PS3 Hacked via USB Dongle
dlove67 writes "PSX-scene.com reports that the first PS3 modchip has been tested and confirmed to be working. Running off of a USB dongle, it appears to be relatively user friendly and claims to not void your warranty. Online gameplay works (at least for the time being). It's been a long time coming; cheers to the PS Jailbreak Guys." The video is attached below if you're curious. Can't help but point out that this wouldn't have happened if Sony hadn't decided to yank the Boot Other OS option.
The whole reason I bought a PS3 was because it was a closed platform, and because it was a closed platform, it was harder to hack the games. I like playing FPS games and they are absolutely ruined as soon as you have to deal with wallhacks and aimbots. Will this new hack open the door to programs like that?
The forum link is broken. The video does not say anything about how they did it or how it works. It's merely a suggestion that the product does work and then is a link to where to buy it.
Nothing to see here.
Sony will disable all USB ports on the PS3 in the next firmware update.
Can't help but point out that this wouldn't have happened if Sony hadn't decided to yank the Boot Other OS option.
why? Can somebody please explain? the linked site seems down so maybe that's what I'm missing.
because nobody uses mod-chips to pirate games, they only use them to boot linux and run homebrew, since computers are so expensive and PS3s are so cheap, this is the only option that some people have. There aren't many pieces of consumer electronics that can run linux, you know.
the recent push to "crack" the PS3 OS was due to the removal of that function, which Sony did to try to prevent the cracking of their OS. Oh, the circular eddies of irony that feed our world :D
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
Sony claimed that they removed the Boot Other OS options to prevent this type of hacking.
~ Mooga
Can't help but point out that this wouldn't have happened if Sony hadn't decided to yank the Boot Other OS option.
why? Can somebody please explain? the linked site seems down so maybe that's what I'm missing.
because nobody uses mod-chips to pirate games, they only use them to boot linux and run homebrew, since computers are so expensive and PS3s are so cheap, this is the only option that some people have. There aren't many pieces of consumer electronics that can run linux, you know.
Most of the pirates don't have the technical abilities to hack a console. The people who do have the technical ability and inclination to hack a console, won't bother if they can tinker with it themselves without bypassing the security, which OtherOS allowed them to do. By removing OtherOS, they were basically asking the people with the skills, ability and inclination to bypass their security so that they could put another OS back on.
The initial heavy lifting to hack the original XBox, 360 and Wii were done by people trying to put Linux on them.
OK, that might very well be so, and it would make sense. The irony would just be unbearable. At least we can laugh at sony now.
Although this "news" does not even mention if booting linux is possible at this point, this just highlights how it is possible to pirate games - which is somewhat confusing.
Of course if they can boot games its possible they have enough control that they can boot other OS... but no details are mentioned.
Any idea what the nature of this exploit is?
I thought that pretty much everyone who's looked at the PS3 security has found it to be pretty ironclad. The hypervisor was supposed to be obscenely difficult to get around, even if you did find an exploit.
Homebrew scene != Pirate scene
The homebrew guys are generally more motivated and talented then the pirates. Almost all console hacks come from the homebrew guys so that they can run their own stuff (and linux).
The pirates tend to take homebrew code and use it to run pirated games.
The entire time that PS2 had the "Other OS" option it was not cracked, because the homebrew community could already run their stuff. Compare that to XBOX and WII both of which have been broken a long time ago. As soon as Sony closed off the homebrew community, the inevitable would happen.
Of course its not so black and white, there is overlap between homebrew and pirates, but not as much as you might assume. Take a look at TeamTwizzers long campaign against pirates from using their code. They even tried in the beginning to have a dialogue with Nintendo about ways to support homebrew and keep the pirates out.
Going back to PS2; even with the "Other OS" option the advanced graphic features were locked, so homebrew games could never take full advantage of the hardware (neither could Other OS be used for pirate games). Some months ago a way was found for full hardware access, and not long after that Sony reacted by removing the Other OS feature.
There is nothing that stops people from creating USB devices that can rewrite their own ID similar to how there is nothing to stop you from using a different MAC.
If that is the only line of defense, economic incentives for the crackers will make sure you can buy a v2 with "valid" Sony ID or simply a changeable one.
The PS3 was secure through obscurity (besides any actual security present), much like the Wii was in its infancy (Wii drivechips notwithstanding, those are a whole different ballgame). Obscurity works a lot better than security for consoles, because they are big, complex systems that inevitably have holes. Obscurity is useful up until the first hack is published, which is when people finally get to poke at dumps of your software and expose your bugs. The more you can delay that from happening, the better. The Wii did a good job of this by encrypting and signing every piece of data on Wii game discs, for example. There were bugs, but nobody could figure them out without access to decrypted binaries.
We don't know if someone involved in PS3 homebrew hacking had anything to do with this, but it's certain that whoever did this at the very least used techniques developed as a result of the Other OS remioval during development. Specifically, until the Other OS fiasco happened, there was no way to dump PS3 software and analyze it for exploits. Now there is.
Both the Wii and the PS3 obscurity-breaking hacks were almost identical: RAM glitching to escalate privileges from an unprivileged mode in order to access secure areas. The Twiizer Attack on the Wii glitched the RAM address lines in order to dump secure software and keys from insecure GameCube mode, and geohot's PS3 exploit used RAM glitching in order to make the hypervisor unwillingly give you read/write access to secure RAM while in insecure Other OS mode. When software is obscure, hardware is the only way to go. This Wii attack paved the way for Wii software exploits, and certainly this PS3 USB device is based upon exploits uncovered by dumping via the memory glitching exploits released earlier this year after Sony pulled Other OS.
So yes, Sony basically asked for this by pulling Other OS and angrying legitimate hackers who used Other OS, and now they got what they asked for. I'm just glad some piracy company did it first instead of repeating the story of the Wii where pirates piggyback on homebrew.
The one sad, sad thing is that this is called "PS3 jailbreak". Jailbreak is a very specific term that describes breaking out of a filesystem jail (e.g. on the iPhone), and it's being used on the PS3 purely for "brand recognition". This will just make people associate jailbreaks with piracy.
why? Can somebody please explain? the linked site seems down so maybe that's what I'm missing.
While one of my siblings states that "nobody uses mod-chips to pirate games", this isn't exactly true.
The first modders aren't doing it to pirate games. They simply want to write their own apps and run their own code on a different platform, or they want to fool around with the hardware and learn how it works, without having to pay 10s of thousands of dollars for development machines.
So, they build mods that allow running of unsigned code. This was true for the Wii, the 360, NDS, etc.
If there is a closed system, there exists somewhere in the world someone with the knowledge and will to break it, if for no other reason than to say they did.
Previously, with the ability to run linux natively on the PS3, these homebrew developers had the ability to code for a cell, and rather cheaply (at the cost of a PS3 and a keyboard). Granted, they didn't have access to the graphics capabilities, neither the hypervisor, but they could run anything they themselves coded for the cell architecture, without being hassled by Sony.
One person got close to breaking into the hypervisor through a bug that Sony either couldn't, or didn't want to spend time to, fix.
He did this so that he could develop homebrew applications that took advantage of the graphics capabilities, mostly. Pirating games wasn't his primary drive.
In response, Sony simply removed access to "Other OS" completely.
With no outlet to run their unsigned code, hackers have made a push to break the system so they can again do so with updated firmware.
As stated in another thread, the pirate community just waits until someone breaks the system (without any ill intent), and then duplicates that exploit (and in the case of a hardware mod, usually capitalizes on it).
I know, thats why this story is surprising, because its exactly the opposite as what you just said.
Otherwise they would have at demoed booting linux at least.
Also, I have not read any text of the official release so I don't know if they mention any of this, but this might very well just be coincidence. Or maybe not..
False dichotomy. Try again.
Yeah I found it rather sad when he was like "now this is what you've all been waiting for!", I thought he was going to load Other OS - but instead he demonstrates that you can now pirate games.. what an asshole..
which is totally what she said
I agree with all you have said but one thing: if it were the hackers who have enabled this hack they would have demoed booting OtherOS, downgrading or whatever.
But clearly it is the pirates here who have done the hack from start to finish. Unless they borrowed it from other "homebrew" guys who were keeping it in private..
I think most of you are missing the fact that this is running on a debug unit which already has the capability to run unsigned code and code off of hard drives with no restrictions. The USB dongle has nothing to do with that, until this can be show running on a non-debug unit this is very bogus.
... is the asking price of the dongle. They're taking pre-orders now, apparently. Take the money and run..?
THE HONOUR OF THE KNIGHTS - CC Licensed Sci-Fi Novel
I'm very uncomfortable with the words " hacked " and " dongle " in the same headline.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Yeah, and every day many crimes are done with guns, which clearly proves that guns only exist in order to enable crime. Obviously the inventor of the gun was a criminal. Right?
Of course, as soon as the mod chip exists, pirates will use it. And it may well be that they outnumber the other users. But that doesn't tell you the slightest bit about the motivation of the person who originally created the mod chip.
The Tao of math: The numbers you can count are not the real numbers.
The initial heavy lifting to hack the original XBox, 360 and Wii were done by people trying to put Linux on them.
I'm going to back up AC on this one, at least with respect to the Wii. Team Twiizers, the team of hackers (as in, tinkering, not cheaters) have released multiple tools to not only allow and facilitate non-pirate homebrew software to run, they also actually have made efforts to fix critical flaws in Nintendo's design of the Wii. This includes ways to recover a bricked console, which came into play when Nintendo's own official system updates (designed to block homebrew and piracy indiscriminately) were sloppy to the point of being capable of bricking unmodified Wiis.
Team Twiizers also go out of their way to specifically discourage and hamper piracy, including making their software run upside-down on-screen if you've hacked your Wii so much that you must be using it for piracy. They really want to avoid large-scale piracy, because it'll just give Nintendo the incentive to try and lock the Wii back down, depriving everyone of the non-piracy uses for homebrew. They'll happily help with installing Linux on your Wii, and there are guides for using it as a media center, a ScummVM host, and even a VNC client. You can also emulate pretty much every game console in history up to the PS1, as well as MAME, but finding roms (and whatever trouble that might cause) is up to you. However, they make it clear that discussions of piracy are unwelcome.
I think you are missing the point of the argument that others are making. Let's take your two circles. The first is the size of a quarter and represents users that want to run Linux, and the second circle is the number of people who want to pirate games and that is 50 meters in diameter. However, you will find that not everyone in either circle has the technical proficiency to actually do the hacking, but the average technical aptitude of people in the Linux circle is far greater than the mean aptitude in the piracy circle. The real comparison needs to be between the people who want to run Linux, have the technical ability to do the hacking and are willing to invest the time to do it versus to the people whose motivation is piracy. The argument that is made is that the Linux circle now shrinks to the size of a dime, whereas you would need a microscope to see the piracy circle.
Bollocks. Other systems have dozens of mods, why would it be any different for the PS3? That's assuming this is a legit hack which is questionable without further info.
This was done on a Debug Console. If you look at 0:44 on the video, you can see the "Install Packages..." option at the top of the list in the XMB. ...so in other words, nothing unusual, folks. This type of thing could always be done on a Debug Console...
Except that the only reason that people by these mod chips is to play burned games. To claim this has anything to do with homebrew or being able to install Linux is naïveté to the highest degree.
Because there's no way someone would modchip a Wii (before software homebrew was refined to its current pretty-damn-easy standard) in order to plug a mass-storage USB device in and use their console as both a home media center and a game machine. That could never, ever happen. It's inconceivable.
Oh, wait. A simple Google search returns a bunch of sites that want to sell you the (free) homebrew software (in violation of copyright--yes, Team Twiizers' homebrew software is original, not stolen from Nintendo, so they technically hold copyright), and they tout being able to use your Wii to play back pretty much any type of video or sound file VLC can understand. You lose. Player 1 insert coin.
Since it's not readily on psx-scene's main page and forums are hammered.. it works on firmware v3.41 :) and yes "pre-orders" appear to be $170 :(
Your paper is correct. Where your logic issue comes into direct conflict with reality is your assumption that the large circle contains within it anyone capable of a real hack of the PS3. It dose not. On the other hand a high percentage of those in your quarter sized circle can. They did not hack because they had what they wanted. Now that Sony has removed it they did the work to "Fix the situation".
Now that 50 meter circle you were talking about gets involved. They capitalize on the work done by the geeks and give to the masses what they want. "Free Beer!". Bad move for Sony.
Why is it so hard to only have politicians for a few years, then have them go away?
The Xbox 360 has not been jailbroken (on current firmware). It's had its DVD firmware hacked to allow booting of pirated discs, but you cannot jailbreak the 360 to run unsigned code.
The way I understood the current situation is the following:
Image for a second a piece of paper, there are two overlapping circles on it. One represents the people who want to run Linux on the PS3 and are trying to hax0r it. This circle is about the size of a quarter.
The other circle is for the people who want to pirate games and cheat AND HAVE THE TECHNICAL SOPHISTICATION TO FIGURE IT OUT THEMSELVES. The diameter of this circle is roughly the same as the Linux camp.
Basically, you have a very small group of people, who's only motivation for hacking the platform is Sony's removal of the boot other OS function. This group of people then gives away the plans for their hack, and thus enables all the people from your 50m circle who can't hack a PS3 on their own.
Claiming that the Linux crowd is irrelevant here, ignores the fact that one motivated person can release an exploit which will work for everyone, and I think the Linux crowd has a much higher ratio of people who might find those exploits than the crowd of wall-hack/aimbot enthusiasts.
Cheers
At least we can laugh at Sony now.
Oh, believe me... we've been laughing for some time now.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
In what way was their security 'security through obscurity'?
Care to explain what PCB traces are shared between D+/D- on the USB and the RAM? And what this has to do with your TomTom?
You're also confusing the service mode jig used in Sony repair centers on retail consoles with debug consoles used for development. The two are unrelated.
The over-current trick has been used in MANY systems to bypass hardware restrictions by forcing it into a failure mode for repair. From Tom-Tom devices, to the original XBox console, now it's been used on the PS3.
Here's your requested information. I gave you more than you needed so you could grab a PS3 for yourself, pop out the mobo, flip it over, and start hacking for yourself so maybe you can help us figure out WTF these other UNKs are.
http://www.interfacebus.com/ps3-connector-pinouts.html
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.