Hackers obtain PS3 private cryptography key due to epic programming fail?


ah well, the wii had its run, its ps3 hacking time, i for one am excited to see what people will do with such a powerhouse running unsigned code
 
ah well, the wii had its run, its ps3 hacking time, i for one am excited to see what people will do with such a powerhouse running unsigned code
O, it is not even close to be a powerhouse, believe me ( someone who actually runs linux on PS3 up to now :p ). The main CPU can be seen just as a 64-bit in-order single-core double-threaded IBM POWER5+ processor, clocked at 3.2GHz, with very weak AltiVec ( Velocity engine ). And honestly it feels that the Pandora console runs applications at the same speed, yet being clocked at 500MHz. Firefox loads up even slower for me than it does on Pandora ! But of course people would say: "PS3 has CellBE in it with 7 super-fast maths co-processors, called SPUs." And where are programs that utilize those units ? There are about 20-30 of them, with practically 0 being usable to end user. ( Most don't even compile, those that compile often seg-fault, those that don't seg-fault are unstable as hell, etc. ) Note to programmers: Porting to GLES is NOTHING compared to the nightmare of porting to CellBE, carefully offloading necessary functions on SPUs ( which have only 256KB of local memory per unit ), optimizing the code on SPU for SIMD, etc.


Plus there is no point of having access to GPU in linux when even the 2d driver hasn't been written for it yet. ( No accelerated Xorg, no accelerated XVideo. )


I wonder what those guys are trying to achieve with linux ... ( even 256MB of DDR3 make me laugh )
 
I find it funny that none of this started until they took the 'other os' option away. I bet if it didn't start out with the other os option it would have been this far along now anyway. The other OS people, or the people that would want another OS on the PS3, do most of the work anyway so I bet piracy on the PS3 would be non-existent right now if they would have just left it alone.


So, they kept the PS3 slims from being used by the US Military but now they have piracy problems. Hmm, wonder which is a worse problem for them.
 
This whole story made me smile from ear to ear! This is crazy. Encryption keys are being released right, left and center, including the PSP it seems. Guess it means Sony now have the largest base of open source consoles (and presumably handhelds) on the planet?! It's like the Dreamcast all over again.


B)
 
This whole story made me smile from ear to ear! This is crazy. Encryption keys are being released right, left and center, including the PSP it seems. Guess it means Sony now have the largest base of open source consoles (and presumably handhelds) on the planet?! It's like the Dreamcast all over again.


B)
O_O You read my mind, didn't you?!
 
Yeah, they're screwed. They can't just change the keys without every game released up till now no longer working. I guess we'll be seeing the PSP2 and PS4 sooner than expected?


EDIT:


Actually, they may push releasing any new consoles back in order to rethink their security.
 
Last edited by a moderator:
I don't think they need to re-think their security. Simply proof read and properly test their code. If the security seed used for generating the key was truly random then the hackers may well have been still trying to crack the system. Anyway my view on this is that I think that most of the 'homebrew' for the PS3 would be better served on PC. I mean come on, the RSX would not achieve the same levels of graphical fidelity without the nVidia/Sony SDK also the controllers are bluetooth that can be used with most, if not all, computers. I think that unless the official SDK is somehow 'leaked' I don't see the homebrew community for the PS3 pushing out much more than ISO leaders and 'backup utilities'. The homebrew on the Wii was interesting, until the piracy took hold, simply because it was something new to try and use in interesting ways.
 
I don't think they need to re-think their security. Simply proof read and properly test their code.
I'm sure they proof-read and tested their code. The problem is, a security system is only as strong as the weakest part. And if hackers can compromise any part of a security system, odds are pretty good they can crack it wide open. Sony / Nintendo / Microsoft programmers are good programmers but they can only do so much.
 
I'm sure they proof-read and tested their code. The problem is, a security system is only as strong as the weakest part. And if hackers can compromise any part of a security system, odds are pretty good they can crack it wide open. Sony / Nintendo / Microsoft programmers are good programmers but they can only do so much.

The thing is the flaw that let the hackers in was a random number generator always returning the same result, so using this result the were able to, essentially, work backwards and discover the encryption algorithm. The fact that this flaw exists is why I suggested proof reading and proper testing. The fact that this flaw got far enough to reach retail units without being noticed makes me think there were either a billion lines of code in the encryption or it was a last minute hack improperly tested and coded in the dead of night on a caffeine buzz. I know this type of thing goes on, I know people who work in the industry who have actually typed the code:


if(hax == 1)


{


//collision detection now works.


}


so I don't think a quick hack that someone thinks no one will notice is that unheard of. I'd reckon more so in the commercial industry as the source code is unlikely to be read by anyone outside the studio.
 
12-29-10-ps3publickeyrandomization.jpg



Confirmed: Sony Software Engineer had proven that 4 is the exact equality of Randomness.
 
Last edited by a moderator:
Looks like the way they tried to "fix" the leak of DVD, HD-DVD and Blu-Ray cryptographic keys
laugh.gif
 
theyre not really suing for now, more like putting a restraining order on the known hackers, or at least trying, dont think they have much ground to go with
 
I like how this was broken, but gads, such a flaw took a long time to notice.


The old Amiga hackers would have found that within days, it's a classic hole. I guess it was so obvious no one thought it could be worth looking at.


However, taking such a long time to crack it means Sony really are screwed in terms of their current hardware.


I do like the thought of their lawyers, I think they use SJ 'hire-a-thug' Berwin, frantically trying to get the horse back in the stables, while the horse is long gone and the stables have been burned to the ground. Brilliant.
 
Sony are now actually suing both Geohot and FailOverflow, filing a suit with a bevy of absurd charges to bulk out their already flaccid case.


I wonder if I could fit "C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B" on a teeshirt?
 
Back
Top