Slashdot Mirror

← Back to Stories (view on slashdot.org)

Five-Year-Old Uncovers Xbox One Login Flaw

Posted by Soulskill on from the kids-input-the-darnedest-credentials dept.

New submitter Smiffa2001 writes: "The BBC reports that five-year-old Kristoffer Von Hassel from San Diego has uncovered a (frankly embarrassing) security flaw within the Xbox One login screen. Apparently by entering an incorrect password in the first prompt and then filling the second field with spaces, a user can log in without knowing a password to an account. Young Kristoffer's dad submitted the flaw to Microsoft — who have patched the flaw — and have generously provided four free games, $50, a year-long subscription to Xbox Live and an entry on their list of Security Researcher Acknowledgments."

8 of 196 comments (clear)

  1. $300? by schneidafunk · · Score: 5, Insightful

    What does that come out to, about $300 for a severe bug? I thought Microsoft just paid out $100k for a Windows 8 flaw.

    --
    Some people die at 25 and aren't buried until 75. -Benjamin Franklin
    1. Re:$300? by Redmancometh · · Score: 5, Interesting

      I found a flaw in skype that allowed the dumping of usernames from regional nodes. I could run it on multiple threads and dump literally as high as 2048 per second (never tried with more threads...) Finding the other regional nodes wasn't exactly difficult.

      There are surprisingly dark uses for that ability.

      They sent me an Xbox 360 (this was less than a week before the Xbox one launch) bundle (kinect), 2 games, an Xbox Live Card, and a researcher acknowledgement on Technet (same as this kid) for August of 2013..I'm one of the "individual" entries with no link.

      I did get invited to bluehat as well which was absolutely incredible, but I paid for the flight, hotel (at a discounted rate, at the Westin, Seattle!), etc.

      It was a f*cking awesome conference.

      Skype isn't cover by their bug bounty program, so they said they had nothing they could do. I was pretty insistent that I really needed the money, because I really really needed the money. That was a brief period in my life of spam sandwiches and ramen.

      I'm not complaining, but I am saying if something isn't covered by their bounty program you're not going to get money from it.

    2. Re:$300? by Redmancometh · · Score: 5, Interesting

      The last person who asked me that turned out to actually work with skype at bluehat. The whole team came over and THEN told me who they were -_-.
        I was just looking for a table with people who weren't anti-social, and one of the people happened to work for skype. Very very friendly people by the way.

      Basically I was trying to get into a friends machine (we were doing a mini CTF) and as a joke he gave me the IP to a skype regional node.

      I fuzzed said regional node and started getting really weird responses. I was trying a port that was open (same port as oracle..7776 I think?) Eventually I figured out that an arbitrary 4 bytes would result in a response with a plaintext string at the bottom of the packet.

      My first thought was that my friend was running a gameserver, botnet, chat room, or really just something..weird.

      Eventually I figured out they were skype usernames. Complete accident that I stumbled upon it. I'm only mentioning the details here because A) Microsoft knows exactly how I found it B) It's patched.

      I believe it would have actually have had use as a DDoS amplification platform. The responses sent back were 50-90x the size of the request.

      They never told me why this worked. The first engineer I had talked to asked one of them if it was an edge case, and the other shook his head "no," and aaaalmost said what it was. Then he noticed I wasn't an MS employee and said he couldn't tell me that.

  2. Who? How? by i+kan+reed · · Score: 5, Insightful

    Who takes shortcuts for code when you're developing a damned password entry system? I mean... really? When the sole purpose of the code is security, who goes "oh, whatever, we'll just match against whatever?"

    I mean, it's not like hashing or string comparison are hard problems.

  3. Prosecute the child and father! by Anonymous Coward · · Score: 5, Funny

    Why is this criminal being celebrated rather than prosecuted for hacking into a protected computer system across state lines? The child is A FELON and must go to jail. The father acted as an accessory and should also be prosecuted.

  4. Sucks to be a security professional... by pegr · · Score: 5, Funny

    Yeah, are you sick of that story of the Indian kid who got his CISSP at the age of 12? Well, here's a 5 year old with a published vulnerability!

  5. They were busy by sl3xd · · Score: 5, Funny

    I'm sure the reason the reward was so paltry was because the rest of the reward went to cleaning the development team's underwear.

    --
    -- Sometimes you have to turn the lights off in order to see.
    1. Re:They were busy by JoeMerchant · · Score: 5, Interesting

      This smells more like a forgotten backdoor than an algorithmic flaw.... probably traceable in the commit log to the particular dev who put it in, and all the auditors who should have caught it, but didn't.