Slashdot Mirror
PS3 Hacked via USB Dongle
dlove67 writes "PSX-scene.com reports that the first PS3 modchip has been tested and confirmed to be working. Running off of a USB dongle, it appears to be relatively user friendly and claims to not void your warranty. Online gameplay works (at least for the time being). It's been a long time coming; cheers to the PS Jailbreak Guys." The video is attached below if you're curious. Can't help but point out that this wouldn't have happened if Sony hadn't decided to yank the Boot Other OS option.
The whole reason I bought a PS3 was because it was a closed platform, and because it was a closed platform, it was harder to hack the games. I like playing FPS games and they are absolutely ruined as soon as you have to deal with wallhacks and aimbots. Will this new hack open the door to programs like that?
OK, that might very well be so, and it would make sense. The irony would just be unbearable. At least we can laugh at sony now.
Although this "news" does not even mention if booting linux is possible at this point, this just highlights how it is possible to pirate games - which is somewhat confusing.
Of course if they can boot games its possible they have enough control that they can boot other OS... but no details are mentioned.
Any idea what the nature of this exploit is?
I thought that pretty much everyone who's looked at the PS3 security has found it to be pretty ironclad. The hypervisor was supposed to be obscenely difficult to get around, even if you did find an exploit.
The PS3 was secure through obscurity (besides any actual security present), much like the Wii was in its infancy (Wii drivechips notwithstanding, those are a whole different ballgame). Obscurity works a lot better than security for consoles, because they are big, complex systems that inevitably have holes. Obscurity is useful up until the first hack is published, which is when people finally get to poke at dumps of your software and expose your bugs. The more you can delay that from happening, the better. The Wii did a good job of this by encrypting and signing every piece of data on Wii game discs, for example. There were bugs, but nobody could figure them out without access to decrypted binaries.
We don't know if someone involved in PS3 homebrew hacking had anything to do with this, but it's certain that whoever did this at the very least used techniques developed as a result of the Other OS remioval during development. Specifically, until the Other OS fiasco happened, there was no way to dump PS3 software and analyze it for exploits. Now there is.
Both the Wii and the PS3 obscurity-breaking hacks were almost identical: RAM glitching to escalate privileges from an unprivileged mode in order to access secure areas. The Twiizer Attack on the Wii glitched the RAM address lines in order to dump secure software and keys from insecure GameCube mode, and geohot's PS3 exploit used RAM glitching in order to make the hypervisor unwillingly give you read/write access to secure RAM while in insecure Other OS mode. When software is obscure, hardware is the only way to go. This Wii attack paved the way for Wii software exploits, and certainly this PS3 USB device is based upon exploits uncovered by dumping via the memory glitching exploits released earlier this year after Sony pulled Other OS.
So yes, Sony basically asked for this by pulling Other OS and angrying legitimate hackers who used Other OS, and now they got what they asked for. I'm just glad some piracy company did it first instead of repeating the story of the Wii where pirates piggyback on homebrew.
The one sad, sad thing is that this is called "PS3 jailbreak". Jailbreak is a very specific term that describes breaking out of a filesystem jail (e.g. on the iPhone), and it's being used on the PS3 purely for "brand recognition". This will just make people associate jailbreaks with piracy.
I agree with all you have said but one thing: if it were the hackers who have enabled this hack they would have demoed booting OtherOS, downgrading or whatever.
But clearly it is the pirates here who have done the hack from start to finish. Unless they borrowed it from other "homebrew" guys who were keeping it in private..
The initial heavy lifting to hack the original XBox, 360 and Wii were done by people trying to put Linux on them.
I'm going to back up AC on this one, at least with respect to the Wii. Team Twiizers, the team of hackers (as in, tinkering, not cheaters) have released multiple tools to not only allow and facilitate non-pirate homebrew software to run, they also actually have made efforts to fix critical flaws in Nintendo's design of the Wii. This includes ways to recover a bricked console, which came into play when Nintendo's own official system updates (designed to block homebrew and piracy indiscriminately) were sloppy to the point of being capable of bricking unmodified Wiis.
Team Twiizers also go out of their way to specifically discourage and hamper piracy, including making their software run upside-down on-screen if you've hacked your Wii so much that you must be using it for piracy. They really want to avoid large-scale piracy, because it'll just give Nintendo the incentive to try and lock the Wii back down, depriving everyone of the non-piracy uses for homebrew. They'll happily help with installing Linux on your Wii, and there are guides for using it as a media center, a ScummVM host, and even a VNC client. You can also emulate pretty much every game console in history up to the PS1, as well as MAME, but finding roms (and whatever trouble that might cause) is up to you. However, they make it clear that discussions of piracy are unwelcome.
They already told me they won't do this when I complained about "Other OS" removal.
Quote from Playstation Consumer Services:
"There would not be able reason to remove the features of your PS3 System that you have mention, card readers USB ports or backwards compatibility. They are physical attributes that your PS3 System possesses and do not present a security threat as the option that Install other OS does in this case does."
"even the great Geohot ripped off other people's work and failed to make a dent"
FTFY. Trace over-current spiking was my idea.
I'm betting the USB stick does the same thing but with some other automated software, because the data line on the USB ports runs down that same trace. That trace is the direct vulnerability past the hypervisor.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Care to explain how this works? Similar to glitching in DTV cards?
Care to explain what PCB traces are shared between D+/D- on the USB and the RAM? And what this has to do with your TomTom?
You're also confusing the service mode jig used in Sony repair centers on retail consoles with debug consoles used for development. The two are unrelated.