PlayStation 3 Hacker Must Allow Sony to Inspect His Hard Drive

http://www.wired.com/threatlevel/2011/02/playstation3-hacker-files/

by ssclafani • 15 years ago

77 57 15 years ago

wired.com

gisenberg2• 15 years ago

> The judge also backed off on an order that Hotz “retrieve” the code from anybody who he may have forwarded it to.

Good to see the judge is knowledgeable in this area! I'm sure this will end well.

tptacek9• 15 years ago

If, by "end well", you mean "the judge readily conceded that there was no practical way for this to happen and apologized for the ill-thought-out demand", then know (by reading just a few sentences further) that this already happened.

logjam• 15 years ago

Uh, "readily conceded?" The judge took several weeks to finally realize that she made an "ill-thought-thought out demand" to "retrieve the codes".

jerf• 15 years ago

It's a little disturbing the order was ever made, though, because the fact that information can't be retrieved isn't some unique computer complication, it's just generally true. There aren't any media in which you can uncommunicate. (A couple of computer media try to hack it in but they can't recover copies either.) If I were being tried by a judge who did that, I would realize that I've basically already lost, pretty much no matter what happens next.

(Which in this case is probably a null issue. This is an open-and-shut DMCA violation. I disagree with the DMCA but that doesn't change the fact that it's an open-and-shut DMCA violation.)

gisenberg2• 15 years ago

The order being made at all is what I'm most concerned about. This is an important case about technology with a judge that demonstrably does not understand technology. Perfect recipe for a lose-lose situation.

aw3c2• 15 years ago

The accused has to led the accuser inspect his data? Scary!

I sure hope they use forensic standards such as not the actual hard drive but an image of it. Otherwise the chances to plant some evidence are truly disturbing.

sukuriant• 15 years ago

I wonder if, for situations like this, you could have a neutral third party image your drive, keep one for themselves and push the image over to Sony.

m0nastic2• 15 years ago

You won't likely find such a party in cases like this.

What is more likely is that each side will hire a forensics firm to image the drive, and as long as both their checksums match, than there isn't much disagreement.

m0nastic2• 15 years ago

Sony won't be involved directly with any part of the forensics.

Their attorneys will contract with a forensics firm who will make an image of the drives (using a write-blocked device like the ones made by Wiebetech or an Encase Fastbloc).

Analysis will not be performed on the actual drive, but on the image.

The defendant's attorney will also receive a copy of this image, ensuring that chain of custody was followed (or else they can sure to try and argue that the evidence has been tampered with).

The images will be checksummed, and I would argue that the odds of evidence being tampered are pretty slim in this instance.

ErrantX• 15 years ago

> I would argue that the odds of evidence being tampered are pretty slim in this instance.

Very slim. Not least because if the defendant's legal team get wind of it that's it for any evidence from the drive, period.

Too much risk.

tptacek9• 15 years ago

Every geek in the world thinks and says this whenever any legal proceeding involves inspecting hard drives. In the real world, it's just not that big a deal. There are chain-of-custody rules that apply any time digital evidence is handled in court. The reality is that the penalty for deliberately planting evidence would be so severe, the likelihood of success so uncertain, that no major corporation (or their zillion-dollar law firm) would risk it over a small-ball case like this.

(Like 'm0nastic points out, Sony can also pay a pittance relative to their legal fees to contract this out to Mandiant).

tptacek9• 15 years ago

This is discovery for a trial, right? What's newsworthy about this? You don't have a right to be free from search and seizure period, only to be free from unreasonable search and seizure, which is to say: (1) demands to compromise your privacy and security have to be mitigate by due process, and (2) Congress can't in the long run be allowed to enact laws that unduly compromise that due process.

It isn't the DMCA per se that's allowing Sony to search the guy's drive, is it? It's civil law procedure. Companies routinely have to fork over years and years worth of mail spools for similar reasons.

tedunangst4• 15 years ago

hmmm, your definition of due process seems to be different than "good things happen to people we like, bad things happen to people we don't like." Are you sure that's how things are supposed to work?

tptacek9• 15 years ago

I absolutely do not understand what you are trying to say with this comment. Can you make your point more directly? My point is: hard drives and mail spools get handed over to the opposition in civil cases all the time. It's called "discovery".

elai• 15 years ago

In discovery, if the hard drive is encrypted and you forgot the passphrase, what happens?

tptacek9• 15 years ago

If you genuinely forgot it, after having long encrypted it in good faith with the intent of simply accessing it more securely? Nothing.

Otherwise: somewhat uncertain.

You probably can't be compelled to testify against yourself, but you definitely can't deliberately use encryption as a defense against discovery anymore than you can destroy evidence by degaussing your hard drive.

voxmatt• 15 years ago

This was exactly what I dove into the comments to say. You're 100% correct; this is routine discovery.

Look, do I like the merits of Sony's arguments? Absolutely not. Do I hope this kid wins? Yes. But there's nothing that nuts going on so far; save your anger for the verdict.

As an aside, who ever is advising Sony is an idiot. The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.

jrockway3• 15 years ago

Not sure I agree. Who is not buying a PS3 because of this? Who has stopped buying games? Nearly nobody, and the lawyers are on salary anyway.

The risk that Sony takes by allowing "hacking" to happen is that nobody will write software for their platform, and then the platform dies. Content-creating megacorps want uber-strict DRM, or they take their ball and go home (or to Microsoft). It's stupid of them, but Sony doesn't want to go to a meeting with a content house and say, "anyone can pirate your stuff if they want to".

Hence all the DRM schemes that don't work. They are not to prevent you from copying things, they are so Sony (or Amazon, or Hulu, or...) can tell the content creators "oh yeah, your shit will be secure". It's not, but they made the bean counters happy.

So really, this seems like the right action for a psychopathic corporation to take. Maximize BS and maximize profits.

It's a shame someone with a clue is caught in the middle.

CamperBob• 15 years ago

The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.

Sony shipped rootkits on audio CDs, and people still line up to give them money. I don't think a DMCA trial, or 100,000 of them, is going to matter to Sony's loyal customers.

jcr2• 15 years ago

http://www.wired.com/images_blogs/threatlevel/2011/02/google...

> Sony is also asking Judge Illston to order Google to surrender the IP addresses [.pdf] and other identifying information of those who have viewed or commented about the jailbreak video on Hotz’ private YouTube page. The game maker is also demanding that Twitter provide the identities of a host of hackers who first unveiled a limited version of the hack in December.

Do you think the above is "reasonable" per definition? In essence, anyone who stumbled across some page where the youtube video was embedded is now suspect. Anyone who made comments on twitter is now suspect. And if you slide down the slippery slope, all of us are now suspect for discussing it here on HN.

The above is excessive, and hence, unreasonable. The lawyers of the plaintiff intentionally asked for the moon, gift wrapped, and the judge agreed. The lawyers from Sony did their job correctly, as they are expected to ask for everything they possibly can to help their case. The judge, Susan Illston, failed to do her job. She was supposed to take the expected unreasonable requests from the lawyers, weigh their merit, and rule on a limited compromise to both enable discovery and protect the privacy of the people. The discovery process is not an excuse for excessive privacy invasion.

That's just the above issue of other parties.

As for the issue of searching the hard disk of George Hotz... --it's an interesting debacle. Discovery is very important but it comes down to where and how one draws the lines. Opinions of reasonable and unreasonable will vary.

tedunangst4• 15 years ago

The very next sentence after what you quoted is "A hearing on that is scheduled next month." That's in the future. Shouldn't you wait until after the hearing to say the judge "failed"?

squeezingswirls• 15 years ago

What a f* initiative from The Master of Rootkits Company.

Never ever again I'm going to purchase a Sony product.

jrockway3• 15 years ago

Not much of a compromise. Who wants a computer that can't run Linux, an MP3 player that only plays ATRAC, and a digital camera that can't take SD cards?

Sony is an evil company, and their products don't make up for it.

danudey• 15 years ago

Never attribute to malice that which can be adequately explained by stupidity.

shii• 15 years ago

Streisand effect[1] for the win.

Top comments on both this wired article and other linked ones has the code[2].

This judge is sorely out of touch with what's going on.

Also, "Sony is also asking Judge Illston to order Google to surrender the IP addresses [.pdf] and other identifying information of those who have viewed or commented about the jailbreak video on Hotz’ private YouTube page. The game maker is also demanding that Twitter provide the identities of a host of hackers who first unveiled a limited version of the hack in December." ...take from that what you will.

Searching[3] for the strings in question[4] yields 11k+ results.

[1] http://en.wikipedia.org/wiki/Streisand_effect

[2] http://www.wired.com/threatlevel/2011/02/playstation3-hacker...

[3] http://www.google.com/search?&q=erk:+C0+CE+FE+84+C2+27+F...

[4]:

erk: C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B

riv: 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D

pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19

R: 80 6E 07 8F A1 52 97 90 CE 1A AE 02 BA DD 6F AA A6 AF 74 17

n: E1 3A 7E BC 3A CC EB 1C B5 6C C8 60 FC AB DB 6A 04 8C 55 E1

K: BA 90 55 91 68 61 B9 77 ED CB ED 92 00 50 92 F6 6C 7A 3D 8D

Da: C5 B2 BF A1 A4 13 DD 16 F2 6D 31 C0 F2 ED 47 20 DC FB 06 70

jjcm• 15 years ago

I'm getting 28,900 results for the erk string: http://www.google.com/search?q=C0+CE+FE+84+C2+27+F7+5B+D0+7A...

jrockway3• 15 years ago

Maybe they should just ask Google for a list of everyone that hasn't seen that string...

sp332• 15 years ago

Even Kevin Butler, VP at PlayStation, retweeted the PS3 dongle key: http://twitpic.com/3xwe6h

Edit: OK, he's not really a VP. He's a character played by Jerry Lambert. The advertising company Deutsch/LA controls his Twitter feed. And check out the titles he gives himself in their ads: http://www.youtube.com/watch?v=WgwNyb80L0s&playnext=1...

eli2• 15 years ago

Fake VP. It's a persona from their ad campaign.

ptomato• 15 years ago

Fake VP, I should note. He's an advertising construct.

eli2• 15 years ago

Not sure what your point is. Anyone who could possibly find the key useful certainly has it by now.

Sony isn't trying to put the genie back in the bottle, they're trying to punish the kid who uncorked it.

kleiba• 15 years ago

Ah kids, gather here by the fire with me, and let me tell you a story of the olden times when you bought a car and could do whatever the hell you wanted with it. Because when you bought the car, you made it your property. You could modify it in whatever way you want. Sure, there were rules if you wanted to take it our for a ride, because others could get hurt. But if you were doing it just for the fun at home, no-one could stop you. You could even go over to your neighbor's house and help him change his car, too. Those were the times.

jonhohle• 15 years ago

Not only that, but you could run a business where all you did was modify cars for other people!

mmb• 15 years ago

Sounds like a use case for a TrueCrypt hidden volume.

pig• 15 years ago

52 comments. tptacek has made 48 of them.

daimyoyo• 15 years ago

And if he encrypts the data behind true crypt and refuses to give the key, what then? Will he be thrown in jail?

PlayStation 3 Hacker Must Allow Sony to Inspect His Hard Drive

Related Stories