Slashdot Mirror
Five-Year-Old Uncovers Xbox One Login Flaw
New submitter Smiffa2001 writes: "The BBC reports that five-year-old Kristoffer Von Hassel from San Diego has uncovered a (frankly embarrassing) security flaw within the Xbox One login screen. Apparently by entering an incorrect password in the first prompt and then filling the second field with spaces, a user can log in without knowing a password to an account. Young Kristoffer's dad submitted the flaw to Microsoft — who have patched the flaw — and have generously provided four free games, $50, a year-long subscription to Xbox Live and an entry on their list of Security Researcher Acknowledgments."
You'd be surprised. There's a LOT of bad security out there. Something this bad really takes the cake though.
It doesn't mean much now, it's built for the future.
To put it in perspective, that $100K was for bypassing exploit mitigation features that cross all processes on the system, and would severely undermine Windows 8.1's security features. This one seems to require you to be standing in front of a specific console.
Still, what a stupid bug to have.
... the matching algo checks for zero length strings *before* it strips out whitespace so lets this through. Once it has stripped out this whitespace it *then* has a zero length string but doesn't know it and then the rest of the algo fails due to it.
I'll bet it something stupid like:
hashed_pwd = strip(input_pwd);
for(*ptr = hashed_pwd;*ptr;++ptr) // Match
{
if (hash char doesnt match) return BAD;
}
return MATCH;