1KIND Reviews
1 HN recommender · recommended in 3 months, 2011–2015
44:40 · 47K views · Dec 30, 2010
The fail0verflow 27C3 talk on breaking PS3 security, covering how Sony's implementation failed, including its ECDSA mistakes.
Recommended as a fun, detailed account of how the PS3's security was broken.
3 comments from Hacker News
DRM does not require a closed/controlled ecosystem. The best protection against the development of game-copying modchips on the PS3 was the ability to run Linux on it as an official feature. The serious jailbreaking (which necessarily allowed game-copying) was done only after they pissed off the "other os" crowd by removing it in a later patch. (the fail0verflow's talk[1] at 27C3 on jailbreaking the PS3 is really fun, and they discuss this in detail. (also: as discussed about 35min into [1], using the same nonce for the ECDSA signature of every game? So the keys can be derived from two games, without knowing most of the curve parameters? What was Sony thinking?!) [1] this video
More or less. 1. Sony removes "Install Other Operating Systems" option from the PS3 OS. 2. Out of frustration at corporate policy for REMOVING major features from hardware/device paid for and owned by millions, the hackers start working. 3. Months later, GeoHot releases (what I understand to be) the root private encryption keys for the device. 3.5 (forgot this) fail0verflow group circumvents the PS3's security system using this work from GeoHot - this video 4. Other hacking groups, now with the keys to the kingdom, begin working on hacking the PS3 to allow the installation of any software, not just officially released/signed/blessed releases. This results in a "jailbreak" for the PS3, much like what jailbreaking does to the lock-down security on an iPhone. (This is when things start to go south) 5. A technique for loading your own software onto the PS3, circumventing the system's security checks comes out. (Now the door to pirating PS3 games is open. Download images, burn the Blu-rays, pop them in the PS3 and play). 6. Another hacking group, using some portion of this manipulation, actually manage to get their PS3's logged into the private developer-based PSN network (it's a full copy of the real PSN network specifically for developers actively working on titles that need to test things like updates or addon downloads/installs). 7. It is discovered that the PSN-Dev network does not do real credit card authentication before items are purchased and downloaded. So for example, if I
The PS3 only went uncracked for so long because Sony offered the option to install Linux on the PS3. Once Sony removed that option the people with the smarts to crack the PS3 did so. Once a magnifying glass was put under the PS3 it turned out that the "DRM" was actually horribly implemented (like Rand() functions that were essentially returning constants). this video