It's too bad that the cracking scene seems so vain, though. This article presented three groups:
* One which wants to sell 'jailbreak' kits to enable piracy, while keeping the details to themselves.
* One which had planned a related disclosure window amongst the broader community for two days from now, and seems to feel somewhat vocally that this release is very similar to their work.
* One which seems like they might have flaunted that window a bit for the credit.
It's amazing and inspiring what these people manage to accomplish, but it'd be nice to see less stepping on fingers - imagine what might happen if these groups really cooperated! I guess it's a very reputation-driven scene, but still...
There will always be squabbles among the different people and groups involved with finding exploits or developing jailbreak/"hack" "kits".
Following from that, there will also always be people who want to jailbreak only to pirate games and there will also be groups who want to disclose the exploits properly, or use them purely for research and non-piracy fun purposes.
Someone developed a exploit, packaged it in usb stick, called it the PSJailbreak, planning to sell it to as a piracy orientated tool. They sent out a few review copies to prove it worked.
One of the reviews obtained a USB trace of the exploit in action, passing it along to a few members of the homebrew scene. The homebrew scene recreated this exploit with an open source implementation (but with the ability to pirate games pirate games superficially patched out) beating the original PSJailbreak to market.
The homebrew scene then set upon developing an open source homebrew devkit.
Many manufactures released their own clone devices of the exploit, the timeframe susgests that they were also working from copies of the PSJailbreak.
It was the homebrew scene who later decimated the PS3 chain of trust, to develop installable modded firmware.
Just check out the amount of name calling and whatsnot thats put into those cracktros that can be traced at least back to the C64.
If you rigged your car to destruct 30 minutes after it went out of cell service, sold it to an unsuspecting buyer, and then laughed when they got stuck in the desert, you'd be rightfully thrown in jail. But yet these companies keep attempting to pull the same shit with impunity.
They lost.
IIRC Argonaut/Jez San had a POC of this using a very simple hardware bodge, intended as a potential way of publishing Eclipse (What became X) without a Nintendo licence.
Fortunately - Nintendo were interested in the 3D rendering, and that started the SuperFX/Starfox/ARC journey.
Internet and countries that don't enforce copyright exist you know? You can even get HDCP strippers on Ebay, pretty easily too. Never had any issue finding ISO and roms online, even for the Switch before this hack.
If only the legal side was a good enough security...
If you want a portable device that you can use to run your own software, then go get a tablet that run the Tegra X1, you will get the exact same thing.
https://www.slashgear.com/expect-an-irate-call-if-you-try-to...
How much further will they go? Will they remotely disable it? Or perhaps, they'll send it into "Service Needed" mode and cripple it?
Also great news for people who want to use their hardware for things that are actively against Nintendo's interests, like playing pirated games.
All around, seems like a story of us: 1, them: 0 story.
This. I decided against buying a switch because I discovered that it prevents owners from backing up save files.
I still don't plan to buy a switch until nintendo supports backing up save files officially like they do with cross-region compatibility. Having to loose 100s of hours of progress for what amounts to an arbitrary reason from a nintendo bigwig is not something I am willing to stomach.
I'll be backing up all my carts as soon as possible. Publishers lose code, assets, entire games (or decide to never re-release them).
Why would you even want to do that...? Money? Fame? As I've heard it said memorably, "would you tell someone who takes you hostage and locks you up, that the lock is actually trivial to open?" This is just further evidence of a fact I've noticed for a long time: a lot of security researchers are pro-DRM, pro-corporatocracy authoritarians, and their vision of "more secure" is a dystopian nightmare.
I still remember the good old days, when the hacking/cracking scene was entirely composed of people doing it for the freedom, with no do-gooding snitches to worry about...
10 years ago, if you shared a way to bypass a DRM scheme in the right places, it would live on for a long time. Now, it's more likely that some bastard is going to report it and get it patched in days to weeks.
Not to mention, it's not patchable without a hardware revision, so sharing it privately before sharing it publicly, while strongly hinting at that it's not patchable without a hardware revision (which has been done) has the same effect in practice for those wanting to escape Nintendo's jail, while letting those who use the Tegra in security-sensitive environments prepare adequately.
>10 years ago, if you shared a way to bypass a DRM scheme in the right places, it would live on for a long time. Now, it's more likely that some bastard is going to report it and get it patched in days to weeks.
From the article it looks like someone else was trying to sell it so she put it in the open for free.
>The release also seems to be partially a response to Team Xecuter, a separate team that is planning to sell a modchip exploit that can allow for similar code execution on the Switch. Temkin writes that she's opposed to Xecuter's explicit endorsement of piracy and efforts "to profit from keeping information to a few people."
It's a cat-and-mouse game, and this mouse wants to tell the cat how to catch the other mice. In the old scene, you'd be branded a traitor for doing that.
This bootloader bug is much sillier (IMO) than Sony's, though. Sony's was a series of crypto mistakes in the trust chain verification: it decrypted blocks in place and there was an issue in the checksum code that left it vulnerable to a timing attack, so a very, very small valid-but-colliding block had to be constructed and the rest of the bootloader was then freely-injectable. This nVidia/Nintendo mistake is an even sillier basic protocol issue.
I think the main lesson here is not to put complex protocol code in your immutable first-stage mask ROM, and if you do, to limit the surface area as much as possible, ensure memory safety, and audit the hell out of it.
Here's a youtube video published March 13th talking about it: https://youtu.be/ZzsbDGDwg1U?t=5m17s
And here's a related reddit discussion on the nintendo switch subreddit: https://www.reddit.com/r/NintendoSwitch/comments/8588c1/50_w....
Not the first system to go down because of a boundary check failure. Though I was hoping for something more spectacular.
[1] https://blogs.nvidia.com/blog/2016/04/25/virtual-cockpit/ [2] http://www.nvidia.com/object/visual-computing-module.html
I think this is amazing news. I'm almost fully convinced to buy a Switch now.
Classic.
So at least one positive then. Nintendo will be forced to improve their online services.
Edit: For people who down vote me do you work in security field or just down vote w/o knowledge?
