Hacking Four new people paid off by Nintendo in the HackerOne program

FAST6191 · Jul 26, 2017

Looks like others have taken care of the "this is a legit thing to do, carry on lads" thing for those which don't understand the world of security.

Where did the "you need your own OS" stuff come from?

Other than software as a service/lease type things which is not this as far as I am aware the only thing I have even close to this is undocumented APIs and leaked SDKs. From there most things seemed to be free and clear, however being undocumented you don't get to complain if the behaviour is not as you expect or vanishings without warning.
SDK wise. You could always write code for it and share it all you like ( https://sourceforge.net/projects/surreal64/?source=recommended has been up for many years now), compiled binaries on the other hand not so much.

We could possibly discuss the nature of APIs (was of interest to various open source peeps, generally command line and dll type calls were fine, linking is where it gets tricky). As we will presumably not be compiling against their source or anything and just calling functions and executing things within normal parameters then yeah.

From a functionality perspective (I imagine the underlying OS will be a bit nerfed) it may end up better to write an OS (hopefully the commercial game thing can be sandboxed or something) but from a legal perspective I am not seeing the need to for console hacks as we understand the concept.

themperror · Jul 26, 2017

FAST6191 said:
Looks like others have taken care of the "this is a legit thing to do, carry on lads" thing for those which don't understand the world of security.

Where did the "you need your own OS" stuff come from?

Other than software as a service/lease type things which is not this as far as I am aware the only thing I have even close to this is undocumented APIs and leaked SDKs. From there most things seemed to be free and clear, however being undocumented you don't get to complain if the behaviour is not as you expect or vanishings without warning.
SDK wise. You could always write code for it and share it all you like ( https://sourceforge.net/projects/surreal64/?source=recommended has been up for many years now), compiled binaries on the other hand not so much.

We could possibly discuss the nature of APIs (was of interest to various open source peeps, generally command line and dll type calls were fine, linking is where it gets tricky). As we will presumably not be compiling against their source or anything and just calling functions and executing things within normal parameters then yeah.

From a functionality perspective (I imagine the underlying OS will be a bit nerfed) it may end up better to write an OS (hopefully the commercial game thing can be sandboxed or something) but from a legal perspective I am not seeing the need to for console hacks as we understand the concept.

The thing is that you're not allowed to change Nintendo's operating system even though the SWITCH itself is under your control.. So if you want to do to do whatever YOU want with the switch you'll need your own or an Open Operating system (such as a Linux Distro).

FAST6191 · Jul 26, 2017

themperror said:
The thing is that you're not allowed to change Nintendo's operating system even though the SWITCH itself is under your control.. So if you want to do to do whatever YOU want with the switch you'll need your own or an Open Operating system (such as a Linux Distro).

When did any ruling like that get handed down? Never seen one for that, dozens of subsequently hacked devices for decades now have had full blown operating systems which stay in memory and, as mentioned in the post you quoted, all the vaguely related stuff I could think of would not lead to a ruling like that either. I have never even seen so much as a sabre rattling say if you hack my device unless you replace the whole kernel then we will come after you hard (or harder than we could if you had).

Even the DMCA only seems to care about bypassing protections, not what you do once you get in there.

themperror · Jul 26, 2017

FAST6191 said:
When did any ruling like that get handed down? Never seen one for that, dozens of subsequently hacked devices for decades now have had full blown operating systems which stay in memory and, as mentioned in the post you quoted, all the vaguely related stuff I could think of would not lead to a ruling like that either. I have never even seen so much as a sabre rattling say if you hack my device unless you replace the whole kernel then we will come after you hard (or harder than we could if you had).

Even the DMCA only seems to care about bypassing protections, not what you do once you get in there.

well. OK, not allowed is a bit of a weird term, What meant was that they're not required by law to give you access to their software (in this case the operating system). The switch itself (if you wanted to) could server as any device you want it, outside the switch OS.

FAST6191 · Jul 26, 2017

Were people confused on that issue? While I have certainly been surprised at what people think (see the 3ds banwave thread where people were upset it was not temporary for a more recent one) I thought most generally understood that even if you get in you have to feel out all the services, and that such things may change on you without warning.

ZoneBlaze · Jul 26, 2017

BlastedGuy9905 said:
And THAT's the stupid thing.

Nintendo's got a reputation for having vulnerable hardware compared to the competition. What's wrong with a company trying to beef up its security by buying the support of "freelancers?" You may say, "I just want the Switch to be hacked for homebrew." But you know damn well once it's hacked, pirating will be the focus. Do you want Nintendo to lose 3rd party support? Cause that's how Nintendo's gonna lose 3rd party support.

isoboy · Jul 26, 2017

Something something I want free games something.

smf · Jul 26, 2017

Felek666 said:
Not every security knows the stuff that hackers do.

That isn't the reason. If you hire 100 people to audit the code then you're paying 100 salaries. If you can get 100 people working for free, with a small reward if they find something then it's way way cheaper.

Plus kids have lots of spare time & will burn into the night trying to find stuff.

Deleted User · Jul 27, 2017

smf said:
That isn't the reason. If you hire 100 people to audit the code then you're paying 100 salaries. If you can get 100 people working for free, with a small reward if they find something then it's way way cheaper.

Plus kids have lots of spare time & will burn into the night trying to find stuff.

This is not a simple "crash my system using printf("hello, world!")" but actual hardware modifications and heavy coding.
You can hire them but they will not be guaranteed to find or sniff most stuff that more talented hacker would do.
Also, some do it for living. Not for free. If Nintendo wouldn't make this program a thing then people would ignore big N completely.

gnmmarechal · Jul 27, 2017

Tonydaexpert said:
Sellouts lol

That's rather wrong. If I find something, I am not obligated to share it with any community for no gain. I can legitimately choose to profit from my discovery. I owe nothing to the community.

linuxares · Jul 27, 2017

ZoneBlaze said:
Nintendo's got a reputation for having vulnerable hardware compared to the competition. What's wrong with a company trying to beef up its security by buying the support of "freelancers?" You may say, "I just want the Switch to be hacked for homebrew." But you know damn well once it's hacked, pirating will be the focus. Do you want Nintendo to lose 3rd party support? Cause that's how Nintendo's gonna lose 3rd party support.

Yeah I mean, lots of talented people gets a good foot in if they find a security leak in for example Google. Instead of making people afraid if report security issues that they hacked, they instead gets paid. It's a win-win! For us that want full freedom of our device, it stinks but this is the life now days.

Tonydaexpert · Jul 27, 2017

gnmmarechal said:
That's rather wrong. If I find something, I am not obligated to share it with any community for no gain. I can legitimately choose to profit from my discovery. I owe nothing to the community.

It depends if they were previously releasing exploits for the community and suddenly they start doing it for Nintendo for the money they are kind of Sellouts. If they started finding exploits on Nintendo Systems specifically for this program and never had an Interest in releasing exploits to the community they aren't

gnmmarechal · Jul 28, 2017

Tonydaexpert said:
It depends if they were previously releasing exploits for the community and suddenly they start doing it for Nintendo for the money they are kind of Sellouts. If they started finding exploits on Nintendo Systems specifically for this program and never had an Interest in releasing exploits to the community they aren't

It doesn't depend on anything. If I want to, I can release one, and go and sell my work on a completely different one. They are not "sellouts", and they have every right to do so. They owe NOTHING, NOTHING at all to the community.

Deleted-355425 · Jul 28, 2017

gnmmarechal said:
It doesn't depend on anything. If I want to, I can release one, and go and sell my work on a completely different one. They are not "sellouts", and they have every right to do so. They owe NOTHING, NOTHING at all to the community.

All right calm down, don't need a hermoridge on our hands.

gnmmarechal · Jul 28, 2017

mech said:
All right calm down, don't need a hermoridge on our hands.

I am and was completely calm.

lostdotfish · Jul 28, 2017

http://bfy.tw/1vx1

Alkéryn · Jul 29, 2017

In what is it a wall of shame ?
They have skills,they need money, and i don't think not caring about crying kiddos waiting for da hax is a shameful thing
I mean maybe they don't care about the community, which is relatable knowing how shity it can be and how much winnings some members of it produce

the_randomizer · Jul 29, 2017

mech said:
All right calm down, don't need a hermoridge on our hands.

Well he is right, these people find exploits in Nintendo's security and people lose their shit over it. I'm just over here laughing thanks to schadenfreude.

Bladexdsl · Jul 29, 2017

also we don't even know what exploits (if any) they told nintendo

Deleted-355425 · Jul 29, 2017

the_randomizer said:
Well he is right, these people find exploits in Nintendo's security and people lose their shit over it. I'm just over here laughing thanks to schadenfreude.

I know but do we really have to deal with pmt on a forum, i get enough of that at home.

Hacking Four new people paid off by Nintendo in the HackerOne program

Techromancer

Well-Known Member

Techromancer

Well-Known Member

Techromancer

Well-Known Member

Well-Known Member

Well-Known Member

Deleted User

Guest

Well-Known Member

The inadequate, autocratic beast!

C++ Pleb, but with a Monado

Well-Known Member

Deleted-355425

Guest

Well-Known Member

Well-Known Member

Moon Dweller ~

The Temp's official fox whisperer

fanboys triggered 9k+

Deleted-355425

Guest

Similar threads

Popular threads in this forum