PlayStation 3 used to hack SSL, Xbox used to play Boogie Bunnies

Between the juvenile delinquent hordes of PlayStation Home and some lackluster holiday figures, the PlayStation has been sort of a bummer lately, for reasons that have nothing to do with its raison d'etre -- gaming. That doesn't mean that the machine is anything less than a powerhouse -- as was made clear today when a group of hackers announced that they'd beaten SSL, using a cluster of 200 PS3s. By exploiting a flaw in the MD5 cryptographic algorithm (used in certain digital signatures and certificates), the group managed to create a rogue Certification Authority (CA) which allows them to create their own SSL certificates -- meaning those authenticated web sites you're visiting could be counterfeit, and you'd have no way of knowing. Sure, this is all pretty obscure stuff, and the kids who managed the hack said it would take others at least six months to replicate the procedure, but eventually vendors are going to have to upgrade all their CAs to use a more robust algorithm. It is assumed that the Wii could perform the operation just as well, if the hackers had enough room to spread out all their Balance Boards.

[Via ZD Net]

[collegekid13 @ Dec 30th 2008 5:46PM]

so from all these article i now know my ps3 is a WMD. Please bush don't invade my dorm room. It's only one little PS3

[jbuers @ Dec 30th 2008 5:49PM]

Do you have any oil wells in your dorm room?

If not, I think you're safe! *ba-dum pshhhh*

Tip your waitress!

[DWells55 @ Dec 30th 2008 5:53PM]

It's almost 2009 and you're still making George Bush and WMD jokes? Come on now.

[oGMo @ Dec 30th 2008 6:04PM]

@DWells55: It's not *yet* 2009/1/20.

[Unknown @ Dec 30th 2008 7:30PM]

@DWells55: It's almost 2009 and you *still* have troops in Iraq?

[Enigma @ Dec 30th 2008 7:48PM]

Meh. It's almost 2009 and we *still* have troops in Europe. Interesting story behind that one...

[unzarjones @ Dec 30th 2008 7:56PM]

Jbuers, you snotty kids with the solar power cars really get to me. Hopefully the islamists get to you!

[Mitch @ Dec 30th 2008 8:37PM]

Now we know where all the PS3's sales came from.

[Alex @ Dec 30th 2008 9:40PM]

Thank you so much Enigma for making that point. Too many people on both sides of the puddle forget that Europe would be nothing like it is today with out the U.S. I'm sick of all the ultra liberal - hippie - Bush bashers that know nothing about fact or history and yet they still open their mouths spouting their propaganda. Oh yeah and the PS3 is amazing.

[Anthony-E @ Dec 30th 2008 10:29PM]

Wow, this Alex guy thinks exactly like me. Good to see that not everyone on the internet is a retard.

[Wooya @ Dec 31st 2008 8:32AM]

@Alex

They (Third Reich & its ally) actually invaded other countries, Iraq did not.
At least half of the international community allied with U.S. (even Soviet Union), this is not true either about Iraq.

Let's face it. The Iraq war is not popular and it cannot have support as U.S. had in WWII

[Alex @ Dec 30th 2008 11:37PM]

Ha ha and I'm glad, Anthony-E, that I'm not alone because it sure feels that way most of the time.

[Flashpoint @ Dec 30th 2008 11:17PM]

I'd like to ask: "is it just me or is the PS3 good at everything but gaming?"

but some asshole on engadget would reply "its just you" and get a Highest Ranked.

Therefore I will make a Declaritive statement.

THE PS3 IS GOOD AT EVERYTHING EXCEPT GAMING.

[FuzzyCat @ Dec 31st 2008 5:14AM]

"Thank you so much Enigma for making that point. Too many people on both sides of the puddle forget that Europe would be nothing like it is today with out the U.S."

The US aren't in Europe for anyone else but themselves, it allows you to launch fighters/bombers during conflicts without the need of a carrier it also allowed (possibly still does) the storage of nukes during the cold war. It also allows you to ship people out to countries haven't banned torture in order to sidestep your own laws.

There are an awful lot of people who are greatful for the US's entry into WW II - albeit a late entry - but that does not excuse anything and everything the US does that is wrong. This Bush is not representative of your other presidents at all - this Bush is a dufus.

[Troy Powers @ Dec 31st 2008 9:55AM]

@FuzzyCat

The difference is, none of these European countries WANT the U.S. to leave. These military installations with thousands of soldiers and families have become a large part of their economies. A lot of towns in Germany would turn into dust-bowls if the U.S. military pulled out. Bush has actually THREATENED to pull our troops out of Europe when he doesn't get his way.

[dagamer34 @ Dec 31st 2008 3:17PM]

You know, you're not allowed to export systems like the PS3 or Xbox 360 to countries that sponsor terror right? It's illegal. Heck, even the PS2 made the list back in the day!

[D @ Dec 30th 2008 5:49PM]

Hacking with a wii balance board, now that sounds like a movie from the 80s i would LIKE to see!

[ED @ Dec 31st 2008 7:34PM]

*girls* hacking on Wii balance boards

[J0K3R @ Dec 30th 2008 5:52PM]

Woot im actually first, think they would give me one of those ps3's

[Arkenklo @ Dec 30th 2008 6:01PM]

You fail so hard it's funny.

+1 from me.

[J0K3R @ Dec 31st 2008 12:36AM]

smh...it was my first time commenting, i woulda been first but I didn't kno i had 2 confirm lmfao...w/e now i kno

[TrentD @ Dec 31st 2008 8:24AM]

Worst comment ever. For multiple reasons.

[V Langs @ Dec 30th 2008 5:49PM]

certainly not useful...

....but ridiculously impressive

the knowledge of my sweet generation, we kick ass. :-)

[J0K3R @ Dec 30th 2008 5:51PM]

aww man... i tried

[kjb434 @ Dec 30th 2008 5:51PM]

At least someone found a use for the PS3.

[Game_playa @ Dec 30th 2008 6:15PM]

Tool.

[NHAnimator @ Dec 30th 2008 6:19PM]

Actually, I do have Tool loaded up on mine.

[kjb434 @ Dec 30th 2008 6:21PM]

@Game_playa

That fact that you take offense to my silly little statement shows us who the tool is...

[iphoney @ Dec 30th 2008 6:32PM]

this is just saaaaad. no one is playing their ps3.

[Abuzar Baloach @ Dec 31st 2008 12:28AM]

I don't know why I checked but kjb you have 666 comments on engadget.

[SiXiam @ Dec 30th 2008 5:51PM]

200 PS3's * $400 each = $80,000

Rich group of hackers maybe...

[Dani Reader @ Dec 30th 2008 5:56PM]

I could be wrong, but I'm pretty sure Sony has offered clusters at a wholesale discount to buyers like these; Scientists, unis, hackers and such

[Mic2000 @ Dec 30th 2008 6:02PM]

It's funded by a school from the Netherlands offcourse ;).

[MioTheGreat @ Dec 30th 2008 6:40PM]

"I could be wrong, but I'm pretty sure Sony has offered clusters at a wholesale discount to buyers like these; Scientists, unis, hackers and such"

Yeah. I mean, it's not like anyone is using them for gaming. They have to do something with them.

[iphoney @ Dec 30th 2008 7:54PM]

A loss for Sony since those hackers don't intend to purchase any games or accessories for it, which is pretty much how console mfrs make a profit these days.

[tom @ Dec 30th 2008 8:35PM]

A result of collaboration of crackers using Cracking@home?

[Phour ZwanZig @ Dec 30th 2008 10:12PM]

Question is thou.. How many dif companies have done that.. Bought Hordes of PS3 to use as a Super Computer..

So how INFLATED is that number sold due to these "PS3 Super Computers"


Try again Sony... Its not a game console its an F'in PC...

[protozoider @ Dec 31st 2008 10:06AM]

$80k... I'm pretty sure this was done with a lot less. After all, someone cracked WPA with an NVIDIA GPU. I'm really not impressed that it would take 200 PS3s to hack something. That doesn't exactly mean they are powerful. $80k could buy you one really powerful system far superior to 200 PS3 systems.

[Nick @ Dec 31st 2008 10:44AM]

@mic2000

Which one? TU Eindhoven?

[Blaine Oliver @ Dec 30th 2008 5:52PM]

Assuming these were bought recently, at $50 per console, that Sony lose, this system costs Sony $1000. Thinking about it, every PS3 that is bought for these purposes ends up quite expensive for Sony.

[melloncollie @ Dec 30th 2008 5:54PM]

I believe you meant to say $10000.

[Blaine Oliver @ Dec 30th 2008 5:58PM]

Yeh, damn typos!

[Titanas @ Dec 30th 2008 6:00PM]

..but what about the marketing value gained, free exposure to blog etc? To throw more numbers in the mix, according to Consumer Depot lower price for a 80GB PS3 is 349 USD or 69800USD for all 200 of them. Add some networking gear and time spent, this hack was a pretty major one. I bet Sony is very happy..

[Charlie @ Dec 30th 2008 6:42PM]

Doesn't really matter how much exposure they get in the press for this kind of thing. All it does is make more people want to buy the PS3 for this sort of job, NOT to play games. Which of course means that Sony loses more money per PS3 sold...

The other thing I'm wondering about though is how many of the PS3s that are sold each week are being used for projects such as this? This is certainly not the first time I've heard of PS3s used to do massive computing projects, so... any guesses as to the percentage of PS3s sold that are being used for their computing power and not for their gaming potential? I'm thinking 5%...

[dark star @ Dec 30th 2008 6:45PM]

im no math genius, but sony would loose a whole lot more than $50 if you dont buy a ps3 in the first place! :)

[PSN: Aggie_CEO @ Dec 30th 2008 7:51PM]

@Charlie......

as those people surely dont go to 50 or so stores to pick up 2-4 PS3s then its not included in the NPD numbers.......

[matt @ Dec 30th 2008 8:42PM]

Yeah it can fold like a motha too.

If i am ever obscenely rich I am buying a clsuter of PS3s to fold@home till i cure all those diseases.

[FuzzyCat @ Dec 30th 2008 5:56PM]

"the group managed to create a rogue Certification Authority (CA) which allows them to create their own SSL certificates"

Huh? It takes virtually no effort to create your own CA and even less to create your own SSL cert - did you mean to say that they recreated one of the valid standard CA's with their own info and then generated ssl certs from that?

[polobunny @ Dec 30th 2008 6:32PM]

Just my thought. The whole article didn't seem very impressive, neither necessitating 400 PlayStation 3. :P

[Kai @ Dec 31st 2008 2:24PM]

According to the "Read" link:

Our attack scenario basically is as follows. We request a legitimate website certificate from a commercial Certification Authority trusted by all common browsers. Since the request is legitimate, the CA signs our certificate and returns it to us. We have picked a CA that uses the MD5 hash function to generate the signature of the certificate, which is important because our certificate request has been crafted to result in an MD5 collision with a second certificate. This second certificate is not a website certificate, but an intermediary CA certificate that can be used to sign arbitrary other website certificates we want to issue. Since the MD5 hashes of both the legitimate and the rogue certificates are the same, the digital signature obtained from the commercial CA can simply be copied into our rogue CA certificate and it will remain valid.

So basically, they got a regular website certificate. But by using the PS3s they created a certificate that can sign other certificates (the regular certificate is not allowed to do this!), and because the created certificate and the regular certificate have the same hash it is accepted. They need the PS3s to calculate a certificate that would have the same MD5 hash.