Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking the console: a brief history of video game security

sergioprado.blog

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Breaking the console: a brief history of video game security

#21

Post by RajT88 »

gjsman-1000 wrote: post #16
RajT88 wrote: post #15

Earlier quoted context omitted.

> Microsoft invented a pseudo-walled garden that has become a technical dead end If you're referring to Windows, this is not very walled at all. You barely need a computer to write and release windows apps, let alone money. Office, perhaps? Or a variety of other products.

Windows is an open platform for developers... if you ignore all of the security checks and Windows Defender and the stagnant platform which is about 2 decades behind everyone else, across the board, in terms of native tooling (e.g. which UI framework should I use and is it good?). However, Windows also has many, many, walled garden things bolted onto it. You aren't distributing your own drivers without Microsoft's ap…

> You aren't distributing your own drivers without Microsoft's approval.

Only kernel drivers.

> You aren't connecting to Active Directory without Microsoft's blessing.

I think you're talking about EntraID. That is true enough. You can just spin up Windows Server and create a domain controller, no problem. You don't need Microsoft for domain services, though - you can use other domain controller types. (You don't get GPO and other things - that's not a 'walled garden' thing, that's a feature set which other systems don't have)

> In that respect, Windows is only open from an end user perspective. In all other respects, it is closed, and it is closed tightly.

Not so tight as you seem to think. And anyways, I was specifically referring to building windows apps - which you did not disagree with. You absolutely can pull down various free tools, build an app, package it up as a .zip or .msi and distribute it from a variety of places. The Windows app store is a walled garden, but you don't have to use it.

Re: Breaking the console: a brief history of video game security

#22

Post by mywittyname »

gjsman-1000 wrote: post #14
wise0wl wrote: post #9

So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He…

I find it interesting that all the way back in 1985, in Atari vs NES, we had proof that consumers preferred walled gardens. The walled garden exploded from a completely dead market, while the already-existing open system killed itself. Apple proceeded to make a killing of their own on this reality, Microsoft invented a pseudo-walled garden that has become a technical dead end, while FOSS communities are still in deni…

I think the takeaway is consumers want to trust the products they are buying are as advertised.

Re: Breaking the console: a brief history of video game security

#23

Post by wil421 »

cheeseomlit wrote: post #10

Back in the day I remember my brother got his hands on a PS1 modchip, but it didn't require any soldering- you just plugged it into the "parallel I/O" port in back of the console and it let us run games on burned CDs. We really got our moneys worth at blockbuster after that

My buddies brother did the same thing with a PS1 and maybe sent his Xbox off somewhere to get it modded. However he was an asshole hermit and wouldn’t let us play or burn any games.

My dad would never cheat or do anything illegal even though he was an EE who could’ve done the mod himself. Today he might do it but there was a strict no stealing policy even for digital things. Like the time he freaked out because I was grabbing stuff from The Scene and wrote down a bunch of terms to research, he saw the word Warez and freaked out.

Re: Breaking the console: a brief history of video game security

#24

Post by sprado »

Pannoniae wrote: post #18
wise0wl wrote: post #9

So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He…

Also another incorrect factoid: "The original Xbox (2001) was built on familiar PC hardware (Pentium III derivative, Intel GPU, standard hard drive)" (it was an NV GPU)

Good catch. Indeed the GPU was Nvidia’s NV2A, not an Intel GPU. I will correct that in the article. Thanks for pointing it out.

Re: Breaking the console: a brief history of video game security

#25

Post by Obscurity4340 »

wil421 wrote: post #23
cheeseomlit wrote: post #10

Back in the day I remember my brother got his hands on a PS1 modchip, but it didn't require any soldering- you just plugged it into the "parallel I/O" port in back of the console and it let us run games on burned CDs. We really got our moneys worth at blockbuster after that

My buddies brother did the same thing with a PS1 and maybe sent his Xbox off somewhere to get it modded. However he was an asshole hermit and wouldn’t let us play or burn any games. My dad would never cheat or do anything illegal even though he was an EE who could’ve done the mod himself. Today he might do it but there was a strict no stealing policy even for digital things. Like the time he freaked out because I was…

Bewarez warez

Re: Breaking the console: a brief history of video game security

#26

Post by favorited »

The best part of the 10NES design, as a consumer, was that it was fail-safe, rather than fail-secure. The console defaulted to booting. So, if your NES started having the infamous boot-reset flashing light, all you had to do was unscrew the NES enclosure and clip the power pin on the 10NES chip. And these were huge pins, it didn't require any subtlety. You could do it with a nail clipper.

Re: Breaking the console: a brief history of video game security

#28

Post by landr0id »

sprado wrote: post #12
wise0wl wrote: post #9

So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He…

Thanks for the comment. No, it is not AI generated. It was based on my research. I think there is a mix-up here between Atari home consoles and Atari home computers. In that section I was talking about early console platforms such as the Atari 2600, where the cartridge interface itself had no lockout/authentication mechanism comparable to what Nintendo later did with the 10NES. That is why third-party cartridges coul…

Hi, quick note on "For modern Xbox platforms, public 2024 work exposed SystemOS kernel exploitation on both Xbox One and Xbox Series"

I'm a former Xbox hacker, then former Microsoft employee, and (long after) leaving Microsoft helped with the Collateral Damage post-exploitation payload.

The design of the Xbox One security predates me, but Microsoft has always known that SystemOS would be a weak link that would almost guaranteed to be compromised and shoved most of their attack surface that can be trivially attacked in there. The system shell, 3rd-party apps, guide, etc. all run in SystemOS.

The key things they focused on though were:

1. Extremely strong defense-in-depth

2. Making full or partial exploitation not economical

3rd party apps and the web browser were seen as being obviously untrusted _and_ needed JIT because they'd mostly be based on .NET or the JS VM. But practically speaking there should be nothing interesting in that VM: its compromise shouldn't enable piracy/cheating and ideally shouldn't leak game plaintext.

What some others found though was that for some reason plaintext was actually visible to SystemOS, but didn't enable piracy on console. You can take those games though and run them on PC using XWine1: https://github.com/xwine1

Technically speaking there's no reason why Collateral Damage couldn't have happened waayyyyy earlier in the Xbox One's lifecycle except for motivation. Even still you could probably take some Hyper-V N-day and compromise HostOS through.

Over there years there have been other "exploits" too: some folks have managed to tamper with gamesaves via cloud connected storage and other shenanigans, XSS in the system shell (some of these apps are JS), etc., but most of this was relatively benign and easily patchable. And there has been a very, very small group of people with similar but less capable exploits to Collat.

Collat allowed compromise of plaintext.

Bliss breaks everything :)

Post reply on HN