Geohot Chimes In

http://geohotgotsued.blogspot.com/2011/04/recent-news.html

by shawndumas • 15 years ago

247 95 15 years ago

geohotgotsued.blogspot.com

chopsueyar2• 15 years ago

What about the money from the legal defense fund? What happened there?

dfischer• 15 years ago

He gave like $10k to the EFF, no?

daimyoyo2• 15 years ago

He did.

http://www.ultrasn0w.ca/2011/04/geohot-donates-10000-to-eff....

giu• 15 years ago

Yes he did: http://geohotgotsued.blogspot.com/2011/04/10000-to-eff.html (Screenshot of the receipt: http://3.bp.blogspot.com/-qsLYAGnuRfM/Takp2Re-dgI/AAAAAAAAAe...)

chopsueyar2• 15 years ago

Yeah, I missed that one.

Definitely enough to pay for one lawyer for several minutes against Sony.

praptak• 15 years ago

This is interesting: "Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can't trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server?"

I wonder if he's purely speculating or maybe knows something more. It's also good to see he can at least still talk about Sony security in general (or can he?)

JoachimSchipper3• 15 years ago

See http://news.ycombinator.com/item?id=2480141 - it has been suggested on HN that Sony can't keep hacked Playstations out of the dev channel. It's likely that GeoHotz is much more knowledgeable/better connected (on this topic, at least).

shareme• 15 years ago

its not speculation, they passed CC numbers in the clear over SSL instead of hashing them..

nsfmc• 15 years ago

"in the clear over ssl instead of hashing them"? am i missing something here? is ssl insecure? is there some way to charge a credit card that doesn't actually involve sending the number to anybody?

Indyan• 15 years ago

Wasn't this debunked?

pilif3• 15 years ago

And how would you use that hashed CC number on the server? Unhashing (impossible)? Send the hash to the CC company (good luck)?

Do you mean they should have pre-encrypted the CC number before encrypting it again in the standard SSL transaction?

Would that have helped? Because if the PS3 knows how to encrypt and you own the server, decrypting is as trivial as just looking at the plain text

For people who don't own the server and are listening in SSL is enough and for people with access to the server neither SSL nor any other encryption is enough.

They have done a lot of things wrongly, but this IMHO is not one of them.

_ea1k• 15 years ago

Who sends hashes of credit card numbers instead of the #s themselves? And how is this passed through to the processor?

I've not seen such a protocol for sending CC#s from the browser before.

marshray12• 15 years ago

"In the clear" and "over SSL" are contradictory in this context.

shawndumas2• 15 years ago

You know; this guy makes some good points:

"This arrogance undermines a basic security principle, never trust the client. [...] Notice it's only PSN that gave away all your personal data, not Xbox Live when the 360 was hacked, not iTunes when the iPhone was jailbroken, and not GMail when Android was rooted. Because other companies aren't crazy."

"[...] To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes."

_delirium• 15 years ago

The pipe analogy is interesting, because I've heard a related analogy in the other direction. I can't recall where I read it, but I think it was some textfile from the 80s, justifying breaking into large corporate computer systems to explore them as similar to breaking into and exploring steam tunnels, and guided by a similar ethos (e.g. don't vandalize them while exploring).

pyre2• 15 years ago

Exploring steam tunnels isn't "messing with pipes." To be "messing with pipes" you would have to be doing things to the pipes in those steam tunnels.

artmageddon2• 15 years ago

I thought part of geohot's settlement with Sony was that he wasn't allowed to discuss what happened? Maybe that was just with his case and not with the latest incident. Regardless, I like his attitude, and hope he continues honing his hacking skills. As he points out, at least they used a very strong XKCD style randomization algorithm.

It's a real shame that Sony alienates their customers with these kinds of acts while building a flimsy infrastructure for gaming. I'm one of those people who bought the PS3 just for OtherOS(and thankfully never got the removal patch) and honestly, given the lackluster performance it has and this move, I'm highly tempted to just sell it. The rootkit debacle of several years ago still leaves a bad taste in my mouth.

Today's Penny Arcade covers it quite nicely: http://www.penny-arcade.com/comic/2011/4/29/

veyron• 15 years ago

the scope of the gag order was limited to info relevant to the original case, not this new incident.

artmageddon2• 15 years ago

Thought so - thanks!

thomson• 15 years ago

On a pedantic note, is there a reason why large corporations 'regret' mistakes rather than apologize for them? Is it just so they don't want to go on the record as being wrong?

Sony's statement for reference: http://blog.us.playstation.com/2011/04/26/update-on-playstat...

iy56• 15 years ago

Their lawyers tell them that an apology is an admission of fault.

eli3• 15 years ago

Maybe true, but I don't think that's the real reason. I think it has a lot more to do with ego and cowardice. (It perhaps also belies a shoot-the-messenger mentality that exists within many major corporations.)

On The Media did a piece a few months ago about how the 1982 Tylenol recall is pretty much the gold standard for corporate disaster PR: identify the problem, apologize, and explain what you're doing to prevent it in the future. It's not hard, but it takes guts. Even J&J itself didn't meet that standard in later recalls. http://www.onthemedia.org/transcripts/2010/02/12/01

yuvadam• 15 years ago

Gotta love the subtle xkcd reference at the end.

lloeki• 15 years ago

It's both a XKCD reference and a reference to the PS3 keys, which were generated at some point using a constant instead of a RNG.

kristofferR• 15 years ago

It wasn't just a xkcd reference I think, I think it really was a reference from the fail0verflow presentation where the security of the PS3 was totally dismantled (the device itself, not PSN).

http://www.youtube.com/watch?v=btDiX319P4w @ around 8 minutes in

mdaniel• 15 years ago

FWIW, one can link directly to a time in a YouTube video using #t=8m tacked on the URL.

More information: http://www.google.com/support/youtube/bin/answer.py?hl=en...

woadwarrior01• 15 years ago

The first thing that came to my mind when i saw it was this dilbert comic. http://dilbert.com/strips/comic/2001-10-25/

misterbwong• 15 years ago

Funny. I have this exact comic printed and pinned to my office wall. For those of you that haven't seen it: http://xkcd.com/221/

daimyoyo2• 15 years ago

The word "hacker" has been corrupted by the media to the point it's nearly derogatory. We need a new term for what we do. Something like "techsmith." Any other ideas?

shawndumas2• 15 years ago

How 'bout "hacker"?

beaumartinez2• 15 years ago

Coder? Programmer?

Although I agree that "hacker" has a new meaning (and has for a long time), much like how the LGBT community adopts otherwise derogatory terms, I don't think we should stop using "hacker" because of outside influences; the actual meaning implied (coder or script kiddie) is often obvious thanks to the context it gets used in (CNN using "hacker" in a news title is different to when Joel Spolsky uses it, for example).

crocowhile2• 15 years ago

I think the proper word already exists since ages and it's "polymath" http://en.wikipedia.org/wiki/Polymath

beaumartinez2• 15 years ago

| In less formal terms, a polymath (or polymathic person) may simply be someone who is very knowledgeable.

It's not specific to the coding field.

JoachimSchipper3• 15 years ago

No, you can e.g. spend 12 hours a day hacking some OS kernel and credibly call yourself a hacker. Being a polymath requires a much wider background.

wladimir• 15 years ago

"hacker" is fine. Yes, it's corrupted by the media, but then again, which word hasn't been at one time or another? Name one profession or job title that is always portrayed as positive in the news. Why care at all?

jjguy• 15 years ago

I have a colleague who uses the term 'digital thaumaturge.'

    Thaumaturgy is the capability of a saint
    or magician to work miracles. A practitioner 
    of thaumaturgy is a thaumaturge or miracle worker.

I like the spirit, but it doesn't quite have the cachet of 'hacker.'

Jun82• 15 years ago

This is not a recent phenomenon. Even in the 80s it had a negative connotation, fueled mostly, I think, by Sherry Turkle's The Second Self (I wonder how many young hackers are aware of that infamous book) where the hacker culture was shown to be macho, masochistic, and closed, see Sex/Machine (http://books.google.com/books?id=vo5b6XA2F30C&lpg=PA369&...) for a summary.

tlrobinson• 15 years ago

Meh, I'd rather just use "hacker", media be damned.

Maybe my perspective is warped, but I feel like the original meaning of "hacker" is gaining popularity lately. "Hackathons" have made their way into the media thanks to Facebook and Zuckerberg. And of course PG's writing and "Hacker News" are somewhat well known in the tech and startup circles.

Still it's far from the mainstream meaning. In some ways it's cool that it's not, it's almost like a secret handshake. If you know what I mean when I say "hacker" I have a little extra bit of respect for you.

marshray12• 15 years ago

Personally, I kind of like the ambiguity of the term a little bit. It reminds us that things are not always as simple as they seem, that we can't cleanly divide our world into 'friends' and 'adversaries', or place our systems neatly into 'trusted' and 'untrusted' boxes.

burgerbrain2• 15 years ago

Why should we change? They're the ones that suck.

regularfry• 15 years ago

Because sitting below high tide and yelling at the sea is a good way to get your feet wet.

pdenya• 15 years ago

Strange how many of the commenters on the article think the Sony was hacked from a rooted PS3. There's no evidence but I'll assume this was done from a PC until I see some reason why doing it from a PS3 would make it easier (in any way).

allwein• 15 years ago

Not too strange when you consider that most people don't understand networking and the internet.

From the point of view of some people: "It's the Playstation Network, obviously you have to use a Playstation to get on the Playstation Network. You can't use a computer, they aren't compatible!"

I can't come up with a direct analogy for a similar lack of comprehension, but I keep thinking of the apocryphal stories of people that lock themselves out of their cars with the windows down, and freak out because they don't think of reaching through the window to unlock it manually.

StavrosK• 15 years ago

Apart from the fact that it's already got all the hardware and software to communicate with the servers, and is thus a much better conduit for an exploit, you mean?

marshray12• 15 years ago

Well the protocol turns out to look a lot like HTTP talking to Apache over SSL. This is no surprise, it's easy to develop with and is the most likely to make through proxies and firewalls outbound.

Nevertheless, Sony seemed to assume that it guaranteed they would only receive valid messages from actual hardware they controlled. This is not a security feature of SSL/TLS which depends on the client doing its part to prevent the absence of a man-in-the-middle.

When the client was hacked, many of their assumptions were violated. We hear rumors of hackers "mapping" their systems onto some internal development networks. What this means exactly I don't know.

But if Sony's primary network defenses were the Maginot line, their dev network probably looked a lot like Belgium.

dfox2• 15 years ago

I agree with you that it was probably done from PC (or well just about anything including PS3, but not because it was required to use PS3), but on the other hand it seems plausible that information extracted from (probably rooted) PS3 was significant help.

Jun82• 15 years ago

This is an excellent piece, my esteem for geohot got even higher. It vilifies Sony (rightly so) but also is balanced. The plumber analogy is spot on and funny:

"To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes. (Note that I do not endorse water piracy)"

pushingbits• 15 years ago

Good Christ, what comments!

"You're the perfect example of someone who can't even grasp the simple concept of how YOUR actions have consequences for OTHER people. If Sony wanted to remove Other OS that's up to them, people like you and George should have just dealt with that. Instead like children you have this sense of entitlement and so the PS3 was hacked and root keys published. No thought was given to how this would be used by other people, all that crossed your tiny little minds was how this affected YOU."

http://geohotgotsued.blogspot.com/2011/04/recent-news.html?s...

You see people become inoculated by all sorts of kooky ideas (usually offering salvation or universal insight), but to see people get their mind twisted around some faceless video game company... the mind boggles...

marshray12• 15 years ago

I think the part about "all that crossed your tiny little minds was how this affected YOU" is the most telling.

pyre2• 15 years ago

Well, their minds must seem tiny to someone with such a big head. ;-)

huhtenberg• 15 years ago

There is a good chance that this particular comment came directly from Sony as a part of some sort of misdirection and damage control campaign. It does not read like something a teenager would write, it sounds more like a mom lecturing her adolescent, but I can't see parents taking time to comment in GeoHot's blog. So given the context it looks artificial.

yardie• 15 years ago

If you think that's bad you should check out the Kotaku comments or the PSN forums. Some of them were promising bodily harm geohotz. I know people get worked up over cheaters but some of the comments were just right off the rails crazy. Seems to be a correlation the more time you spend playing the system the more you hate people that screw around with it.

I know people like to make fun of Mac and Android fans but some playstation fans took it way too personal.

chrischen• 15 years ago

A lot of PS3 users are NOT teenagers... I'm guessing PS3's user base will tend be slightly higher in age than Xbox owners, given that people who buy PS3s might buy them for the Blu-ray player as well to complement some home theater setup. Teenagers will most likely only have appeal for the gaming aspects of a console.

cheald2• 15 years ago

That was my immediate thought, as well. I'm willing to bet that a good number of those comments come from Sony shills trying to paint blame on external parties.

eli3• 15 years ago

I happen to disagree with the commenter, but it doesn't sound kooky to me. Aside from the fact that the connection between the root keys and the PSN hack is a bit tenuous, it seems like a reasonable point.

cheald2• 15 years ago

It's disingenuous because the problem isn't that the root keys were released, but that Sony was singlehandedly trusting the security of all their customer information to the assumption that the client would never be compromised. It's bad (and even negligent) design, and while, yes, the root keys being released might have been a component of the break-in, if the system had been designed with the proper security principles in mind, then it wouldn't have been an issue at all.

To use an analogy, Sony's system seems to have been designed like a a car that starts with a push button, no key required. It's assumed that you'll never be able to start it without being the owner because you would have to open the door first. George, being the owner of one of these vehicles, figured out how to get into it without using his keys (in case he ever locked himself out), then people took that information and used it to steal these cars, because once you can open the driver door, there are no additional security checks (like an ignition lock) to prevent the car from being stolen.

dhume• 15 years ago

but it doesn't sound kooky to me

The idea that expecting a product you buy to have the features it was described by the seller as having is a "sense of entitlement" seems pretty kooky to me. We can't have a functioning market like that.

leon_• 15 years ago

I don't understand those comments. Are those frustrated kids who can't play online anymore?

marshray12• 15 years ago

My understanding is that the "battlefield graphic murder" online simulator games are quite popular and they've had a problem with cheaters. Players have built up quite a rage against these cheaters and they look to Sony to fix it.

When hackers come along having the goal of running their own OS on the PS3 or even restoring the ability to run as a guest of the hypervisor (OtherOS), many players don't see the difference. Probably any research into the inner workings of a PS3 has the potential to benefit cheat development as well, but I for one do not accept the idea that we would turn off our inquisitive nature and forgo our home supercomputers so that others might gain a more fair killing field.

eli3• 15 years ago

I think you're exactly right.

But I think you need to respect the opposing viewpoint: that supporting OtherOS actually isn't worth the risk of new cheats for a lot of people. It is a game console after all.

awakeasleep• 15 years ago

"And let's talk about Sony's use of the word illegal. It is illegal, criminally so, to break into someone else's servers. But when the same word is used to refer to streaming a song from a non RIAA approved website, or to gasp playing a homebrew game on your PS3, respect for the word and those who say it is lost."

Who is this kid? He's like 20 years old and he talks like this? Geohot, you have my respect thats for sure.

Geohot Chimes In

Related Stories