Voltage glitching attacks are pretty brutal to defend against because you're essentially fighting physics, not software. You can write perfect code and still get bypassed by someone manipulating the electrical signals at the right microsecond..
Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
271–280 of 311 posts
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#272Earlier quoted context omitted.
DCLS actually makes sense for this scenario as the fault tolerance gained from having three processors isn't needed here. The system can halt when there's a mismatch, it doesn't have to perform a vote and continue running if 2 of 3 are getting the same result. Also I just thought of this but it should be possible to design a chip where the second processor runs a couple cycles behind the first one, with all the input…
You could glitch both processors?
I think the idea is they both hang off the same voltage rail.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#273I really wish I could root my series x -- especially in this age of RAM and GPU scarcity.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#274Earlier quoted context omitted.
[flagged]
People should use their smarts and common sense to qualify statements. LLMs need a page of context, explanation and disclaimers so they maybe understand the meaning and intention. > calling a safe uncrackable because nobody showed up with the right tools The tools used for the hack (like voltage glitching) were there since before the first Xbox but nobody had the skills to apply them in a way that defeated the protec…
[flagged]
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#275Earlier quoted context omitted.
I have my doubts. I suspect that Nvidia have made mistakes. Anyway, situations like the one you describe are one to be solved by legislation requiring certain devices be sold as open devices that put power in the hands of the owner.
my nintendo switch is "rootable" by shorting two pins in the controller interface, with a previously set up SD card inserted with the homebrew bootloader. My PS3 and PS4 were both jailbroken/rooted. I don't remember the ps3 routine, but the PS4 was loading the "system -> help" page while connected to a ESP32 wifi AP running a simple web server that replied to requests with the jailbreak for PS4. I give it about a yea…
The shorting two pins is a heavy oversimplification of what happened.
The two pins were installed by design from Nintendo to activate the Tegra RCM mode. RCM mode meanwhile has a USB buffer overflow which is the real bug.
In modern NVIDIA chips, this RCM mode no longer exists. The new recovery modes meanwhile are running across multiple physically separate CPUs verifying each other (glitch one, the other notices), all running formally verified firmware written in SPARK (the thing you use for nuclear reactors and avionics).
As for the OS itself, according to a maintainer who rewrote the kernel twice for open source, it has zero bugs. None. The microkernel is tiny, has no drivers, and almost no attack surface. This is born out by WebKit exploits being a dime a dozen on Switch, but all of them are useless.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#276Earlier quoted context omitted.
The other major incentive for hacking the console Microsoft removed was for the first time on a modern mainstream home console to allow side loading of homebrew code/emulators etc. The console supported a developer mode that allowed side loading of third party applications, so folks could get emulators and other traditionally "banned" content on the console through an officially supported route. There's a great prese…
"side loading", I know this term is the one used but I think should be pushed back against with just using the standard "installing"/"install". It makes the control point clearer and (should be) unsettling when you can't "install" software on hardware you own.
I think sideloading is a fine term when it is a consumption device. No one buys a video game console expecting to be able to install anything they want. As a matter of fact, there is an argument that restricting what can be installed is a feature. By maintaining control of the hardware, they can eliminate entire classes of problems that someone might run into. That is to say, when you let your kid play on the switch, you don't want to have to troubleshoot how they got the thing borked from installing malware.
That said, I do think words matter and I always point out that the reason these systems are locked down is because of Digital Restrictions Management. I also refuse to buy anything from Sony because they changed their mind about letting me install linux on the PS3.
I just think side loading is good way to describe installing custom software on a non-general purpose computer, and that not every computer needs to be general purpose. It's significantly better than the previous terms of hacking, cheating, stealing, and voiding your warranty.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#277I would imagine jail breaking modern PlayStations and Xboxes would not be as interesting as the PS3 or Xbox 360. The modern generations are too close to PCs. I miss the time when console makers were also making interesting CPUs and, sometimes, GPUs.
BTW, what would be the specs for a Xbox 360? I remember the PS3 was a rather limited Linux workstation because it lacked RAM (and tge hypervisor limited access to the GPU - a limitation gone when jailbroken), but I haven’t read much about the 360 and its own weird PowerPC.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#278Earlier quoted context omitted.
>and remains the least popular major console (with an abysmally tiny market presence outside of the US). TF are you on about? The xbox one of 2013(competitor of the PS4 who got hacked long before) had a ~46% market share in the US and ~35% globally. Hardly insignificant. And any Microsoft Product, even those with much lower market share, attracts significant attention from hackers since it's worth a lot in street-cre…
Can you provide a source for those statistics? They don’t match up with any numbers I’ve seen, and in fact look ludicrously unrealistic.
>Can you provide a source for those statistics?
Google Gemini
> They don’t match up with any numbers I’ve seen, and in fact look ludicrously unrealistic.
Well can you post your numbers and sources, or are we supposed to read your mind?
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#279Earlier quoted context omitted.
This is what killed Linux support on PS as well, Sony was disappointed with what was being done with PS2Linux, instead of indie titles. Hence why PS3 Other OS no longer did hardware acceleration.
The PS3 was incredible value dollar-to-flop, given that it was sold at a loss. This resulted in universities and other research institutes buying them en masse to create supercomputer clusters. Naturally buying thousands of consoles but not a single game puts sony in a difficult position. Although I think it's sad the hardware got locked down in later revisions, I fully understand why they did it.
> Although I think it's sad the hardware got locked down in later revisions, I fully understand why they did it.
The PS3 was coincidentally locked down after it was jail broken (broken in Jan, otheros patched out in Mar.
Re: Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'
#280Earlier quoted context omitted.
my nintendo switch is "rootable" by shorting two pins in the controller interface, with a previously set up SD card inserted with the homebrew bootloader. My PS3 and PS4 were both jailbroken/rooted. I don't remember the ps3 routine, but the PS4 was loading the "system -> help" page while connected to a ESP32 wifi AP running a simple web server that replied to requests with the jailbreak for PS4. I give it about a yea…
The shorting two pins is a heavy oversimplification of what happened. The two pins were installed by design from Nintendo to activate the Tegra RCM mode. RCM mode meanwhile has a USB buffer overflow which is the real bug. In modern NVIDIA chips, this RCM mode no longer exists. The new recovery modes meanwhile are running across multiple physically separate CPUs verifying each other (glitch one, the other notices), al…
> In modern NVIDIA chips, this RCM mode no longer exists. The new recovery modes meanwhile are running across multiple physically separate CPUs verifying each other (glitch one, the other notices), all running formally verified firmware written in SPARK (the thing you use for nuclear reactors and avionics).
I guess that, when you absolutely want zero surprises, Ada is the language of choice.