Microsoft Aims for Hack-Proof 360

jondaw writes "The BBC is reporting that "Microsoft plans to make its next generation games console, the Xbox 360, as difficult as possible to hack...There are going to be levels of security in this box that the hacker community has never seen before...I'm sure sooner or later someone will work out how to circumvent security. But the way we have done the design doesn't mean that it will work on somebody else's machine.""

Comments

Amount of work in design

[Wayne247]

Is simply equal to the amount of work hackers will have to do to get around it.

Claiming something hackproof is like saying a doorlock is tamper-proof. It *can* be opened, it's just how much work are you prepared to do that justifies doing it.

Re:Amount of work in design

[Red Flayer]

Not claimed to be hackproof in TFA: "'I'm sure sooner or later someone will work out how to circumvent security. But the way we have done the design doesn't mean that it will work on somebody else's machine'[said Chris Satchell]"

So, they say that a hack may work on one machine, but not another? Article implies that this additional security is added through hardware design. What are they doing, putting a combination lock on the circuitry?

No matter what the new security is, I'm sure it'll me that much more rewarding for the person who first publishes the workaround.

MS has to be careful that the console isn't too easily modifiable, or else they'll get slapped with a lawsuit for enabling people to pirate copyrighted works...

Re:Amount of work in design

[Iriel]

I have to agree with another reply that this is simply an open invitation taunting every hacker to crack the 360 ASAP. Besides, there's going to be a problem, as with all hackery, that Microsoft, however large their development team is, has to design something that can withstand the combined efforts of at least an entire country of would-be 360 hackers.

The numbers don't look too good for Microsoft on this one.

The Only Secure System

[TracerRX]

The only secure computer is one that is turned off, locked in a safe and buried 20 feet down in a secret location, and I'm not completely confident of that either. -- Bruce Schneier

Re:The Only Secure System

[PedanticSpellingTrol]

Well that settles it, I'm telling my bank to give their next tech contract to Infinium.

This must be...

[Pig Hogger]

This must be the computerish equivalent of the "Kick-Me" tee-shirt...

Re:This must be...

[MarkGriz]

This must be the computerish equivalent of the "Kick-Me" tee-shirt...

More like the *triple* dog dare.

Just keep it up

[oman_]

Just keep on hyping up your new security up until launch. Thay way you look like even bigger 4$$holes when it all comes crashing down.

To test this...

[voxel]

They should (if not already) create a new team, called the XBox Crackers Team. They can use a saltine logo for thier t-shirts.

The saltine group will then comprise of a group of 5 bright individuals, who will be awarded as a whole $200,000 or $40,000 each if they can come up with a hack that would or could end up with a cheap mod-chip solution that could be mass-produced.

They of course have a pre-set deadline, say between now and the actual launch.

Misleading

[Anonymous Coward]

They aren't trying to make it "Hack Proof" just difficult to hack. That headline will have worthless forum threads going for days...

Why?

[marcus]

I am sure that there are others like me, the only reason I bought an Xbox was because it *was* hackable!

I use it in a 'hacked state' far more often than 'straight'.

Re:Why?

[nb caffeine]

seconded. XBMC runs more often than games do on my xbox. I know they are including xbmc-like functionality in the 360, but that doesn't do me a bit of good, with my media files stored on a debian based server. Though, its not like my xbox is going to stop working the instant the 360 hits the street. I'll be fine till xbmc360 comes out :)

Re:Why?

[marcus]

That might have been a good reason for the Xbox to be made hack proof, but not the 360. Unless I have mis-remembered something, M$ has opted out of the take-a-loss on the console for market share and volume in order to re-coup on game sales business plan. They intend to profit, or at least take no loss, on the console sales. Thus the appreciably higher prices and different levels of factory installed features.

The same hackability is still an attractive feature. Having one GP box that can play DVDs, surf IMDB and weather sites, play tunes and vids from my home file server, play games, etc. without hassling with reconnecting cables and chasing remotes is *very* nice compared to the heat and noise generating, cable tangling mess that is a 'normal' home audio/video/PC/game stack.

Note that I don't especially want to hack it. Instead, I want to use features that are enabled since it has been hacked.

I'm still looking for a box that will do all this and HD. Perhaps a hacked 360 will be it.

hack-proof != difficult to hack

[lysander]

Article: Microsoft plans to make its next generation games console, the Xbox 360, as difficult as possible to hack
Headline: Microsoft Aims for Hack-Proof 360

I would like to think that slashdot would be a place where people (e.g. editors) would know the difference between these two statements.

As a wise man once said to me :

[LePrince]

"If something was done by a man, another man can undo it". Still holds true, IMHO.

Re:As a wise man once said to me :

[loopback_127001]

Ok. I'm going to burn down the Sistine Chapel.

undo it.

Re:As a wise man once said to me :

[Xarius]

So if I, say, cremate someone, who's the man that can undo this?

Just a though. ;)

Real security

[steveo777]

The first, most obvious measure is price. If people can't afford one, they certainly can't hack one.

The kernel software will, of course, be protected with poor coding that is nigh impossible to navigate.

The box will be made out of the rare metal Adamantium infused with trace particles of kryptonite. Virtully unbreakable, and protected against any Kryptonian hackers.

But the most important security measure of all: Microsoft plans on installing at least half a dozen starving, crazed weasels that will attack anyone who succeeds in opening their boxes.

I think people underestimate the challenge

[EnglishTim]

There seems to be this attitude that a crack will inevitably come out fairly quickly.

I don't think that's the case.

I think many slashdotters are overly confident just because the original Xbox got hacked and we've manage to hack CSS, but you've got to remember a couple of things: Firstly, the original Xbox was the first hardware of that type that Microsoft had created. They put in some protection but it wasn't good enough. I'm sure they have learnt from their mistakes and it will be considerably more difficult to crack this time around. Secondly, with CSS it took quite a long time to get a crack and that was due (IIRC) to a CSS licensor screwing up and leaving the key unprotected in the firmware.

Now, it's possible that Microsoft have screwed up again, but it's by no means a sure thing.

Re:I think people underestimate the challenge

[kisrael]

You make a decent point.

It wasn't as tempting a target for hackers I guess, but Atari put some checksum encryption in the Atari 7800 that, in effect, stymied 3rd party/homebrew cart makers for YEARS. I think they finally got a handle on it, but still. Smart people are making the security, and while they have tremendous obstacles, they might not always bat .000 like people assume.

A more recent example...all those people who like homebrews so they have to be petrified of getting their PSP updated to > 1.5 whatever...

Re:I think people underestimate the challenge

[arkanes]

It's not just overconfidence, it's basic information theory. All the components for cracking the XBox are present in the XBox itself.

CSS was broken very quickly by extracting a valid key from a player. Note that this is not a "cheat" - this is a fundamental hole in this sort of DRM. The key is and must be present to play the DVD, and with the key present it can be extracted.

However, DeCSS does not rely on extracting a key - it's an algorithmic attack on CSS itself.

Re:I think people underestimate the challenge

[tolan-b]

To my knowledge every major console ever released has been cracked. What makes this one so different?

Re:I think people underestimate the challenge

[Troed]

the over all impression I got was that Microsoft was fairly close to 'unhackable' with their chain of trust.

True. If Microsoft hadn't released the v1.0 security system bunnie hacked we probably wouldn't have been able to hack v1.1 since we used a lot of knowledge gained from 1.0 in doing so. One of those things was used to get hold of the code for the hash algorithm. Without that we wouldn't have known it was TEA and thus flawed for hashing.

The Gamecube was only hacked since tmbinc found an extreme implementation flaw. A single "clear register" in their loop would've made the Gamecube unhacked up until this day, in my view.

The reason it's possible to make an "unhackable" console is that they can use hardware security, i.e, "if you cannot extract the key from our little chip here, you're not going to run code on our hardware".

That's secure enough.

Re:I think people underestimate the challenge

[swillden]

DeCSS does not rely on extracting a key - it's an algorithmic attack on CSS itself.

Actually, to be precise, DeCSS is just a reverse-engineered implementation of the decryption algorithm, and must be provided with the correct key. libdvdcss, the open source library widely used to decrypt DVDs, includes not only another (improved) implementation of the decryption algorithm, but also an algorithm that performs a very efficient ciphertext-only attack on a CSS-encrypted DVD title.

DVDJon's original DVD work involved reverse engineering the encryption and decryption algorithms, and extracting a player key from the Zing software DVD player (the player key is used by "legitimate" players to recover the disk key, which is used to recover the title keys, which are used to decrypt the data). Only later was CSS cryptanalyzed and found to be so weak that it's actually more convenient to simply break the title encryption directly rather than ship a player key with libdvdcss.

Re:I think people underestimate the challenge

[einTier]

I used to think everything was crackable. And, to a certain extent, I still believe that, though I realize now that not everything will be hacked.

DirecTV had their orginal F cards hacked, then their H cards, then their HU cards. And that's as far as it went. The new P4 and P5 cards are still encrypted and secure. In my mind, it shouldn't be all that hard to intercept calls through the box and figure out how to write to the card -- but then again, more talented hackers than me have tried and failed, so what do I know?

The second generation of secure big-dish satellite recievers is yet to be hacked as well, despite the fact that it's been over a decade and the first generation boxes were hacked nine ways to Sunday.

Re:I think people underestimate the challenge

[KillShill]

it requires more sophisticated hardware analysis tools and perhaps revised algorithmic attack vectors.

clearly, they've changed the way it works enough that previous avenues for revealing the mechanism will not work.

try something totally new.

DRM is the most flawed cryptology around for the simple reason that it must be viewable by all people who purchase it. and because of that, it must be on the hardware and software in possession of the customer.

hardware is a lot tougher to crack than software simply because the tools required are more often than not, not able to be acquired by the hackers.

but the difference here is that your hardware which a "console" (read computer) is, has far more uses than trying to "crack" satellite to get free service.

if you can hack a "console", then the person who bought that device, can have full access to their personal property. that's simply not the way it is with satellite access.

all those processors in the "console" can then be put to use to do things like being a MYTH tv box, a node in a render cluster, a home theater silent media center, etc.

they are DENYING the customers their lawful property. to hide behind "well that's not what we're selling" BS. they spend considerable time and money preventing people from having full access to property they purchase.

it's a smokescreen, a red herring if you will. there are other ways to prevent copyright infringement. because the real issue, like it is with the RIAA and the MPAA is not infringement, that's small potatoes. the real reason is for control and having the leverage for other avenues for extorting money.

like when people have cell phones that they cannot upload and download ringtones, pictures etc without having to ask permission from the provider and paying an extortionist fee. i can see where they can block you if you are renting or leasing a phone but not when you buy it outright.

but as you know, they deceive and defraud customers because they don't mention that these consoles are rented or leased with a one time fee. people, virtually 99.9%, including techies assume incorrectly that it's a sale.

there is no "hack" in the sense the public understands. people are just trying to get back what the manufacturers are denying them. they use the law to screw over people and that makes the situation even worse.

it's not "homebrew", call it arbitrary code execution. execution which is legally owed to you by the manufacturers who go out of their way to deny you.

Working Definition

[Anonymous Coward]

A lawyer friend once told me that the working definition of "waterproof" was not that something was impervious to water, but that when something was damaged by water the manufacturer was obliged to replace it.

Maybe what Microsoft is saying is that when your Xbox 360 becomes a DDOSing zombie, they will replace it for free*.

*postage paid by end user. Please include a stamped, self-addressed return box. 350 dollar processing fee required. Void in New York, California, and anywhere else those linux loving hippies live.

Hacking never got anyone anywhere, right?

[truthsearch]

Yeah, cause hacking never resulted in the creation of any large software companies... Microsoft thinks there's no way to profit from hobbyists. How was it their company got started again?

Was is the green or red wire?

[vertinox]

"Microsoft plans to make its next generation games console, the Xbox 360, as difficult as possible to hack..."

In a basement in the Midwest...

Hacker1: According to the diagram we are supposed pull the firing pin without shifting it's center of gavity or otherwise the mercury will hit the electrodes on the C4.
Hacker2: Ok. *click* *beep* *beep* *beep* Oh crap! You didn't say anything about a presure plate.
Hacker1: Quick. Cut the wire to the right of the power supply.
Hacker2: Ok. Oh double crap!
Hacker1: What?
Hacker2: There are two wires!
Hacker1: Well just cut one for christ sakes!
Hacker2: Here goes nothing! *clips* *beeping stops* *phew*
Hacker1: Finally... No we put the rom chip here... *xbox starts spewing green smoke*
Hacker2: Oh fark! *coughs* It the posion gas!
Hacker1: *coughs* Does this mean we *coughs* voided the warranty?

what they really mean is...

[advocate_one]

they can't guarantee the 512 byte bootloader will be free of bugs... so they're hoping and praying that the super duper hardware is so obfuscated with a seriously weird state machine that no-one... even them, can figure how on earth it ever works...

can't be done.

[Ruis]

My boss learned a long time ago that the fastest way to get a hacker to do something is to tell them that it can't be done.

Re:Wha? Are they even thinking?

[RoadDoggFL]

As the above reply stated, Xboxes cost more to manufacture and distribute (I'm assuming that's factored into the "sold at a loss" claim) than they're sold for. So every Xbox bought up by "all the buisnesses that were buying Xboxes and turning them into linux servers/clusters back when the first box was hacked" had to be replaced on the shelves by another Xbox that cost more than MS made from it,

Why on earth doesn't Microsoft want a "piece of the pie"?

That reminds me of a joke from a bad movie

[captaincucumber]

what's the difference between a light bulb and a pregnant woman?

You can unscrew a lightbulb.

Not everything can be undone.

So I guess the question is, will the XBOX 360 be more like a lightbulb or a pregnant woman?

How hack proof does it need to be?

[rev0102]

If a few dedicated people are able to hack/mod their new XBox 360s, I seriously doubt microsoft will be bothered. The question is, Will any monkey with a soldering iron be able to mod their new console and run homebrew software and pirated games? Having just finished my first xbox mod, I have to say it was staggeringly easy: Solder these pins and these wires here, here, and here. Replace hard drive. Done. I would not have attempted it if it had meant, say, soldering a dozen or so additional wires, desoldering and replacing a chip or two, and maybe dremeling out a section of the case. All they have to do is make sure that the system is difficult and/or expensive to mod so that only the dedicated few are really doing it.