[PS3] Sony's PS3 Security is Epic Fail

[MrBill]

Looks like the next step has been taken and the root keys went public. Next will be how difficult it is to get the keys onto the media or injected into the system boot process. Sony still has low adoption rate of Blu-Ray writers working in their favor but if there is a way to FTP games from a PC to a PS3 hard drive and play online, there could be a lot more people interested in how to leverage this discovery.

Playstation 3 Update: Hackers Make PS3 Root Key Public
January 5, 2011 10:02 AM

Playstation 3 was stripped of its final defense on Sunday by hackers, including the security keyes used to authenticate legitimate applications and reject illegitimate ones, according to PCWorld.

In other words, the hack allows the PS3 to run any program without authentication, meaning that PS3 game files burned onto a Blu-ray disc will function the same way as traditional PS3 retail discs.

German hackers fail0verflow have claimed credit and say they started the hacking process to allow Linux ‘Other OS’ installs, a feature Sony stripped from the console last year.

A few days after the reverse-engineering of the PS3, iPhone hacker GeoHot allegedly leveraged the work done by fail0verflow and published the PS3 root key, which can be used to sign any code to run on the console and make it appear as though it was signed by Sony itself. Geohot released the key for public use, although he added that he “do[es] not condone piracy.”

At press time, Sony representatives said they were still waiting confirmation or a denial from within the company.
..

Read more: http://www.thirdage.com/news/playst...ke-ps3-root-key-public_1-5-2011#ixzz1AAuEkSge

 

[Maynard]

waits for twigg to defend the ps3's security

 

[Dmac]

I realize that this cant be stopped now due to it being in the hardware or whatever, but would it be possible to put a safeguard or some kind of way for sony to know if a system has been tampered with in a firmware update?

I'm not saying a firmware update to stop the use of downloaded games but just a way where they can see who has modded. Like xbox did with the mass bans.

 

[jms493]

another article

http://www.redmondpie.com/how-to-install-custom-firmware-on-playstation-3-ps3/

 

[Maynard]

i see all this info but it doesnt seem that any of these sites have anything that even matters. i dont played modded console games, but thats about the only thing i would even care about and it doesnt seem to be an option for people who use modded consoles

 

[jms493]

i see all this info but it doesnt seem that any of these sites have anything that even matters. i dont played modded console games, but thats about the only thing i would even care about and it doesnt seem to be an option for people who use modded consoles

I really don't know what any of it means to be honest. I really don't care either but I guess it took like 5 years to crack the PS3 and they finally did it in a big way so it is big news.....i guess.

My friend did it and he has like 30 games on his hard drive....i guess that's awesome?

 

[Maynard]

yeah if u like that sort of thing. i never got into learning about modding a console. it always seemed like a big pain in the ass and thats without the guarantee the disc would even work.

 

[Twigg4075]

waits for twigg to defend the ps3's security

You are such a dick.

My point was only that it took so long for them to do it. The PS3 has been Fort Knox for four years now. The other two consoles have been hacked since day one.

Congratulations to these guys for finally doing it...I guess.

But it doesn't affect me one iota.

 

[BrntO4Life]

My point was only that it took so long for them to do it. The PS3 has been Fort Knox for four years now. The other two consoles have been hacked since day one.

This is the point that fail0verflow was arguing against though. Since it was so easy for them to hack, they have reason to believe no one really tried until Sony announced it would no longer support Linux.

 

[MrBill]

This is the point that fail0verflow was arguing against though. Since it was so easy for them to hack, they have reason to believe no one really tried until Sony announced it would no longer support Linux.

I believe with the potential profitability of coming out with the first real modchip for the PS3 that somebody somewhere had to be trying.

 

[Maynard]

You are such a dick.

when i was 19 years old i worked as a line cook and the servers gave me a name tag that said dickhead, i wore it proudly everyday.

 

[Maynard]

I believe with the potential profitability of coming out with the first real modchip for the PS3 that somebody somewhere had to be trying.

especially since the ps2 was modded so early on.

i guess i never realized the ps3 had not been modded yet. i assumed they accomplished that in year 1. I was under the impression that this new hack was for the registry of the system allowing people to do whatever they wanted without having to actually install a mod chip

 

[MrBill]

especially since the ps2 was modded so early on.

i guess i never realized the ps3 had not been modded yet. i assumed they accomplished that in year 1. I was under the impression that this new hack was for the registry of the system allowing people to do whatever they wanted without having to actually install a mod chip

It might not require a modchip, not sure at this point. The root keys still have to be either flashed into the BIOS of the PS3 or injected in the boot process. I'm not sure if the keys could be put into a bootloader and burned to the Blu-Ray game image or not. That would be really bad for Sony if that was possible, sort of a SEGA Dreamcast scenario that would be impossible to stop.

 

[Twigg4075]

I believe with the potential profitability of coming out with the first real modchip for the PS3 that somebody somewhere had to be trying.

Yeah, I find it nigh impossible that no one was trying.

when i was 19 years old i worked as a line cook and the servers gave me a name tag that said dickhead, i wore it proudly everyday.

LMAO! This had me rolling.

 

[stevsta]

anyone still think sony can fix this with firmware

http://uk.ps3.ign.com/articles/114/1143598p1.html

Sony Going After PS3 Hackers

Sony Computer Entertainment America filed a complaint for injunctive relief and a motion for a temporary restraining order in a California court yesterday against hacker George Hotz, members of the hacker group fail0verflow, and a number of John Does for allegedly circumventing the PlayStation 3's protection measures.

In late December, members of fail0verflow discovered a way around Sony's PS3 security measures to access private root keys, allowing anyone to run unauthorized and pirated software on the console and later distributed the tools to other hackers. The group claims the security hole cannot be fixed with a simple firmware update and that Sony would instead have to issue completely new hardware.

Hotz, who last year claimed he already hacked the PS3, took it a step further days later by distributing tools helped created by fail0verflow to hack the console publicly on his website and even published a video of YouTube showcasing his homebrew application running on the PS3.

Sony is looking to restrain the hackers from further illegal activity, including manufacturing and distributing hacking tools, or they will "succeed in their attempts to ensure that pirated software can be run on the PS3 System, resulting in the destruction of SCEA's business."

The company claims the hackers violated the Digital Millennium Copyright Act, the Computer Fraud and Abuse Act, and other copyright infringements, and is asking the defendants to turn over all computer hardware and software used in creating and transferring the hacking software.

A copy of the proposed restraining order can be viewed here

I dont think sony will win this one as the precedent has been set that as long as you are not profiting from the hacks or mods you are free to do what you wish with the "property" you bought

 

[killgod]

Sony is SOL on this one.

 

[Maynard]

epic fail?

 

[MrBill]

epic fail?

In that Sony themselves inadvertently gave hackers the keys, yes. Looking at the fact it took this long for it to happen, no.

 

[Maynard]

maybe that would classify as a fail...but not an epic fail? on one hand the fail itself is pretty epic, but on the other hand the amount of time it took to occur is not. Somewhere there has to be a middle ground on the terminology of the magnitude of this fail. If not epic then what?

I feel as though the discussion is not about the timing of the fail, but the fail itself. And that the only reason the timing of the fail has been mentioned is to alleviate the negative feeling about sony and the ps3 fail when the real issue should be the fail of the security.

so i think it still stands as an Epic Fail and that anyone who discussed the timing of the fail is a fail

sidenote: this post is an epic fail

 

[Twigg4075]

I dont think sony will win this one as the precedent has been set that as long as you are not profiting from the hacks or mods you are free to do what you wish with the "property" you bought

But I read somewhere that these guys do have PayPal accounts that people have been "donating" money to all because of this and that is one of things Sony is attacking. If they can prove a direct correlation wouldn't these hackers be screwed?