Slashdot Mirror
The 'Unpatchable' Exploit That Makes Every Current Nintendo Switch Hackable (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: A newly published "exploit chain" for Nvidia Tegra X1-based systems seems to describe an apparently unpatchable method for running arbitrary code on all currently available Nintendo Switch consoles. Hardware hacker Katherine Temkin and the hacking team at ReSwitched released an extensive outline of what they're calling the Fusee Gelee coldboot vulnerability earlier today, alongside a proof-of-concept payload that can be used on the Switch. "Fusee Gelee isn't a perfect, 'holy grail' exploit -- though in some cases it can be pretty damned close," Temkin writes in an accompanying FAQ. The exploit, as outlined, makes use of a vulnerability inherent in the Tegra X1's USB recovery mode, circumventing the lock-out operations that would usually protect the chip's crucial bootROM. By sending a bad "length" argument to an improperly coded USB control procedure at the right point, the user can force the system to "request up to 65,535 bytes per control request." That data easily overflows a crucial direct memory access (DMA) buffer in the bootROM, in turn allowing data to be copied into the protected application stack and giving the attacker the ability to run arbitrary code. The exploit can't be fixed via a downloadable patch because the flawed bootROM can't be modified once the Tegra chip leaves the factory. As Temkin writes, "unfortunately, access to the fuses needed to configure the device's ipatches was blocked when the ODM_PRODUCTION fuse was burned, so no bootROM update is possible. It is suggested that consumers be made aware of the situation so they can move to other devices, where possible." Ars notes that Nintendo may however be able to detect "hacked" systems when they sign on to Nintendo's servers. "The company could then ban those systems from using the Switch's online functions."
Nintendo should have used custom hosts files in the Switch. That would have made them unhackable. I'm sure APK will agree with this.
Nintendo begins charging for online service in September so I wasn't going to be playing online after that anyway. Losing access to the eShop doesn't matter so much if you're pirating all the games. This is a shitty development for Nintendo and game developers.
So if I'm understanding TFS correctly users might be able to take control of their devices and use them for something other than their intended purpose?
Sounds good to me!
The 'Unpatchable' Exploit That Makes Every Current Nintendo Switch ownable by the person in possesion of it, which can be a good thing.
So it's an bug that can only be exploited locally, is this really a big deal? I'm not worried that people can now run arbitrary code on hardware they own.
Enigma
I'm sure glad I don't know what this is.
Here's hoping.
If you want to hack your Switch to run whatever you like when you're offline then you should be free to do so.
If you're hacking your Switch for aimbots and wallhacks in online games then you can FOAD.
It's finally time to get one now that you may actually own one?
Nintendo, again leaving the competition in the dust when it comes to building what the users really want!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I thought they could ban you from their servers too, but since they're all Nvidia Tegra X1-based systems, I just sent them an improperly coded USB control procedure at the right point and changed the ban-state for my account.
It is suggested that consumers be made aware of the situation so they can move to other devices, where possible
Why the hell would they do that? Because the device's general utility has suddenly improved?
Ezekiel 23:20
1) Hack your switch and be able to turn it into an awesome, open device able to emulate and do all sorts of things it wasn't designed to do, or
2) Keep it unhacked and be able to play new games that come out that require the latest Nintendo updates (of which I'm sure you would be blocked from when they detect that your system has been hacked).
This was the same deal with the Wii.
It is pitch black. You are likely to be eaten by a grue.
When confronted with the concept of irreplaceable fuses in hardware I always get this profoundly sick feeling deep inside my stomach. I'm sure I'm not the only one; the whole idea seems perverse somehow.
From a manufacturer's point of view, having fuses reduces the number of parts they have to ship.
For example, if I want to ship a PC that my enterprise customers can permanently lock the bootloader so that it's useless to a thief but which is unlocked by default, I only have to ship one model.
If I were not allowed to use fuses or some equivalent technology, I would have to create several slightly-different models. All but one of the models would have a locked bootloader that was uniquely configured to a particular enterprise customer's requirement.
Granted, that's a made-up atypical case but it does illustrate the value of allowing the customer to make irreversable modifications of this type.
Is "attacker" what you call an owner unlocking his or her device? Do you call people who root their Android devices, or people who jailbreak their iOS devices "attackers?"
The Daddy casts sleep on the Baby. The Baby resists!
As I scanned the story, I thought, 'Wow, a female doing low-level, really tough,hardware hacking! Waaaaiit, it's gotta be a dude...'
>Checks youtube video from hack author
>hacker is clearly, openly a dude in makeup, using the cringe-iest-ever falsetto voice.
-__-
Can't Nintendo make sure games don't run unless they download some x, y or z file?
I find it funny that FOSSies were super worried about access to the source code (never mind that several proprietary games have been hand-hacked using hex editors with great results, without the need for a line of source code)
The problem is that all the hand-hacks that you mention, even if successfully done in practice, are theoretically against copyright and other DCMA-alike laws (though in some jurisdictions they are expressly covered by local "fair use"-alike exception. I think you *could* be allow to bypass security to access your own device that you own in several European countries).
So even if it was done, it's something that in theory we would not be allowed to. The whole idea behind copyleft licenses (like the GPL family) is to expressly allow end-users to modify the code running on device they own in this way.
and the real threat to user freedom came from a GPL kernel locked behind locked bootloaders and locked root access. Nice foresight there Mr Stallman!
Yeah, and if you were paying attention, Stallman did not only foresee it, he was even the one to come up with a name for that : he suggested "tivoization" named after the first device with widespread public knowledge to have such signed firmware locking the access.
The whole reasons to release a new "version 3" of the GPL was exactly to complain agaisnt companies who abuse GPL code by locking it behind signature checks in the bootloader.
It's for company that pretend to follow the letter of GPLv2 (by publishing the code) while at the same time violating its spirit (finding a loophole so the users is free to study and modify the code, just not the peculiar install that is running on the company's hardware that the user has bought. You could modify the code published by Tivo, but you could only install it on a self-built PVR/PCTV, you cannot upload your mods to your own Tivo).
But hey, you were probably among the first to complain about the "restictiveness" of GPLv3, how it's even more an evil virus than the previous GPLs, etc.
(NOTE: Linus refused to switch Linux to GPLv3.
- for a practical reason, because currently the Linux license says "GPL version 2" without adding the optionnal "or any future". So switching to GPLv3 would have required to comb through the git log to find every single last developer/patch submitter/Etc. that is still responsible for lines of codes that are still present in the modern linux (survived later patching and code removal), and then ask every single one of them to confirm accepting the license change.
- for theoretical reasons : Linus considers himself a pragmatist. Current GPLv2 already allows users to at least see the code, and play around with it and learn from what the publishers have modified. The maker of the device gets to decide what goes with their device (barring user access using signatures). The user get to vote with their wallet and decide which maker they want to support).
(Also, I suspect that the forking that did happen back in recent history around controversial re-licensing (see XFree86 vs Xorg).
Also, GPLv3 was seen as controversial by some companies. See Apple : even if the newer GPLv3-ed GCC are popular elsewhere, Apple did decide to stick with pre-GPLv3 older GCC 4.2, and has been progressively replacing everything with LLVM as their default supported compiler.
Given that, Linus might have been right to be afraid of losing marketshare / mindshare by switching to GPLv3)
Cue in eternal debates of corporate developers finding that BSD is more free because more permissive, and end users finding that GPL is more free because it enforces the end-users' freedoms being kept.
Now excuse me, an Android phone of mine crapped its own /system partition and I cannot reinstall the OS (like I can with evil non-free Windows) because locked bootloader. No, honestly.
Yup, so why don't you go and hand hexedit it wi
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Today I learned that someone running their own code on a machine they bought is considered an "attacker".
This is great news, I hope the community comes up with great new ways of using the Switch that Nintendo isn't willing to do.
Dual booting Android, being able to backup *gasp, such a novel notion* your saves, among several other things that the Switch has the hardware to do, but it doesn't because Nintendo fears it might create a pathway for a hack or something.
Nintendo might hate it, but this could potentially make the Switch a thousand times more enticing for costumers.
And yes, pirates will make use of the exploit. But I hate the fact that Nintendo keeps stepping back on features their paying costumers want just because of the potential for exploits. If the company is going to adopt an anti-consumer posture because of fears of piracy and exploits, I'd rather they end up with an unpatchable device so they can be freed of speculative crap.
Now Nintendo, your precious Switch is already wide open. Get to working on the features we are asking for.
Signed, a paying costumer.