Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “unpatchable” exploit that makes every current Nintendo Switch hackable

arstechnica.com

Post reply on HN
Print view View original

51–60 of 78 posts

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#51

Post by khedoros1 »

TheSoftwareGuy wrote: post #28
white-flame wrote: post #21

Earlier quoted context omitted.

I actually kind of liked the Gameboy approach. You needed to include a byte-for-byte image of the trademarked Nintendo logo in order for the boot ROM to run your cartridge. So there were no technical hurdles to running your code in it, but it just made it legally dangerous to distribute.

Holy shit. Is that why when you plugged in a cartridge a little weirdly, the nintendo logo would look all weird and the game wouldn't boot? it was a simultaneous legal protection and a harware protection? that was fucking genius!

The reason for the logo looking weird is that it did load the logo from the cartridge, and if the pins aren't reading perfectly, the data comes out wrong.

One of the first pieces of code in the startup code embedded in the GB's CPU reads the logo data, doubles it vertically and horizontally, and writes it out to the graphics tile memory. It scrolls down the screen, even if it's corrupted. Then it compares the logo with one built into the CPU and puts itself into an infinite loop if they mismatch.

So, yep. It's a combined data consistency check, and an attempt to use trademark to prevent unauthorized software.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#52

Post by letsgetphysITal »

jake_the_third wrote: post #44
ohthehugemanate wrote: post #22

Great news for people who want to use their purchased hardware for things Nintendo won't allow... Ie watching movies on the great screen, using generic hdmi adapters, playing games they already purchased for older console versions, or backing up savegames. Also great news for people who want to use their hardware for things that are actively against Nintendo's interests, like playing pirated games. All around, seems…

> backing up savegames This. I decided against buying a switch because I discovered that it prevents owners from backing up save files. I still don't plan to buy a switch until nintendo supports backing up save files officially like they do with cross-region compatibility. Having to loose 100s of hours of progress for what amounts to an arbitrary reason from a nintendo bigwig is not something I am willing to stomach.

Buy used. Nintendo won't get a cent, you'll pay less, and you won't be hit so hard in the wallet if your device fails after this mod.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#53

Post by asiekierka »

userbinator wrote: post #31

In the FAQ, Temkin says she has previously notified Nvidia and vendors like Nintendo about the existence of this exploit, providing what she considers an "adequate window [for Nvidia] to communicate with [its] downstream customers and to accomplish as much remediation as is possible for an unpatchable bootROM bug." Why would you even want to do that...? Money? Fame? As I've heard it said memorably, "would you tell so…

The exploit concerns most Tegra chips currently on the market, not just the Nintendo Switch. Those are used in, for example, cars. I believe that was part of the reason.

Not to mention, it's not patchable without a hardware revision, so sharing it privately before sharing it publicly, while strongly hinting at that it's not patchable without a hardware revision (which has been done) has the same effect in practice for those wanting to escape Nintendo's jail, while letting those who use the Tegra in security-sensitive environments prepare adequately.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#54

Post by asiekierka »

buildbot wrote: post #50

I wonder if this exploit would be workable on older Tegra systems, like for example a Tegra 3 int he digital cockpit on the Audi S3/R8/TT [1] or the K1 they are selling now [2] - it would be really great to be able to modify and customize those systems. [1] https://blogs.nvidia.com/blog/2016/04/25/virtual-cockpit/ [2] http://www.nvidia.com/object/visual-computing-module.html

Yes, as far as I know both the Tegra 3 and K1 are vulnerable.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#55

Post by fjsolwmv »

userbinator wrote: post #40
dsfyu404ed wrote: post #33

Earlier quoted context omitted.

>I still remember the good old days, when the hacking/cracking scene was entirely composed of people doing it for the freedom, with no do-gooding snitches to worry about... >10 years ago, if you shared a way to bypass a DRM scheme in the right places, it would live on for a long time. Now, it's more likely that some bastard is going to report it and get it patched in days to weeks. From the article it looks like some…

If she truly wanted to make it free, why secretly tell Nintendo and nVidia first? It's a cat-and-mouse game, and this mouse wants to tell the cat how to catch the other mice. In the old scene, you'd be branded a traitor for doing that.

You can't be a traitor to someone you have no allegiance to.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#56

Post by hvidgaard »

crankylinuxuser wrote: post #32
mindslight wrote: post #6

This doesn't sound like it itself "exploits" anything, just deflates Nintendo's attempted scheme to exploit their customers by booby trapping their hardware. If you rigged your car to destruct 30 minutes after it went out of cell service, sold it to an unsuspecting buyer, and then laughed when they got stuck in the desert, you'd be rightfully thrown in jail. But yet these companies keep attempting to pull the same sh…

Sounds kind of like a Tesla, now that you mention a car like that. They already will call and threaten you if you own a Tesla and mess around with it under the hood. https://www.slashgear.com/expect-an-irate-call-if-you-try-to... How much further will they go? Will they remotely disable it? Or perhaps, they'll send it into "Service Needed" mode and cripple it?

It ought to be the law that anything I can do, is fair game. If I fuckup something it shouldn't be under warranty, but only for the issues the tinkering causes. If I can connect to a port in the car I've paid for, and read something, it's not industrial espionage. That is just Tesla being lazy and trying to get security-by-obscurity, instead of a proper secure implementation.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#57

Post by samlittlewood »

white-flame wrote: post #21
mindslight wrote: post #6

This doesn't sound like it itself "exploits" anything, just deflates Nintendo's attempted scheme to exploit their customers by booby trapping their hardware. If you rigged your car to destruct 30 minutes after it went out of cell service, sold it to an unsuspecting buyer, and then laughed when they got stuck in the desert, you'd be rightfully thrown in jail. But yet these companies keep attempting to pull the same sh…

I actually kind of liked the Gameboy approach. You needed to include a byte-for-byte image of the trademarked Nintendo logo in order for the boot ROM to run your cartridge. So there were no technical hurdles to running your code in it, but it just made it legally dangerous to distribute.

Interestingly, this could be circumvented - the boot rom does the logo scroll using data from cart, THEN, in a separate loop checks it vs local copy. If you can make the cart read different data at each stage, you are golden!

IIRC Argonaut/Jez San had a POC of this using a very simple hardware bodge, intended as a potential way of publishing Eclipse (What became X) without a Nintendo licence.

Fortunately - Nintendo were interested in the 3D rendering, and that started the SuperFX/Starfox/ARC journey.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#59

Post by DanBC »

userbinator wrote: post #40
dsfyu404ed wrote: post #33

Earlier quoted context omitted.

>I still remember the good old days, when the hacking/cracking scene was entirely composed of people doing it for the freedom, with no do-gooding snitches to worry about... >10 years ago, if you shared a way to bypass a DRM scheme in the right places, it would live on for a long time. Now, it's more likely that some bastard is going to report it and get it patched in days to weeks. From the article it looks like some…

If she truly wanted to make it free, why secretly tell Nintendo and nVidia first? It's a cat-and-mouse game, and this mouse wants to tell the cat how to catch the other mice. In the old scene, you'd be branded a traitor for doing that.

For Nintendo to fix this they need to replace the IC.

They'd need to recall all the sold switches and replace the IC. And they need to specify a new IC for all future production, with some cost implication for new drawings and getting rid of stock.

Re: The “unpatchable” exploit that makes every current Nintendo Switch hackable

#60

Post by Jonnax »

userbinator wrote: post #40
dsfyu404ed wrote: post #33

Earlier quoted context omitted.

>I still remember the good old days, when the hacking/cracking scene was entirely composed of people doing it for the freedom, with no do-gooding snitches to worry about... >10 years ago, if you shared a way to bypass a DRM scheme in the right places, it would live on for a long time. Now, it's more likely that some bastard is going to report it and get it patched in days to weeks. From the article it looks like some…

If she truly wanted to make it free, why secretly tell Nintendo and nVidia first? It's a cat-and-mouse game, and this mouse wants to tell the cat how to catch the other mice. In the old scene, you'd be branded a traitor for doing that.

"Why disclose this at all? Why not hold onto this in order to increase the number of affected Switch consoles?

Unfortunately, this bug affects a significant number of Tegra devices beyond the Switch, and beyond even the X1 included in the Switch. I can tell you, it wasn't fun to find a bug with such a broad impact; it significantly complicated the ethics involved.

In the end, given the potential for a lot of bad to be done by any parties who independently discover these vulnerabilities, I thought it best to disclose this immediately and under terms that ensured that the vulnerability reached the public quickly."

At the end of the day Tegra is used in a lot of places. Even cars. If there's a risk that someone could conduct a crime through through a firmware hack then that presents an ethical dilemma.

10 years ago there were few portables that you could run your own code on. Now there's things like the GPD Win.

All this homebrew stuff is a bit of fun and games at the end of the day. Calling someone a traitor because they decided to responsibly disclose a vulnerability is just childish.

Post reply on HN