So just how hack-proof is the 360?
posted Nov 28th 2005 10:30AM
We haven't yet had a chance to get our hands dirty and bust out our trusty tunneling electron microscope to see for ourselves just how in deep we'd have to go in order to load up our new 360 with Linux, but apparently the Free60 Project has a pretty good idea of what's in store for Xbox hackers this time (though of course none of this is officially verified):
-
The flash is encrypted with a per-box key
-
The key is stored inside the CPU
-
The boot ROM is stored inside the CPU
-
Also inside the CPU is a hypervisor that verifies the running state of the kernel, making sure there is no modification (RAM checksums), else the Xbox 360 panics and blows up!
-
The CPU contains RAM inside of it to store the checksums
-
All interrupt/exception handling is done by the hypervisor
-
All code runs in kernel mode
-
The emulator for first generation games can be updated via an official Microsoft download burned to CD by the user, though the CDs' content will be encrypted and signed with public key cryptography. The boot ROM is stored inside the CPU.
Don't worry if you don't know what any of that biz means — but if you do, you probably know that this is a real
world best-case-scenario trusted computing environment. In other words, would-be Xbox 360 hackers have definitely got
their work cut out for 'em.
[Via Joystiq and
Xbox 360 Fanboy]
So... A week 'til it's all busted, then?
No problem, somewhere, deep down, there has got to be Internet Explorer on the thing. Thats all anyone will ever need. ;)
I'm thinking a fake Live server on your local net (redirected to by a local DNS server) that exploits anything it can find with some buffer overflow action etc. etc.
I already hacked it, but I'm not telling anyone how.
I'm running Mac OS X on my X360, but I'm not telling anyone how.
Mmmm... hypervisor... I dunno what that is, but I bet it sure as hell keeps the sun out of my eyes!
The vulnerability could be in the emulator. If someone can change somethings in that...
Very true, the emulator runs nonprotected older xbox. It would be a slow hack though. We just have to wait till the first firmware update to get a real hack. Could be as easy to hack as itunes was?
I'll wager that the 360 isn't hacked for a very long time, if ever. The original XBOX itself was only compromised due to a couple of mistakes (that won't be made again) and less than full control of the hardware. Good luck to the modders you've got a hell of a job ahead of you.
Hypervisor, you know like how hyper = super, which makes it kind of like a supervisor but with an iron fist or something.
Anyway I think I remember something about coding your own games and MS might put them on sale on Live. Maybe this could be an opening unless you're supposed to buy a developers' version of the console.
I give it two weeks until someone's running Doom on it...
The first script test should be "Halo world". LOL
I'm sure Apple is watching this closely as they develop their final Intel TPM of OSX.
I give it two months before somebody's booted linux.
I say by Friday they'll have it displaying a penguin logo :-P
So, if you try to hack it, it explodes? That's even worse than the blu-ray players. Those just get disables. This can cause your house to burn down, not to mention death to whoever is trying to hack it. Depending on how strong the blast is of course.
I gotta say, MS put a lot of thought into this, so they may have even thought of a way to hinder hacks through the emulator, but not for long, cuz you know a lot of people bought the 360 just to hack it.
That'd be stupid funny if the emulator allowed the same softmods as the original xbox.
1) I wonder if anybody has tried, and
2) I wonder if Microsoft put some kind of funny message in when it detects the attempt.
Runs all code in kernel mode? That sounds like a really foolish decision by Micro$oft (could be the cause of some of the instability). There is a reason why modern processors have two modes. Oh well I guess its just a toy anyway.
After playing a 360 for a few hours(Call Of Duty), I am very pleased with the system and the speed of loading is fine with me... so my question would be...
...why hack this one? I agree the price of the games is too high, and it would be better regulated by demand, but I can't help but wondering... what benefits would be had by hacking.
My hacked XBOX does allow me to load up my son's games without worrying about them getting scratched (games not kids), and they can also watch whatever movies they choose, and it's much faster, but it wasn't cheap. I had to pay to get it hacked, I also had to get a new hard drive, and I gave up LIVE among other features, but it serves it's purpose, but what exactly is to be gained from hacking the 360?
Just from the description the security seems pretty layered. Doubt hacks will flow that fast and when they do come they will not be all that awesome. If supersonic is going the speed of sound and hypersonic refers to a speed of five times the speed of sound then hypervisor.. well is tough to mess with: http://www.research.ibm.com/secure_systems_department/projects/hypervisor/
In response to #14, my main reason would be to get more video options to work. On current hacked xbox's I can play all types of video without a Media Center pc. With the current setup I need a pc, and it will only play certain types of files.
dreampc:
hacking the box is not simply to be able to play games you downloaded. One of the best apps out there right now is the Xbox Media Center, which is free and extremely powerful.
In addition, there are several methods to unlocking the systems, many of which allow you to continue using Live, and some cost nothing and don't even require you to open the case.
Response to #15: One of the main reasons I hacked my Xbox is so that I can watch downloaded TV shows, like 24, in high-def on my HDTV. So far, Adelphia doesn't offer ANY of the network channels in HD, so I have to download them to see them. I download them on my PC, put them in a shared directory, then access them over the network from my XBox. By the way, you don't have to give up LIVE completely. Just lock your hard drive, disable your modchip when you boot, and play LIVE all you want (from what I understand... I don't play on LIVE).
In response to #15, the reason to hack the xbox 360 is to hack the xbox 360. When microsoft said that it will be difficult for hackers to break their system, it was a challenge. It's sort of a symbol that we as consumers don't have to be tied down by these corporations.
Fight the power back.
woops, i meant #16, not #15
hey #18, if i called it mega-ultra-visor, it isnt going to make it any tougher. The only thing that makes it tougher is stronger encryption, more keys, and stuff like that, not fancy buzzwords.
I knew this would happen. These days with totally custom CPUs and such you can put in some extreamly tough security.
I would not be suprised if it takes them till end of next year to get even a basic hack out.
i imagine that emulation would be the key to hacking the 360. as i recall, two months ago, j allard was saying that they don't know if they'll do backwards compatibility or not. and then a few weeks later, they announce that they can with certain titles. i suspect that they rushed the emulation thing so that they can make the deadlines. kinda makes sense eh?
"2. Posted Nov 28, 2005, 10:57 AM ET by NNTPgrip
No problem, somewhere, deep down, there has got to be Internet Explorer on the thing. Thats all anyone will ever need. ;)"
This functionality may already exist as a feature through MC
Check it out here.
http://games.slashdot.org/article.pl?sid=05/11/28/1413228&from=rss
I see it in the photo, but I see nothing on my screen on my desktop. I was going to get a powerbook, but I think Im going to wait for the Intel version.
Heh - actual statement from IBM:
"_sHype_ is a hypervisor security architecture developed by IBM Research, in various stages of implementation"
Unfortunate name of a security architecture. Sounds more like an accurate description of the "Microsoft Security Initiative"
New slim Xbox 360 will come out when someone finally hack original Xbox 360.
Hmm... Ultimately, everything in the system is just bits. Hacking it to do whatever you want is a matter of getting to run arbitrary code in ring 0, and considering everything runs in ring 0 already, it all boils down to:
Can you run anything on it? Well, since the Xbox runs games from DVD, the answer is yes. Next question: Can you imitate a game in the right way that it satisfies security precautions while executing *something* on the system?
Ultimately boyz and girlz, hacking anything that isn't 100% closed box is as easy as your ability to examine the communication protocol between the outside world and the inside one. Imitate it, and voila.
Good luck.
smart move in putting most of the encryption key security stuff inside the cpu itself. that way they cut of a lot of standard hardware mod chips.
last time i read about something with similar amount of security layers was the hi-md system from sony...
I wish a hacker would figure out how to run OS X on the 360.
That would give "X Box" a whole new meaning!
Wouldn't it be great to have M$ subsidize the cost of your next Mac.
I understand the need for security - how else can they fetch those prices on the games to make up for subsidizing what is essentially a PC. That said not everyone wants to hack their x-box to play downloaded games. One reason to hack is to hack for the challenge - to "climb the mountain because it is there". The second, and the one MS (and others) should be paying attention to is for the know-how. The security will eventually make its way into PC's. And, hopefully, the mods & hacks will eventually become features for the next box.
Man, this is worse than Slashdot. The source of this information is "I met someone on the IRC the other day who told me the following." Take all these items with a big grain of salt. I'm sure some may be true, but it is probably more guess work than fact.
Hypervisor:
http://en.wikipedia.org/wiki/Hypervisor
I'm not gonna buy one until it's hackable. If not, I have no plans on buying one. And it's not because I particularly care to pirate their games or anything, it's just that I've found the open-source xbox projects (notably, Xbox Media Centre) to be far more valuable than any game on it.
Microsoft should take note. If they were to make a XBMC (that supported all of the same features as the open-source release), then I'd snap-up a 360 in a second. Or, alternately, give the XBMC folks a signed bootloader that only works with XBMC so they can continue development.
Until then, no 360 in my house.
N.
Basically hackers are screwed, judging from what I just read.
You could probably exploit getting a system on there via the media center extender function, but once on, it sounds like the 360 will fail to operate, especially if checks are present in the CPU. You're going to have to bypass the CPU, but by then, what's the point?
The answer for any programmer or hacker or whatever to the question "Why do it?" can best be summarized like so:
I've always remembered from one of my favorite college professors when we were learning how to write Assembly and a student asked, "But Mr. Harris, why would you ever want to do that?" and his answer, "Because you can." Even though Dr. Harris is gone now I'll always remember that.
Acording to Wiki "Originally, hypervisors were developed in the early 1970's, when cost reduction was forcing multiple scattered departmental computers to be consolidated into a single, larger computer, the mainframe, that would serve multiple departments. By running multiple OS's simultaneously, the hypervisor brought a measure of robustness and stability to the system; even if one OS crashed, the others would continue working without interruption." "The first computer system designed specifically for virtualization was the IBM/360 mainframe computer, developed in the late 1960's." Hmm, that sounds like the name could have some type of link. Hmm.
This seems like it may be a tough nut to crack. But if the info posted above is correct, and the hypervisor only uses checksums as opposed to a strong error check like a CRC or other ECC code, then there may be hope.
Hopefully someone does find a way to execute naitive, arbitrary code, and the CPU serial number/encrytion key can be dumped, and the boot rom decrypted. Then, maybe the boot rom could be rewritten. Heck, maybe the key/SN is in flash to, and it can be rewritten as well.
As a game console, I'm eager to see how well this tech holds up, and how it affects online gaming (cheat free enviornment?). I fear for the future of the PC though. Time for some inventor to head to the garage and make the next PC?
Response to #18 - running all code in kernel mode generally increases performance about 10% due to not needing context switches between kernel mode and user mode, at the expense of OS stability. Since you're only running one app at a time anyways, it's not really that big of a deal. The XBox1 did the same thing.
Nothing is impossible. If one man can make it another can break it.
I love a hack as much as the next guy, but to be honest, I can't see anything that needs hacking on the XBox (except xvid codec support). A lesser known fact is that the Windows Media Extender functionality on the xbox allows it to run ANY windows program... Although the obvious catch is that the program is actually hosted by another windows computer on your network, but this doesn't bother me. I have Web browser, RSS, and Tetris functionality on my xbox, and will probably add more later.
i hacked the xbox 360 go to playboy.com to find out how i did it
What are you talking about, when SNES was king everyone ripped it, it was....religious. Then PS came on the scene, it took down the king, that was a revolution ...which people wanted.
But WTF is this, this is corperate shite, this isn't going to get hacked properly, common, not like SNES and PS were. It's 2005, things don't feel the same.
i doubt it blows up (rolls eyes at Matt) people automatically assume that when something explodes, chaos and death ensues. they could mean figuratively, or the cpu fries itself. some people....
Your all forgetting something..
The CPU is in itself proprietry, so code that executes perfectly on any old PC, probably won't execute properly, if at all on the Xbox 360.
One might have to go as far as making a new CPU before any direct hacks can be applied to the Xbox.
The best bet is for someone to snap up a Debug machine and start developing soft-hacks from it.
But it's anyone's guess unless your a Rogue Xbox core developer, which is probably never going to happen.
They're payed too much :P