Slashdot Mirror

← Back to Stories (view on slashdot.org)

Nintendo Offers Up To $20,000 To Hack the 3DS (silicon.co.uk)

Posted by BeauHD on from the bug-bounty dept.

Mickeycaskill writes: Nintendo will pay up to $20,000 for system and software vulnerabilities in the Nintendo 3DS family of handheld gaming consoles. The company is looking to prevent activities such as piracy, cheating and the circulation of inappropriate content to children. The stated goal is to "provide a secure environment for our customers so that they can enjoy our games and services. In order to achieve this goal, Nintendo is interested in receiving vulnerability information that researchers may discover regarding Nintendo's platforms." Silicon.co.uk reports: "Rewards will range from $100 to $20,000, with one given per 'qualifying piece of vulnerability information.' Hackers looking to claim a reward will have to provide Nintendo with either a proof-of-concept or a piece of functional exploit code in order to qualify."

45 comments

  1. Good luck with that, Nintendo. by Anonymous Coward · · Score: 2, Interesting

    $20,000 is peanuts compared to what a good exploit can bring in. The Xkey360 is a good example of a hack that brought in buckets of cash for the folks that made the kit.

    1. Re:Good luck with that, Nintendo. by Anonymous Coward · · Score: 0

      ...and $20k is the upper limit. I'd be surprised if they released any $20k rewards, most are probably $1k or lower which isn't even worth the time submitting a notice to Nintendo. Spend more on your software developers or pay more for your bug bounties--otherwise, keep your chump change, Nintendo.

  2. Remember, the GBC had an ACE exploit. by Anonymous Coward · · Score: 1

    Thankfully they weren't wifi enabled or 1998 could've been an interesting year...

    https://www.youtube.com/watch?v=aYQpl8Jj6Yg

  3. Do they really have a piracy problem? by sims+2 · · Score: 1

    I mean I haven't even seen a 3DS in months I just figured they were obsolete or something. You know like the WII and that thing you have to explain is not a handheld the WII U.

    --
    Minimum threshold fixed. Thanks!
    1. Re:Do they really have a piracy problem? by Anonymous Coward · · Score: 0

      Pretty much the only reason the 3DS gets patched is to fix exploits. There's a small industry that creates 3DS cartridges that fit microSD cards that get loaded with ROM images of games so you can pirate 3DS games to your heart's content. The original DS also had this problem, and the flash carts for it were fairly sophisticated and allowed some interesting features like save states, frame slowdown, and a hex editor.
       
      Source: I pirated a lot of DS games through the flashcart (there were many options) and even played NES Earthbound on it. The cart worked in my 3DS but I wasn't interested in pirating 3DS games because it required you to run old firmware. I looked into it and the flashcart devs do update their software to work with more recent firmware, but it's such a hassle for something I wasn't going to use very much.

    2. Re:Do they really have a piracy problem? by Anonymous Coward · · Score: 1

      There's a very active homebrew/modding scene for the 3DS currently, with a pretty good selection of homebrew apps that you can directly install into a modded console. Including apps that will literally download and install pirated content directly from Nintendo's own CDN servers. So yeah, you could say they have a bit of a piracy problem at this point.

    3. Re: Do they really have a piracy problem? by Anonymous Coward · · Score: 0

      If the only reason they update firmware is to patch exploits why do you care if you're running an old version?

    4. Re: Do they really have a piracy problem? by Anonymous Coward · · Score: 0

      If the only reason they update firmware is to patch exploits why do you care if you're running an old version?

      Mostly because Nintendo forces you to if you are an active gamer and wish to play new games or have access to online content.

      The 3DS automatically downloads and installs a lot of their firmware updates with very minimal user interaction. If your 3DS is not set up to automatically connect with the local wifi, sometimes new gaming cartridges will come bundled with a 3DS firmware upgrade you have to install before being allowed to play the game.

      Several games with online content will not allow you to connect if your firmware version isn't the latest.

    5. Re:Do they really have a piracy problem? by Bing+Tsher+E · · Score: 1

      Considering you can download an entire collection of every Nintendo DS game ever produced and run any of them off of flash in an R4 cartridge, they probably want to prevent that from coming to be for the 3DS.

      There is nearly zero incentive, except for collecting purposes, to search out old DS cartridges to play. An R4 cartridge costs less than a vintage DS Pokemon cart and can hold the entire Pokemon DS collection.

    6. Re: Do they really have a piracy problem? by Anonymous Coward · · Score: 0

      You don't even a flashcart anymore, the 3ds is even more broken than the ds and wii. It takes a couple of hours but afterwards you can simply download any game directly from the eShop to the SD card. If you want to play older games you can use literally any ds flashcard, emulators, or virtual console.

    7. Re:Do they really have a piracy problem? by Anonymous Coward · · Score: 0

      The 3DS is already so much worse than that for piracy... You can pirate 3DS games directly on the system without even needing extra hardware or a computer at this point. It works just like the official eshop except for the whole paying for things part.

  4. It's a trap! by AlexanKulbashian · · Score: 1

    Yeah.. Once you win the prize, they will sue you for the hack

  5. It's funny though... by bobbied · · Score: 1, Troll

    THEY decide what hacks get the money and how much.... I'd like this kind of thing more if it was more of a community decision, where the company puts up some funds in escrow and then some independent evaluation or poll among the user community decides which hacks are worth the most. As it stands, even though Nintendo is asking for help from hackers, they hold all the cards AND the cash.

    Nice PR ploy, but until they actually pay up for this "help" I'm choosing not to hack my way any closer to them than twice as far as I can throw a hacked device.

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    1. Re:It's funny though... by Anonymous Coward · · Score: 0

      Wouldn't work -- the community would just keep voting 'Sploity McSploitface for hack of the week. Just assign a dollar value based on the vulnerability's CVSS score. Something like 2^cvss_score * base_value would work pretty well, especially if the base value were above $1,000. That way, minor flaws would only be worth thousands but a vulnerability that totally screws the pooch ends up being worth millions.

  6. Pirates pay more ... by thesjaakspoiler · · Score: 1

    .. for your hacks than Nintendo does. $20000 is peanuts. Even the retired ladies cleaning the toilets at Nintendo get a bigger annual bonus for their hard work.

  7. They're a little bit late by HalAtWork · · Score: 1

    SKY3DS can already play backups

    --
    Twinstiq, game news
  8. Don't help them until they support homebrew by MobyDisk · · Score: 2

    Security holes in these types of devices are what enable the homebrew developer community. Until Nintendo provides support for homebrew development on the 3DS, no ethical hacker should be providing vulnerabilities to Nintendo. Now, if Nintendo put that $20,000 toward providing homebrew options, then ethical hackers will want to help Nintendo since it would help secure their platform.

    Although, with the rise of smart phones, there is a much smaller homebrew community on the 3DS than there was on previous generations of their hardware.

    1. Re:Don't help them until they support homebrew by Bing+Tsher+E · · Score: 1

      Unless you add a bluetooth controller, there is no comparison between smartphone games and actual handheld games like the 3DS. Kneading your fingers against flat glass will never be a replacement for a handheld with real buttons.

      The fragmentation of the bluetooth controller market, along with the iOS/Android separation, keeps mobile gaming fragmented and weak.

      Just mho, of course.

    2. Re:Don't help them until they support homebrew by tepples · · Score: 2

      This July, Nintendo offered devkits to individuals for the first time. See https://developer.nintendo.com...

    3. Re:Don't help them until they support homebrew by Anonymous Coward · · Score: 0

      You still need Nintendo's blessing to publish.

    4. Re:Don't help them until they support homebrew by tepples · · Score: 1

      Likewise, you need Apple's blessing to publish on Nintendo's competitor (the iPod and iPhone).

    5. Re:Don't help them until they support homebrew by MobyDisk · · Score: 1

      yay! Thanks for posting that!

  9. It will work, but not how you think by k3vlar · · Score: 4, Insightful

    This tactic will likely work, even for the pitifully low amount of money Nintendo's offering, and here's why:

    Real exploit developers will be less likely to release their kits. As soon as they do, nothing's stopping someone from decompiling or reverse-engineering their exploits, and then sending them in to Nintendo claiming ownership and collecting the pitiful reward.

    For every true developer doing it for the challenge, there's two dozen desperate wannabes who will steal it to try and make a quick buck, and it's a lose-lose for everyone. This is why the Wii & Wii U modding and homebrew scene died, it's why the iOS jailbreaking scene died, and those are just recent examples.

    .

    --
    Unlike porn, which yada yada rimshot hey-ooh!
    1. Re:It will work, but not how you think by Bing+Tsher+E · · Score: 2

      People doing it for the challenge probably will continue to do it, then. I can sympathize with them. Many times defeating the copy protection on an 'entertainment' device or game is more fun for nerds than playing the actual game.

      So it's not a lose-lose for the hacker having their fun finding and refining the exploits.

    2. Re:It will work, but not how you think by Anonymous Coward · · Score: 0

      Actually both the Wii and Wii U have fairly good hacking communities but that's because Nintendo no longer supports either of those platforms. It's also likely already to late for the 3DS. The 3DS has maybe 6-18 months left in its lifespan. The homebrew community has all the exploits* it needs to remain relevant for that amount of time. Once the 3DS is no longer supported by Nintendo the homebrew community will have free reign.

      This is more likely a test so Nintendo can learn the ends and outs of these kinds of bounty systems before the switch is released. It also would surprise me if the switches OS is based on the 3DS's OS so they maybe trying to shore up security before release of the switch as well.

      *There are guides detailing hardware based root key extraction that you could look up right now. Nintendo would basically have to rewrite their entire security to stop those and they're not going to do that for the 3DS at this point in its life.

    3. Re:It will work, but not how you think by Anonymous Coward · · Score: 0

      The reason modding scenes died on console and phone is because you can get much more powerful devices for a lot less money. It was more interesting when consoles and devices were more powerful than what you could get without spending lots of money. Now they're even weaker than a basic prebuilt PC.

    4. Re:It will work, but not how you think by Anonymous Coward · · Score: 0

      Shit, even if I were a true developer doing it for the challenge, I wouldn't turn down $20,000.

    5. Re:It will work, but not how you think by trawg · · Score: 1

      For every true developer doing it for the challenge, there's two dozen desperate wannabes who will steal it to try and make a quick buck, and it's a lose-lose for everyone. This is why the Wii & Wii U modding and homebrew scene died, it's why the iOS jailbreaking scene died, and those are just recent examples.

      Hmm, interesting perspective. I guess from the other side though, a lot of us nerds are constantly berating these companies for not being vigilant enough when it comes to security.

      It's possible I guess that the security holes that allow us to jailbreak platforms to exploit other functionality could be considered "beneficial" but I suspect the reality is if those holes exist, it's just as likely they can be exploited by malicious actors.

      If the net result is more secure software - that stops us jailbreaking - is that a better or worse outcome?

    6. Re:It will work, but not how you think by geekmux · · Score: 1

      This tactic will likely work, even for the pitifully low amount of money Nintendo's offering, and here's why: Real exploit developers will be less likely to release their kits. As soon as they do, nothing's stopping someone from decompiling or reverse-engineering their exploits, and then sending them in to Nintendo claiming ownership and collecting the pitiful reward. For every true developer doing it for the challenge, there's two dozen desperate wannabes who will steal it to try and make a quick buck, and it's a lose-lose for everyone. This is why the Wii & Wii U modding and homebrew scene died, it's why the iOS jailbreaking scene died, and those are just recent examples. .

      Then perhaps Nintendo should raise that fucking pathetic reward.

      If the bug bounty reward were $2 million, chances are you would bypass all of this other nickel-and-dime bullshit.

      And don't give me this shit that Nintendo can't afford it. They can't afford not to protect their products making millions, and bounty payouts are also written off as a business expense.

  10. Good idea by raymorris · · Score: 1

    > As soon as they do, nothing's stopping someone from decompiling or reverse-engineering their exploits, and then sending them in to Nintendo claiming ownership and collecting the reward.

    Thanks for the idea! ;)

  11. Just Open up your Hardware by Anonymous Coward · · Score: 0

    Don't bother with payouts. Just publish the details of your system, and let people do with it what they will.

  12. Politically-Correct Hackers by CanEHdian · · Score: 1

    PCHs might. Not for the money, they'd come to the teacher anyway and tattle-tale all about their findings... then have these doe-eyed looks hoping for a "good job, boys" from teach. Because their hack might... (omnious pause, tension builds...) enable PIRACY!!! Ba-dam Tssss. In the old days people just openly released their stuff. Nowadays you got to take precautions and pretend you're a whistleblower, but you can still can get your stuff out in the open anonymously.

    --
    When the copyright term is "forever minus a day", live every day like it's the last.
    1. Re:Politically-Correct Hackers by Anonymous Coward · · Score: 0

      Can't say I've heard of anyone like that... with the possible exception of the Denuvo traitors.

  13. $20,000 ? Nice try add a zero to get serious by ElectricPrism · · Score: 1

    When a developer finds that kind of bug they have the upper hand, I would add a zero and make it $50,000 - $200,000 and if Nintendo wasn't willing to enter contract to exchange the security research for the money by say 20-30 days I would pull a Google and do a Day-Zero publish on the defect. Then I would rinse and repeat including a contractual boilerplate clause to protect and indemnify and collect my payment in bitcoin. 20K is insulting.

    1. Re:$20,000 ? Nice try add a zero to get serious by geekmux · · Score: 1

      When a developer finds that kind of bug they have the upper hand, I would add a zero and make it $50,000 - $200,000 and if Nintendo wasn't willing to enter contract to exchange the security research for the money by say 20-30 days I would pull a Google and do a Day-Zero publish on the defect. Then I would rinse and repeat including a contractual boilerplate clause to protect and indemnify and collect my payment in bitcoin. 20K is insulting.

      Given the amount of money Nintendo makes off these products, $200K is insulting.

      Make it $2 million. THEN you'll find the right amount of attention and results.

  14. DMCA? by Anonymous Coward · · Score: 0

    So let's see... hack the console, get $20,000, go to prison. Yeah, that's worth it.

    1. Re:DMCA? by tepples · · Score: 1

      Security testing, if performed for purposes other than to enable infringement, is not only explicitly exempt from the DMCA's circumvention ban (17 USC 1201(j)) but also likely explicitly permitted under the bug bounty program's terms.

    2. Re:DMCA? by Opportunist · · Score: 1

      So 20k is more like the "20k to life" option?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:DMCA? by K.+S.+Kyosuke · · Score: 1

      It's a good thing to live in a place where the DMCA doesn't apply...

      --
      Ezekiel 23:20
    4. Re:DMCA? by tepples · · Score: 1

      Which country is that that lacks an implementation of the WIPO Copyright Treaty of 1996? And how many refugees from the U.S. copyright regime can your country and its like-minded neighbor(s) absorb?

    5. Re:DMCA? by Anonymous Coward · · Score: 0

      It's Sealand, and it can probably absorb exactly zero.

  15. As a person who owns 2 hacked 3DS's by Nyder · · Score: 1

    Nintendo is really late on this boat, not even sure why they are doing this now.

    The 3DS was hacked a few years ago, but required a 4.5 or less version firmware.
    Then like 2 years ago, a entry point was found under the 9.2 firmware, while 9.2 was the current firmware, and it was a community found exploit, which led to custom firmwares that didn't need hardware cards (like the Gateway or Sky). Since then we've had excellent work on hacking the 3ds, found multi entry points, homebrew entry points and other stuff. Best thing is the Freeshop, which allows you to download games for free off the eshop.

    So ya, Nintendo is really late on this bus, mainly seeing as the Switch comes out in March 2017 and honestly the 3DS will probably stop being supported next year.

    --
    Be seeing you...
  16. Here's how you do it by Opportunist · · Score: 1

    1. Develop exploit.
    2. Sell exploit kit to people who want to pirate soft but can't develop exploit.
    3. Wait for about as long as it takes to reverse engineer your exploit.
    4. Report exploit to Nintendo and collect the 20k. It's just pocket change, all right, but someone's going to report it anyway.
    5. Start over at 1.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  17. Can't hack what you can't get by daveywest · · Score: 1

    About two weeks out from Christmas and you can't find a 3DS in any retail store. I guess for research, I could pay 3x the retail price to a scalper on eBay.

  18. Preparing for the NX release by Not-a-Neg · · Score: 1

    This sounds like they are going to use the same system for the NX that they use for the 3DS to release and deliver games physically and digitally.

    --
    -==- Buy a Mac and leave me alone!