Sponsored Links

Sponsored Links

Video: PS Vita Content Manager and Security Concerns of Wololo


Sponsored Links
140w ago - Following up on the PS Vita HBL Demo, today PlayStation Vita hacker wololo has shared details on the PS Vita Content Manager and the related security concerns as outlined below.

To quote: A few days ago I posted my concerns about the “Content Manager” tool, a tool that is compulsory to install and use if you want to copy files from and to your vita. Some people said I was paranoid (see my answer to that at the end of the article), and others shared my concerns and started digging. Interestingly enough, that article gathered almost as much attention as my much more spectacular (in my opinion) video of a Megadrive emulator running on the vita.

Some sites took my words out of context and said that I had proof Sony is spying on us when we copy files. This is not true, I don’t have any proof, just lots of concerns. Because of that I decided to call Sony’s customer service in order to get more information. Read along.

First of all, a piece of relatively good news: some users on French site psvitagen mentioned that it is possible to copy Movies and Music without being connected to the internet, through the dedicated “Music” and “Movie” sections of the vita.

I confirmed this is true, so movies, music and pictures can still be copied to the vita even without an internet connection. The internet connection is however, as far as I can tell, required to copy anything else, which, given the limited possibilities of the vita, basically means PSP/Vita games and/or savedata.

In theory and from what I saw so far, the internet connection is probably used for two things: check for new versions of the firmware (an update was enforced on me if I wanted to keep using the content manager 2 days ago), and possibly do some DRM verifications. That’s the theory, and is somewhat confirmed by some early investigations of the binary by dev Hykem.

So, when you copy it to your vita, Sony checks that your Vita game or your Sony-purchased movie is actually “ok” to play on your vita, to make sure you didn’t steal it or copied it from a friend’s computer. Fair enough (although I would question why this check needs to be done there, rather than directly on the vita). But what happens for content that does not require any Sony drm check is my concern.

Even though it’s possible to copy them without an internet connection, does Sony gather any information on my music, my pictures, or my movies (and how about my games savedata, which do require the internet connection while being transferred) ? Do they collect filenames, id3 tag, or exif information? Probably not, but more transparency on the subject would definitely be welcome. This is not about hacking here, this is about sending private information to a company that has proven regularly that they [Register or Login to view links] with our data.

So, full of concerns, I decided to call Sony’s customer service today (actually my wife did it for me...). The person we talked to, as expected, wasn’t a technical person and therefore had close to no information on this. She was aware that an internet connection is required, and mentioned to us that this is written on the manual.

We explained that we knew that, and that we have an Internet connection (it usually takes time when calling a customer service to explain that you don’t have a technical problem using the software, but an ethical one) , but we’d like to disconnect it when it is not necessary, because we don’t see the point in being connected to Sony’s server when we transfer files between two pieces of hardware we own (at which point my wife added: “especially given what happened to your company recently, we’re a bit concerned about our private information“. Hehe, that’s why I love her ).

Understanding our concern the person at the customer service contacted somebody more technical to get more information on the subject. She then came back to us and told us this was in place to make sure that the computer running the content manager is correctly “associated” to the Vita. She didn’t have any technical details to share about the firmware upgrade or the DRM verifications, but she guaranteed us that no personal data was being transferred. She also gave us her name (which I won’t share here) in case we have more questions on the subject (but don’t ask me to call them more, first it’s not a free call, and second I already felt super bad to have my wife spend 30 boring minutes on the phone for me because of my new toy)

(one thing I’d like to say is that every time I contacted Sony’s customer service, their answers were fairly fast and accurate. They usually give me bad news, but they’re doing their best to help. The only time they were completely wrong was when my PSP 1000 stopped accepting connecting to Media Go. They told me it was because the PSP was a Japanese PSP, and I was trying to connect to the European store. I knew this wasn’t true since I had no problem doing the exact same thing with two other PSPs. The real cause was probably that Sony had banned my console for some reason. Anwyays overall thumbs up for the efficiency of the customer service)

So, that’s the official answer, but I’m sure some of us will pass the PC parts of the Content Manager through their microscopes to confirm if this is true. But at least now I have some official information from Sony, which is, in a way, positive. Nevertheless, it does not statisfy my curiosity on some of the files found by Hykem, (such as Mp3Promoter.suprx, png_promoter.suprx, etc… so I’m sure many people will want to learn more about this thing.

Oh, Before I go...

Note: don’t read the section below if you don’t like me when I rant, I know some of you don’t like me when I do that (Spare me the “why do you buy Sony products in the first place?” types of comments if possible, as that’s not the point)

A personal note about why I’m doing all of this, and a message to haters. There’s something interesting about fanboys, no matter how much you show them the truth and give them verifiable proof about it, they’ll always find excuses to justify the illegal behavior of their favorite company. A few days ago I started investigating the insides of the PS Vita. I got HBL to run on it, and was able to run PSP homebrews on the vita. Fanboys told me I would kill the vita because of piracy.

I also raised privacy concerns about the vita “content manager”, a tool that is compulsory to use if you want to transfer some files from and to your vita, and requires you to be constantly connected to the internet while doing so. Again, Sony fanboys told me Sony would never spy on their users, or went [Register or Login to view links] on me, telling me that Sony probably has good reasons to spy on me in the first place.

Well guess what, champions: my work on the PSP was never used in any way to pirate Sony’s content, because it is not technically doable to do such a thing with HBL. And telling me that Sony would never do something illegal to their users is completely forgetting that they intentionally did so a few years ago with their infamous [Register or Login to view links].

There’s no historical record of me being a bad guy, I was never sued or sent to jail in my life, while Sony has proven several times to engage in illegal or barely legal activities (see the rootkit case, or the Sony VS Universal studios case), but yet in Sony fanboys’ heads, I am the one with a suspicious behavior. Next time you comment on my work, just get your facts straight, not all hackers are promoting piracy, and my work (HBL) cannot be used to pirate games.

I won’t pretend I’m a fighter of freedom or anything, I do this mostly for fun, but I take extra care to do things that are legal, or at least not ethically questionable. The same cannot be said for Sony, so it is perfectly legit to have doubts about the tools they make me install on my machine, even if in the end the suspicions were wrong.

Sony lost their “presumption of innocence” rights years ago, I’d rather assume they’re guilty first, than feel sorry for myself later when the contents of my hard drives get leaked from Sony’s servers by some black hat hacker.









Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 189 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

Nabnab's Avatar
#159 - Nabnab - 131w ago
You don't need to spend 20 bucks on a digital psp game, i also reveal another game that can be use that it's free and available on every PSN take a look (it's also a demo, the only one PSP Demo that is available for PS Vita)

ModderFokker's Avatar
#158 - ModderFokker - 131w ago
First time i spend 20.- on a digital psp game ..lol

technodon's Avatar
#157 - technodon - 131w ago
here is a link to the game: [Register or Login to view links]

i'm not sure if it is useful, maybe it could be installed using charles or something?

Nabnab's Avatar
#156 - Nabnab - 131w ago
Here is another game that you can use but i don't care about the MIPS Wrapper

[Register or Login to view links]

ils's Avatar
#155 - ils - 131w ago
Following up on the previous update, today PS Vita homebrew developer wololo has revealed the game used for the PlayStation Vita Half Byte Loader (VHBL) is Motorstorm Arctic Edge (Motorstorm Raging Ice in Japan) and shared a video of it in action below!

As a result, Sony has officially removed the Motorstorm Arctic Edge title from PlayStation Store.

To quote: "Ok, so, since the PSN maintenance is being postponed, there is no reason for me to not give the name of the game used by Teck4 for his exploit:

The Game is Motorstorm Arctic Edge, also known as Motorstorm Raging Ice in Japan. It is available for 19.99 euro on most European Playstation Stores, 15.99 Pounds in the UK, and for 3800 yen on the Japanese store.

Note for North American readers: that game, despite being available on the US Store, is marked as not compatible with the Vita in the US. People who have bought it in the US and tried to transfer it to their vita have failed as far as I know, which is why a few days ago I recommended people in the US to get a European PSN account.

Now what's next?

Well it's simple and stressful at the same time: I'm giving you guys a couple days to buy a copy of that game if you think VHBL is worth it (and assuming you trust that I'm not lying), and then I'll release the VHBL files. There are pros and cons to this "2 steps" release. The cons are that you have to trust me, and there's a possibility Sony actually patches/patched something without me knowing it, the pros are that I don't think Sony will remove the game from their store until they actually have something to patch, so I think this gives you guys a couple days to buy the game.

Or, you can wait until I release the files and other people confirm it works, at which point you run the risk that Sony patches the exploit and/or removes the game from the store before you can even buy it.

Now, let me be clear once again: buy the game if you want to play it, I have no way to guarantee VHBL will work for you, I can just tell that a few days ago this was confirmed to work by a few testers.

Also keep in mind that VHBL gives you no iso, no special access to the Vita hardware, just a limited PSP homebrew experience on your vita. If like me you think it's fun, then you might be interested. Or, if you think that 20 euros is a fair price for one of the best PSP games, then, well, just consider VHBL as a "bonus".

VHBL has been confirmed to work on firmware 1.61. If your console asks you to update to firmware 1.62 or something, I cannot guarantee it will still work. It is also recommended, after you bought the game, to be paranoid and disconnect your console from the network, and to install openCMA. Again, there are lots of unknown things going on with the Vita, it is impossible for me to tell if this will work for everyone.

As far as I know, there are 5 versions of this game out there. I ported VHBL to 4 of them, and I am sure the fifth one is vulnerable too, but I couldn't find any place selling or "distributing" it, so I couldn't port the exploit to it. That being said, it should be "doable" if somebody can get a copy, to port the exploit to that version as well.

Finally, for those who want proof, here's a video:





I want to thank the people who made this release go as smoothly as possible, especially Teck4 and Mamosuke, HBL devs (in particular m0skit0 and JJS, thanks for lurking on the scene for so long, you guys are the real deal!) the mods at /talk who have helped a lot over the past week, the handful of devs/testers who know how to keep a secret (you know who you are), but also the thousands of /talk users who, for some of them, have been knowing the game's name for several days now, and haven't leaked anything.

You guys are truly an awesome community, you can of course now go ahead and let your friends know, or brag about how you've known about the game for a while and hold the secret. It was so far an awesome experiment, let's hope the result will be worth it!"

Too bad my Vita will arrive in 9th March (international delivery) hopefully someone find another exploit by then.

More PlayStation 3 News...

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News