Christiaan008
2 HN recommenders · recommended in 3 months, 2019–2026
44:11 · 33K views · Jan 6, 2011
The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.
HN recommends it as the primary source on Sony's ECDSA nonce-reuse blunder and the history of console cracking.
4 comments from Hacker News
This doesn't take anything away from Sony's decision making, but removing OtherOS never really helped them "get good security". The PlayStation 3 was cracked wide open [1] without OtherOS and because people were pissed at its removal. On Playstation 3s released in the first 3.5 years of its lifespan you can get full hypervisor compromise without any hardware mods, and you can yet again run OtherOS on the latest firmware. Now with less restrictions than before. Newer PS3s (starting with CECH-25xx) have 'only' been partially compromised. They can't run OtherOS, but they can still run homebrew and piracy despite Sony taking OtherOS away. Maybe it's a bit of solace that this stuff only punished Sony. But inevitably, the lesson they learnt is "we'll never experiment with this stuff again". [1]: This video is really worth watching if you're interested in this stuff: this video
If anyone is interested in the cryptography mistake that Sony made I recommend watching the Console Hacking talk at 27c3 by the fail0verflow team: this video
I'm a frankly rather disgusted at the comparison (or suggestion of) using an LLM to correct the record. So instead I used the 20 watt "LLM" behind my eyeballs running on snacks to reaffirm my memory as someone who was there. Going through old news articles and WayBackMachine where needed. Sadly your own blog was privated and not archived, which makes some things difficult. But news reposts from other sources were helpful! Back in Jan 2010, Digital Foundry did an excellent cover of your work on the PS3's hypervisor attack [1] Grabbing some choice quotes from that article: - "the all-important decryption keys are held entirely in the SPU and can't be read by Hotz's new Hypervisor calls" - "The other security element is the so-called root key within the CELL itself. It's the master key to everything the PS3 processes at the very lowest level, and according to publicly available IBM documentation, it is never copied into main RAM, again making its retrieval challenging. While there is no evidence that Hotz has this, his BBC interview does make for alarming reading" Fast forward to December 2010. 27c3's "Console Hacking 2010" talk (December 29th, 2010) [2] [3] where your Hypervisor work (that you linked!) is mentioned at 4:25 or so. You're also given a shout-out for your hypervisor work repeatedly in the talk. With the link you provided described at 18:25. Described as "really unreliable" and "eh whatever" due to requiring hardware modification and only granting rudimentary hyperv
I believe the patent issue was by far the dominant friction for adoption in 2000s. On the NIST curve problem, well, maybe FUD, but evidently, they indeed backdoored the elliptic curve-based random number generator, so I would say some distrust is warranted. Irrespective of the curve issue, ed25519/x25519 is superior and has other nice properties like not catastrophically breaking if you can't generate a unique random "k" for ECDSA as PlayStation discovered the hard way[1]. [1]: this video