Slashdot Mirror

← Back to Stories (view on slashdot.org)

Nintendo Switch Ships With Unpatched 6-Month-Old WebKit Vulnerabilities (arstechnica.com)

Posted by BeauHD on from the buyer-beware dept.

An anonymous reader quotes a report from Ars Technica: Nintendo's Switch has been out for almost two weeks, which of course means that efforts to hack it are well underway. One developer, who goes by qwertyoruiop on Twitter, has demonstrated that the console ships with months-old bugs in its WebKit browser engine. These bugs allow for arbitrary code execution within the browser. A proof-of-concept explainer video was posted here. The potential impact of these vulnerabilities for Switch users is low. A Switch isn't going to have the same amount of sensitive data on it that an iPhone or iPad can, and there are way fewer Switches out there than iDevices. Right now, the Switch also doesn't include a standalone Internet browser, though WebKit is present on the system for logging into public Wi-Fi hotspots, and, with some cajoling, you can use it to browse your Facebook feed. The exploit could potentially open the door for jailbreaking and running homebrew software on the Switch, but, as of this writing, the exploit doesn't look like it provides kernel access. The developer who discovered the exploit himself says that the vulnerability is just a "starting point."

7 of 89 comments (clear)

  1. You say vulnerability, I say opportunity by Opportunist · · Score: 5, Insightful

    You see, on consoles such things get fixed incredibly quickly. Not because console makers are security conscious, but because such holes allow people to actually own the consoles they paid for.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:You say vulnerability, I say opportunity by The+MAZZTer · · Score: 2

      I am quite understanding of console makers' desire to protect their consoles from running pirated games. I am less understanding when their anti-piracy measures go as far as to block backups of saved games, which means if you have to send your console in for repair all your saved games may very well get wiped. There are already horror stories about the Switch in this regard. I fully support homebrew on the Switch if only to fix this intentional flaw. If it enables piracy in the process, too bad for Nintendo. They should have learned their lessons like Valve did when they created Steam and totally owned the PC gaming market.

  2. Re: IoT bots? by Anonymous Coward · · Score: 2, Interesting

    Good thing Nintendo hasn't pushed the device as something you'd frequently take out in public and connect to random hotspots or anything.

  3. Re:There's a shock. by jonwil · · Score: 3, Interesting

    Sony has been bitten by browser bugs on PS4 as well (and in fact such bugs have been used by people looking to jailbreak the system)

  4. A non-issue, just update the device! by adosch · · Score: 2

    That's great there's an announcement of using an outdated Webkit framework on the Nintendo Switch. Is this anything new? How's that any different if I got some IoT device to a smart phone (Android or iPhone) to installing any Windows/Linux OS to an Xbox/Playstation? Does what I had deployed out of the box already have packages that are already part of security updates that need to be updated?

    Fun to report from a journalism perspective, but definitely not news or anything to debate. Just update the Nintendo Switch and stop the huge reach of trying to criticize the console or Nintendo feebly.

  5. Early soft-mods? by wardrich86 · · Score: 3, Insightful

    This sounds like good news to me... if it allows unauthorized code to be run, it could very well be the beginning of the homebrew scene!

  6. Mission Critical? by DatbeDank · · Score: 2

    While all holes and bugs should be fixed, this reads as FUD for me. Maybe those considering using their Nintendo Switches for accessing nuclear launch systems, banking software, and power infrastrucures should refrain from doing so.