Hacker Group Gives Video Tour of PS3 Security System
Group claims that the only reason the PS3 was "hack proof" was that until Sony removed the Other OS feature, no one was actually trying.
A hacker group calling itself "Fail0verflow" - the same people responsible for the Wii homebrew channel - has given a talk at the 27th Chaos Communcation Congress [http://events.ccc.de/congress/2010/wiki/Main_Page] in Berlin, Germany, giving a detailed look security measures that Sony implemented for the PS3, and how they were circumvented.
In their 45 minute presentation, the group made the case that the removal of the Other OS function had played a pretty big role in the PS3 getting hacked. Had Sony left it alone, the group said, all the hackers would have been quite happy to tinker with Linux, instead of poking around the PS3 looking for vulnerabilities. In a tweet [http://twitter.com/#!/fail0verflow/status/20283862579945472], the group reiterated that point, saying that Sony's security for the PS3 was so bad that it was inconceivable that it had taken four years to crack.
The rest of the presentation was devoted to explaining how the security worked, and how different exploits had bypassed it. The group explained how the PSJailbreak worked, but said that they wanted a hacking solution that didn't require the use of a USB stick. Thankfully, for them at least, a blunder by Sony - in which a supposedly random number that formed part of a security key is actually the same value each time - allowed the group to sign their own code, which the console would accept without question.
The group's crack does not allow the PS3 to run pirated games however, as the group's aim was just to allow the console to run Linux again. As part of a Q&A session at the end of the presentation, they said that it was likely possible to use some of the vulnerabilities to make piracy possible, but that it wasn't something they were interested in at all.
You can watch the whole presentation in the videos below. It's pretty technical stuff, but it's very interesting too. The group also plans to demonstrate its hack on its website [http://fail0verflow.com/] in the near future.
Source: Joystiq [http://www.joystiq.com/2010/12/29/hackers-claim-discovery-of-ps3-private-key-enabling-unauthori/] and PSGroove [http://psgroove.com/content.php?581-Sony-s-PS3-Security-is-Epic-Fail-Videos-Within]
Permalink
A hacker group calling itself "Fail0verflow" - the same people responsible for the Wii homebrew channel - has given a talk at the 27th Chaos Communcation Congress [http://events.ccc.de/congress/2010/wiki/Main_Page] in Berlin, Germany, giving a detailed look security measures that Sony implemented for the PS3, and how they were circumvented.
In their 45 minute presentation, the group made the case that the removal of the Other OS function had played a pretty big role in the PS3 getting hacked. Had Sony left it alone, the group said, all the hackers would have been quite happy to tinker with Linux, instead of poking around the PS3 looking for vulnerabilities. In a tweet [http://twitter.com/#!/fail0verflow/status/20283862579945472], the group reiterated that point, saying that Sony's security for the PS3 was so bad that it was inconceivable that it had taken four years to crack.
The rest of the presentation was devoted to explaining how the security worked, and how different exploits had bypassed it. The group explained how the PSJailbreak worked, but said that they wanted a hacking solution that didn't require the use of a USB stick. Thankfully, for them at least, a blunder by Sony - in which a supposedly random number that formed part of a security key is actually the same value each time - allowed the group to sign their own code, which the console would accept without question.
The group's crack does not allow the PS3 to run pirated games however, as the group's aim was just to allow the console to run Linux again. As part of a Q&A session at the end of the presentation, they said that it was likely possible to use some of the vulnerabilities to make piracy possible, but that it wasn't something they were interested in at all.
You can watch the whole presentation in the videos below. It's pretty technical stuff, but it's very interesting too. The group also plans to demonstrate its hack on its website [http://fail0verflow.com/] in the near future.
Source: Joystiq [http://www.joystiq.com/2010/12/29/hackers-claim-discovery-of-ps3-private-key-enabling-unauthori/] and PSGroove [http://psgroove.com/content.php?581-Sony-s-PS3-Security-is-Epic-Fail-Videos-Within]
Permalink
