MIT grad student hacks into Xbox security system

[tigerbait]

did a search, so I apologize if this is a repost

Yahoo Article

LOS ANGELES, June 3 (Reuters) - A graduate student at the Massachusetts Institute of Technology has found a way to circumvent the security system for Microsoft Corp.'s (NasdaqNM:MSFT - News) Xbox video game console, opening the way for hackers to use it to run competing software, according to documents released over the weekend.

The MIT computer expert, who posted his report on his university Web site, also questioned the security behind Microsoft's soon-to-launch online service, Xbox Live, saying hackers could exploit a flaw in the system to identify individual players from their game machines.

Andrew Huang, who recently completed a PhD thesis on supercomputer architecture, wrote a memo May 26 describing his efforts to build hardware that would read the Xbox's internal security system. A link to the 15-page report was posted this weekend at technology news and discussion Web site Slashdot.org (http://www.slashdot.org).

Computer enthusiasts have been excited about the possibility of using the $199 Xbox, which is technologically similar to a PC, as a stand-alone computer running operating systems like Linux.

Some see it as the ultimate slight against Microsoft -- using the software giant's own hardware to run software that competes against its Windows operating system.

In the memo, Huang said the Xbox's primary security is contained in what he calls a "secret boot block" that is encoded into a media processor chip built for the Xbox by Nvidia Corp. (NasdaqNM:NVDA - News)

MIT whitepaper on the security holes in the MS X-Box

Is this basically telling us what we already can do with the newly released Xbox "modchip" or is this going a step further?

once this goes mainstream, that will be one nice $199 PC.

 

[Gooberlx2]

Living room DivX and Mp3 server anyone?

 

[UNCjigga]

If the boot block really does reside on the MCP, then I doubt any modchip can defeat it--this definately goes a step further. Otherwise, those modchips (which would have all the functionality of an nvidia MCP) would be VERY expensive...and I don't think you can just yank out the chipset either!

 

[thelanx]

No this is much more than a mod chip! Not only will you be able to play any game, you will have complete control, it will be like a computer.

 

[Mark R]

Basically, the method descibed is one which will allow retrieval of the decryption key used to decrypt the OS ROM.

Previous attempts to analyse the XBox boot sequence have been thwarted by the fact that the OS ROM is encrypted. As might be expected also in ROM is a program that decrypts the OS, but there is a problem, it doesn't work, the output is just garbage.

The security works by having the real OS decryption program built into the south bridge - the one in ROM is a fake designed to obstruct hackers. Because the decryption key is built into ROM in the south bridge, it was supposed to be impossible to retrieve - MS assumed that it would be impossible to spy on the super-fast hypertransport bus which connects the south bridge to the rest of the system - however, this paper describes a cheap and simple way to intercept the hypertransport signals, and reveal the program being read from ROM and being transferred to the CPU.

Once the key is retrieved, it would be simple to decrypt the OS, modify it, and then encrypt it again so that it will boot, then just flash the new OS onto a chip. I presume that the OS chip is socket mounted, which means that a mod based on this system should require no soldering, plus if you are able to modify the OS in any way pleased, then the possibilities are endless - this includes running Linux, an OS modified to allow PC software, and much much more.

 

[UberNeuman]

Ooohhh... Daddy like!

 

[tigerbait]

evening bump

 

[StageLeft]

If there isn't a bunch of crap you have to do to get it to work that would be awes.

 

[bozack]

"Hack the Planet"

 

[austin316]

Heres the problem, not all of us are MIT Grad Students.

 

[tigerbait]

Originally posted by: austin316
Heres the problem, not all of us are MIT Grad Students.

true , but

By attaching a custom-designed board to that high-speed data path, Huang was able to capture the data transmitted between the two chips and manually process it to uncover the secrets contained in the "boot block."

He said it took a total of three weeks to build his custom board for a total cost of around $50.

he could sell them to us for $50

 

[Techronious]

Originally posted by: tigerbait

Originally posted by: austin316
Heres the problem, not all of us are MIT Grad Students.

true , but

By attaching a custom-designed board to that high-speed data path, Huang was able to capture the data transmitted between the two chips and manually process it to uncover the secrets contained in the "boot block."

He said it took a total of three weeks to build his custom board for a total cost of around $50.

he could sell them to us for $50

He could, but then you know what would happen? He would be making NO MONEY. He would be selling them for what he paid to make it and also he is taking three weeks to build them, so it would be even worse for him. I know you were joking, but just playing the "glass is half empty" role.

 

[EvilYoda]

Well, if it cost him $50 to build it in three weeks, and that was the first shot (or so), I'd imagine they could streamline the build process (someone like lik-sang or something), and get the per-chip cost down to like $20, and sell it for $100. It'd be nice having a $300 living room DVD/divx/MP3 linux/[OS of your choice here] box, with no hassle...

So we wait and see.

 

[Praetor]

Originally posted by: Techronious

He could, but then you know what would happen? He would be making NO MONEY. He would be selling them for what he paid to make it and also he is taking three weeks to build them, so it would be even worse for him. I know you were joking, but just playing the "glass is half empty" role.

Not necessarily. It took him 3 weeks to build the first one. This is most likely including any final tweaks, modifications, etc that had to be done to "perfect" it. Future chips, if built from scratch, would take much less time. Granted, not a 1 board per hour, but definately not 3 weeks per board.

I agree with you though that it would be a bad idea for him to do this himself. Just leave the schematics out and available and us hackers or psuedo-engineers will build 'em ourselves.

 

[fooshkee]

cool... bump...

 

[Comp625]

I like my X-Box the way it is...

 

[Ferocious]

That's cool.

MS should hire that guy.

 

[milagro]

Originally posted by: EvilYoda
Well, if it cost him $50 to build it in three weeks, and that was the first shot (or so), I'd imagine they could streamline the build process (someone like lik-sang or something), and get the per-chip cost down to like $20, and sell it for $100. It'd be nice having a $300 living room DVD/divx/MP3 linux/[OS of your choice here] box, with no hassle...

So we wait and see.

if that's all anyone wants at the end of the day, I'm sure dell or other box makers can spit something out that cheap or even cheaper....either way, its kinda kool when constructive hacking puts pressure on the market

 

[MadRat]

Its this kind of hacking that will bring about XBOX emulation for the PC.

 

[ElFenix]

Originally posted by: tigerbait

Originally posted by: austin316
Heres the problem, not all of us are MIT Grad Students.

true , but

By attaching a custom-designed board to that high-speed data path, Huang was able to capture the data transmitted between the two chips and manually process it to uncover the secrets contained in the "boot block."

He said it took a total of three weeks to build his custom board for a total cost of around $50.

he could sell them to us for $50

why would you want one? it looks like he already uncovered everything that the device is needed for. i bet he could publish plans and then anyone with a radio shack and some soldering skills could build one.

 

[Darien]

console divx player that runs linux and is a server for the home...

that'd be awesome.

 

[Mark R]

The device described is not the mod chip - it is a 'sniffer' designed to find out the 'password' the the encrypted OS.

You only need 1 device, on one Xbox to retrieve the password - the same password is used in every xbox.

Once the password is available - any Xbox can be hacked with trivial ease - just pull out the ROM chip, and insert a cracked one.

 

[gregor7777]

Originally posted by: MadRat
Its this kind of hacking that will bring about XBOX emulation for the PC.

Exactly. Port the OS and you allready have the games and bam! Halo for the PC while the programmers drag their feet for another couple years.

 

[MadRat]

My gut would bust wide open if I saw someone playing XBOX games on a Mac using OS X and running an emulation of Windows to drive the XBOX emulation. Oh, the irony!

 

[js1973]

"Heres the problem, not all of us are MIT Grad Students. "

That's the best laugh I've had all day.