Rendered at 10:07:52 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
MayeulC 3 hours ago [-]
This blogpost makes the point that the advent of the Raspberry Pi microcontroller made it easier to interface with a variety of hardware.
And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance.
I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O.
Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection.
Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW.
Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that.
merpkz 4 hours ago [-]
What did Microslop change in Xbox One that prevented it from being exploited much in the same way? Afaik Xbone is still undefeated in terms of security, either because it's so good or because it's just uninteresting console to own
xav_authentique 4 hours ago [-]
It has been defeated, but through hardware attacks (voltage glitching mostly). The author did an very interesting presentation about the process at reverseconf: https://www.youtube.com/watch?v=FTFn4UZsA5U&t
MayeulC 3 hours ago [-]
They allowed people to run their own homebrew, and allowed more third party apps like Kodi (formerly known as XBMC -- XBox Media Center, that grew out of XBMP) on their store.
Homebrew software had been a driving force behind consoles being hacked in the past. The console is obviously more secure, but they also removed some incentives.
Arainach 3 hours ago [-]
Ooh, you misspelled Microsoft and made it an insult, how original and insightful. Get in line behind every teenager on Slashdot 25 years ago.
No, but like most people I matured out of name calling many years ago.
account42 29 minutes ago [-]
Your previous comment is evidence to the contrary.
qs1ykyusPlate 1 hours ago [-]
[dead]
0points 1 hours ago [-]
> Slackdot
What kinda insult is that?
qingcharles 5 hours ago [-]
And now we have a working permanent softmod. The Xbox 360 hacking scene is basically complete at this point.
landr0id 3 hours ago [-]
I was in the Xbox 360 scene back in the day before JTAG hacks existed -- modding savegames, getting a devkit, and building my own private homebrew. For the most part I left the scene around 2013.
The softmod had me seeing what the status quo is and things are... not great.
17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.
The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.
Hacking the console is complete. But the state of the scene is a bit sad.
At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).
ZenoArrow 2 hours ago [-]
> Hacking the console is complete.
No it's not. For starters the recently released softmod does not work on all Xbox 360 revisions.
landr0id 2 hours ago [-]
BadUpdate works on all revisions. It's just not persistent.
With BadAvatar you get interactionless console exploitation that's good enough for most people.
ChrisRR 2 hours ago [-]
As long as rock band blitz isn't removed from the store
landr0id 1 hours ago [-]
The Rock Band Blitz demo was distributed as a roamable package -- i.e. no license that ties it to any particular console (this was intended for e.g. demos distributed on magazine CDs or whatever).
You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.
hizlikovboy27 3 hours ago [-]
Did you check whether the glicthing setup still has any advantage? for example on consoles the software exploit doesnt cover?
landr0id 2 hours ago [-]
The software exploit works for all console revisions, but the persistent softmod does not.
There exist 3 main things in the software hack space for Xbox 360:
1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox.
2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox.
3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer.
At any rate, #1 and #2 do not provide early boot exploitation.
#3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom.
The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version which did not blow a downgrade fuse and using an additional hardware flash chip containing a different version of the OS which had a hypervisor bug, boots the console into that, triggers the exploit using SMC black magic, then reboots back into the upgraded version of the OS.
The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain.
Markoff 4 hours ago [-]
TLDR it requires modchip, can't just use software like with all PS3, so why would anyone bother with xbox when you can play PS games?
> Peer Pressure is a persistent softmod exploit for Xbox 360.
asimovDev 3 hours ago [-]
Still mind-boggling that it took almost 20 years for it to come out
>You can try to use the exploit with a SSD if you choose, however, for optimal boot times and reliability it's recommended to use a mechanical HDD instead
is also very amusing to read
Markoff 35 minutes ago [-]
Then I fail to see what's the point of the article and why author omitted this information from it.
And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance.
I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O.
Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection.
Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW.
Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that.
Homebrew software had been a driving force behind consoles being hacked in the past. The console is obviously more secure, but they also removed some incentives.
Microsoft Security gave an excellent presentation on the topic: https://www.youtube.com/watch?v=quLa6kzzra0
What kinda insult is that?
The softmod had me seeing what the status quo is and things are... not great.
17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.
The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.
Hacking the console is complete. But the state of the scene is a bit sad.
At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).
No it's not. For starters the recently released softmod does not work on all Xbox 360 revisions.
With BadAvatar you get interactionless console exploitation that's good enough for most people.
You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.
There exist 3 main things in the software hack space for Xbox 360:
1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox.
2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox.
3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer.
More info on #3 here: https://youtu.be/ftEuor1asBM?t=96
At any rate, #1 and #2 do not provide early boot exploitation.
#3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom.
The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version which did not blow a downgrade fuse and using an additional hardware flash chip containing a different version of the OS which had a hypervisor bug, boots the console into that, triggers the exploit using SMC black magic, then reboots back into the upgraded version of the OS.
The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain.
> Peer Pressure is a persistent softmod exploit for Xbox 360.
>You can try to use the exploit with a SSD if you choose, however, for optimal boot times and reliability it's recommended to use a mechanical HDD instead
is also very amusing to read