Root keys for Sony’s PlayStation 3 go public

http://geohot.com/

by Uncle_Sam • 16 years ago

139 75 16 years ago

geohot.com

st3fan• 16 years ago

Wow. How did this happen? Was the root key stored in the PS3? Or was it brute forced?

jtdowney• 16 years ago

Part 1 - http://www.youtube.com/watch?v=c77Qnk_CMF8

Part 2 - http://www.youtube.com/watch?v=ovy2kPFOu0E

Part 3 - http://www.youtube.com/watch?v=Y23LUiBRcOg

That talk was at the 2010 Chaos Communication Congress which just concluded a few days ago.

sp332• 16 years ago

Slides here (PDF): http://stadium.weblogsinc.com/engadget/files/1780_27c3_conso...

The talk covers the motivations of hackers, as well as the vulnerabilities they found.

The new exploit starts toward the bottom, on the slide that just says "ECDSA" in big letters.

ghurlman• 16 years ago

Part 3 has the specific answer to parent's question, though I recommend watching all 3 if you have the time.

aw3c2• 16 years ago

http://events.ccc.de/congress/2010/Fahrplan/events/4087.en.h...

It might be worth waiting until the official recording gets released at http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/ (named "Console Hacking 2010").

robryan• 16 years ago

I always assumed the PS3 has top notch security given how long they had managed to avoid exploits. Seems from watching the videos that they could go a long way on a future console to prevent hacks just by plugging these issues. The hypervisor happily allocating/ running anything and everything seems like a good place to start.

Obviously other ways would probably eventually be found but as these guys say, just providing a way for people to run their own code to begin with takes a lot of effort behind people hacking the system. There will always be an army of people out there wanting to pirate games and an army of people wanting to profit off of it but only a tiny amount of them can really do anything about it.

Omega1917• 16 years ago

No, no, no. This is a different exploit. We don't know how he did it yet. (He did get the private key mathematically, using the method from the talk, but not using the revocation list exploit)

tompagenet2• 16 years ago

There's a good Eurogamer/Digital Foundry article on this here:

http://www.eurogamer.net/articles/digitalfoundry-ps3-securit...

Swannie5• 16 years ago

Wow. Not a great article, but not a bad overview of the subject!

ronnier2• 16 years ago

"if you want your next console to be secure, get in touch with me. any of you 3."

I would take the mans word and hire him. I'd even through Apple into his list, he did after all release jailbreaks for the iPhone too.

geoffw8• 16 years ago

Surely, someone has to hire this guy. Forget Apple. Intel? Nokia? IBM?

executive• 16 years ago

The US Government?

ronnier2• 16 years ago

*throw

marshray7• 16 years ago

I'm not so sure I'd want to take a job having just made my new chain of command look like incompetent idiots, they'd probably find a way to repay the favor. They'd just make him to sign a bunch of long-term NDAs and fire him 6 months later. If this guy had much experience in the workplace he'd know that development like this usually happens when an organization has systematically driven out the detail-oriented security-minded people. They tend to be on the low end of the "net reduction in buglist items per salary dollar" scale.

On the other hand, there are any number of independent security assessment/pen testing firms that would love to have this guy's skills. He might even end up working on consoles. That's probably the way he should approach it.

stcredzero4• 16 years ago

I'm not so sure I'd want to take a job having just made my new chain of command look like incompetent idiots

A chain of command that's savvy enough to really want him despite that is one you'd actually want to be in, though. An organization that focused on results would be all edge like the fictional Maas Neotek from Gibson's Neuromancer.

mustpax• 16 years ago

Contract employees are paid to perform specific services as laid out by, well, their contract. This makes them a lot less beholden to management than their full time equivalents. The most vindictive thing management could do is to not hire GeoHot in the first place, which would be their loss really.

sliverstorm3• 16 years ago

Bunnie, the original hacker of the first Xbox, was brought on as council by Microsoft to help improve security for the Xbox 360. You can see the results if you ever get deep into the security models of the two.

burgerbrain• 16 years ago

Didn't this happen with their last round of consoles, and didn't they hire the people that did this last time around? I recall something about this from that case with the guy who was chipping in CA a few weeks ago.

boredguy82• 16 years ago

Clearly brilliant, but he also faked a photo of a jailbroken iPhone 4, which (apparently) motivated his partial withdraw from the scene.

Though talk about a comeback... This is a much better online "hire me" than the ones that were popular on HN several months ago.

comex• 16 years ago

Huh? I don't remember any such thing and doubt he would do that.

egohot• 16 years ago

Really not that brilliant. It appears that the fail0verflow guys did all of the work here. He just beat them to the punch after taking the fruits of their labor, and dropped the key using their exploit.

This is not unlike his behavior that got him rejected in the iPhone scene. I am actually a bit surprised that there are so many comments here praising him.

Hiring the fail0verflow guys, on the other hand, would be a good move.

There is a reason that he never releases technical details and just comes out of nowhere.

Omega1917• 16 years ago

Let's not forget that fail0verflow found the keys. After this he saw that it was possible to exploit the loaders.

YetAnotherDvlpr• 16 years ago

almost makes me want to get one.

sybreon• 16 years ago

From the mathematician on stage: "and for some reason, Sony uses the same random number all the time!" - classic!

nkassis• 16 years ago

Can you provide a time index for that in the videos?

eirikref• 16 years ago

Have a look at http://www.youtube.com/watch?feature=player_detailpage&v... and watch for a few minutes. The whole video is really interesting, but that part is the really embarrassing one.

Swannie5• 16 years ago

I'm not sure if that was hyperbole or not.

As I understand it, all that was required was for them to use the same random number /twice/. Let's say you're Sony and you sign a patch, release it, realise there is a minor fix, and release within 2hours... maybe in your rush you failed to regenerate the random seed?

Or, my initial thoughts, someone inside Sony did this maliciously?

gnaffle• 16 years ago

No, it was parabole. :)

From what I understand, they use the same number every single time without exception.

JonnieCache4• 16 years ago

If your build process requires you to manually generate a random number and copy and paste it in, you need to try harder. If you work for a bank handling payments, you should be fired and never allowed to work in software again.

EDIT: that last bit about banks is OT, sorry about that, I've been watching the chip and pin hacking talk from CCC and got confused.

stcredzero4• 16 years ago

maybe in your rush you failed to regenerate the random seed?

Or, my initial thoughts, someone inside Sony did this maliciously?

As always, the human factor is the real weakness. (Key management by users and coders.) There are similar problems with RSA signatures on related numbers or selecting keys for IDEA block cipher and RC4 stream cipher, just to name a few. If you use crypto tools incorrectly, you actually put yourself in a somewhat weaker position than if you hadn't even tried. What you've essentially done is create "security theater" for the bad guys to dupe the unsuspecting with.

Omega1917• 16 years ago

No, it works on any two binaries.

JonnieCache4• 16 years ago

http://dilbert.com/strips/comic/2001-10-25/

(Bonus points if you get the reference: https://secure.wikimedia.org/wikipedia/en/wiki/Feynman_point)

jpablo• 16 years ago

So what are the implications of this ? Homebrew software ? Pirated games ?

iloveponies• 16 years ago

Homebrew first and foremost, and reclaiming back the ability to run Linux on the consoles (and run it on the PS3 Slim as well). It's possible to pirate games with this knowledge, but from my understanding a lot of the Blu-ray security has not been broken at this point in time so these keys are by no means all you need to get up and start ripping those discs.

artmageddon4• 16 years ago

I have a PS3 that hasn't been received the update to remove the "Other OS" option(and I'm damn glad I waited...). Does this also provide access to the PS3 Hypervisor? I remember reading, a long time ago, that that was one portion of the PS3 that was restricted from running Linux. On the same token, I wonder if that could mean better performance... I found that running Yellow Dog Linux on it was awfully slow.

Omega1917• 16 years ago

Piracy was there before this. This is for homebrew primarily :)

cantbecool• 16 years ago

Looking at GeoHotz accolades on his Wikipedia page makes me feel like a terrible underachiever.

Root keys for Sony’s PlayStation 3 go public

Related Stories