Post: fail0verflow! - Sony's ECDSA code
Options
12-29-2010, 04:08 PM
#1
manster
League Champion
Hi!
Featured News from You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
JAILBREAK -> DOWNGRADE -> fail0verflow
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
Well the big PS3 Exploit talk is now officially over at the annual 27C3 conference. All the big names in the developer scene world was there giving a one hour talk regarding Sony's EPIC FAIL
You must login or register to view this content.
But basically they talked about how the PS3 totally failed in security, by botching the pki implementation it became possible to calculate the keys needed to sign everything. PUBLIC PRIVATE KEYS, and replacing the "revoke-list" with super-large one (overflow) during the bootup NOR flash at startup, giving them full control of the PS3 system.
Featured News from You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
JAILBREAK -> DOWNGRADE -> fail0verflow
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
Well the big PS3 Exploit talk is now officially over at the annual 27C3 conference. All the big names in the developer scene world was there giving a one hour talk regarding Sony's EPIC FAIL
You must login or register to view this content.
But basically they talked about how the PS3 totally failed in security, by botching the pki implementation it became possible to calculate the keys needed to sign everything. PUBLIC PRIVATE KEYS, and replacing the "revoke-list" with super-large one (overflow) during the bootup NOR flash at startup, giving them full control of the PS3 system.
The 360 console is now more of secure system then the PS3 after all these years!
This site was announcend at the conference
You must login or register to view this content. - Coming Soon
You must login or register to view this content.
check this site too
You must login or register to view this content.
"The recent advent of these new exploits means current firmware is vulnerable, v3.55 and possibly beyond. It will be very difficult for Sony to fix the described exploits."
"we can now run unsigned code on an non-exploited PS3."
@KushanTheCat our goal is to have linux running on all existing PS3 consoles, whatever their firmware versions.
Our current PS3 goal: AsbestOS.pup
Myth #1: It took us 3-4 years to do this. Negative, this exploit only took a few months after we started working. We weren't trying before.
Myth #2: Sony can change keys. No, they can't. These aren't encryption keys, they're signing keys. If they change them GAMES STOP WORKING.
Clarification #3: The private keys refer to keys that Sony HQ uses. PS3s don't have these keys (but we calculated them due to the fail).
Clarification #4: the random number isn't 4, it's more like 007eabbb79360e14df1457a4194b82f71a0dc39280 (example). But it's still constant.
Note: we won't be working long-term on CFW or similar. We'll release tools and a PoC, someone else can take over. The fun part is done
Myth: Geohot -> Sony pulls OtherOS -> JB -> Fail. Fact: Slim had no OtherOS -> Geohot -> ... . Geohot started his work due to the Slim.
@You must login or register to view this content. yes, we'll release all our tools as soon as we cleaned them up in january or so.
Great news for all PS3 User's 
Console Hacking 2010 - Chaos Communication Congress
Screenshots:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
short videos from the conference:
[ame]https://www.youtube.com/watch?v=YbUVgxw1yWc&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=GPjd6gHY6A4[/ame]
[ame]https://www.youtube.com/watch?v=ClnvJe4_u0Q&feature=player_embedded[/ame]
Full Video
[ame]https://www.youtube.com/watch?v=hcbaeKA2moE[/ame]
Splitted in 3 parts:
[ame]https://www.youtube.com/watch?v=X6CA4fqAdsc&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=X8ohOy8_XO4&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=Eag0VyRTld8&feature=player_embedded[/ame]
Download full video here (right click -> save as):
You must login or register to view this content.
Marcan @ 27C3 Lightning Talk
[ame]https://www.youtube.com/watch?v=lGI0EnNQ5GE&feature=player_embedded[/ame]
Have fun watching
Sources:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
This site was announcend at the conference
You must login or register to view this content. - Coming Soon
You must login or register to view this content.
check this site too
You must login or register to view this content.
Originally posted by another user
"The recent advent of these new exploits means current firmware is vulnerable, v3.55 and possibly beyond. It will be very difficult for Sony to fix the described exploits."
"we can now run unsigned code on an non-exploited PS3."
@KushanTheCat our goal is to have linux running on all existing PS3 consoles, whatever their firmware versions.
Our current PS3 goal: AsbestOS.pup
Myth #1: It took us 3-4 years to do this. Negative, this exploit only took a few months after we started working. We weren't trying before.
Myth #2: Sony can change keys. No, they can't. These aren't encryption keys, they're signing keys. If they change them GAMES STOP WORKING.
Clarification #3: The private keys refer to keys that Sony HQ uses. PS3s don't have these keys (but we calculated them due to the fail).
Clarification #4: the random number isn't 4, it's more like 007eabbb79360e14df1457a4194b82f71a0dc39280 (example). But it's still constant.
Note: we won't be working long-term on CFW or similar. We'll release tools and a PoC, someone else can take over. The fun part is done
Myth: Geohot -> Sony pulls OtherOS -> JB -> Fail. Fact: Slim had no OtherOS -> Geohot -> ... . Geohot started his work due to the Slim.
@You must login or register to view this content. yes, we'll release all our tools as soon as we cleaned them up in january or so.
Console Hacking 2010 - Chaos Communication Congress
Screenshots:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
short videos from the conference:
[ame]https://www.youtube.com/watch?v=YbUVgxw1yWc&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=GPjd6gHY6A4[/ame]
[ame]https://www.youtube.com/watch?v=ClnvJe4_u0Q&feature=player_embedded[/ame]
Full Video
[ame]https://www.youtube.com/watch?v=hcbaeKA2moE[/ame]
Splitted in 3 parts:
[ame]https://www.youtube.com/watch?v=X6CA4fqAdsc&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=X8ohOy8_XO4&feature=player_embedded[/ame]
[ame]https://www.youtube.com/watch?v=Eag0VyRTld8&feature=player_embedded[/ame]
You must login or register to view this content.
Marcan @ 27C3 Lightning Talk
[ame]https://www.youtube.com/watch?v=lGI0EnNQ5GE&feature=player_embedded[/ame]
Have fun watching
Sources:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
Last edited by
manster ; 12-31-2010 at 11:43 PM.
The following 29 users say thank you to manster for this useful post:
369lo, 8======D----, bcb, Cain, CHuRCHYx, CRACKbomber, Fallen152039, Geigers, GetDeleted -_-, Hells, ihaxgames, IRiSe_GodFather, iSergeant-Adam, KimKardashian, MarioDaKid, Mark00agent, Mr. Aimbot, Mr. Star, Nicky74me, ProjectPartial, Slashey, Solid Snake, Suxh4rd2bu, That Guy_, The InvadeR, The Overdose, Uk_ViiPeR, UMD, XxLuisMaxX
12-29-2010, 10:46 PM
#20
manster
League Champion
Originally posted by Dutch
I lol'ed so much at this:
//Random num for private key
int getrandomnum()
{
return 4;
}
lol!! HAHAH
//Random num for private key
int getrandomnum()
{
return 4;
}
lol!! HAHAH
Originally posted by another user
Clarification #4: the random number isn't 4, it's more like 007eabbb79360e14df1457a4194b82f71a0dc39280 (example). But it's still constant.
source
You must login or register to view this content.
12-29-2010, 10:51 PM
#22
Cyborg Ninja
PS3 Security FtW !
Originally posted by manster
yes
looks very complicated
found some cool pictures:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
looks very complicated
found some cool pictures:
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
These are really interesting photo's what a wierd chipset hes using i wonder what it does.
I cant wait for the supposive release next month.
Unsigned code ftw ! .
---------- Post added at 10:51 PM ---------- Previous post was at 10:47 PM ----------
Originally posted by Dutch
Still though. Randomnum? nahhh. Lets just put in 4. HAHA
Sony are complete idiots they thought nobody would ever get far enough to cause any real damage.
Well they were wrong.
The main thing i thought was funny was the fact that they basically called the hyper visor stupid halfway through there talk.
They said it doesn't provide any sort of security there puzzled at what Sony thought they were doing.
Oh well hopefully these newly found exploits can't be patched that will f*ck up Sony a treat. !
12-29-2010, 11:07 PM
#24
Cyborg Ninja
PS3 Security FtW !
The following user thanked .Requiem. for this useful post:
12-30-2010, 12:40 AM
#26
ihaxgames
Treasure hunter
Originally posted by packarda12
It seems they have found a way to replicate sony's signature.
Which correct me if I'm wrong.
Means stuff like backup manager can be signed and run in non jailbreak mode.
It could also lead to a number of different other things.
Which correct me if I'm wrong.
Means stuff like backup manager can be signed and run in non jailbreak mode.
It could also lead to a number of different other things.
You are correct, the only issue involving that is installing packages, which could be done with using the proxy server do download a backup manager or something like that instead of a game patch, as that would be the easiest way to install it
12-30-2010, 01:32 AM
#27
Mr.Pure420
Banned
Originally posted by manster
give it 2-3 weeks ps3 gonna be fully hackable get ready for homebrew
Copyright © 2024, NextGenUpdate.
All Rights Reserved.
