Sponsored Links

Sponsored Links

BBC Interviews Fail0verflow and GeoHot on Recent PS3 Hacks


Sponsored Links
190w ago - Today the BBC (linked above) has published an interview conducted with PlayStation 3 hackers fail0verflow and GeoHot on the recent PS3 hacks and summarizing the unveiling Sony's secret key.

Below is the interview, to quote: "The PlayStation 3's security has been broken by hackers, potentially allowing anyone to run any software - including pirated games - on the console

A collective of hackers recently showed off a method that could force the system to reveal secret keys used to load software on to the machine.

A US hacker, who gained notoriety for unlocking Apple's iPhone, has now used a similar method to extract the PS3's master key and publish it online. Sony declined to comment on the hack.

"The complete console is compromised - there is no recovery from this," said pytey, a member of the fail0verflow group of hackers, who revealed the initial exploit at the Chaos Communication Congress in Berlin in December.

"This is as bad as it gets - someone is getting into serious trouble at Sony right now."

The group, which has previously hacked Nintendo's Wii and says it is vehemently against games piracy, said that it had developed the hack so that it could install other operating systems and community-written software - known as homebrew - on the powerful machine.

"The details we provided and information and techniques we disclosed would have been enough to install Linux," he said. "We have no interest in piracy."

Following the presentation, US hacker George Hotz, who has previously hacked parts of the console, used a similar technique to extract the master key. He has now published it on his blog.

"This is supposed to be the most secret of secret of secrets - it's the Crown jewels"

This formerly secret number is used to "sign" all games and software that run on the system, to authenticate that it is genuine and approved by Sony.

However, once the key is known it can be used to sign any software - including unofficial software and games.

"I hate that it enables piracy," said Mr Hotz. "The publication of the key is more academic than anything else."

The number also works for Sony's handheld console the PlayStation Portable, said Mr Hotz.

Developers have already started releasing tools to develop new software for the PS3 using the hacks.

'Valid target'

The PS3 - once regarded as the most secure of the game's consoles, and the only one not to have been permanently cracked - has in the last 12 months come under increasingly scrutiny from hackers.

PlayStation hack (George Hotz) Mr Hotz's original hack is widely believed to have led to Sony disabling features on the console. In January 2010, Mr Hotz claimed to have cracked the console.

Following his initial announcement, Sony released an update disabling a function, called OtherOS, that allowed gamers to install a version of Linux on their machines, thought to have been exploited by Mr Hotz.

Many saw it as a pre-emptive strike to guard against games piracy.

Mr Hotz never released the exploit and publicly said that he had stopped work on the console.

But Sony's removal of OtherOS prompted other hackers to begin to look at the system more closely.

"It became a valid target," pytey told BBC News. "That was the motivation for us to hack it."

He said the team had spent "months" trying to find their way into the system.

"It was not trivial to do this," he said.

In the end, the flaw that allowed them to crack the system was a basic cryptographic error that allowed them to compute the private key, held by Sony, he said.

"Sony uses a private key, usually stored in a vault at the company's HQ, to mark firmware as valid and unmodified, and the PS3 only needs a public key to verify that the signature came from Sony.

"Applied correctly, it would take billions of years to derive the private key from the public key, or to make a signature without knowing the private key, even when you have all the computational power in the world at your disposal."

"I'm scared of being hit with a lawsuit"

But the team found that Sony had made a "critical mistake" in how it implemented the security.

"The signing recipe requires that a random number be used as part of the calculation, with the caveat that that number must be truly random and not predictable in any way," the team said.

"However, Sony wrote their own signing software, which used a constant number for each signature."

This allowed the team to use "simple algebra" to uncover Sony's secret key, without access to it.

"This is supposed to be the most secret of secret of secrets - it's the Crown jewels," said pytey.

The team decided to publish its method but not the keys.

After the team revealed their hack, Mr Hotz said that he was prompted to renew his work on the system.

"What fun is a race if no-one else is running," he said. "fail0verflow did great work - they took it up a level."

"It's my own hardware, I can run whatever I like on it"

Using a similar technique he was able to extract the entire master key for the system, which he subsequently publish online along with a demonstration of it in action.

However, he has not released the method he used to extract the key.

"There is no reason to," he said.

However, he said that he may release a piece of software that will allow people to easily sign their own pieces of software and homemade games - also known as homebrew - on to the console.

"I have a program running but am thinking of a good way to release it," he said.

Like fail0verflow, he said that he does not condone games piracy.

"I do not want it to be able to sign official Sony programs. I'd like it just to be able to sign homebrew."

fail0verflow said it "disagrees" with Mr Hotz's decision to release the key, saying that it expects them "to make piracy easier without accomplishing intrinsically useful".

Legal worry

Sony takes a dim view of people hacking its system.

Last year, a team released a USB dongle called PSjailbreak that contained software that allowed gamers to play homemade and pirated games on the PlayStation 3.

Sony updated its consoles to block the software and took legal action against distributors in many countries.

However, according to pytey, it may not be so easy to fix the problem this time.

"The only way to fix this is to issue new hardware," he said. "Sony will have to accept this."

He said that he thought his group was on safe legal ground with its work.

"I haven't stolen anything," he said. "It's my own hardware, I can run whatever I like on it.

Mr Hotz also defends his actions, although admits he is "scared of being hit with a lawsuit".

"I am confident I would win since what I released was just a number obtained by running software on the PS3 I purchased"."



Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 33 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

Chivafighter's Avatar
#18 - Chivafighter - 190w ago
Thats true, the ps3 will make hits what so ever. I find it crazy though that both geohot and fail0verflow went public though, but its our gain in knowledge and homebrew aka bootleg backups.

nicotine's Avatar
#17 - nicotine - 190w ago
Piracy is bad! Sony will release new hardware and soon game developer will move to new hardware. PS3 will be dead with no new games like PS2. Everyone will be so happy to spent more money to buy new system thanks to these hackers. I really hope they don't bust the game business.
i'm not for piracy, but you're talking straight up BS.

the ps2 was modded less than a YEAR (neo 2, then the 44 wire neo mod, then omega team, then all the clones, and still is). ps2's modding was ONLY for piracy. this can be used for development use too, unlike ps2 mods.

ps2 modding was HUGE - and it still was hugely successful. you act as if there was no copying ever on ps2 and it was so secure. do you live under a rock?

stinky1978's Avatar
#16 - stinky1978 - 190w ago
there is never "nothing" that can be done. Sony has an obligation to the devs to try and seal the system back down. I don't think it will work well, but they still must do it.

F0F claims to have found out about their signing bug by decrypting the bits of info they had on the system. Nothing to do with insider information. Sure there was leaks about the service jig, and the dev software has leaked a few times, but none of that has really done much here.

Geohot still used his otheros hack to get into the system before anything else. He peek and poked around and dumped bits of HV a few bits at a time. Twiizers did pretty much the same thing on the wii. And it had no leaks at all. Look where it is now. entirely off dumped and decrypted data.

THE PS3 is in the same position now. I think the even bigger news is that keys for the PSP were inside the PS3 fw. So we got a 2 for 1 deal. PSP is at the end of its life cycle though. so not much loss there. PS3 was supposed to have at least another 5 years before it was going to be looked at being replaced.

Sony still has lots of options though.. we have not heard the last of them.

Rocky5's Avatar
#15 - Rocky5 - 190w ago
Any how that is incorrect aslong as they release firmwares for the 40+ million consoles out there we can get all the keys so there screwed. New hardware would close the bootloader bug that would mean they can't get keys or replace the lv2 loader/app.

From what I get from reading all these threads and watching the console hacking videos is sony are screwed sideways with this there is nothing bar new hardware will fix this (this I'm not sure about, keys or just the bootloader bug)

mik30's Avatar
#14 - mik30 - 190w ago
Sony made its biggest mistake in the PS3 realm by removing OtherOS.
Nobody could find that mistake in Sony's Signing procedure without having access to Sony's signing codec. So I am quite sure that this was not a common hack. Getting the private keys is rather the result of a whistleblower information from a Sony insider...

So if I were Sony I would prosecute the know people to the maximum extent possible under the law. The are known violators of releasing privately held informations which will result in severe civil and criminal penalties in nearly all western countries. In addition to that this enforces a huge pressure on these guys to uncover the whistleblower to Sony...

We will see if Sony boldly goes where no one has gone before...

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News