Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

Security Concerns When Consoles Go Online? 211

Posted by michael from the never-had-these-problems-with-atari dept.
VonGuard writes "I've written an article for Security Focus about the security concerns that having an Xbox or Playstation 2 on your network might raise. The article, entitled Welcome to the Jungle was an interesting experience to write. I really think that Sony will end up having some trouble from their stance on third party security design, while Microsoft might end up smelling like roses. Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio."
This discussion has been archived. No new comments can be posted.

Security Concerns When Consoles Go Online? More

Security Concerns When Consoles Go Online?

Comments Filter:
  • someone just hacked my game of gta3, i lost my saved game. oh damn.

    • deleted games (Score:4, Insightful)

      by lightspawn ( 155347 ) on Thursday June 20, 2002 @02:08AM (#3734407) Homepage
      someone just hacked my game of gta3, i lost my saved game. oh damn.


      Yeah right, try shrugging it off when somebody deletes your Phantasy Star Online characters after 50 hours of gameplay (this actually happened to many many people playing Sega's first online RPG).

      • Yeah right, try shrugging it off when somebody deletes your Phantasy Star Online characters after 50 hours of gameplay

        50 hours? In EverQuest it's not uncommon to invest that much time into the acquisition of a single weapon or piece of armor. EQ is one game in which hacks that deleted characters might drive less-than-perfectly-stable players to homicide.

        Luckily, EQ has a pretty good (not perfect, but pretty good) track record at keeping everything straight in people's accounts, but the point is that cheating and hacks can really have a significant impact on players.

        Of course, those players should really get lives, but that's a separate issue ;-)

  • are they going to delete my games?!?!? FP..
  • Could I read just one article on Slashdot that doesn't rehash Microsoft bashing (the Nimda thing) that's old news [slashdot.org]?

  • Microsoft Bashing (Score:4, Insightful)

    by Anonymous Coward on Thursday June 20, 2002 @01:46AM (#3734355)
    People on this site always have to get in their Microsoft bashing. It is pretty shameful. Why can't you just make do with what is out there? That article had nothing to do with the Nimbda virus, but the poster had to throw it in there cause Microsoft didn't look bad in that article. Awful.
    • Well, I'd rate the xbox as more hackable than PS2, not because it comes from MS, but because it has a hard disk, which means once it is owned, it can stay owned. PS2 has memory sticks though right?

      • Re:Microsoft Bashing (Score:2, Insightful)

        by Anonymous Coward
        The PS2 is releasing a HD so in that respect it will be the same.

        As someone who has tested the PS2 network adapter, theres basically 2 things that go wrong.

        1. Denial of service attack.
        It's really easy to overflow a buffer cause the PS2's sound chip is doubling as the network chip.

        2.transfering personal information over the net unencrypted, and as each game has to basically have its own security / servers, its gonna be a race to find out who the most clueless game makers are!

        I for one will have my PS2 with network adapter safely behind a good firewall.
      • The network kit for the PS2 comes with a hard drive.

    • Re:Microsoft Bashing (Score:2, Funny)

      by Anonymous Coward
      "People on this site always have to get in their Microsoft bashing. It is pretty shameful. Why can't you just make do with what is out there? That article had nothing to do with the Nimbda virus, but the poster had to throw it in there cause Microsoft didn't look bad in that article. Awful."

      Shut up, Ballmer.
    • The article was a bit alarmist to catch the reader's attention, but was a pretty good overview of the mischief one can wreak with a zillion consoles; though I think there's no more danger than the zillions of PCs already out there.

      [donning flamesuit]
      Yeah, there's a lot of Microsoft bashing on /. - sometimes it's deserved and sometimes it's not. Mostly the former.

      MS touts it security while its insecurity stands frozen in the stark daylight. It's kind of like trying to be all suave and debonair with your fly unzipped. It's funny.

      Now I'm all for using the right tool for the right job. It just turns out that Linux is cheaper, breezier, and more stable most of the time. For LAN parties, it's Windows 2000 hands-down. For console gaming, I like the XBox - mostly for its hacking potential. But I plan to get a Playstation 2 as well.

      • So there I was getting a replacement vest for my tux for my best friend's wedding and Im being all badass, or as you say it, debonair to the chick thats working there. I feel like im king cock of the walk!

        So, as I switch cars in the parkinglot, the bestman points out that my fly is undone and has been the whole time ... ...

        doh
  • Someone haxored my xbox ... and they own it now

    omg, they dont even run a proper os to bounce packets inside the local net.

    Even if using the linux in psx2 its linux and you need to secure it as any other box.
    • its linux and you need to secure it as any other box

      No, you don't. You might want to patch or disable some of the buggy programs that are distributed with it, but Linux itself (the ekrnel) is fairly secure. Probably more so than any other OS kernel (well, apart from some things like Solaris maybe), due to the amount of people and experience put into it.

  • Is that really neccesary? (Score:4, Insightful)

    by recursiv ( 324497 ) on Thursday June 20, 2002 @01:47AM (#3734360) Homepage Journal
    Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio


    Come on. This really looks childish. That's an irrelevant story. Just let the facts speak for themselves or you lose credibility.

    • are you new to slashdot? The authors here are NOT journalists. They are guys. People send them interesting links and these guys might post them, might comment who knows. They do what they feel like. And, no one (except VA) can force them to become "more professional." This is infact why a lot of people like shashdot, because it isn't just the standard news, you hear about a whole lot of whacky things that the authors think is cool.

    • >Too bad MS shipped the Nimda virus with their
      >Korean version of .Net Visual Studio

      Come on. This really looks childish. That's an irrelevant story. Just let the facts speak for themselves or you lose credibility.

      I agree with you about that being childish, but its worth noting that italicized text in the stories on the front page are all from the submitter. Editor comments -always- appear as non-italicized text. Its definitely silly that the poster stuck that in there, but I do have a level of respect for Slashdot not messing with submission commentary. IMHO its best that they leave it verbatim.

      • I agree with you about that being childish, but its worth noting that italicized text in the stories on the front page are all from the submitter. Editor comments -always- appear as non-italicized text. Its definitely silly that the poster stuck that in there, but I do have a level of respect for Slashdot not messing with submission commentary. IMHO its best that they leave it verbatim.

        See, the title "editor" implies that the person wearing that title actually edits. They're under no contractual obligation to provide the submitter's full post. Had the submitter pulled something equally as stupid, like putting profanity in his submission, I'm sure the so-called "editors" would've sanitized that (it doesn't look professional to have profanity on your front page). On high-volume submissions, they could just take their pick of the hundreds of similar submissions. This isn't one of those. This is an author pimping out his article. It's very unlikely there would be multiple submissions for this, so the editors have three choices:

        1. Leave the submission as-is and just post it. They chose to do this.
        2. Just take the links from the submission and summarize in their own editorial words.
        3. Cut the flamebait from the submission, leaving the important content intact. This is what they should've chosen.

        Go whine all you want about "freedom of speech" (you're guaranteed to be able to say what you want, but you're not necessarily guaranteed an audience), but if the editors are going to call themselves editors, then they need to learn how to edit. To leave such an obvious troll in the submission smacks of amateurism. The Slashdot eds have been doing this long enough that they should know better.
        • I think the main issue is that they don't give a shit whether or not you approve and if you don't like it you're free to not read.

          • I think the main issue is that they don't give a shit whether or not you approve and if you don't like it you're free to not read.

            And yet, I'm sure they'd love it if I (and others) would subscribe to their new for-pay model. They can't stay unprofitable forever. Eventually, VA Software will really find themselves in a bind and will have to offload or kill their unprofitable branches, which I would expect would include Slashdot. Thus, it's in Slashdot's best interests to get their frequent visitors to pay money. However, aside from the few fanatics and zealots, I doubt you're going to see a large number of people paying money to Slashdot if they don't significantly enhance the value of their site. Yes, I know, the value of Slashdot is not the stories, but the user-submitted comments. I agree with that, to an extent, but I also believe that the stories are what drive the comments. With the current status quo of subtle (and blatant!) trolls, repeat stories, late stories, chronic database problems (the about-once-daily "can't login" problems), and atrocious spelling and grammar, the site rates as little more than an amateur news clearinghouse (albeit it with a large following). I think the clearinghouse model is a good one, as that way I don't have to traipse all over the net to find the stories that would interest me. However, I damned well won't be paying a dime until the quality issues are resolved (while at the same time not feeling bad about blocking their ads, either). If they increase the quality somewhat (say, Taco takes a remedial English writing course, or the editors finally get in sync and stop duplicating stories), I'll happily unblock ads on Slashdot. If they don't get their acts together and act like true professionals (includes editing user submissions for spelling, grammar, and unnecessary inflammatory comments), they'll never see a subscription fee out of me.


            And yes, I realize I can simply not read Slashdot. That's a perfectly valid option, and if it gets much worse I'll probably do just that. Right now, I still think the site has potential, and can be saved if the guys get their arses in gear and do their jobs.

            • And _I_ think, again, that they don't care about your opinion and will make thier own choices about what they want Slashdot to be. If Slashdot fails because of that, then so what? It's Slashdot. It's not CNN. It's not K5. The biases are real, well known, and not presented as anything but, which makes it a step up from Fox News as far as journalistic integrity goes. The poor language and spelling goes with the territory and doesn't bug me. If it bugs you, go away. All you're doing is charging VA money so you can say bad things about them, and you don't even have the decency to see an add in exchange for doing so.

              • So basically, love it or leave it? I'm sorry, but I believe in a third option -- constructive criticism. And that's exactly what I gave. Too bad the editors will likely never see it. As I said, I feel there's definitely something worth saving in Slashdot, and you can't honestly believe that the changes I suggested wouldn't be better than what you currently get. I'm fine with Slashdot editorializing, and I know there are obvious biases. However, there is a time and place for those. There was absolutely no reason for the underhanded dig in this story. If Slashdot wants to run an editorial (user-submitted or otherwise) about what's wrong with Microsoft (or the RIAA/MPAA, or the government, or whatever), great. That's an editorial. It's supposed to have bias. This was presented as a news item ("Hey, look! Neat article. Oh, and since the article does cast Microsoft in a somewhat favorable light, here's a completely unrelated dig to fulfill the status quo,"). As such, it is the Slashdot editors' editorial duty to lose the troll and present the news.


                Dissenting viewpoints are what can turn an only decent community into a truly great one. If everybody here always agreed (and those who don't just go ahead and leave), then you've lost the most interesting part of Slashdot. The Linux zealots rant and rave about how a monoculture in the OS market will cause major problems. How is this not the same, then? You're advocating that those who don't always agree with Slashdot's editorial policy should just go away. You're in favor of creating a monoculture here, and that will be the death of Slashdot.


                You're right. If Slashdot fails, too bad. However, it won't be because of people like me who filter the ads. Instead, it will be a slow rot from within. It's already evident with the increasing number of trolls and flamebait. It's evident in the greater number of blatant trolls that have been accepted as user submissions. It's obvious in the fact that even the editors can't keep in sync with each other. Dare I say it, but it's even obvious in the fact that CmdrTaco doesn't even have enough self respect to spell check and grammar check the writings he does for a living. Were he just another AC or random poster, then who cares? But he's not. He's the head honcho, and a prominent editor. It's pretty revealing about his character that he doesn't even bother to do such a simple thing before submitting an article (oh no, that's going to make the article 10 minutes late! oh, wait, it's already three days late, big deal ...).

    • Relevance (Score:4, Interesting)

      by _Sprocket_ ( 42527 ) on Thursday June 20, 2002 @03:27AM (#3734588)



      Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio


      Come on. This really looks childish. That's an irrelevant story. Just let the facts speak for themselves or you lose credibility.


      Yea. It looks childish. But that doesn't mean the event has no relevance here. Let's look at this a bit deeper.


      Data integrity is often one of the goals of an organization's infosec posture. This is more than simply ensuring the data is not improperly accessed and is available. It is also ensuring the data has not been altered without authorization.

      In this case, Microsoft's data being offered to its customer had its integrity violated. Malicious code made its way in to an external distribution; not obscure code but a well known virus. Now, Microsoft is not the only one to suffer the embarrassment of distributing a virus. But it does highlight a breakdown in Microsoft's internal infosec practices. And that comes at a very inopportune time for Microsoft.


      So the question would then be - how does this apply to the security of the XBox? Microsoft has a long history of troubles not only with security, but an almost arrogantly blatant disregard for security practices and concepts. This has eventually backfired on Microsoft and they have been faced with a growing PR issue. The answer to this situation has been Trusted Computing - a bottom-up change in Microsoft where everyone has been trained in infosec concepts and practices. If Trusted Computing pans out, Microsoft's security woes are behind them.


      The cynical in the infosec / IT industry have already noted that they've heard this song before. Microsoft's PR and Marketing departments constantly promise security - especially after incidents that focus on MS products. Furthermore, experienced infosec workers know that addressing infosec issues often requires a complete change in methodology and outlook. And this translates in to changing Corporate culture. Microsoft may be nimble, but this change may be too demanding for even Microsoft to accomplish.


      The relevance of Nimda appearing on a Microsoft software release is the question of whether this incident was a simple embarrassment or an indication of a continued lack of understanding for infosec issues within the Microsoft culture. And that certainly has a bearing on the question of Microsoft's concepts of information security and the XBox.

    • Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio

      Come on. This really looks childish. That's an irrelevant story. Just let the facts speak for themselves or you lose credibility.

      Ok. Facts.
      Security is a perimeter type thingee. Everything is relevant, particularly any odd anecdotal accounts of lapses.
      Credibility. Slashdot tries to make the headlines "interesting". Should I see what's up or go back to work? I've seen no indications that Slashdot has ever attempted to be "fair, balanced, unbiased". What is ironic is that Slashdot has become the best source of unbiased information for supporting Microsoft software.
      Microsoft is big and arrogant. The only effective antidote is public ridicule.

  • An interesting article (Score:3, Insightful)

    by q-soe ( 466472 ) on Thursday June 20, 2002 @01:48AM (#3734363) Homepage
    Its interesting to note that in this case the closed network MS have been building for X box might be the best thing in the circumstances as it should prevent DDOS usage of the things.

    but is this really going to be a major issue ? in reality how much time will these boxen spend on line when not playing games ?

    have MS written in code to the os to identify what is and is not and X Box for example? and what about servers - can they be run ?

    Thought provoking.
    • http://web.mit.edu/bunnie/www/proj/anatak/xboxmod. html

      There's an Xbox mod. How long before kiddies start buying mod kits that have holes (as if there aren't holes not yet found.) Another poster asked how often consoles will be online while not playing games... why couldn't a trojan take up bandwidth while a game was being played? And with broadband, they'll likely be left on. No, the internet is a dangerous place and you don't have to be named Gibson (www.grc.com) to be paranoid.
      • Good points and i was wondering about it - but the issue is present with every console isnt it..?

        And the broadband applies to the states but what about other countries ? in Australia at the price of broadband i cant see many people getting it just for their X Boxen.
    • The XBoxen won't be able to break out of their playpen, but it's only a matter of time before someone reverse engineers the XBox protocol and connects a PC (or an XBox running a full-featured OS) to the network. There's still plenty of fun to be had if you can get inside.
      • The XBoxen won't be able to break out of their playpen, but it's only a matter of time before someone reverse engineers the XBox protocol and connects a PC (or an XBox running a full-featured OS) to the network. There's still plenty of fun to be had if you can get inside.


        I can understand the if its there challenge but seriously what sort of fun? wheres the fun in hacking into someones console ?
        • DDOS, or other attacks where you want to own other people's boxen. And consoles are probably less likely to be kept patched up than PCs.

          • "DDOS, or other attacks where you want to own other people's boxen. And consoles are probably less likely to be kept patched up than PCs"

            yes i understand that but why ? what is the point of hacking to 'own' someones system? they havent got bank account data etc on it so why ?
            • For fun. For stupidity. To cheat at games. To see if they can install IIS on someone's XBOX and get free hosting. For mean ol' malice. Why do people hang around IRC networks soley to fuck things up for other people?

              It's the same mindset, and it'll hit consoles sooner or later.
            • what is the point of hacking to 'own' someones system?
              "They" is not "you". "Your" misdeeds are traceable back to "them" not to "you".
              That's one of the key points of Code Red. The victims advertise.

      • Except they already have.

        For example xbconnect [xbconnect.com] (Gamespy have another one), and there's even a Linux version somewhere.

        Basically people have produced a tunneling application that fakes the local LAN facility for multiplayer games and pushes it over the net. Nothing nasty happening yet (well, expect getting my ass kicked in Halo by 9 year old kids, but that's depressing, not nasty)

    • It's not an interesting article. Not even a good one. It jumps all over the place -- cheats and DDoS aren't even slightly similar. It seems simultaneously surprised that consoles are computers and can be hacked while failing to realise how useless an underpowered, rarely-on console is in any sort of malicious role.

      It's a non-story. (And a poor writeup.) Give me my 10 minutes back.

  • when a 10 years old kid start playing Tic-Tac-Toe on Norad's top secret supercomputer.
  • someone is addressing this subject. I've been cracking hacked up playstation jokes for a few months now. Regardless, the same principles apply to console security as do to any workstation, home server, always-on ip connected thing. I think the real concerns could come into play when the linux distro thing starts to have a more common place in the console market (if ever.) Anyhow, I think there's probably some stack hackers that might want to start thinking about kernel level mods to address the forthcoming issues.

  • for those that don't read the article (Score:4, Funny)

    by Rubbersoul ( 199583 ) on Thursday June 20, 2002 @01:52AM (#3734376)

    "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."


    Now I try not to MS bash but come on this just seemed funny to me that is all :)

    • "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."
      It's true folks - nothing stops NT on on a warship - particularly when you divide by nothing.

      Still, I hope they live up to their claims for the sake of the net. After all, they've come a long way since they couldn't get "ping" right (eg. the ping of death attack which could bring a server down with one command).

      • "It's true folks - nothing stops NT on on a warship - particularly when you divide by nothing."

        Not to start some religious type mathematical discussion here, but dividing by nothing is NOT the same as dividing by zero. Nothing is not the same as zero.
      • It's true folks - nothing stops NT on on a warship

        Just to be a little picky: Water resistance in the ocean stops NT on a warship, after NT kills the engines.
    • Hah. I bet the military wishes that they could have military-grade security on the Microsoft product it uses.
    • You can have an absolute open box where anyone can get on and do anything they want, and it will have a military grade. Granted it is not a high level of security but it is a military graded security.
    • "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."

      Whose military? The Three Stooges come to mind, somehow.
    • I didn't read the article, but when did that stop someone on /. from commenting? I get the feeling that military grade security means 128 bit encryption. BFD, there are a lot of other ways to break security besides brute forcing the key.

  • X-Box already cracked! (Score:3, Informative)

    by jmd! ( 111669 ) <jmd.pobox@com> on Thursday June 20, 2002 @01:58AM (#3734383) Homepage
    X-box will have better security you say? Right... man, I can't WAIT till consoles are on line... I love laughing at security holes in all the crap I don't use, or know how to use properly.

    X-Box was already cracked. It didn't get much press covereage... Eweek did a story, here's the reg's:

    http://www.theregister.co.uk/content/3/25568.htm l
    • X-box will have better security you say? Right... man, I can't WAIT till consoles are on line... I love laughing at security holes in all the crap I don't use, or know how to use properly.

      X-Box was already cracked. It didn't get much press covereage... Eweek did a story, here's the reg's:

      Well, x-box's have been online for quite some time now, many people who own one have been using gamespy software to play Halo online for a fair bit in fact.

      and as for x-box's having been cracked, the cracking you refer to is no more than the same mod-chips that allow the console to run unsigned code that dreamcasts, PS1's, and PS2-s have been running for quite a while.

      the simple fact is that, MS's controlled servers may be more secure than public servers sony will promote, in fact i would expect it to be.

      you can knock em all you like, but the model they are promoting might just be better than Sony's, why not wait till they are actually functioning, and have a bit of substance behind your complaints before you dismiss them offhandedly?
  • Closing their service to outsiders increases the security of their system overall and "prevents hackers from scaling beyond one machine," the company claims. "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."

    Now only if they could apply this theory to their OS strategy...

  • Good article.

    People are going to hack their consoles. Hell, the first thing I did with my TiVo was to take it apart. Don't think I'm not tinkering with my xbox, it's potential as a cheap Apache webserver or slave in a rendering farm begs experimentation.

    It's good that Sony is supportive of the curious developer. It means their platform will spread wider. At $199 apiece, there's no reason not to mod consoles.

    I don't doubt a lot of consoles are going to be 0wn3d. Whether it's Microsoft first or Sony will depend on the hobbiest - or on a corporate uh-oh. After all, Microsoft did ship Nimda to Korea with Visual Studio .Net. I'm not crazy about Microsoft's decision to close their gaming community, but I'm not surprised either.

    Blizzard does the same thing (and are villified for it). But I'm less troubled by Blizzard's motives than by Microsoft's.

  • Ok, so someone hacks you Playstation. That's bad, but I don't think it's nearly as bad as the article will have you belive. Remember, people, these are consoles. You turn them off when you're not playing. You reset them when you swap games. And although the Xbox has a harddisk, I'm not sure if you could actually store something on it that would have any effect on the machine after a reset and a swapped game.

    While it may or may not be hard to hack the console in the first place, it should be pretty difficult to keep the box hacked. It's like if you re-installed your PC everytime you want to run a new program.

    The window of opportunity for exploiting the machine for DDoS attacks, as stepping stone etc only exists for as long as the gamers current gaming session. With enough boxes out there, that could still add up, of course.

    The cheating/disrupting games angle is much more benign - this is something the gamers will notice, and thus force the game companies/console manufacturers to fix, or they risk losing their sales, and as we all know, wallet beats paper, rock AND scissors.
    • Everyone seems to forget that XBoxLive is a subscription service. How about I hack your box and steal your password? Now I can play as you.

      Even worse when MS truly implements passport as a "single sign-on" service.. then I'll be able to become you wherever there is passport. Perhaps I'll log in and place a few bids on ebay for you.. you did want a gamecube and PS2 didn't you? Well guess what lucky bidder, you just paid $800 for them!
  • Oooh... so now when someone is playing DOA3, and the guy on MY network gets the crap kicked out of him, one of my servers gets the crap kicked out of it as well. Now, seeing as I am pissed about that... I go and royally beat the crap outta him, and whee... look ma, I just killed www.microsoft.com
  • Well if they didn't throw in the MS bashing, they would be keeping to the spirit of a slashdot post. No matter if it concerns MS or not they must make some not so witty remark about how MS is the evil overlord of the earth. BAH.
  • I would imagine that since the PS/2 or Xbox is INSIDE a LOCAL network, it wouldnt really open up security issues. For something to really cause a security issue, it has to open up and recieve requests on a port. I.E. Apache, telnet, ssh, ftp etc etc. So I dont think the PS/2 or Xbox is a problem. Unless you give it a global ip and start running Apache...uh....shit...There's an idea...
  • Isn't that how it works with PC Gaming? The security of the game and ultimately the PC lies in the hands of the Game developers and things for the most part work out "O.K".

    The same methodology for the PS2 will work. "Why Fix it if it ain't broke". If a PS2 Developer House wants their game to flourish online they know they will have to do their best to curb cheating and most certainly avoid security holes in their games at all costs.

    I fail to see how having Microsoft hold all the cards for the security of the XBox is a good thing. That's how it is with their OS and well... look at it.

    Power to the Third parties!

  • MS's "Disney Land" approach (Score:5, Interesting)

    by Y-Crate ( 540566 ) on Thursday June 20, 2002 @02:16AM (#3734429)
    Microsoft decided some time ago that the best way to create a good online gaming experience for a console is to maintain a console's three biggest advantages over PC gaming.

    No Cheating
    No Viruses
    And no Cheating

    Cheating in online games has reached such epidemic porportions on the PC that many have given up on it completely. Others just slug it out and learn to deal with it.

    Microsoft wants to offer 3rd party mods and the like to its customers. Since they get a cut of every game sold for the Xbox, it makes sense for them to freely distribute mods that increase the value of the games and the console. But they want to check to make sure the mods aren't buggy, virus infected peices of shit that are going to screw up a few million Xboxes.

    They want to take all the mods, pour over them, check them for cheats and viruses then let you d/l them. All the while monitor for cheats in use.

    If they can do it, more power to them.

    If not, the Xbox is in trouble.

    I give them 50/50 odds.

    I'm sure a lot of people are like "OMG, Microsoft, evil, evil evil! They can't do anything right!"

    Well, they are evil (so are Nintendo and Sony in their own ways) and they do screw up more than they succeed. But they do have divisions which score a win on a regular basis.

    The Macintosh Business Division was created when it became clear that teaching some Windows guys the Mac's APIs and sitting them down to port Word or something was a complete disaster. A small team of people who Knew What They Were Doing sat down and without interference from the rest of the company, were allowed to do their own thing.

    The result? The versions of Office, IE, Outlook and other Microsoft apps are lightyears ahead of their Windows counterparts. They pick up the latest APIs and exploit them before anyone else. Their products tend to be stable, well-thought out and actually useable.

    How has the community reacted? The MBU averages 1 Billion+ dollars in revenue every year.

    Could the X-Box division do the same thing? Yes

    Is it too early to tell? Yes

    Does it look promising? Yes

    They've already made a number of good decisions with the Xbox. Excluding the bizzarely unreliable store models, they are stable and reliable machines that can be left on for ages. The hard drive didn't bring patches for games, but only free expansion discs, personal game soundtracks and the end of memory card hell. The money I've saved in memory cards has nearly paid for games I own.

    The breakaway cables have saved me about half a dozen destroyed Xboxes.

    The DVD kit saved me when an out of warranty DVD player turned to crap.

    The Xbox has some issues, but it doesn't have the "too many hands in the pie" problem that Windows and the PC versions of IE, Outlook and Office do that lead to bloat, instability and security problems.

    They can make it work. It's their call wether they do or not

  • More recent discussion of this issue (Score:3, Informative)

    by The Optimizer ( 14168 ) on Thursday June 20, 2002 @02:16AM (#3734431)
    can be found at news.com [com.com] and of course there is that little article I wrote for Game Developer (which has already been covered twice here) at gamasutra.com [gamasutra.com]

    -Matt Pritchard
    • that the news.com article focuses mostly on the "cheating" side of the problems and barely touches the more general purpose "hacking the console game via the new".

      However, if you hack the console, cheating is a automatically a problem by definition.

      It's interesting that the definiton of online cheating has expanded to included a myraid of things a person can do disrupt the game, host systems, or even the network connections of other players. All that seems to matter is hurting another player in some way.

      Console systems will be vulnerable to the standard problems (buffer overflows, poor design, etc), but just how much can you loose? On the Xbox, it will be necessary to save executable code to the hard-drive to make a hack persistant, and I'm not sure that a game currently running is even allowed any access to those paritions. On the PS2, what if the hard drive isn't even present? Just reboot and reset.

      On the flip side - it's a royal pain to patch a console game. You have to issue new disks.

      -Matt Pritchard

    • Here [com.com] is another news.com story about x-box hacking and the new generation of x-box modchips. The author actually interviewed me by email and lifted some choice quotes at the end of the article.
  • Just about ALL games that combat online cheating have to do so through online updates. With these consoles still largely running off their read only media, attacks on them are likely to last longer than with their PC counterparts. I'll stick to my PC games, thank you very much.

  • So... (Score:5, Insightful)

    by sean23007 ( 143364 ) on Thursday June 20, 2002 @02:22AM (#3734450) Homepage Journal
    Too bad MS shipped the Nimda virus with their Korean version of .Net Visual Studio.

    Now, wait a second. These are two completely unrelated parts of the company. If the Xbox team does something well, they deserve praise, and if the .NET team does something poorly, they deserve to get slammed. But the Xbox team does not need to hear about the mistakes of the .NET team. You wouldn't say that the Playstation 2 sucks because Sony supports copy protection on its CDs, would you? That was un-called-for.

  • Military grade security... (Score:2, Interesting)

    by Anonymous Coward
    You know, it almost seems that Micro$oft might be coining yet another totally ambigous term to be used by the all-knowing press when discribing 'computer things'.

    It reminds me of the wonderul unit of measurment we have come to know as the 'Library of Congress' that renders such wonderfully discriptive stories such as:

    HEADLINE - 1000000GB Ethernet spec being reviewed!
    Transfers 4324231124 LoC's per / second!

    Or maybe the use of number of songs an MP3 player can hold....(instead of MB of storage)

    Just makes me want to find out exactally what this 'military grade security'. Just remember, they didn't bother specifying which military. If their idea of militrary involves a bunch of monkeys, then it might not be so good...

    Yes, I know its off topic but I couldn't help myslef...

  • Waking up one morning and finding out that you XBox which you left online playing HALO was turned into an FTP server, by a couple of script kiddies.
  • (from the article)

    "it's just a game"

    Well if it's just a fucking game then why bother fucking cheating you worthless shit eater. People like you make me despair for humanity.

    Did I mention that online cheating really annoys me?
  • thoug microsofts security record is, well, slim at best. it's a little bit out of line to use every opportunity to mock them for theire* blunders. this article deals with consoles, and the editor managed to slip inn a little "and they also did ..."

    its a little bit of "say what they wan't to hear", well hey, this is slashdot

    *hmm. i better go watch "henry fool" again, the donut people
  • The author seems to confuse the true danger, that of people being to 'get root' on the consoles, and thus pull off things such as distributed denial of service attacks, with the trivial ability of people to patch the various games with hacks so they can show their 133t s|<i11z.

    The first is a true danger and should convince people to only attach these consoles to the net by way of a well configured firewall. The second can be summed up by saying "whoop-de-frickin-doo."

  • Some people seem to be missing the point (Score:3, Insightful)

    by JazFresh ( 146585 ) on Thursday June 20, 2002 @03:05AM (#3734549)
    They say it's not such a big problem, because a hacker could only either cheat in an online game, or perform a DoS attack on the user. "If someone hacks you, shrug shoulder's, hit reset. You've only lost time."

    But the real problem is that eventually these consoles will also serve functions other than just gaming. Both Micros~1 and Sony want your living room for more than games, they want to provide other services such as movie/music downloads, general web surfing and online commerce.

    That means that the HDD (standard in Xbox, optional in PS2) will contain potentially valuable information, such as content you've downloaded, or maybe your CC number you used to buy the extra content in the first place. So if hackers could get at that data, they're potentially ripping you off.

    While this problem exists on PC too, consoles are an easier target because each one has exactly the same OS (non-upgradeable/non-patchable). If game Foo comes out with some vulnerability that allows hackers to access the contents of the HDD, then the game developer won't be able to send out a patch for Foo...

    Yeah, I'd be worried.
  • my XBox or PS2 get r00t3d? What can be worth the time spent hax0ring the consoles? It's not like they are being used to store CC numbers... It's not that there are shell access for which you can compile l33t war eggies for #h4x0r-united... Hell, even for the publicity concious h4x0rs out there, it doesn't even run HTTP service (even it it does/can, who the hell would want to point a domain to their XBox/PS2 anyway!), so there's no web pages to deface!

    The only security you need for your consoles is physical security so that it doesn't get stolen while you're not playing with it (and most definitely it won't be online during this time).
  • lets take the track record for Asheron's Call, currently microsofts highest premium on-line game. If you are looking for an example of MMORPG where massive cheating and hacking is allowed this is it. While developed by an outside company, which created a great game, Microsoft controls the rules and Code of Conduct. Microsoft could careless about the cheating and does minimum amount of taking care of people who just play to cause problems for other people. Thing is thier is no reason to believe that microsoft will change with the X-Box network. Based on microsoft's current track record thier is no way I would purchase an x-box for on-line gaming and believe that microsoft will take care of the security, hacking, and just plain trouble making people.

  • Self marketing? (Score:1, Interesting)

    by Anonymous Coward
    Although the article itself might not be bad, it is quite surprising that the author posts it himself on /. If all the /. readers were posting everything we publish on the web, the /. staff would be quite overwhelmed by the amount of self-advertising posts.

    But, of course, this does not question the interest of the article.
  • There are two different issues here, one of great concern to the entire net, the other of concern primarily to online gamers. The first issue is that somebody will figure out how to allow users to run unauthorised code, thus allowing the cheats that ruin PC online gaming to be replicated on the XBox and PS2. That's a worry for MS, Sony, and the gamers who want to play the games, but it's beatable in a closed system - make sure everybody in the system is identifiable to the operator as a real person, and if people are detected using bots (by either technical means or complaints from other users followed by monitoring) ban them from the system. Why is this more possible here than in the PC world? Simple. Microsoft and Sony can impose a monopoly on where you play online, which isn't the case for PC's.

    The other issue is that somebody might figure out how to crack these boxes from afar (and, because they're all identical, once you've got one you've got them all). Now, people don't keep commercially-sensitive data on them, so the worst that can happen from the owner's POV is that the box is rendered unusable and they have to take it back to the store. However, they'd make a really good place to run DDoS's from.

    The best way to make this harder, IMHO, would be to require people using these boxes to use special broadband connections that have been firewalled upstream to let only let normal traffic in and out - nobody should be trying to establish connections with these consoles, and the only things they should be trying to connect to are the game servers. Anything else should be firewalled off. The firewall would presumably be carefully monitored.

    One wonders also whether game code runs "as root" on the XBox. Obviously such code should have direct access to the video hardware, but whether it has unfettered access to the file system is another question. Surely it's possible given the restricted functionality available and given an unmodified XBox, that only code signed by Microsoft can alter certain key files? (In other words, avoid "local root exploits" in services runnable by game code). That way, even if a game has a buffer overflow or the like in its network code, nothing too serious can be compromised and the problem presumably goes away on power-cycle when the whole game is reloaded fresh from DVD.

    • The games run in ring 0. Under any decent PC OS, even your setuid root programs run in ring 3. If, for instance, you're running IIS (which runs in the System security context, IIRC) and IIS gets a buffer overflowed, the attacker has to upload and install a trojaned driver (or find and/or install some other flawed/maiicious ring 0 code) if s/she wants to overwrite, say kernel32.dll's memory space. Many imbedded systems, including the XBox do not have memory protection in place.

      Think of ring 0 as the hardware version of root priveledges. Infact, the software protections that enforce the system security policy would not be possible without all of the user's code running outside ring 0.

  • New programs (Score:1, Funny)

    by Anonymous Coward
    Comming to your Xbox soon!

    BSOD for the Xbox
    Nimda for the Xbox
    iloveyou for the Xbox
    linux for the Xbox
    Goatse.cx for the Xbox
  • ... this will be an intersting experiment.
    Can anyone remember when in Internet history this many nodes have gone on-line in such a short period of time?

    I don't know what sort of bandwidth these games will require, but what if any effect will there be when potentially hundreds of thousands of consoles start accessing the 'net within a period of a few days, on top of the normal growth?
  • From the article:
    "I don't always cheat. I'm pretty good playing straight," he insists. "Cheating makes me a god."

    Ok, if you are "pretty good" playing straight, why cheat? Seriously. It's a game. People cheat all the time, but I for the life of me don't understand the need to have an edge like this.

    IMO, part of the fun is seeing how you truly match up against people and watching yourself progressively get better. This I feel like God crap is worthless. Besides, doesn't he get tired of it?

    I know there will be plenty of people saying it's just human nature to do this, but really, is it? The vast vast majority of people are not like this, so what causes people (in Counter Strike and other online games I mean) to do this. Notoriety? Fame? (It's a fucking game!) Fortune? I don't think so.

    I guess my final take on this is yes, he may indeed think he is a God, but all he is doing is cheapening himself in the eyes of people like me. And I believe there are a lot of us out there. Do unto others as you would have them do unto you.
  • How in gods name could X-box be safer than PS2? I thougt that xbox ran a mutated version of Windows XP. It is supposed to be a multimediahub in the future and as such it is bound to have many networking fetures turned on and fully implemented. Since many exploits that works on WINXP probably works on Xbox i can rpedict that it wont be that safe. PS2 on the other hand hasnt any known exploits yet and to get hold of the SDK is a bit harder. I think xbox owners will have to patch as often as any other WinXP user.

  • Bad, bad box, bad! (Score:4, Informative)

    by juliao ( 219156 ) on Thursday June 20, 2002 @06:01AM (#3734932) Homepage
    The difference of attitude between MS and Sony is striking: Sony chosses to "open" its system, letting developers implement new things, potentially allowing devices other than Sony consoles to access their network. Microsoft, on the other hand, chooses to "close" their system, specifying their own methods and protocols, and creating a supposedly XBox-only network. What is wrong with this picture?

    In fact, this looks very much like the Unix-Windows security arena. Unix has been traditionally open. All the protocols are open, and, especially, the implementations never assume that they know who or what is on the other side. This, in fact, is one of the critical aspects of security. Never trust the remote. Ever. Always assume that things can be spoofed, always assume that all and every piece of data you receive has NOT been validated by the remote. This is the Unix way of doing things. This, in fact, is the right way of doing things.

    Alternatively, you can start "trusting" the untrustable. You can build a single platform network and assume that all data sent from the remote is "good data". This is naive, and leads to disaster.

    Remember the "ping of death" vulnerability that existed on Windows machines: why did it exist? The simple answer is that it was there because the ICMP stack was badly coded. Right. But that's only half of the story. In fact, it was there because of Microsoft's way of thinking. Microsoft always assumes that things are under full control. The ping of death vuln existed because the Windows version of "ping" did not allow for larger-than-a-given-number packets to be sent. And the Microsoft way of thinking is "if the client can not send it, the server can neglect checking for it". That way of thinking has lead to many of the security flaws in Microsoft products.

    The truth is, things are not always under full control. The XBox can be hacked locally, changed into allowing modifications to be performed on the "Microsoft trusted" software components. Other kinds of machines can be connected to the network and made to pretend to be XBoxes, while still allowing full control by the owner on what gets sent and to where.

    In short, by choosing to create an "XBox-only network", Microsoft has taken the step that will make its network fundamentally insecure. If you still can't see why, think of it in the Disneyland way Microsoft suggests. What they are in fact saying is that "since the Disneysoft is secure, you can trust everyone there". The things you normally tell kids to do, like "never take candy from strangers", are no longer in effect inside the Disneysoft. Inside Disneysoft, you can take candy from anyone. What is the rationale behind this?
    That "bad people" can't go inside? Wrong.
    That "bad people", once inside, can't give you candy because "giving candy" is not an option? Wrong - if you own the box, everything is an option.
    That if "bad people" do this, they will be expelled? Sure. They can expell all they want. That won't prevent them from coming back, and it certainly won't prevent your kid from being dead.

    A last thought: People go around saying "what can happen? someone steals your save game? so what?".

    Well, on one side, the XBox is being touted as a future "computing/internet/browsing platform". That means all kinds of sesitive information is going to get stored in its hard disk. And while having your save game stolen can be little more than a nuisance, having your personal data, personal files and credit card information stolen can be a bit more serious than that.

    On the other side, the XBox has a network adapter. And guess where it is going to sit? Right on your home network. Together with your PC. Together with your other local devices. Probably inside your firewall? Great target for a hacker to attack and, from there, jump on to your private network. Sure, you can always firewall it, put it on a DMZ. Sure... Microsoft does not have a good security record.

    • Wrong. In short, by choosing to create an "XBox-only network", customers will have one community, not several with a bunch of different UI's. They won't have 5 bills from 5 different game companies for the 5 games they play, they'll have 1 bill from The Bill (sorry I couldn't resist). XBox is not fundamentally less secure because it is one system. This is a philisophical blunder similar but worse then faith in security through obscurity. By this logic, you are saying because all ~1million XBox Live users (predicted within the first year) are using one system, there's more chance of them getting hacked as opposed to ~5+ million PS2 using one of 5 online systems in which there's... oh, ~1million per system.

      Finally, like you mentioned, a fricken game console should NOT be on a public network. I hope that Sony and Microsoft educate their online users about the need for a good firewall.
      • Just to clarify my point:

        I'm sorry if I seemed to imply that an XBox network is "fundamentally less secure because it is one system".

        The thing that will make the XBox less secure is if Microsoft assumes that it will only ever interact with other XBoxes, and forgets to test for vulnerabilities that involve

        a) Systems that are not XBoxes
        b) Modified XBox hardware
        c) XBoxes running modified software

        All of these will, no doubt, be found "in the wild" inside Microsoft's XBox-only-no-modded-consoles-allowed Disneysoft.net . We will then see if Microsoft designed and tested the XBox to interact (and endure interaction) with anything other than itself.

  • eweek [eweek.com] is linking to a report (PDF format) [mit.edu] from a student at MIT detailing how Microsoft is using a hardware-based encryption key in the Xbox. The bad news? The key is identical in every unit.
  • From the linked article:


    Closing their service to outsiders increases the security of their system overall and "prevents hackers from scaling beyond one machine," the company claims. "Xbox Live has military grade security to ensure no cheaters, no hackers, and no viruses."


    So they couldn't make their OS with mititary grade security, but their game console is good to go? Yeah, right.
  • Security is one of the reasons Microsoft is building its online service as a closed, Microsoft-only system.

    'Cos for sure no one has ever made a clone of battle.net or Everquest

  • Warranty void if you're rooted or get a virus (Score:3, Informative)

    by morcheeba ( 260908 ) on Thursday June 20, 2002 @08:39AM (#3735301) Journal
    Section E of the warranty (page 18) [xbox.com] says "Exclusions from limited warranty. This limited warranty shall not apply and Microsoft has no liability ... if the Xbox Product:" ... (section E5) "is damaged by programs, data, viruses, or files, or during shipments"

    Not that you'd ever get one with the military grade security, but it's reassuring that Microsoft has no responsibility to do anything...
    • You take it on line, you'd best be cognizant of the risks and requirements thereof. Or do you think Ford should be liable if one of it's vehicles lets you drive into oncoming traffic? Or doesn't automatically swerve out of the way when somebody from the opposite side of the road suddenly drives into your lane? Everybody complains about the corporations not taking responsibility, but it's often to avoid taking personal responsibility.
      • Well, let's take the disney land analogy [slashdot.org] that another poster used. Would I sue Disney if I were riding the Snow White ride [ebay.com] and got run over by oncoming traffic [macktrucks.com], I think most people would think I could sue.

        But it's an analogy that is just as silly as the ford one - it all comes down to what the customer expectations are for the product and how they jive with what Microsoft is willing to provide.

        Microsoft requires users to dial into their servers -- not servers owned by the game's publisher. This is a big sticking point with some of the software companies because it violates the "don't let anyone get between you and your customers" rule of business. Since it's microsoft-certified software, microsoft hardware, and a microsoft network, you'd think you were in a safe area. But, microsoft can't control everything (even its own employees), so there could be problems. This disclaimer (at the risk of making another silly analogy) is like McDonalds saying "we're not responsible if we spit in your food and you get sick".

        click here if the snow white link expired [ebay.com]
  • Closed global broadband network. Bwahahahahahahahaha!
    Bwahahahaahahahahahahahahahaha!
    BWAHAHAHAHAHAHA HAHAHAHAHAHAHAHAHAHA!!!

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (5) All right, who's the wiseguy who stuck this trigraph stuff in here?

Close