Category Archives: Game security

Glitching the Xbox

Posted on by
Reply

A group of hackers has designed a stunning attack to run arbitrary code on Xbox.  XBox uses a hypervisor (or boot loader) that checks that the software that is running is properly signed (or does not have the wrong hash).  They use fault injection techniques, here glitching.  The aim of the attack is to make the processor derail after a serious glitch when applied at the precise moment.  This technique was initially designed to attack smart cards or secure processors (For instance, see chapter 9 of  Markantonakis and K. Mayes, Smart Cards, Tokens, Security and Applications, Springer-Verlag New York, 2008)

In the case of Xbox, the attackers had to produce a 100 nS glitch on the chip reset when it compares the calculated hash with the stored values.  If well designed, the glitch should make the memcmp positively fail and thus should allow to run arbitrary code.  They had to succeed two challenges:

  • Find the precise moment for the glitch to occur, and find the right shape for this pulse
  • Find a method to slow down the processor; with a slower processor, the accuracy of the glitch can be reduced.

They succeeded!  It is interesting to note that they had to design two solutions: one for the fat Xbox, and one for the slim one.  They have different PCBs.  For the fot box, they found a pin to slow down the CPU, whereas for the slim one, they attacked PLL by over writing parameters in an I2C memory (this old serial bus is not protected).

It is a  nice piece of reverse engineering.  This is not a consumer-grade hack.  It is extremely complex.  I believe that here, the motivations are purely to succeed a technical challenge (real Hackers).

Lessons:

  1. As always, Law 1 is true.  Attackers will always find a way.
  2. Attackers may use top-notch techniques.

 

 

PC game piracy examined

Posted on by
Reply

Koroush Ghazi maintains a site TweakGuides which purpose is to help to optimize your PC. One of his biggest focus seems to be on PC games.

He publishes a long article “PC game piracy examined”. This paper is excellent. He presents a very balanced, realistic view on piracy, game piracy and especially PC game piracy. His vision encompasses the economical aspects making it realistic. For instance, he explains the lack of games on Mac because initially it was too pirated and the market size was too small to have a ROI.

According to him, piracy harms PC games, because developers may first go to consoles that are less pirated. Clearly, using a hacked game on a console requires either a modchip, or flashing the firmware. All that makes it more difficult for Joe SixPack, and brings some risks (see “Ban under Xray” in security newsletter #18). Therefore, PC became the preferred platform for pirated games.

He also debunks some myths such as DRM generates piracy, or PC games are dead…

If you are interested in game piracy, read it. It is really worthwhile.

Thanks to Yves for the pointer.

Glider versus WoW

Posted on by
Reply

Many years ago, company MDY issued the Glider Bot for World of Warcraft (WoW). The Glider Bot allowed to automatically do mandatory routine tasks in the (which are not thrilling but simulate “real” life). Using the bot allowed you to accelerate your progression by earning experience without in fact being in front of your screen. An alternative is gold farming, i.e., you pay somebody to take care of your character while you’re not playing, thus also gaining experience.

As you may guess, Blizzard, the editor of WoW, does not like the bots. It has even installed a tool, called warden, that attempts to detect such bots. Glider passes under the radar of the warden.

Thus, Blizzard sued MDY for copyright infringement because it violated the EULA (End user License Agreement). In February, the Ninth Court of appeals ruled that MDY did not infringe copyright (under some complex difference between covenant and condition, for more legal details see the blog “Lawyers in a Gamer’s World”).

But the court ruled that indeed MDY infringed DMCA’s circumvention of technical prevention measure (the other TPM) although it did not bypass it!

As usual, copyright and DMCA issues are awfully complex.

PS3 jailbroken v(3)

Posted on by
Reply

As I reported, the hacker George Hotz, aka GeoHot, was sued by Sony under DMCA for having leaked the private signing key of PS3.

Sony and GeoHot have settled down an agreement. Under this agreement, GeoHot will never again hack any Sony product. See the official press release by Sony.

Interestingly, during this fight in March, Sony succeeded to get a subpoena that allowed them to have access to every IP address that visited GeoHot’s blog since January 2009.

PS3 Jailbroken v(2)

Posted on by
1

If ever you were surprised by the statement of the need of a random number for signature in my post PS3 jailbroken or if you’re interested in the mathematics behind the exploit, I would recommend that you read Nate Lawson’s post DSA requirements for random k value.

Funnily, he posted that before the hack of PS3 was public. In general, his blog root lab rdist is excellent (although very technical). Nate was a former employee of CRI (the company of Paul Kocher)

PS3 jailbroken

Posted on by
1

Monday, January 24, 2011

At the December CCC conference, George Hotz, by the nickname of GeoHot, disclosed that he has discovered the private key used to sign the firmware of all PS3 devices.

Usually a piece of code is signed using a private key. The device checks that the code is properly signed using the corresponding public key. if it is the case, it proves that the software was not tampered and that it was issued by the owner of the private key (here Sony). Normally, there is no way to guess the private key from the public key. The usual assumption is that this private key never ever does leak out. They are usually stored in Hardware Secure Module (HSM) within a safe and with strict security policies. It is the corner-stone assumption of most of the trust models.

It seems that GeoHot and Fail0verflow guessed the private key due to a mistake in the signature software that uses a fixed value and not a true random value, dixit a member of Fail0verflow team in an interview to BBC.

PS3 was already jaibroken. The difference with the previous jailbreak[/url] is that this one is purely software. it does not require to change anything in the PS3.
There is no way to recover. It is now possible to execute any arbitrary code on the PS3, because it is possible to sign any code. The issue is that this checking is done in the loader which cannot be modified in the field (else the hackers could easily change this checking process :( )

Sony has launched, under the DMCA, a procedure of temporary restraining order that attempts to stop dissemination of jailbreak.

Lessons:
– Proper implementation of cryptography is difficult
– PS1 and PS2 were open to homebrew applications. They were never hacked. PS3 was closed… Blocking the access of a game console for homebrew may be an attractor for crackers.

Open API to Kinect

Posted on by
Reply

It did not took long for the hacking/hobbyist community to reverse engineer the API with Microsoft’s Kinect. Kinect device is the new gizmo for Xbox which uses the body as an input device.

Adafruit, a US company, offered a $3,000 bounty to the first developer who would provide a library to connect to the Kinect. Hector Martin is the winner. His library gives access the RGB data from the camera together with the depth map.

The first person who reported to be able to connect to Kinect was alexP from NUI. Nevertheless, he did not publish his drivers. He works with the open source group Natural User Interface (NUI). At the contrary,Hector Martin has published them as open source under the name LibFreenect. Meanwhile, Theo Watson has adapted this library to work on Mac OS X.

The initial reaction of Microsoft to Adafruit’s challenge was to threaten of legal suite in case of hacking.

With Kinect, Microsoft built in numerous hardware and software safeguards designed to reduce the chances of product tampering. Microsoft will continue to make advances in these types of safeguards and work closely with law enforcement and product safety groups to keep Kinect tamper-resistant

Microsoft has smoothened its position. It does not claim that this library is a hack (which stricto senso may be true).

Kinect for Xbox 360 has not been hacked–in any way–as the software and hardware that are part of Kinect for Xbox 360 have not been modified. What has happened is someone has created drivers that allow other devices to interface with the Kinect for Xbox 360. The creation of these drivers, and the use of Kinect for Xbox 360 with other devices, is unsupported. We strongly encourage customers to use Kinect for Xbox 360 with their Xbox 360 to get the best experience possible

The position of Microsoft is very smart. In no way does this library harm Microsoft business. Soon, hobbyists will use the Kinect and create most probably applications extending further than game. They may even come with some ideas that Microsoft’s engineers will be able to exploit. This may be even good advertisement for Kinect.

It reminds the use of Sony’s PS3 in fields unrelated to games. See security Newsletter #9.

Another winner is Adafruit, for $5,000, they made the headlines worldwide! and with the role of good guys!! That is cheap. :)