Technological discussion on PS3 security and crack.*

Discussion in 'Console Technology' started by senas8, Jan 23, 2010.

  1. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    Not that we have heard. Probably looking for solutions now…

    The partners may get updates but I think the picture is still shifting.
     
  2. JPT

    JPT
    Veteran

    Joined:
    Apr 15, 2007
    Messages:
    2,387
    Likes Received:
    861
    Location:
    Oslo, Norway
    Would love to be in on those meetings where they discuss this :)
     
  3. RenegadeRocks

    Legend

    Joined:
    Oct 16, 2005
    Messages:
    10,108
    Likes Received:
    1,105
    Frankly speaking, they not letting it get cracked uptill now is itself a great feat ! Bravo Sony !
     
  4. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    Nah… it could have been better, much better... had a few Sony developers made the right implementation decisions.
     
  5. RenegadeRocks

    Legend

    Joined:
    Oct 16, 2005
    Messages:
    10,108
    Likes Received:
    1,105
    Yup, but we can't cry over spilled milk, can we ? But still, comparing this to the hacking of Wii and 360, I think its a big feat to hold on for so long when the whole world is against you !
     
  6. Neb

    Neb Iron "BEAST" Man
    Legend

    Joined:
    Mar 16, 2007
    Messages:
    8,391
    Likes Received:
    3
    Location:
    NGC2264
    Sounds like something that could be taken straight from some 'SDF' slogan. :lol2: :razz:

    But seriously the flaw has always been there it could have been exploited just a few years or even months after it came out had they wished to exploit system but they gave their opinion on why not. Things only get 'cracked' and flaws exposed when there is enough interest from in this case hackers and profitable either as in money or reputation.

    I am sure also games being on the costly Blu-ray media and burners (by the time) was something that scared off the lesser teams dedicated to piracy.
     
  7. -tkf-

    Legend

    Joined:
    Sep 4, 2002
    Messages:
    5,634
    Likes Received:
    37
    Irony is that without otheros it seems impossible to even get close to finding out it was flawed.
     
  8. aaronspink

    Veteran

    Joined:
    Jun 20, 2003
    Messages:
    2,641
    Likes Received:
    64
    I pretty sure that is exactly what sony management is doing: crying over spilled milk. The hacks/cracks that have been discovered/used are fairly embarrassing, pointing to major engineering and management issues within Sony. The DSA issue is close to inexcusable considering the resources and people they had working on security for the PS3.
     
  9. makattack

    Regular

    Joined:
    Feb 13, 2008
    Messages:
    352
    Likes Received:
    0
    Location:
    Boston, MA US
    Right. I sort of see two possible reasons for this happening:

    1) Developer just didn't understand the algorithm they were tasked with coding.
    2) Test/debug code somehow got finalized for production release.

    At any rate, it really goes to point out that we don't perform negative testing well enough... and when you have cryptographic algorithms, you need to perform some cryptanalysis based testing as well -- basically have a test team actively try out various attacks.
     
  10. ban25

    Veteran

    Joined:
    Apr 7, 2002
    Messages:
    1,380
    Likes Received:
    6
    Location:
    San Francisco, CA
    Indeed. They should have a red team. Honestly, I'm curious to see if they truly understand the gravity of the exploit. I wonder if they'll try some pointless fixes first? It will be interesting to see...
     
  11. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    I'm actually not sure if all the flaws were there since the beginning, or opened up later. ^_^
     
  12. ERP

    ERP Moderator
    Moderator Veteran

    Joined:
    Feb 11, 2002
    Messages:
    3,669
    Likes Received:
    49
    Location:
    Redmond, WA
    I'd bet it was a relatively junior programmer tasked with coding the algorithm from a description, making an honest mistake.
    What should have then happened is the code should have been reviewed, and the mistake should have been caught. On a piece of core security code it should probably have been reviewed by multiple people.

    Clearly the second part just didn't happen, or it was reviewed by people who also misunderstood the implementation.

    The buffer overruns and timing exploits I mostly understand, you'll see them in any sufficiently complex piece of code, but we're talking about a team fucking up the most important 100 lines of code in the security system.
     
  13. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    Yap, it's also possible that tasks get dropped amongst staff shuffling during the Kutaragi transition. Could be a build problem too (Getting debug setup into production release).
     
  14. ban25

    Veteran

    Joined:
    Apr 7, 2002
    Messages:
    1,380
    Likes Received:
    6
    Location:
    San Francisco, CA
    Probably ERP's theory. A signing tool isn't necessarily a sexy piece of code more experienced engineers would want to jump on, but it is critically important and should have been carefully audited.

    I'm sure Sony has code review policies in place, but this is something that should be looked at a little closer before giving it a "Ship It!"
     
  15. liolio

    liolio Aquoiboniste
    Legend

    Joined:
    Jun 28, 2005
    Messages:
    5,724
    Likes Received:
    194
    Location:
    Stateless
    Indeed the PS3 had what it takes to remain untouched.
     
  16. Silent_Buddha

    Legend

    Joined:
    Mar 13, 2007
    Messages:
    18,250
    Likes Received:
    8,594
    Except on the existing 40+ million consoles, you can't protect the new key. So that will be in the wild and available.

    You also can't protect the Device ID. Being able to run arbitrary code, you can have your console report back to PSN whatever Device ID you want it to. Spoofing ID's is nothing new. You "could" tie it to your account. But again, with a completely open system, you just end up with the same situation as PC games where the account validation is hacked out and games will be released and available for pirating soon after they are made available to paying customers.

    Then you have a problem with how much do you charge. And how much money do the publishers and developers get. It's unlikely that 15 USD a month will be enough. I find it doubtful that even 50 USD a month would be enough. Would consumers be willing to pay 100-200 USD a month?

    And that still doesn't address how much companies would get from that. You can't just split it equally. If you did, companies would no longer have any incentive to spend the money to develope something like KZ2, Halo: Reach, GTA4, etc. Base it on time played and some of the smaller developers might get even less money now than they do with the current system.

    Which then goes back to how much do you charge each month? Publishers would no longer have the ability to rely on blockbuster sales to fund new IP which might or might not have a positive ROI.

    Eventually you'd end up with a system where you'd have mostly PopCap style games. Being a PC gamer, I love this myself, as it would encourage AAA Publishers and Developers to abandon consoles and go back to being PC only. :) But that certainly doesn't help the PS3. :)

    Regards,
    SB
     
  17. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    The Cell CPU has a hardware random number generator. It's a mystery why it's not used.
     
  18. Fafalada

    Veteran

    Joined:
    Feb 8, 2002
    Messages:
    2,773
    Likes Received:
    49
    PSP2 being DD only makes this trivial/non-issue.
    PS4 could allow old-key execution from pressed BRs only (DD software is a again, a non-issue), so really, it doesn't need to be a BC stopper.
     
  19. Karoshi

    Newcomer

    Joined:
    Aug 31, 2005
    Messages:
    181
    Likes Received:
    0
    Location:
    Mars
    If I've understood right it's the (ECDSA) signature of the firmwares/EXEs that was broken. Signing the update/EXE package is most likely done on some linux/window system far deep in the back office running on x86 or sparc. It's that signing program that has the incredible bug of using a constant as a cryptographic random number. Anyone who has read a bit of cryptography knows the importance of using a cryptographic-grade RNG. Whoever implemented that feature had very little interest in cryptography.

    Possibly it wasn't specced into that kind of detail because the security design team took it for granted. They should have specced it down to user-friendly level, i.e. "Is your monitor plugged in and powered on?"-level. In this case: "Is your RNG cryptographic grade?".

    Maybe the EXE signing was implemented per PDF spec in a different development division. Like the security guys passed the PDF to the deployment guys.
    It must be demoralizing to the core security designers to see all blown to hell by a literally clueless deployment workflow.

    Only thing that could save it now would be if there was a shadow security system with a 2nd set of root keys. Call it the "2nd and last chance"(TM) security feature.
     
  20. patsu

    Legend

    Joined:
    Jun 25, 2005
    Messages:
    27,709
    Likes Received:
    145
    I see…

    A second set of root keys ? Doubtful. Likely to be subjected to the same problem. If it works, it'd be called the "Hail Mary" keys.
     
Loading...

Share This Page

  • About Us

    Beyond3D has been around for over a decade and prides itself on being the best place on the web for in-depth, technically-driven discussion and analysis of 3D graphics hardware. If you love pixels and transistors, you've come to the right place!

    Beyond3D is proudly published by GPU Tools Ltd.
Loading...