Slashdot Mirror
Five-Year-Old Uncovers Xbox One Login Flaw
New submitter Smiffa2001 writes: "The BBC reports that five-year-old Kristoffer Von Hassel from San Diego has uncovered a (frankly embarrassing) security flaw within the Xbox One login screen. Apparently by entering an incorrect password in the first prompt and then filling the second field with spaces, a user can log in without knowing a password to an account. Young Kristoffer's dad submitted the flaw to Microsoft — who have patched the flaw — and have generously provided four free games, $50, a year-long subscription to Xbox Live and an entry on their list of Security Researcher Acknowledgments."
What does that come out to, about $300 for a severe bug? I thought Microsoft just paid out $100k for a Windows 8 flaw.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
Who takes shortcuts for code when you're developing a damned password entry system? I mean... really? When the sole purpose of the code is security, who goes "oh, whatever, we'll just match against whatever?"
I mean, it's not like hashing or string comparison are hard problems.
OK, So they have learned about Jack in these last 16 years... but they are still having some trouble with Shit.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
You'd be surprised. There's a LOT of bad security out there. Something this bad really takes the cake though.
It doesn't mean much now, it's built for the future.
Why is this criminal being celebrated rather than prosecuted for hacking into a protected computer system across state lines? The child is A FELON and must go to jail. The father acted as an accessory and should also be prosecuted.
This might have been a simple to find bug but that's exactly why it would have been so damaging. They could at least give the kid a permanent XBox Live subscription. He would have effectively had one if he hadn't disclosed the bug.
Yeah, are you sick of that story of the Indian kid who got his CISSP at the age of 12? Well, here's a 5 year old with a published vulnerability!
I'm sure the reason the reward was so paltry was because the rest of the reward went to cleaning the development team's underwear.
-- Sometimes you have to turn the lights off in order to see.
I means what kind of code can allow a space password to be approved... the MD5 didn't surely checked... oh wait... another buffer overflow because the length of the password that too big? Why the space? It is a like a backdoor the developer forgot to removed?
I don't know who could get this wrong or how you could get this wrong.
Does it work if you have the same number of characters?
len(input) == len(password)?
or?
input == password OR (len(input) == len(password) AND string_is_all_spaces(input))
You'd really have to go out of your way in a most bizarre manner to screw this up. I mean, this is like tell someone to make an omelette and they accidentally build a time-machine. What the heck were they doing here??
I wonder...
Either this is some developer/tester login thing.
Or the developer did something weird were he removed whitespace, and a "correct" match was found when the manipulated/tested string was length 0.
Troll is not a replacement for I disagree.
You'd be surprised. There's a LOT of bad security out there.
Understatement of the day.
Some people would be shocked if they knew how many retailers offering free wifi don't change their router's login from default. I know I always am.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Which makes me appreciate all the thought that Slashdot put into its security. For example, did you know if you accidentally type your own password into a comment, it stars it out for you? Example:
***********
Neat, huh?
Dark Reflection
... the matching algo checks for zero length strings *before* it strips out whitespace so lets this through. Once it has stripped out this whitespace it *then* has a zero length string but doesn't know it and then the rest of the algo fails due to it.
I'll bet it something stupid like:
hashed_pwd = strip(input_pwd);
for(*ptr = hashed_pwd;*ptr;++ptr) // Match
{
if (hash char doesnt match) return BAD;
}
return MATCH;
Actually, it says Hunter2 for me...
Peter predicted that you would "deliberately forget" creation 2000 years ago...
What if your pin is a palindrome?
"No man's life, liberty, or property are safe while the legislature is in session." -- Judge Gideon J. Tucker
Generally agree.
I would however note that it's that curiosity to try stuff like this and that "what happens if I.." mindset that tends to make a good hacker. Yes this kid lucked out, but it's always encouraging when you see this kinda "poke holes in everything" behaviour early on.
Posting anonymous because I'm still afraid that pepsi goons will break down my door any minute now.
Quite a few years ago, I found that sombody had shown my preschooler that you could enter code numbers from inside the caps of pepsi products to get "free" merch.
He just started entering random numbers and characters until he found a pattern that worked every time. He thought that was the point! He spent hours at it and then proudly showed me that he'd "solved the puzzle" and Pepsi was going to send him truckloads of free stuff.
I quickly popped through a couple DHCPs on the cable modem and told him not to do that anymore.
It's not that hard to do.
Basically could be
a) debug code for QA left in to bypass login
b) buffer overflow (off by one); and an exception thrown that was caught outside the password system; that exited back to the main run-time. ... rarely tested by QA.
Testing that your code can actually handle the maximum number of characters allowable by the input field, is
I've personally crashed websites that don't restrcit the form input length on the password field. Apparently putting in 4096 character passers does tend to cause issues on -many- sites.
c) Other logic errors:
You explicitly forbid empty password from entry.
Some process internally does a trim($b)
Password process throws an unhandled exception case due to using an empty string; or null value returned from the password hashing; validation, oro assocated sub layer.
Maximum length exceeded (-1) combined with a trimmed length of 0; can cause issues if an assumption of "the password cannot be empty at this point" was inadertantly violated.
You code each layer with the assumption of where the data came from, and whether it's been validated or rejected at a higher layer. Something slipping by causes lots of strange, and subtle bugs.
I guess their team of advisors is incomplete:
http://www.eviloverlord.com/li...
"12. One of my advisors will be an average five-year-old child. Any flaws in my plan that he is able to spot will be corrected before implementation."
And:
"60. My five-year-old child advisor will also be asked to decipher any code I am thinking of using. If he breaks the code in under 30 seconds, it will not be used. Note: this also applies to passwords."
Perhaps Microsoft doesn't consider itself evil? Lots of people no longer do. At least they followed rule 32 in this case.
You have that backwards. M$ has always known about shit. Just look at their products.
Reminds me of that stupid urban legend about entering your pin at an ATM when under duress.. entering it backwards summons ze police.
What if your PIN is a palindrome?
Then you get your money and the police....
> Hello, you appear to be new to Slashdot
"For discovering a multi-million dollar bug that would have required us to shut everything down until fixed, and probably reverted our databases by several days, you get almost nothing! Good day, sir!"
"Wut?"
"I said 'Good day, sir!' !"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
That right there should be a serious warning to anyone using or considering Microsoft products.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
> What if your PIN is a palindrome?
you enter "emordnilap a"
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
No! No NO! This is an _extremely_ bad habit! The code looks like crap, but most importantly: you're changing the logical flow of the code. You're changing the way the code explains itself to the reader, which makes it harder to understand. It's like spelling errors in professional texts: it interrupts the flow of the reader.
ALL compilers nowadays warn about the assignment pattern. Try doing "if (i = 1)" in gcc or clang, for example, they'll insist you use double parenthesis around the assignment to explicitly tell it you're really not just missing an equals sign.
For the love of neat code and all that is holy, please drop this extremely annoying "if (constant == variable)" pattern!