbox. I OWN every part of that machine. No where does it say "Property of Microsoft" on my Xbox. Can't I do whatever I want with it? Can't Free-X release any software they want for it, much like 3rd parties can release software of their own? .02

Obvious solution

[princeofweasels]

The obvious thing for Microsoft to do is to install a video camera in the box so that they can insure proper use.

Isn't this all just a bit pointless?

[Theovon]

Compared to what you can get in a Walmart PC, isn't the Xbox kindof unimpressive technology? I mean, what are you going to do with Linux on Xbox anyhow? Certainly not cluster computing -- the Walmart PC would be cheaper and faster. Graphics? Buy the Walmart PC and add a Radeon -- then you'll have faster graphics than the Xbox.

What could you possibly get from running Linux on Xbox that you can't from the cheaper, faster Walmart PC?

Xbox-Linux Team confirms the exploit

[k-hell]

See here. ZDnet is also running a story here

Sadly....

[Dr Reducto]

The members of the team were found dead the next day. The police believe that they all had heart attacks while sleeping. No Foul play is suspected.

Font Names

[BigBadBri]

You just gotta love anyone that uses 'Bert and Ernie' for the font names.

I'm surprised Big Bird never got a look in.

Seriously, though, If Microsoft want to market a crippled general purpose computing device, I'm not surprised that people are going to want to hack it just for the hell of it.

Good luck to the guys, and a big up to the Sesame Street gang.

This is the end game.

[twitter]

Could be, Free X sounds like M$: The software companies who are developing titles for the XBox should be very worried by the lack of protection that Microsoft is offering their work as exploits such as those found by our team pose a serious threat to potential sales due to the possible use of such exploits for software piracy.

Software piracy? Exploit? Could they have protrayed themselves in a worse light? They also promised to sign NDAs and happily screw everyone else and work exclusively for M$ like good little boys and girls should. Sounds like standard BSA propaganda to me and the wave of corporate sponsored, Digital Rights Damaged, coppies of free software bode evil for software freedom.

Free software is not about making binary coppies of a few games, it's about having control of your hardware and building things. An xbox with a "signed" Linux kernel that can't be programed or modified offers neither liberty nor the license FreeX offers as a substitute. That kind of box is worth no more than XP on a Next Generation Enslaved PC, except it might have better uptime.

It would not be at all surprising to learn that Microsoft is paying FreeX to make this noise. If it looks like a duck and acts like a duck, chances are it's a duck.

Who knows, perhaps this is the way for M$ to meet the Linux threat while further expanding into hardware sales. Embrace, Extend, Extinguish is their tried and true pattern. They can call it Shared Linux, port M$ Office to it and push it on big dumb companies as the legitimate child of the free software movement. $100/box is 1/4 the price of a current corporate desktop and they will be just in time for the next corporate "upgrade" cycle. If it caught on, Dell and Gateway would indeed be introuble, because they have to buy their software from M$. Then they move in for the kill by using the DMCA to neuter the GPL. Distributing partial source kernels in a way that nothing can be modified even if you had the source is a massive violation of the spirit of the GPL if not it's letter. What use is source code if you go to jail for modifying it?

I've said it before and I'll say it again, purchasing the xbox only helps M$. If you want a gaming console, buy one with merrit. If you want a PC build one. One way you get better games, the other way you keep your computing freedom. Purchasing the xbox gives you neither of the things you are looking for and removes a sale from someone who's more interested in what you want.

Re:Woops, too late? This is what MS wants....

[alienw]

And, where can I get one for $179.99? With a case, a hard drive and a Geforce 3 video card?

Closed Platform as Mixed Blessing

[cait56]

For better or worse, the concept of selling a closed platform is legal. This is especially true if the buyer has adequate information to know that it is a closed platform. I would prefer a mandatory big red WARNING label to be affixed to all closed platforms saying "The retail price of this unit reflects a subsidy from the manufacturer. This subsidy is provided in anticipation of future revenues. Therefore this unit will only work with software lisenced by the manufacturer."

There are benefits to a closed platform to consumers.

• It allows a manufacturer who is optimistic to assume the risk that there will be an inadequate supply of software for the platform. If they don't produce their software, they just ate their subsidy.
• It allows all software to be signed and authenticated. Responsibility for any hardware damage caused by a software installation can be easily assigned to the lisencee who supplied the software.

The down side is simple. The consumer is being mislead by an artificially low up-front price into being locked into continued payments of a monopoly tax on each piece of software they purchase.

I believe the only solution is for the FTC to require platform vendors to offer their product in an unbundled format. You can buy an XBOX that will run third party software, but it might cost you $150 more.

Re:Closed Platform as Mixed Blessing

[Col. Klink (retired)]

Yeah, sure, it's legal to *sell* a closed system. However, there is absolutely no legal basis that allow a seller to prevent a consumer from opening it. The most they could do would be to void all warranties if you do anything unapproved.

If MS can say that you can't open it or run software on it, does that also mean that MS can keep you from reselling it or smashing it with a sledgehammer or just tossing the whole thing in the garbage?

If someone wants to maintain control of a device after they give it to the consumer, their only choice is to rent it to the consumer and maintain the ownership themselves.

Re:Closed Platform as Mixed Blessing

[Elm Tree]

But the beauty of this hack is that it exploits the fact that microsoft *did't* use encrytion on this one section of the machine. They check the SHA hash for everything except .wav and .ttf files, and by using a malformed font you can exploit a buffer trickyness to gain control of the machine.

No right to making a profit.

[MikeFM]

Once a machine is sold the seller should have no say in what I do with it. I paid for it afterall. If I want to run Linux on it that's my right. If I throw it in a closet and never use it that's my right also. Either way M$ would lose the same amount of money on the deal.

It seems to me that this group gave Microsoft a fair offer, to let them run Linux on what they have legally purchased, without having to play dirty. Since Microsoft didn't even try to make a counter offer I guess they shouldn't complain. They probably will use the DMCA to attack this group but IMO that just proves what a shitty bit of law the DMCA is.

LIBERATE AUSTRIA!

[Recoil_42]

poor guys, they have no idea that they've just put austria next in line for "regime change"..

But you DONT own the firmware

[nurb432]

While you do currently ( but not much longer i do forsee ) own what hardweare you buy, any firm/soft-ware that came with the device you only have a license to use.. at their terms.

Re:But you DONT own the firmware

[bahamat]

any firm/soft-ware that came with the device you only have a license to use.. at their terms.

Fine then, I don't accept the terms of the license. I guess I gotta delete the software. Hmm, now what am I going to do with my XBOX? I know! I'll run Linux on it!

Re:But you DONT own the firmware

[ChaosDiscord]

...any firm/soft-ware that came with the device you only have a license to use.. at their terms.

No, no, no, no, no !

Is there some sort of infinitely renewable stream of people completely unaware of how copyright works?

Copyright has nothing to do with a license. In the basic case, when you buy something that is protected by copyright, you neither need nor receive a license to use it. You are free to use it however you want. The only restrictions are specified in copyright law, primarily limiting your ability to distribute copies of the copyright protected work. There is no "you have no right to use this unless you get a license" clause in copyright law. There is no "when you buy something you get a license to use it" clause.

Unfortunately End User License Agreements have somehow tainted peoples brains and convinced them that they need some sort of magical license to use things they're purchased. You don't. Copyright law restricts you, yes. You can accept a license that will grant you things you couldn't do normally under copyright law (see the GPL, BSD, and similar licenses). But you don't need a license to use, modify for personal use, sell, or give it away! EULAs on software are built on a shaky legal foundation and is most certainly not a point of established law.

X-Box Media Player

[rufus t firefly]

I'm really amazed that no one brought up the X-Box Media Player. Honestly, it's the *only* reason I have considered purchasing an X-Box. At 150 USD for a used one (or less; I haven't been shopping recently), it's the cheapest VCD/SVCD/MP3/DivX/DVD/etc player I could get (since Mini-ITX boards with nice setups are still more money than that). I wonder who is going to be the first to modify the loader for it...

Acknowledge our demands.

[Mulletproof]

"For the exchange, we were requesting but not demanding the following..."

I mean really. I think this hack is as cool as the next person does, but who do these guys really think they're fooling? If there is one thing that everybody on the planet Earth knows, it's that MS is not about to assist ANYBODY in the installation of Linux on their console.

"We were nice, polite and reasonable in our attempt to pursuade MS into supporting offical Linux/Xbox development, but since they didn't call back, we released the exploit to the world at large."

I guess you can't blame em for trying, but how is this noteworthy again? Microsoft doesn't want Linux on the XBox. How dense do you have to be to not realize this??? OF COURSE THEY AREN'T GOING TO COOPERATE WITH YOU, regardless of how unfortuante you think it is!!!

You're asking them to remove the only saftey that guarantees they make money on games, their primary source of income! Add Linux and the box becomes a computer, a device of multiple uses. Now you can buy a cheap ass XBox computer sold at a hefty loss and MS has no guaranteed way to recoup the loss because you no longer have to buy games for it.

On top of all that, MS is in DIRECT COMPETITION with the Linux platform (unlike Sony)!!

To even believe they'd answer any other way than they did is insanity of the highest order. Asking them to sell their hardware at a loss and cut the only guarantee they can make the money back through games?! Yeah, I know I would have cooperated too...

I mean, I think the hack is cool, but the sheer naivity of people like these amazes me.

now they respond

[gotem]

this has just arrived to the bugtraq mailing list:

Periodically we hear people say they tried to contact Microsoft about a product or service vulnerability and that Microsoft didn't respond.
We are concerned that people may not know how to report security vulnerabilities to Microsoft.

The Microsoft Security Response Center investigates all reports of security vulnerabilities affecting Microsoft products. If you believe you have found a security vulnerability affecting a Microsoft product, we'd like to work with you to investigate it.

You can contact the Microsoft Security Response Center by emailing secure@microsoft.com directly, or you can submit your report via our web-based vulnerability reporting form located at https://www.microsoft.com/technet/treeview/default .asp?url=/technet/se curity/bulletin/alertus.asp.

Sincerely, Microsoft Security Response Center

Hardware EULAs

[The Monster]

There is nothing to keep hardware manufacturers from putting similar EULA's on their devices,

Yes, there is. It's a little thing called the law. A EULA that says 'by opening this seal, you signify your acceptance of these terms' on an inner package that you don't see until after you have purchased the item, is flat-out unenforceable. The only terms and conditions of a transaction are those disclosed to both parties before the transaction.

IANAL, of course, but IHAB, and it seems pretty obvious that the only HW EULA that would pass muster in a court would be one that the consumer reads and signs before completing the transaction. Otherwise, the consumer's belief that he is in fact purchasing the item in question, rather than a license to use it, would be ratified by any court that heard the case.

Re:Hardware EULAs

[afidel]

Because software is copied by copyright and hardware is covered by patents. With physical devices you own them merely by possessing them, the only limitation is that you may not create copies and sell those copies. Software and other ephemeral things are covered by copyright and because the idea is the posession you must obtain a liscense to own it, hence the origional author has more controll over your ownership.

IP in the EU rights charter

[yerricde]

And even if you are convicted of some sort of made up IP crime, you can always take the matter to the European Court of Human Rights, which pretty much always finds for the individual, because the EU Convention on Human Rights is a very broad and generous document.

If the EU Convention on Human Rights is anything like the UN Universal Declaration of Human Rights, it includes something about copyright. Article 27 of the UDHR guarantees at least some semblance of copyright to adhering nations.

Article 17 of the Charter of Fundamental Rights of the European Union states bluntly: "Intellectual property shall be protected."

Re:IP in the EU rights charter

[darien]

Hey, this guy actually did some research! Good on him!

It is true that the second section of of Article 17 declares that "intellectual property shall be protected." However, as you imply, that's all it says: there's no inherent provision for DMCA-style übercopyright. Meanwhile, the first section of that same Article states that

Everyone has the right to own, use, dispose of and bequeath his or her lawfully acquired possessions.

While it admittedly doesn't explicitly say that you have the right to hack your XBox and publish your findings, I'd strongly suspect a European court would go for this interpretation rather than the one that would allow a company to disenfranchise the individual. The European Commission wants to keep that power for itself.

Broaden Your Horizons, People

[istartedi]

The XBox isn't the only product with issues like this. Remember the EV-1 electric car? They wouldn't sell them to people, even though people wanted to buy them. They would only lease them, and they insisted on taking them back.

Remember when Ma Bell owned your phone?

Surely there are other examples of "lease only" hardware too.

The real question is, "to what extent should lease-only hardware be permitted"? not "how do we stop this one company from releasing lease-only hardware?".

Personally, I think there should be no such thing as lease-only hardware at the consumer level. It probably makes more sense at the corporate level, like, if you're leasing a drilling rig or something.

OTOH, there are other less clear-cut cases. For example, is your credit card "hardware"? Not in the traditional sense, but the card is owned by the bank, and they can take it from you any time they like. How is that different from, for example... MS disabling your XBox remotely if you violate their TOS?

We could make lease-only illegal by default and carve out exceptions for things like credit card issuers. Or, we could make lease-only legal by default and carve out exceptions for companies like MS.

Actually, a more effective, and less ad-hoc reform might be to prohibit *any* legally declared monopoly from selling *any* product at a loss or under lease-only terms.

How does this validate anything?

[tkrotchko]

"They've essentially validated the need for the DMCA. "

This is a non-sequiteur.

If I buy a piece of hardware, its not my responsibility to validate that vendor's business model, particularly since you haven't signed an agreement with the vendor agreeing to support that business model.

"Microsoft sells XBOX at a loss"

Maybe. Maybe not. I frankly don't care. They are competitive in selling price with other game consoles; it isn't my job to make sure their cost of manufacture is in line with the price of sale.

So I get my XBOX home, I hack it, or a friend hacks it. But it now functions in a way that Microsoft doesn't like.

Maybe. Maybe not. I frankly don't care. I bought it, its mine. I can use it to play games, I can use it as a skeet target, I can use it to prop open the basement door. Hell, I might even use Linux on it. If Microsoft will let me smash it with a hammer, if they'll let me use it to prop up my book shelf, but they won't let me use it to use Linux, I'd say MS is being pretty particular on how they want *MY* equipment to be used.

Just because Microsoft wants you to do something, why are you obligated to do it that way? I don't see the logical connection between the two. If Microsoft is willing to give me some benefit for restricting my use of the XBOX, they probably should have made me agree to it before I bought it.

Too bad.

[Anonymous Coward]

There isn't anything on the outside of the box, and I didn't sign anything that agreed I could only use the firmward in a microsoft approved manner.

Why do you think I owe microsoft anything beyond the purchase price of the XBOX?

Re:This is what MS says

[Psykechan]

"The software included in the Xbox product is licensed to you, not sold." It's on page 20 of the Xbox manual. This exploit involves the dashboard which is MS property even if it's on your Xbox. It is not yours to do with whatever you would like.

Other nice parts of the manual state that your warrenty can be voided if your system is damaged by a virus. I asked MS about this once and they couldn't give me an answer beyond "don't worry about it". Unfortunatly, my experience with MS products says I should worry about it.