PS3 Root Key Hacker Sued

http://www.geohot.com/

by davidcuddeback • 16 years ago

159 100 16 years ago

Previous discussion when the root key was released: http://news.ycombinator.com/item?id=2063058

heretoo2• 16 years ago

>>> In late December 2010, a hacking group called FAIL0VERFLOW discovered a way to access certain (but not all) levels of the PS3 System by circumventing the corresponding TPMs. Id. at ¶16; Bricker Decl. at ¶5, Exh. D. At that point, hackers were given the tools to run unauthorized and pirated software on the PS3 System <<<

My understanding is that fail0verflow's exploit didn't enable piracy at all because metldr wasn't being exploited. Anyway, won't this go the way of iphone, where is was ruled that jailbreaking is legal?

My hardware, my rules...

wipt• 16 years ago

One can hope so. It's really dependent on how the DMCA is interpreted. I was wondering where this legal action was when I heard about the exploits.

Shame on Congress for passing the DMCA to begin with. This exploit only furthers cryptography in practice (that is, this will be a lesson in crypto textbooks for generations to come).

Xuzz• 16 years ago

They didn't have an exploit: they showed how to get the private keys to sign anything. Much more valuable (for legitimate uses (and piracy)) than geohot's posting of one individual key.

trotsky2• 16 years ago

Note that phone jail breaking was given a very narrow exemption by the Library of Congress through the terms of the DMCA. It doesn't establish any legal precedent here, and lobbying for such an exemption is a lengthy process.

Morally they seem similar enough, sadly that's not the issue.

GooseFlyFox• 16 years ago

Sony is always willing to spread the love while I fully understand the desire and drive to reverse and break the security of closed platforms.. grandstanding about your success in a public way traceable to you seems really misguided...

It would seem better to release and wait for the ashes to settle first no?

heretoo2• 16 years ago

Should have leaked the keys through wikileaks .. harhar..

But seriously, the fail0verlflow guys had legitimate grounds to exploit the PS3. Sony had taken away OtherOS, effectively crippling the product they had purchased, which was advertised as offering this feature. Imagine instead, what would happen if Sony had taken away the ability to play games?..

loire280• 16 years ago

Then Sony's console business would go bankrupt?

But seriously, except for scientific computing, the PS3 was a terrible Linux system, especially for the price. Is this really about restoring functionality, or is it just punishment?

maeon32• 16 years ago

This notion of owning a piece of hardware without the legal right to take it apart worries me.

Close that car hood citizen, there are secrets in there, don't make me taze you.

erk: C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B

riv: 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D

pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19

R: 80 6E 07 8F A1 52 97 90 CE 1A AE 02 BA DD 6F AA A6 AF 74 17

n: E1 3A 7E BC 3A CC EB 1C B5 6C C8 60 FC AB DB 6A 04 8C 55 E1

K: BA 90 55 91 68 61 B9 77 ED CB ED 92 00 50 92 F6 6C 7A 3D 8D

Da: C5 B2 BF A1 A4 13 DD 16 F2 6D 31 C0 F2 ED 47 20 DC FB 06 70

sorghum• 16 years ago

This bit in particular disturbs me:

>> First, the PS3 System consists of a “protected computer” because it is used in interstate commerce (e.g., the Internet.) Second, without SCEA’s authorization, Defendants intentionally accessed certain levels of the PS3 Systems by circumventing SCEA’s TPMs in the PS3 Systems. Defendants’ access to such levels in the PS3 Systems is not authorized; to the contrary, the PlayStation Network Terms of Service and User Agreement (“PSN User Agreement”) prohibits the circumvention of security features in the PS3 System.

It looks like there is a legal definition of a "protected computer" (see http://en.wikipedia.org/wiki/Protected_computer), but I can't imagine it was ever intended to apply to one's own computer. Furthermore, how is the PlayStation Network user agreement relevant here? You don't have to agree to anything to buy a PS3, only to use the optional PSN service.

pyre3• 16 years ago

It sounds like they are grasping for straws with that claim. I think that it's likely to get thrown out. If it doesn't get immediately tossed out, or at least defeated in court, then it would be time to worry.

allwein• 16 years ago

They're also failing to grasp that "protected computer" is an instance attribute, and not a class attribute.

SriniK2• 16 years ago

Yea. Seriously, don't know why sony is making fools out of themselves - seems like act of desperation. Just move on to innovating a newer version with more security. I guess lot of game developers are not happy with this.

eru3• 16 years ago

Why should they move to a newer version? Can't they just drop the `security'?

RyanMcGreal• 16 years ago

> Close that car hood citizen, there are secrets in there, don't make me taze you.

Auto makers originally tried to prevent car owners from servicing their own cars or taking them to third parties to be serviced. It took a legal struggle and legislation to enshrine the rights of ownership that car owners take for granted.

Or at least took for granted. A new legal struggle is turning around the right to repair modern cars that make extensive use of processors and proprietary software.

http://blog.fosketts.net/2010/07/29/walled-gardens-gilded-ca...

atomical6• 16 years ago

Judging from a lot of the comments on this topic and others many geeks don't believe intellectual property should be protected. When someone creates a platform (Heroku, Facebook, Apple's App Store) they have a right to lock it down. If you don't believe in that don't buy the product!

cookiecaper2• 16 years ago

It's not a cut-and-dry matter of whether intellectual property "should be protected". I think most hackers expect some protection in the form of copyright. However, most hackers are also tinkerers and are disturbed that current IP law so heavily favors corporate interests, even to the extent where you cannot use something you rightfully own according to your own desires.

Would you buy an oven if there was a big label that said "IT IS ILLEGAL TO USE THIS OVEN FOR BROWNIES; ALL BROWNIE BAKERS WILL BE PROSECUTED"? Do you think laws that allow that kind of thing are good? Remember, this isn't a rented oven, you bought the whole thing outright. Why should there be laws that allow hardware makers to say "THIS COMPUTER CAN ONLY RUN MOBILE OS 5.5; ALL USERS OF NON-MOBILE OS 5.5 WILL BE PROSECUTED"?

What about (cooling it on the caps) "it is illegal to publish the words etched into the bottom of this oven. Do not read the words on the bottom of this oven"?

Copyright was originated to make the creation of intellectual property economically worthwhile so that more intellectual content could be produced and distributed. I think we crossed that threshold a long time ago and now we've gone way overboard into the other extreme; our current laws actively discourage creativity, which is the exact opposite of their purpose.

Why doesn't your post say, "It seems many companies don't believe that those that purchase their hardware have a right to use it according to their own dictates. If these companies don't believe in that, don't mass produce and sell your product to everyone!"?

Surely massive distribution with no restriction on buyers is a horrible way to keep a secret.

roel_v4• 16 years ago

EULA's have nothing to do with copyright, it's plain contract law.

If you and I are neighbors and we agree that you I will pay you 250$ a month to not park you car in front of my house (while you legally have a right to do so), should that not be allowed?

If I am a shoe manufacturer with local retail outlets you and I agree that I will sell you my shoes for reselling overseas, but part of the agreement is that you won't sell them locally; should that be allowed?

If you and I agree that I will sell you a device but you will only use it under certain circumstances, should that be allowed?

I think the government has no business in private contracts in any of the above situations. Let people make their own agreements and then let the market decide. The only role the government has herein is to enforce contracts - what good are contracts when one party can decide retroactively that they don't like the terms anymore, and oh I don't want to cancel the contract, no I want to have my pie and eat it, too?

eru3• 16 years ago

> Copyright was originated to make the creation of intellectual property economically worthwhile so that more intellectual content could be produced and distributed.

This is often cited as the reason for copyright. Was this the actual historical reason, or just some windowdressing after the fact? (And the wording of the law in America doesn't count. It that argument hold any water, the USA PATRIOT Act wouldn't be so funny.)

Wikipedia has something like "The origin of copyright law in most European countries lies in efforts by the church and governments to regulate and control the output of printers." and similar lines.

tzs3• 16 years ago

> Would you buy an oven if there was a big label that said "IT IS ILLEGAL TO USE THIS OVEN FOR BROWNIES; ALL BROWNIE BAKERS WILL BE PROSECUTED"? Do you think laws that allow that kind of thing are good? Remember, this isn't a rented oven, you bought the whole thing outright.

It depends. Did they sell me the oven at below cost, and their plan for not losing money overall depends on people not using the ovens for brownies? If that were the case, I'd consider buying the oven and satisfying my brownie desires some other way.

maeon32• 16 years ago

It's about freedom to tinker, It is wrong to seize some hackers computers and sue him because he was able to figure out how a device he owned worked.

I don't want to live in a world where I become a criminal for even attempting to figure out how MY stuff works.

dools• 16 years ago

Well, in practice you only get prosecuted if you publish your results on the internet. This guy could have figured out how his stuff works all he wants, and even shown his friends, with impugnity.

tomjen3• 16 years ago

If you can't see the difference between the examples you posted and the ps3, you shouldn't be posting on hn.

amock• 16 years ago

I think people believe that once you buy hardware you should be able to do whatever you want with it.

baddox2• 16 years ago

It's not just "many geeks" that don't believe intellectual property should be protected. The software engineering community in general concludes that treating software like property is illogical and perhaps harmful. At least around where I'm from, software engineers and computer scientists are explicitly taught in their ethics seminars that the entire analogy of "intellectual property" has serious logical and ethical problems inherent in it.

parasubvert• 16 years ago

Uh, no. There's no consensus on the ethical or illogical nature of IP. It would be extremely biased and wrong for CS majors or engineers to be "taught" that IP is illogical.

There's a big difference between being supportive of FOSS and believing that intellectual property should not be protected. As far as I can tell the majority of computer scientists and software engineers (even here on HN or on Slashdot) believe that some form of copyright should exist. The problem in the US and the DMCA is with the perpetual extension of term lengths, and the prohibition of tinkering. Software patents, on the other hand, are increasingly opposed in the mainstream.

Let's also not forget that there are generations of geeks that don't care for open source, and don't contribute to it. It is going to be decades before they retire.

trotsky2• 16 years ago

With opinions like yours it's a miracle we have libraries.

atomical6• 16 years ago

Not a very clever one liner but I'll bite. My opinion appears to be in the minority on here and possibly elsewhere as well. What gave you the impression that my opinion is so important to the debate as to make it a miracle. I could see if I was a congressman or in government you might think that, but I am not.

Andys• 16 years ago

If I buy physical goods, I have an expectation that I completely own it and can do with it whatever I want, and can share my experience completely with others.

What Sony is trying to say is that when you buy a PS3 you are sort of renting it, and they still own what you can and can't do with it. Perhaps because they are selling it at a loss so they can make money when you buy games. I think that in this case they should NOT sell the device to consumers but lease/rent it, because that is the agreement they are really looking for.

temugen• 16 years ago

It may seem like renting to you, but unfortunately those licensing terms you agree to when you open a package of new hardware or install a piece of software, are legal. It is a shame, but if you don't agree to it, don't buy and use the product. Sony, in this case, has strong reasons for wanting to protect their console. Namely because of the contracts they hold with certain chip makers, and because they are expecting profits from playstation games to offset production costs of the console, of which there are none if people are buying loads of them to run their clusters.

alexqgb• 16 years ago

This is a joke, right?

I can't believe you're seriously comparing online platforms owned and operated by their creators to a hardware platform that's neither.

atomical6• 16 years ago

Just because it is a physical product doesn't make it any less protected. So, yes, I am seriously comparing them. If that's all you have to add I can't believe you wasted your time writing that.

praptak3• 16 years ago

"[...] many geeks don't believe intellectual property should be protected."

And also, toilet paper is used to wipe asses. Many geeks indeed do even believe that intellectual "property" is a propaganda term which was coined to make the false impression that a temporary monopoly on information is somehow similar to physical property.

iwwr2• 16 years ago

If you watched the CCC presentation on the PS3, you know these people are more interested in running their own software than breaking the console to play pirated games.

http://www.youtube.com/watch?v=YbUVgxw1yWc (30 seconds)

ugh• 16 years ago

Here is the whole presentation (45 min., three parts): http://www.youtube.com/watch?v=LuIlbmn-4A4&feature=mfu_i...

Other formats here: http://events.ccc.de/congress/2010/wiki/Conference_Recording...; slides and links here: http://events.ccc.de/congress/2010/Fahrplan/events/4087.en.h...

zzygan• 16 years ago

Although I dont agree with SECA, their point of view is that once the console can run "uncertified" software then its only a matter of time before the pirates have their day.

I think that if Sony had just left the OtherOS option in the new consoles, and not removed the support from older ones and maybe improved it by allowing access to the GPU, then this would have taken a lot lot longer since there was no motivation for the hardcore guys

iwwr2• 16 years ago

They may have even lasted into the release PS4 and so benefit from nearly zero piracy through the product cycle.

DougBTX• 16 years ago

Sony doesn't get a cut when people play games they've made themselves. If people play their own games, then they have less time to play games where Sony does get a cut, so it hurts them in just the same way that pirated games do. This is going to be a problem one way or another as long as the cost of the hardware is subsidised.

PostOnce• 16 years ago

Do you seriously think homebrew is a threat to commercial games? The quality is 1/1,000,000th. The budget is one billionth.

Let me know when SCOURGE ( http://scourgeweb.org/tiki-browse_gallery.php?galleryId=2 ) starts impacting Diablo sales.

rbanffy• 16 years ago

> Sony doesn't get a cut when people play games they've made themselves.

So, the obvious solution is to stop subsidizing consoles with title royalties.

Let the market decide whether they prefer a more expensive homebrew-friendly console or a cheaper homebrew-hostile console.

And, BTW, when it was introduced, the PS3 was an amazingly powerful computer. Now it's not. It's, at best, interesting.

makeramen• 16 years ago

engadget article says it's just a restraining order? unless things have changed since they published this post: http://www.engadget.com/2011/01/11/sony-sues-geohot-fail0ver...

redthrowaway2• 16 years ago

From the court order:

IT IS HEREBY ORDERED that Defendant Hotz and his officers, employees, attorneys and representatives, and all other persons or entities in privity or acting in concert or participation with Defendant Hotz, be immediately temporarily restrained from:

...Offering to the public, posting online, marketing, advertising, promoting, installing, distributing, providing, or otherwise trafficking in any circumvention technology, products, services, methods, codes, software tools, devices, component or part thereof...

...Providing links from any website to any other website selling, offering for sale, marketing, advertising, promoting, installing, importing, exporting, offering to the public, distributing, providing, posting, or otherwise trafficking in any Circumvention Devices...

And a whole lot more. Aside fromt the fact that it seems the corporate world still hasn't heard of the Streisand Effect, the language of this document is worrying. Clearly, the laws were written with commercial theft of IP and industrial espionage/reverse engineering in mind. The linguistic contortions seem to make it clear that the DMCA and CFAA were never meant to be used against hackers, but rather against counterfeiters. It's pretty disturbing that even the courts march lockstep with corporations in stretching the law to serve corporate ends.

edit: As pointed out below, this is a proposed order, not one issued by a judge. Thus, please disregard the last bit about the courts marching in lockstep with corporate interests. I'm appending rather than editing so that the responses make sense.

obsessive1• 16 years ago

If I'm right though, that's only a proposed restraining order? Or do I have the wrong end of the stick?

redthrowaway2• 16 years ago

I think you're right. There's no signature from a judge at the bottom, which suggests this is something they're submitting to the court in the hopes of having it approved. IANAL, so I don't know how that would work.

cft• 16 years ago

This is a proposed court order, written by Sony's lawyers. Even the PDF file name has "proposed" in it. The court can approve, amend or deny it.

vog• 16 years ago

It is interesting to see how fast this key spreads over the net. At the moment, a quick google search shows 26,700 results:

http://www.google.com/search?q=%22C0+CE+FE+84+C2+27+F7+5B%22

Raphael• 16 years ago

Results counts on Google are wildly inaccurate.

lamnk• 16 years ago

It's still a data point to take. How else do you propose to measure the popularity of one thing on internet (in a quick way) ?

christoph2• 16 years ago

http://www.cs.cmu.edu/~dst/GeoHot/

Note to Sony lawyers: no doubt you're eager to rack up another billable hour by sending legal threats to me and my university. Before you go down that unhappy road, check out what happened the last time a large corporation tried to stop the mirroring of technical information here: The Gallery of CSS Descramblers. Have you learned anything in ten years?

David S. Touretzky Research Professor of Computer Science Carnegie Mellon University Pittsburgh, PA 15213

PS3 Root Key Hacker Sued

Related Stories