Behind the Xbox Boot Code

NiteStar writes "The Xbox-Linux team has up a new article about The Hidden Boot Code of the Xbox. The Xbox console contains a 'chain of trust' to allow only legit Microsoft signed code to run on the Xbox. The hidden 'MCP' boot ROM (just 512bytes) is the link between hardware and software in this chain of trust." From the wiki article: "The Xbox, having an external (reprogrammable) 1 MB Flash ROM chip (models since 2003 have only 256 KB), would normally start running code there as well, since this megabyte is also mapped into the uppermost area of the address space. But this would make it too easy for someone who wants to either replace the ROM image with a self-written one or patch it to break the chain of trust ("modchips"). The ROM image could be fully accessed, it would be easy to reverse-engineer the code; encryption and obfuscation would only slow down the hacking process a bit."

Comments

A guess

[interiot]

Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't been Microsoft Corp. been able to do the same? Why?

I can make a guess. I've worked near a similar security feature implemented in hardware, and they wouldn't let anyone ANYWHERE near any documentation that described how it actually worked. My impression was that no matter how much you know about security, the less the employees know about the implementation, the better, to minimize the possibility for internal leaks. I'm sure they got the minimum 4 people together to inspect the code, per our coding standards, but how experienced were those four?

In Microsoft's case, their 512 bytes are incredibly high-profile. And based on the extensive nature of the hacks, they had to find a couple of VERY experienced security people to inspect their code, and who they trusted 100% to not disclose inside information. My bet is they didn't choose the right people to inspect their code, and after the inspection, any other employees who showed an interest in making sure the code was secure were treated more with suspicion than anything.

Re:A guess

[interiot]

FTFA: After they had learnt their lesson, they designed a pretty good system with the second version of the MCPX - but the implementation still contained at least three security holes

so, my bet is they just aren't clever enough.

*shrug* Not necessarily.

The first shuttle accident was caused by... institutional problems. The engineering issues had already been discovered and discussed, but there were institutional issues that prevented the engineering discoveries to be fully investigated.

The second shuttle accident was caused by... institutional problems again. Again, the engineering issues had already been discovered and explored as much as the engineers could. Certainly NASA tried to fix their issues the first time, but apparently institutional issues aren't as easy to fix as engineering problems are.

My bet is that there WERE at least 4 people at Microsoft who were clever enough, they just weren't involved in the code inspections. Even if those four people knew that it was absolutely critical that they be involved in the inspections, they were specifically not permitted to look at the code, because four other people had already inspected the code, and involving more people (especially people who are "eager" to "help") would simply increase the chance of internal leaks. And that's not an engineering problem.

(on a personal note, at the company I work at, there have been several cases of problems being solved that have well-known solutions, but management puts inexperienced people in charge of the project, and then surround them with many more inexperienced people, ensuring that they never come in contact with someone who can steer them in the right direction. If management doesn't have a process in place to put people with the right knowledge on the problems that really require their expertise (even in an advisory role), then the organization isn't going to perform as well as it otherwise could. (this relates more to the XBox problem... the Shuttle problem is obviously more complex))

Re:A guess

[Monkelectric]

Yep. Let me describe the situation at a place I work, posting anonymously because there are only 4 or 5 companies in this industry. We make devices used in the semi-conductor manufacturing industry ... so when theres a problem, it ruins very expensive batches of chips.

Me: "The software that validates that units are configured correctly is 8000 lines of unauditable if statements. There is no definition of the policy it implements. This madness is going to cause an accident. We must rewrite the software and have lots of very boring meetings."
Management: "Hmmm...interesting...continue patching the software as issues come up."
Legal Department, "We're being sued because a configuration error ruined a batch of very expensive chemicals."
Me: "We must rewrite the software."
Legal: "We must rewrite the software."
Management: "hmm...interesting...continue patching the software as issues come up."

Re:A guess

[cornface]

Management: Hey, stop posting our dirty laundry to slashdot!
Monkelectric from monkelectric.com: Don't worry, I posted anonymously.
Management: We trust you to write software?
Legal Department: AIIIIIIEEEEEE!
Management: AIIIIIEEEEEE!
Monkelectric from monkelectric.com: ...

Re:A guess

[brkello]

Soo, ummm....I take it there is a position in monk electric that will be opening soon. Should I send my resume?

Re:They had some

[CDLewis]

chink in their chain (of trust)

Andrew "Bunnie" Huang, specifically.

Summary

[acaspis]

• Due to technical constraints, the Xbox designers had to implement a secure virtual machine in 175 bytes of x86 code, and failed (there are at least two execution paths leading out of the sandbox). But congratulations for trying.

• They also used a non-cryptographically-secure hash function for authentication (or maybe they didn't have enough space left).

Nice attempt at a TCPA-like architecture, though. And cheers to the xbox-linux guys for their amazing achievements and enlightening write-up.

OT: Shuttle Failures

[cant_get_a_good_nick]

Richard Feynman was one of the people who investigated the first shuttle disaster, and as a pain in the ass cantankerous old coot, really didn't care about standard Washington procedures and really got to the core of the matter. He cronicles a lot of it in What Do You Care What Other People Think?, ISBN: 0393320928 (get it from wherever, no Amazon kickbacks here). A very interesting read, I ended up reading it right after the second shuttle disaster, and thought that a lot of the human problems that caused the first blow up could be fingered in the second.

If you haven't read Feynman before, you'll probably like him. Funny guy, pretty damn smart, and managed with luck, brains, skill and stubbornness to get in the middle of some of the biggest science in the last century.

Re:remember slashdot, that site that got taken dow

[thegrassyknowl]

His point is absurd, but it is a point. As much as we all value freedom of speech, there have been cases here when ISPs and Children (yes, children) have lost in court cases becase a web page belonging to said children contains links to pages (belonging to someone else) that linked to a few copyrighted MP3s.

The GACs (Greedy-Ass Cu..s) are making legitimite technology harder to develop, deploy and use; write a program that can easily share files and someone will load his entire CD collection into it for all to download... then the GACs will come along and take you to court for "developing software with the specific intent to violate copyright" or somesuch.

The world is in a sad state of affairs when it comes to matters like this. The (in the US and all countries that entered into free trade agreements with it) DMCA makes it illegal to circumvent any form of encryption, copy protection, etc.

Slashdot linking to an article that clearly describes the flaws in a copy protection implementation and how to get around it is becoming shaky ground. Gone are the days of free information... the GACs that run the world are making sure of that.

Be afraid, be very afraid.