Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security

Keeping Secrets in Hardware: Xbox Case Study 317

Posted by michael from the peeling-the-onion dept.
BS405397 writes "Here is the just released MIT whitepaper on the security holes in the MS X-Box, and for those who are interested, opens up the X-Box pretty nicely." Update: 06/04 17:13 GMT by M : The server appears to be down at the moment. There is a copy of the paper mirrored here. Reuters and other news outlets have now picked up the story, two days after Slashdot.
This discussion has been archived. No new comments can be posted.

Keeping Secrets in Hardware: Xbox Case Study More

Keeping Secrets in Hardware: Xbox Case Study

Comments Filter:

  • DMCA... (Score:2, Interesting)

    by Mr. Smoove ( 160347 )
    Doesn't this violate the DMCA?
  • When the xbox first came out I wondered about the security holes it would have once they rolled out the internet service. Does anyone know if it is setup in a way that it can receive software updates?
  • OUCH!...looks like the server went kaboom...ok, who's gonna be the first with a mirror?

  • Mirror and guys website (Score:5, Informative)

    by Angry Black Man ( 533969 ) <vverysmartman@@@hotmail...com> on Saturday June 01, 2002 @01:01PM (#3623017) Homepage
    Here [mit.edu] is the guys website (bunnie), with a ton of other hacking information not in the whitepaper.

    He also has an alternative link [mit.edu] to the paper.

  • Security holes? In a Microsoft product? (Score:5, Funny)

    by Moosifer ( 168884 ) on Saturday June 01, 2002 @01:01PM (#3623020)
    Inconceivable!

  • With Microsoft's permission (Score:5, Informative)

    by damieng ( 230610 ) on Saturday June 01, 2002 @01:02PM (#3623022) Homepage Journal

    I quote from a posting [siliconice.net] to XBOXHACKER [xboxhacker.net] that quotes "I did the work in february, but it took about three months to get it positioned and cleared with both MIT and Microsoft."

    I guess that means the DMCA was not violated although the posting mentions that Microsoft intend on addressing these 'holes' in future revisions of XBOX hardware.

    • More from author on MSFT (Score:4, Informative)

      by Angry Black Man ( 533969 ) <vverysmartman@@@hotmail...com> on Saturday June 01, 2002 @01:35PM (#3623173) Homepage
      He frequents the Xbox hacker msesage boards. [xboxhacker.net] Heres what else he had to say about Microsoft in this post [166.88.8.240]...

      "To answer some specific questions:

      no, I will not publish the encryption key or the boot block. That's Microsoft copyright material, and I respect their copyright.

      Microsoft is not particularly happy about the paper, but they seemed to concede that well, reverse engineering is protected by law, so there's nothing they can do about it. Let's hope they don't change their opinion...they've been known to go back on their word before. "

       also, from his website [mit.edu]...

      "You are actually allowed by law to reverse engineer copyrighted code so long as it is necessary to discover the ideas or functional elements behind the code (still, I'm not allowed to post copyrighted code for free distribution). Hey, microsoft...what are the ideas and functional elements behind your BIOS ROM? ... hmm...patent search turns up nil on the Xbox...guess we'll just have to reverse engineer it. (FTR, Nintendo has patented what looks to be the entirety of the N64 console, thus perchance making reverse engineering an N64 illegal--not yet court tested.)"
      • Since copyright has historically covered things that couldn't be generated automatically, I wonder if this guy could publish an algorithm to produce the key? (Besides, it should be short enough for fair use, anyway.)
        • Since copyright has historically covered things that couldn't be generated automatically

          Huh? Where'd you get this from? If you can generate a key automatically then you can generate a book like Jurassic Park automatically, so that doesn't sound right to me.

          (Besides, it should be short enough for fair use, anyway.)

          Length is only one of the considerations to apply when deciding if something falls under fair use. Other factors might tip the scale one way or the other. Besides, I think it's more the percentage of the excerpt that matters, not the absolute length. If you publish the whole key, that's 100%, so fair use probably doesn't apply.

  • Intermission (Score:2, Funny)

    by cymraeg ( 578870 )
    While the rest of the world waits for the site to come available...

    Let's all go to the lobby,
    Let's all got to the lobby,
    Let's all go to the lobby...
    To get ourselves a drink!
  • My favorite game protection of all time was quake 2. First Id software makes this incredible game, with 0 protection against copying, and then release quake 3 with online copy protection and online gameplay only. Thus, suckering in a bunch of people into buying the new version. I wonder if the struggle between companies and consumers will ever end, because the companies always lose :P

  • Better Ways to Hack it?! (Score:3, Interesting)

    by IronTek ( 153138 ) on Saturday June 01, 2002 @01:03PM (#3623027)
    Hopefully, this is yet one more step in fully hacking the X-Box (can't tell because the site's been /.ed)

    And I don't meant the usual Playstation-like hacking. I couldn't care less about not having to pay for games...

    What I can't wait for are things like a DiVX player (DivX movies on TV!), Linux -> and with it all those wonderful applications, DVD Movies without the hardware adapter, etc. and all of this for only 200 bucks!

    Many Dreamcasts were sold because of their hacking potential...just imagine what an X-Box is capable of! This, more than any reason, is why I'm hoping the X-Box pulls through and "makes it" among the video game platforms...

  • Mirror (Score:1, Funny)

    by DigiBoi ( 139261 )
    here is a mirror [bathroomcity.co.uk]

  • XBOX probing... (Score:1, Interesting)

    by Anonymous Coward
    For those who where unable to see the .PDF, due to the ./ effect...
    It is about searching for magic numbers :) probing the LDT/Hyper Transport Bus via an hardware tap board linked to a FPGA based custom sniffer. It seem a bit like a magic... but the only magical thing is the mind operating those (cheap!) hardware! :)

    Very intresting read!

    Bye!
  • Should we start taking bets as to when the "xbox update" web site and service packs start coming out?
  • That's pretty impressive, guys. How big is that PDF anyway? I timed out with 7 replies showing.

  • Mirror: (Score:4, Informative)

    by Saint Aardvark ( 159009 ) on Saturday June 01, 2002 @01:10PM (#3623074) Homepage Journal
    http://saintaardvarkthecarpeted.com/AIM-2002-008.p df [saintaardv...rpeted.com]

    Just in case the guy's web server goes down too...


  • here is a link to convert the paper to HTML

    http://access.adobe.com/simple_form.html [adobe.com]
  • I like this part about MS guy:

    The speaker at this talk also indicated that the kernel on the Xbox is a much-stripped-down Win2k derivative (from 12 MB to around 23kB).

    (from their website [mit.edu])

  • This means... (Score:3, Funny)

    by Drakker ( 89038 ) on Saturday June 01, 2002 @01:39PM (#3623191) Homepage Journal
    ...that we will be able to play NetHack on the xbox?

  • Some XBox Hacking Links (Score:5, Informative)

    by gagravarr ( 148765 ) on Saturday June 01, 2002 @01:43PM (#3623201) Homepage
    For those of you just getting into XBox hacking, you might want to check out the following:

  • Thumbs up? (Score:5, Funny)

    by handsomepete ( 561396 ) on Saturday June 01, 2002 @01:56PM (#3623254) Journal
    I got a grudging thumbs up, so to speak, from Microsoft on my Xbox reverse engineering work

    I think I'd much rather he post what must've been a very entertaining conversation with a Microsoft spokesperson than the bios to the XBox.

  • Abstract (Score:4, Insightful)

    by Hast ( 24833 ) on Saturday June 01, 2002 @02:04PM (#3623274)
    A lot of people seem to belive that it's about network security. It is about hacking the boot procedure for the X-Box. This can be grasped just by reading the abstract to the paper.

    Abstract


    This paper discusses the hardware foundations of the cryptosystem employed
    by the Xbox TM video game console from Microsoft. A secret boot block over-lay
    is buried within a system ASIC. This secret boot block decrypts and verifies
    portions of an external FLASH-type ROM. The presence of the secret boot block
    is camouflaged by a decoy boot block in the external ROM. The code contained
    within the secret boot block is transferred to the CPU in the clear over a set of
    high-speed busses where it can be extracted using simple custom hardware. The
    paper concludes with recommendations for improving the Xbox security system.
    One lesson of this study is that the use of a high-performance bus alone is not a
    sufficient security measure, given the advent of inexpensive, fast rapid prototyping
    services and high-performance FPGAs.

    So no need to worry about DDoS or lost savegames. This is about playing unauthorized games, making a DiVX player etc.
    • A lot of people seem to belive that it's about network security. It is about hacking the boot procedure for the X-Box.

      Correct. And when did this become a "security hole" - oh, it makes people bash MS. Nevermind, carry on.
    • If make an XBox game and want to play on my XBox, is it ok? What do I buy, the hardware or only a permanent "lease" to play Microsoft approved games? Your answer is welcomed :)
      • The boot encryption block is really there in order to let Microsoft control which games are available for their console. They are more interested in getting money from producers of games than from stopping you from playing a non-licenced game. Naturally if everyone were to play using hacked machines than that would be bad for Microsoft, and so they added the encryption/authentication to stop that from happening.

        Naturally stuff like this will undoubtedly pave the way for "X-Box" demo's within the demo scene. That would rock! (Because those guys can really do some neat stuff.)

        And from his (The guy who wrote the paper.) website it's clear that he has contacted Microsoft and he has been given a go ahead on publishing the paper. So it's unlikely that it will be "foxed" at least at this stage.

  • very interesting (Score:5, Insightful)

    by Dr. Awktagon ( 233360 ) on Saturday June 01, 2002 @03:19PM (#3623554) Homepage

    I read that article and found it very interesting. It seems there's always a weakness in any security system, and a clever person with time on their hands can find it.

    But then it hits me: this "security" is to keep THE OWNER, the PAYING CUSTOMER, out of the product he bought. This "security" doesn't protect my family, me, or my possessions from absolutely anything. It serves no purpose except to make work for somebody at Microsoft and then somebody at MIT. If they left it out, they'd save both parties a lot of effort. I'm sure someone will build on this article and figure out how to easily run arbitrary code on the Xbox, and so the security will be a total waste. So why is it there?

    • not quite (Score:5, Interesting)

      by Skuld-Chan ( 302449 ) on Sunday June 02, 2002 @01:11AM (#3625325)
      Sure - but one could easily argue that its main purpose is to keep pirates from running unauthorized (copied) programs on it

      and to keep developers from building their own executables without real dev kits (and depriving ms of royalties)

      and it keeps game hack systems out - like the gameshark and the codebreaker like devices from running.

      And before you bitch and moan about MS being a bunch of bastards - almost every game system that ever came along has had some system to keep developers, hackers, and users from explointing the technology inside. Even Atari was that way - mostly through Atari not releasing all the specs for programming it so their games could look better in comparision - and they sued the first company who dared defy them (I think it was sierra).

  • Site back up (Score:2, Informative)

    by mindhive ( 582783 )
    I'm one of the sysadmins at the AI lab - we had a power shutdown in our building last night through much of today, but the site is back up and ready to get slashdotted.

  • Not there yet (Score:5, Interesting)

    by Animats ( 122034 ) on Saturday June 01, 2002 @04:00PM (#3623700) Homepage
    Note that even after all this, the guy isn't even close to being able to make a disk that will boot on an unmodified XBox. Or a mod that doesn't require soldering.

    He now understands the boot process, and can mess with it via hardware mods. But he has only the decryption key, which is the public key of the pair. To make a bootable disc, you need the encrypting (private) key, which is nowhere in the XBox. That key probably exists only in a vault in Redmond.

    I don't really care all that much about the XBox, but if the RIAA and MPAA have their way, all audio and video equipment will be protected like this.

    • Re:Not there yet (Score:3, Insightful)

      by nick this ( 22998 )
      Correct me if I'm wrong, but the article states that:

      1. The bootloader and kernel are stored in flash.
      2. The bootloader is RC-4 encrypted (symmetric, not public/private keypair)
      3. The flash can be reprogrammed either by desoldering the flash, like bunny did, or by using what he calls a "bed-of-nails" jig. (I assume this is merely contact points to connect the test points on the board).

      The RC-4 key is now known, so it appears to me that a custom bootloader (and kernel) can be flashed on the box that will allow unsigned code to run without soldering or expensive equipment.

      Probably the path that will be taken is that a booting linux kernel will be developed using the mod chips that are reported to be on the way, then, once drivers and an xbox kernel are developed, a bootloader will be written to boot it directly off CD-R/RW or HDD. Supposedly the xbox is kinda flakey about reading CR-R's, but DVD+RW won't present a problem.

      I wouldn't be surprised to see a bootloader that would either boot into the xbox or off an untrusted CD or DVD.

      I expect to see a cheap and easy kit for booting linux on xbox in less than six months. Console DivX/MP3/Mame player, here we come!

    • "But he has only the decryption key, which is the public key of the pair. To make a bootable disc, you need the encrypting (private) key, which is nowhere in the XBox. That key probably exists only in a vault in Redmond."

      You have it backwards. The private key decrypts.. the public key encrypts. He has the private key. And you can derive the public key from the private key.

      • It is NOT public key (Score:2, Insightful)

        by yerricde ( 125198 )

        You have it backwards.

        No, you have it all wrong. The Xbox encrypts the flash with RSA's RC4 symmetric cipher (i.e. not a public key cipher). The remainder of this post is (strictly) off-topic because the Xbox boot process does not use public-key encryption.

        The private key decrypts.. the public key encrypts.

        In a public-key secrecy scheme, you're correct. But in a public-key authentication scheme, the private key encrypts the hash into a signature, and the public key decrypts the signature for comparison with the hash.

        He has the private key. And you can derive the public key from the private key.

        No, you can't do that in (for example) RSA.

  • Why the security on a game console? (Score:3, Interesting)

    by A nonymous Coward ( 7548 ) on Saturday June 01, 2002 @04:03PM (#3623709)
    I guess I am naive here. What is the point of making the X-box or any other game console hard to hack?

    I used to believe the old saw that compared game consoles to razors; lose money on the console, make up for it on the games. But I read something recently which seemed (to me) to prove that everyone except M$ was making money on consoles too. So although it might make sense for M$ to prevent hacking for use as other than a game console, why would others do so?

    Is it to prevent people from playing ill-gotten copies of games?

    Is it to prevent cheating while playing a game?

    Is it to prevent reverse engineering of a game?

    I guess I just don't get it!

    • Actually, while you're right... everyone (besides MS) does make money off their consoles... they also make a lot of money off something else: licensing. In fact, while you can make a pretty penny off your console, the main draw is that you get an even larger percentage from the license royalties off every game your console sells. You only sell one console per person. You sell lots of games.

      Naturally, if everyone could write code for a console and burn their own CDs or DVDs, large game houses would have little reason to buy licensed development kits and publishing contracts with their respective console manufacturer, and thus you lose a lot of your revenue.

      Interestingly enough, though, in the old days, unlicensed games happened every so often. I recall that Taito reverse-engineered the NES cartridge and put out their own games...

    • There are two answers. One is a fair one. Another is not fair and it's even anti-competitive.

      1- To prevent piracy
      2- To stop you using the system in legal ways but which do not follow their "targeted use".

      #2 basically means that they sell at a loss and compensate with overpriced games. But if you want to use it as a web server, their entire "sell hardware at a loss" doesn't work anymore and they have to start charging what the equipment really costs. And then they cannot sell enough consoles and cannot dominate the market (and thus, no good games produced and never a profit).

  • From the paper:

    "...it is an error to assume that a secret, distributed along with the information it guards, is never revealed."

    I don't know about that. It seems to have worked for the Word file format.

  • Oh no! (Score:3, Funny)

    by DarkHelmet ( 120004 ) <<ten.elcychtneves> <ta> <kram>> on Saturday June 01, 2002 @05:11PM (#3623933) Homepage
    My XBox web server is vulnerable? I guess I'll just have to download a patch from windows update!
  • As was mentioned in several posts, this is bad (for MS) because it may allow two things - non-authorized software development and pirated software. (don't mark me as redundant yet, keep reading :)

    That's why Nintendo stuck with cartridges and why they now have a non-standard format for Gamecube games. I am really surprised other console developers haven't done this.... the slight increase in costs to slow piracy is a good trade-off.

    Anyone know if it would be possible to burn those mini-dvd's that Nintendo uses?

    • Re:Booting CDR/DVDR (Score:2, Insightful)

      by CatPieMan ( 460995 )
      Don't know about burning (or even obtaining) the mini-dvdrs that Nintendo uses, but, Sega tried just this with Dreamcast. The Dreamcast used a proprietary cd (I think it was called a GCD or a CDG or something) and was supposed to have a capacity of about 1GB (making buring impossible on a standard cd). There were two problems with this. The first one was, since the products were slightly non-standard, they were very easy to scratch and this would make the game not work. The second was the fault of the developers, they never used the full potential of the disk and only used less than 650MB -- so, people could burn them on CD writers (after some modifications here and there, it isn't quite that easy, but, it is close).

      Sometimes, it is just easier (and arguably better) to use the standard equipment rather than have to create something totally new.

      -CPM

  • He does far more than reverse-engineer the XBox. Read this guy's project list. [mit.edu] He's cranked out an incredible list of hardware projects. His own RISC CPU. A DES cracker. A controller for a midget submarine. An all-new design PBX for his frat house. Keyboard pedals for EMACS. A Linux-based computer that fits in a Star-Tac phone case (in progress.) Plus he's in a fraternity, plays guitar and violin, and has a blonde girlfriend. And all this while doing a thesis at MIT.
    • Yes, you know a guy has really made it in the world when he has a blonde girlfriend. (Not a cheap knockoff, or just a very light brunette, but a genuine, certified blonde.)

Slashdot Top Deals

Utility is when you have one telephone, luxury is when you have two, opulence is when you have three -- and paradise is when you have none. -- Doug Larson

Close