Slashdot Mirror
PS3 Encryption Keys Leaked
An anonymous reader writes "PS3 security has been compromised again. The holy grail of the PS3 security encryption keys — LV0 keys — have been found and leaked into the wild. For the homebrew community, this means deeper access into the PS3: the possibility of custom (or modified) firmware up to the most recent version, the possibility of bypassing PS3 hypervisor for installing GNU/Linux with full hardware access, dual firmware booting, homebrew advanced recovery (on the molds of Bootmii on Wii), and more. It might lead to more rampant piracy too, because the LV0 keys could facilitate the discovering of the newer games' encryption keys, ones that require newer firmware."
The PS3 is nearing the end of its life and it's taken 6 years to do it so it's served its purpose.
Fundamentally, client-side security doesn't work. You can obscure the hell out of it and bury it deep within the system, but sooner or later, someone's gonna crack it. If they'd just let the damn homebrew people make backups of their games and install their own software, I doubt the mod community would have sprung up like this. They wanted access to the hardware, not pirated games. If they'd just locked up the portion of the system responsible for validating a game disk with some kind of TPM mechanism but left the possibility of running "unsigned" content, I doubt this breakthrough would have happened within the life of the product.
Sony, like every other big corporation, doesn't understand how hackers think. They don't give a fuck about your games: They want to see the nifty hardware! They want to push it to its limits, make new stuff with it. These are creative people who are endlessly fascinated with how things work. They're bored engineers.
But management got the idea in their head that the hardware is also theirs, not the person who bought it, and they're the only ones that get to say what it does, how it does it, etc. In so doing, they pissed off about a half million people who have the time, patience, resources, and will to tear the damn thing apart piece by piece until it's theirs again. Guys, why couldn't you just let them have their fucking Linux on PS3?
#fuckbeta #iamslashdot #dicemustdie
"In non "nerd" speak: This leak only matters if your PS3 is already hacked. If you updated your PS3 with any official update released in the past 8 months (3.60 or higher), nothing has changed. No free games for you."
Not entirely accurate: There aren't any free games for you today. But within the next few months, you can be sure firmware will be available to give you free games forever. Start downloading now, non-nerd.
#fuckbeta #iamslashdot #dicemustdie
It's always a little amazing to see how people cheer on the leaks and cracks when they appear in a closed system, yet continue to support these closed systems with their money and attention when open systems are available.
It's just this very weird disconnect in consumer psychology. You don't have to crack a PC (yet) to do what you want with it. But you make a computer small and flat and suddenly you find yourself having to pay $1+ for every little program, from a collection of programs that somebody else has decided you shall have access to. You don't see the "fuck the man" attitude at the store, you only see it when a Scandinavian high schooler comes up with a crack for your game console and the manufacturer tells you you can't have it.
I just don't get it. How many years past DeCSS are we and banging our heads against the same wall?
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
Honestly if you have any patience you just wait 3 months and the good games are 25$ a pop - that's 2 lunches for me. I'm in my 30's now and I suspect my heavy piracy days are long gone. I also feel slight guilt when I pirate games now, some of these guys bust their asses to make some really good stuff. If ever do pirate anything it's only the gargantuan huge games which are selling a tonne anyhow.
I'm also really really happy with my PS3. I know Sony is the devil here but the exclusive games for the system, unlike the 360 - don't get ported to PC. There's some genuinely unique and fantastic games on the platform.
If I didn't own a beast little HTPC now (HP Microserver N40L) then I would however be happy that finally XBMC might come to the PS3. (I can't deny it DID piss me off they closed the loophole the developers were considering on the PS3) They honestly coudl've sold a shitload more if the PS3 supported XBMC out of the box with a basic live boot CD / DVD or something.
LV0 keys encrypt LV0, the loader that loads all other loaders (no joking - http://www.ps3devwiki.com/wiki/Boot_Order). So, in theory (if Sony doesn't manage to create a clever new way to secure the loaders), yes, you can manage to decrypt any newer firmware they release.
That means that nerd doesn't belong or is it a second level?
Nerds never belong, especially not at second level. They require name-level (10 or greater) to attract followers, and only after constructing a keep.
They (initially) sold hardware at a loss, planning to make up the cost by selling games.
The homebrewers are not, as stated, interested in the games. Therefore, in Sony's view they are stealing the hardware, just as much as someone downloading Sony brand music is stealing it.
The only reason PS3s were able to make cheap clusters is because Sony subsidized the consumer hardware; otherwise it would make more sense to buy hardware designed for the purpose without the controller ports, blu-ray drives, etc. etc.
It's a result of Sony's business decision, and they were losing too much to the people who would never buy a single game or blu-ray movie, so they cut their losses by killing homebrew capabilities, protecting the price points for their profitable target market.
The first-stage bootloader is in ROM and has a per-console key which is effectively in tamper-resistant silicon. The second-stage bootloader (bootldr) is encrypted with the per-console key, but is not upgradable and is the same for all consoles (other than the encryption wrapper around it). This second-stage bootloader verifies lv0. Sony signed lv0 using the same broken process that they used for everything else, which leaks their private key. This means that the lv0 private key was doomed from the start, ever since we demonstrated the screwup at the Chaos Communication Congress two years ago.
However, because lv0 is also encrypted, including its signature block, we need that decryption key (which is part of bootldr) before we can decrypt the signature and apply the algorithm to derive the private key. We did this for several later-stage loaders by using an exploit to dump them, and Geohot did it for metldr (the "second root" in the PS3's bizarre boot process) using a different exploit (we replicated this, although our exploit might be different). At the time, this was enough to break the security of all released firmware to date, since everything that mattered was rooted in metldr (which is bootldr's brother and is also decrypted by the per-console key). However, Sony took a last ditch effort after that hack and wrapped everything after metldr into lv0, effectively using the only security they had left (bootldr and lv0) to attempt to re-secure their platform.
Bootldr suffers from the same exploit as metldr, so it was also doomed. However, because bootldr is designed to run from a cold boot, it cannot be loaded into a "sandboxed" SPU like metldr can from the comfort of OS-mode code execution (which we had via the USB lv2 exploit), so the exploit is harder to pull off because you don't have control over the rest of the software. For the exploit that we knew about, it would've required hardware assistance to repeatedly reboot the PS3 and some kind of flash emulator to set up the exploit with varying parameters each boot, and it probably would've taken several hours or days of automated attempts to hit the right combination (basically the exploit would work by executing random garbage as code, and hoping that it jumps to somewhere within a segment that we control - the probabilities are high enough that it would work out within a reasonable timeframe). We never bothered to do this after the whole lawsuit episode.
Presumably, 18 months later, some other group has finally figured this out and either used our exploit and the hardware assistance, or some other equivalent trick/exploit, to dump bootldr. Once the lv0 decryption key is known, the signing private key can be computed (thanks to Sony's epic failure).
The effect of this is essentially the same that the metldr key release had: all existing and future firmwares can be decrypted, except Sony no longer has the lv0 trick up their sleeve. What this means is that there is no way for Sony to wrap future firmware to hide it from anyone, because old PS3s must be able to use all future firmware (assuming Sony doesn't just decide to brick them all...), and those old PS3s now have no remaining seeds of security that aren't known. This means that all future firmwares and all future games are decryptable, and this time around they really can't do anything about it. By extension, this means that given the usual cat-and-mouse game of analyzing and patching firmware, every current user of vulnerable or hacked firmware should be able to maintain that state through all future updates, as all future firmwares can be decrypted and patched and resigned for old PS3s. From the homebrew side, it means that it should be possible to have hombrew/linux and current games at the same time. From the piracy side, it means that all future games can be pirated. Note that this doesn't mean that these things will be easy (Sony can obfuscate things to annoy people as much as their want), but from the fundamental security standpoint, Sony doesn't have any security leg to stand on
Playing devils advocate... For the same reason the court seemed to side with Sony about being able to remove features (e.g. Linux support), why wouldn't they also be allowed to remove other features (e.g. all of them), by bricking the whole thing, especially if it's out of warranty. It would be a total dick move to do, but it's Sony. PS3 is 6 years old. PS4 is in development. They can manufacture slim PS3s cheaply now. The games are where they make their money. Just send everyone (who bought a PS3 in the last year) a new slim PS3 with new keys, and nuke the rest. They lose maybe $100 per customer, but they get to secure their machine. and as long as they sell at least 2 new games for each free PS3 they send out, they break even. Presumably anyone who bought a PS3 within the last year, intends to buy games for it. Naive people will be glad to get a new PS3 because it's new. If I was a corporate douchebag at Sony, I know I'd be pushing to nuke the old PS3s and screw over all my customers (because I would be in character).
LV0
erk=CA7A24EC38BDB 45B98CCD7D363EA2A F0C326E65081E0630 CB9AB2D215865878A
riv=F9205F46F6021697E6 70F13DFA726212
pub=A8FD6DB24532D094EFA08 CB41C9A72287D905C6B27B 42BE4AB925AAF4AFFF 34D41EEB54DD128700D
priv=001AD976FCDE 86F5B8FF3E63EF3A7 F94E861975BA3
ctype=33
I would not be at all surprised to find out that the leak came from Sony, and was deliberate.
Making the PSX/PS1 easy to hack was the smartest thing that Sony ever did, intentionally or not. Chipping the PlayStation was simple for geeks, who got excited about exclusive games like Gran Turismo, Metal Gear Solid and Final Fantasy 7, and spread the word to their non-chipping friends.
The original PlayStation was so overwhelmingly popular that they mortally wounded Sega, and ensured that the N64 was only a modest success.
That set the stage for the PS2 to be the best-selling console in history, despite the efforts of the (deeply-subsidized) Xbox, which was an excellent console in its own right.
The PS3 was not hacker-friendly or technologically superior. Worst of all, it was very expensive. The reasonable success that Sony has had with the PS3 is largely due to the momentum from the PS1 and PS2 - the PS4 will have no such advantage.
In its last years, the PS3 is still unable to compete on price. The basic specs cannot be improved without destroying backwards compatibility. That only left Sony with one option - make the PS3 easy to hack.
No. The keys are used for two purposes: chain of trust and chain of secrecy. The compromise of the keys fully compromises the secrecy of the PS3 platform permanently, as you can just follow the links down the chain (off-line, on a PC) and decrypt any past, current, or future firmware version. Current consoles must be able to use any future firmware update, and we now have access to 100% of the common key material of current PS3s, so it follows that any future firmware decryptable by current PS3s is also decryptable by anyone on a PC.
However, the chain of trust can be re-established at any point along the line that can be updated. The chain of trust is safely rooted in hardware that is near impossible to modify (i.e. the CPU's ROM and eFuse key). The next link down the chain has been compromised (bootldr), and this link cannot be updated as it is specific to each console, so the chain of trust now has a permanent weak second link. However, the third link, lv0, can be updated as it is located in flash memory and signed using public key crypto. This allows Sony to secure the entire chain from there onwards. Unless you find a vulnerability in these updated links, you will not be able to attack them directly (applications, e.g. homebrew software, are verified much further down the chain). The only guaranteed way to break the chain is to attack the weak link directly, which means using a flash writer to overwrite lv0. Once you do so, the entire chain collapses (well, you still need to do some work to modify every subsequent link to turn off security, but that is easy). If you have old firmware, you have at least some other weak links that, when compromised, allow you direct access to break the bootldr link (replacing lv0), but if you run up to date firmware you're out of luck unless you can find a weakness or you use hardware.
Old PS3s are now in the same boat as an old Wii, and in fact we can draw a direct comparison of the boot process. On an old Wii, boot0 (the on-die ROM) securely loads boot1 from flash, which is securely checked against an eFuse hash, and boot1 loads boot2 but insecurely checks its signature. On an old PS3, the Cell boot ROM securely loads bootldr from flash, which is securely decrypted and checked using an eFuse key, and then bootldr loads lv0 but checks its signature against a hardcoded public key whose private counterpart is now known. In both cases, the system can be persistently compromised if you can write to flash, or if you already have code execution in system context (which lets you write to flash). However, in both cases, you need to use some kind of high-level exploit to break into the firmware initially, particularly if you have up-to-date firmware. It just happens that this is trivial on the Wii because there is no game patch system and Nintendo seems to have stopped caring, while this is significantly harder on the PS3 because the system software has more security layers and there is a game patch system.
I know I should not feed the trolls but...
If you circumvent the firmware, it's copyright violation.
If you circumvent the firmware you are committing the offence of circumventing technological protection systems, not copyright violation.
If you acquire any free games you haven't paid for and are supposed to, that is theft.
Again false, if you have not taken any physical property, it is not theft, that is copyright violation. If you walked into a store and took a game disk, that is theft.
Therefore, copyright violation where a free product is obtained illegally is in fact COPYRIGHT VIOLATION
It's not open in the OSS-speak sense but it is in the sense you can install any software you want on it, write code for it with no license to anyone and so on. You can even run other OSes along side it as a dual boot, or in it with an emulator. Has all kinds of the games.
I do all my gaming (and I do a ton of gaming) on the PC not for any idealistic reasons, but because I like it better. There are very, very few games I don't get to have that consoles do, and a number I get to have that consoles don't. It is a very valid gaming platform, and is open if that matters to you.
The name is presumably wrong - they would be the bootldr keys, as the keyset is considered to "belong" to the entity that uses those keys to check and decrypt the next thing down the chain - just like the metldr keys are the keys metldr uses to decrypt and verify other *ldrs, the bootldr keys are the keys bootldr uses to decrypt and verify lv0.
Anyway, you're confusing secrecy with trust. These keys let you decrypt any future firmware; as you say, if they were to "fix" that, that would mean new updates would not work on older machines. However, decrypting firmware doesn't imply that you can run homebrew or anything else. It just means you can see the firmware, not actually exploit it if you're running it.
The only trust that is broken by this keyset (assuming they are the bootldr keys) is the trust in lv0, the first upgradable component in the boot process (and both it and bootldr are definitely software, not hardware, but bootldr is not upgradable/replaceable so this cannot be fixed). This means that you can use them to sign lv0. Period. Nothing more, nothing less. The only things that these keys let you modify is lv0. In order to modify anything else, you have to modify everything between it and lv0 first. This means that these keys are only useful if you have write access to lv0, which means a hardware flasher, or an already exploited console, or a system exploit that lets you do so.
Oh, one more thing. I'm assuming that these keys actually should be called the bootldr keys (as in the keys that bootldr uses to verify lv0), and that the name "lv0" is just a misnomer (because lv0 is, itself, signed using these keys).
If this keyset is just what Sony introduced in lv0 after the original hack, and they are used to sign everything *under* lv0 and that is loaded *by* lv0, then this whole thing is not newsworthy and none of what I said applies. It just means that all firmwares *to date* can be decrypted. Sony will replace this keyset and update lv0 and everything will be back at step 1 again. lv0 is updatable, unlike bootldr, and is most definitely not a fixed root of trust (unlike metldr, which was, until the architecture hack/change wrapped everything in lv0). If this is the case, color me unimpressed.
Nevermind, I just checked. They are indeed the bootldr keys (I was able to decrypt an lv0 with them). Consider this confirmation that the story is not fake.
It pisses me off how many Sony fanboys cheered when OtherOS was revoked, and said that the hackers using it were such a small portion of the market that they deserved to get fucked over anyway.
Whatever happened to truth in advertising? When did it become ok to assrape one part of the market to protect another?
The bottom line is that the people who bought the PS3 for OtherOS were retroactively mislead and someone thought so enough that Sony wound up getting sued in 5 different class action lawsuits over it.
People actually blame hackers for piracy, when it's actually pirates being opportunistic thieves taking advantage of the hacker. Pirates "steal" effort from hackers by subverting hacker work for their own ends just like they "steal" from content creators.
The argument that promises were broken fall on deaf ears because most people think that Sony was cool to flip the bird at OtherOS users, simply because hackers are scum that deserve to be cheated anyway.