Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sony says it can fix private key crack

thinq.co.uk

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Sony says it can fix private key crack

#11

Post by mmastrac »

Here's the problem (picture supplied by first result after googling for ps3 nand motherboard):

http://s200.photobucket.com/albums/aa138/ejsid/infectus%20ps...

The keys are hard-coded in hardware and the content in question lives on a TSOP NAND device on the motherboard. No matter what Sony does, they can't prevent you from flashing your own code, signed with the old keys, to that onboard NAND. Whether you de-solder it and socket it, or use some other sort of hardware device, Sony is screwed for old hardware.

Re: Sony says it can fix private key crack

#12

Post by glhaynes »

alecco wrote: post #7

If I can resurrect my PS3 and run *nix natively on it with graphics and full blown access to the co-processors I'd buy a second one for gaming. The main problem is the memory limitations of 256MB+256MB but with careful configuration it can be just OK. I wouldn't be surprised if this ends up making the PS3 ubiquitous leaving all the other consoles behind. Even in spite of the poor higher management coming from old med…

What makes you think it would make the PS3 ubiquitous? What evidence is there that more than a tiny set of people want to run non-built-in services on their PS3s? What would they do with them? I'm a geek and I certainly don't need another box running 24/7...

Re: Sony says it can fix private key crack

#15

Post by raganwald »

"We will fix the issues through network updates, but because this is a security issue, we are not able to provide you with any more details,” [Sony] said.

Wrong on two counts. First, Sony can't really "fix" the problem, merely patch over the current situation until their "fix" is compromised. At best they can hold freedom off for a little while longer.

Second, there is no security through obscurity, and failing to explain exactly how they will "fix" the compromised hardware is vainglorious. If a fix does exist, it will be so resistant to exploit that an explanation won't change anything.

It's conceivable for them to have an impervious fix (without conceiving of the fix itself), however experience has shown that the strongest schemes are the ones that have been exposed to the most eyeballs.

Re: Sony says it can fix private key crack

#16

Post by sitmack »

raganwald wrote: post #15

"We will fix the issues through network updates, but because this is a security issue, we are not able to provide you with any more details,” [Sony] said. Wrong on two counts. First, Sony can't really "fix" the problem, merely patch over the current situation until their "fix" is compromised. At best they can hold freedom off for a little while longer. Second, there is no security through obscurity, and failing to ex…

Thank you for the word vainglorious.

Re: Sony says it can fix private key crack

#17

Post by alecco »

glhaynes wrote: post #12
alecco wrote: post #7

If I can resurrect my PS3 and run *nix natively on it with graphics and full blown access to the co-processors I'd buy a second one for gaming. The main problem is the memory limitations of 256MB+256MB but with careful configuration it can be just OK. I wouldn't be surprised if this ends up making the PS3 ubiquitous leaving all the other consoles behind. Even in spite of the poor higher management coming from old med…

What makes you think it would make the PS3 ubiquitous? What evidence is there that more than a tiny set of people want to run non-built-in services on their PS3s? What would they do with them? I'm a geek and I certainly don't need another box running 24/7...

Different paragraph, different concept. A cracked and affordable PS3 with HD (Blu-ray) media player and trivially changeable HDD can be very attractive. And running a *nix home server on it could be a definite plus for many people, anyway.

Re: Sony says it can fix private key crack

#18

Post by tedunangst »

raganwald wrote: post #15

"We will fix the issues through network updates, but because this is a security issue, we are not able to provide you with any more details,” [Sony] said. Wrong on two counts. First, Sony can't really "fix" the problem, merely patch over the current situation until their "fix" is compromised. At best they can hold freedom off for a little while longer. Second, there is no security through obscurity, and failing to ex…

I think it's conceivable for a fix to exist such that 1. knowledge of its inner workings could be used to prevent it from being applied. 2. it will take weeks to reverse, by which point most systems will be upgraded. 3. once applied, the trick used to prevent it from being applied cannot be used to remove it.

trivial example: the fix creates a new file "supersecurity" only if the file doesn't exist. by creating an empty with that name, you can upgrade but dodge the fix. but once you've got the supersecurity, you can't delete that file.

Re: Sony says it can fix private key crack

#19

Post by raganwald »

tedunangst wrote: post #18
raganwald wrote: post #15

"We will fix the issues through network updates, but because this is a security issue, we are not able to provide you with any more details,” [Sony] said. Wrong on two counts. First, Sony can't really "fix" the problem, merely patch over the current situation until their "fix" is compromised. At best they can hold freedom off for a little while longer. Second, there is no security through obscurity, and failing to ex…

I think it's conceivable for a fix to exist such that 1. knowledge of its inner workings could be used to prevent it from being applied. 2. it will take weeks to reverse, by which point most systems will be upgraded. 3. once applied, the trick used to prevent it from being applied cannot be used to remove it. trivial example: the fix creates a new file "supersecurity" only if the file doesn't exist. by creating an em…

I agree with your first paragraph: It is possible for there to be a "fix" where knowledge of its inner workings would expose an easy way to prevent the fix from being applied.

Of course, what I said would still apply: I am less confident that such a thing would be resistant to compromise using other methods. So, if they have this supersecurity patch to put out, after it has been installed they should be eager to tell the world how the systems are now secured.

Re: Sony says it can fix private key crack

#20

Post by wmf »

mmastrac wrote: post #11

Here's the problem (picture supplied by first result after googling for ps3 nand motherboard): http://s200.photobucket.com/albums/aa138/ejsid/infectus%20ps... The keys are hard-coded in hardware and the content in question lives on a TSOP NAND device on the motherboard. No matter what Sony does, they can't prevent you from flashing your own code, signed with the old keys, to that onboard NAND. Whether you de-solder i…

If you jailbreak your PS3 before they push out the security update then you've won. But that probably isn't very many people at this point. If the security update is non-downgradable and invulnerable to the currently-known exploits then Sony will be back in control of most PS3s.
Post reply on HN