Hacking Question How stupid is Nintendo?

MadMageKefka

Well-Known Member
Member
Joined
Apr 28, 2016
Messages
1,672
Trophies
0
Age
36
Location
World of ruin
XP
1,915
Country
United States
If somehow you were instantly placed with four of your dearest friends as heads of hardware security at Nintendo, obviously you'll do so much better than them. In half the budget. And getting constant payments from nvidia for upgrading their products.

On a more serious comment I'll tell you this: every big company mistake is usually tied to hard decisions, budget planning and trade-offs. You want the most powerful portable console ever, capable of 720p gaming on the go, with great batteries, better yet feeling and an oustanding NSA-like security starting at 2 bucks in store at release day.

Please, a little bit of reality around here. Cheap systems = cheap construction (in some sense). The switch looks quite sturdy to me, physically. The cost reduction has to be the hw architectural/software.
The 3DS bootrom was exploited through brute force. They decided to only check a small portion of the signature. I'm no dev, so please explain to me the reason for this if there is a logical one, but why wouldn't they just check the whole thing? What? It would have made boot time slightly longer or something? I don't get it. Maybe we all don't have the skill to run a giant company, but you have to admit that some of Nintendo's security choices seem..... bad. I can give plenty more examples if this turns out to be a bad one.
 
  • Like
Reactions: Subtle Demise

SciresM

Developer
Developer
Joined
Mar 21, 2014
Messages
973
Trophies
3
Age
33
XP
8,294
Country
United States
This is a bad thread.

Nintendo's consoles are actually on par, security wise, with other modern ones -- the Switch has a pretty beautiful cryptosystem, actually, that would allow Nintendo to recover from up to 32 arm9loaderhax-style breaks or far, far more trustzone breaks and still be able to lock hax out of future firmwares (and prevent them from accessing new content). Their security system is not bad, not in the slightest.

Nintendo, like every other company, makes exploitable implementation mistakes that are just that -- mistakes. They don't really happen any more frequently than in other consoles/other contexts.

What you see -- that Nintendo stuff gets hacked faster -- is actually because Nintendo consoles drive a lot more interest than the others; very few people with the relevant skills are trying to hack the PS4, but I can think of >20 talented people interested in hacking the switch off the top of my head. It's no wonder, then, that when nintendo's code is subject to far, far higher levels of scrutiny that its mistakes are noticed more quickly.

The 3DS bootrom was exploited through brute force. They decided to only check a small portion of the signature. I'm no dev, so please explain to me the reason for this if there is a logical one, but why wouldn't they just check the whole thing? What? It would have made boot time slightly longer or something? I don't get it. Maybe we all don't have the skill to run a giant company, but you have to admit that some of Nintendo's security choices seem..... bad. I can give plenty more examples if this turns out to be a bad one.
They didn't "decide" to only check part of the signature -- they made a totally reasonable mistake in forgetting to remove a debugging fallback path from their signature parsing code prior to 1.0.0 from the image burnt into the hardware, and we found a way to exploit the parser into using the debug path by brute forcing a signature that signaled to the bootrom parser appropriately. Big difference.

Please do give more examples, I'd be happy to refute them.
 
Last edited by SciresM,

LightOffPro

ユキオクン
Member
Joined
Jun 10, 2016
Messages
316
Trophies
0
Age
29
Location
In Papa Rei's closet.
XP
821
Country
Portugal
I absolutely love reading these explanations by SciresM. Most of these opinions here in this thread have almost 0 credibility.
I wish more "known" scene devs like SciresM here to do the same, go here on a public forum and post some quality explanations/content instead of those vague tweets.
Nintendo engineers are, like any other human being, capable of making mistakes. They don't just "decide" to miss something.

PS: @SciresM swap out your avatar dude, it's far too easy to miss who you are in this forum with the "?" avatar. :rofl2:
 
D

Deleted User

Guest
This is a bad thread.

Nintendo's consoles are actually on par, security wise, with other modern ones -- the Switch has a pretty beautiful cryptosystem, actually, that would allow Nintendo to recover from up to 32 arm9loaderhax-style breaks or far, far more trustzone breaks and still be able to lock hax out of future firmwares (and prevent them from accessing new content). Their security system is not bad, not in the slightest.

Nintendo, like every other company, makes exploitable implementation mistakes that are just that -- mistakes. They don't really happen any more frequently than in other consoles/other contexts.

What you see -- that Nintendo stuff gets hacked faster -- is actually because Nintendo consoles drive a lot more interest than the others; very few people with the relevant skills are trying to hack the PS4, but I can think of >20 talented people interested in hacking the switch off the top of my head. It's no wonder, then, that when nintendo's code is subject to far, far higher levels of scrutiny that its mistakes are noticed more quickly.


They didn't "decide" to only check part of the signature -- they made a totally reasonable mistake in forgetting to remove a debugging fallback path from their signature parsing code prior to 1.0.0 from the image burnt into the hardware, and we found a way to exploit the parser into using the debug path by brute forcing a signature that signaled to the bootrom parser appropriately. Big difference.

Please do give more examples, I'd be happy to refute them.
I'd like to ask a question.

Currently there seems to be alot of worry among the community about getting Homebrew onto their systems, even more so because of the bug bounty page. So this question needs to be asked.

Do you, and others that you might potentially know of, intend to releasing homebrew capabilities in the future if/when you feel the time is right, on the chance you get Homebrew running?
 

SciresM

Developer
Developer
Joined
Mar 21, 2014
Messages
973
Trophies
3
Age
33
XP
8,294
Country
United States
Do you, and others that you might potentially know of, intend to releasing homebrew capabilities in the future if/when you feel the time is right, on the chance you get Homebrew running?

See:
And obviously I can't tell the future, but whatever I eventually work on will be released for people to use, since that's kind of the point.
 
D

Deleted User

Guest
While i'd love to hear for other hackers inputs on this awkward subject aswell, this is still good news to hear! Thanks much for the answer, and good luck.

Actually, while I have your attention, I have another question, though this one might not be answerable.

Have any exploits or "tricks" disappeared so far after each of the bounty reports have gone up? And if so, how "dire" was the change?
 

RustInPeace

Samurai Cop
Member
Joined
Oct 13, 2014
Messages
5,942
Trophies
1
Age
31
XP
5,148
Country
United States
I wish more "known" scene devs like SciresM here to do the same, go here on a public forum and post some quality explanations/content instead of those vague tweets.

Some of those "known" scene devs have publicly abandoned this forum, for understandable reasons, but yes it's interesting to read their words.
 

SciresM

Developer
Developer
Joined
Mar 21, 2014
Messages
973
Trophies
3
Age
33
XP
8,294
Country
United States
Extention to that question, since I've already seen that post; If you discover and develop an entry point, would you release it once it's finished, or once it's patched?

If something I am aware of gets patched, obviously I'll talk about it publically (I immediately added the NS module dumping flaw in pl:u to the wiki when it was patched in 3.0.0). Edit: I suppose this only applies to things I've found or have permission for, it would be shitty to share others' exploits I'm trusted with without asking first, even if they're patched. Unlikely to ever be relevant, though, hard to imagine someone wanting to keep something secret after it's patched, heh.

For unpatched things: probably only reasonably releasable when there's some kind of backup exploit in place to prevent the release from locking us out on future firmwares? This is all highly contextual and hard to talk about in advance, though.
 
Last edited by SciresM,
D

Deleted User

Guest
Some of those "known" scene devs have publicly abandoned this forum, for understandable reasons, but yes it's interesting to read their words.
I agree, it really is interesting. Hell, it's so interesting, I listen and watch those hacking convention talks. I might not be a hacker, but I sure know enough to understand, and it's great interacting with and/or listening to explanations straight from the horses mouth. Really makes the community feel closer like that. It's why I love the hacking community like that. Ever since the PSP days. June 23, 2007, the "Illuminati Exploit". And loved it ever since.
 
  • Like
Reactions: HaloEliteLegend

Yepi69

Jill-sandwiched
Member
Joined
Nov 29, 2010
Messages
2,862
Trophies
2
Age
28
Location
Behind you
XP
1,776
Country
Portugal
I belive that's illegal
It has already been done before, see DS Bricker.

If something I am aware of gets patched, obviously I'll talk about it publically (I immediately added the NS module dumping flaw in pl:u to the wiki when it was patched in 3.0.0). Edit: I suppose this only applies to things I've found or have permission for, it would be shitty to share others' exploits I'm trusted with without asking first, even if they're patched. Unlikely to ever be relevant, though, hard to imagine someone wanting to keep something secret after it's patched, heh.

For unpatched things: probably only reasonably releasable when there's some kind of backup exploit in place to prevent the release from locking us out on future firmwares? This is all highly contextual and hard to talk about in advance, though.
Not to mention that shared exploits can make their way into HackerOne, it has happened before.
 
Last edited by Yepi69,

cualquiercosa327

Well-Known Member
Member
Joined
Mar 24, 2009
Messages
201
Trophies
1
XP
428
Country
This is a bad thread.

Nintendo's consoles are actually on par, security wise, with other modern ones -- the Switch has a pretty beautiful cryptosystem, actually, that would allow Nintendo to recover from up to 32 arm9loaderhax-style breaks or far, far more trustzone breaks and still be able to lock hax out of future firmwares (and prevent them from accessing new content). Their security system is not bad, not in the slightest.



Please do give more examples, I'd be happy to refute them.

Great posts.i would love ask you if it is true than psvita is the most secure game device ,being ps4 totally inferior on this matter.
Thank you
 

SciresM

Developer
Developer
Joined
Mar 21, 2014
Messages
973
Trophies
3
Age
33
XP
8,294
Country
United States
Great posts.i would love ask you if it is true than psvita is the most secure game device ,being ps4 totally inferior on this matter.
Thank you

I'm not qualified to answer this question -- I don't own a PS Vita and am unfamiliar with the specifics of its security system :)
 

LightOffPro

ユキオクン
Member
Joined
Jun 10, 2016
Messages
316
Trophies
0
Age
29
Location
In Papa Rei's closet.
XP
821
Country
Portugal
Another question for @SciresM.

I already know that your work is intended for public use, my question is:

Do you purposely "delay" your work? Or do you know if the scene devs (mainly ReSwitched) purposely delay their work to give a chance for the Switch to grow? Is that something that you consider?

I see lots of replies that say "oh switch hacking will be slow for the console to grow" or "i hope that the switch isn't hacked so soon, i don't want to see the console fail to piracy", etc etc. But we never know if the devs actually consider that, or if hacking does take years like the 3DS scene because it is a complex process that takes time to crack, and not because the devs feel releasing whenever the hell they want.

Probably not the best phrasing there, as english isn't my mother tongue... apologies in advance!
 
Last edited by LightOffPro,

darklordrs

Well-Known Member
Member
Joined
Aug 16, 2015
Messages
791
Trophies
0
Age
23
XP
434
Country
United States
the fact me and you and somebody else cant do better is partly because of lack of budget, time and knowledge.

So you're formally admitting here that even given budget and time, such as if you and a few friends were just shoved in charge of Nintendo one day, knowledge is a hurdle that would shut you down instantly - because the people running Nintendo are significantly smarter than most of us are. Wasting time making ragethreads asking if a corporation is stupid isn't exactly proof of sanity.
 

cualquiercosa327

Well-Known Member
Member
Joined
Mar 24, 2009
Messages
201
Trophies
1
XP
428
Country
I'm not qualified to answer this question -- I don't own a PS Vita and am unfamiliar with the specifics of its security system :)

Thanks.
I have been reading about yours advances on switch investigation,and i think (please correct me if i am wrong),altought after the released dumps "drama",i still see than it is the same which happened on ps4 ,which until recently has no been able to load backups/roms (they had make free a tool to convert to debug console and also said soon they will be backups loaders).

I love the homebrew and also i have download some roms from the net but i would love the second will begin almost 2-3 years after switch released.

my questions are :

1)does this dump could be dangerous ,in the sense than they could create a backup loader ?

I found nice could see the diferent data from romfs (i am very interesting on vibration files,translations ).

2)could someway ,without helping to piracy,to be able to dump and add extra/mod stuff ,something as
Riivolution on wii?
(Translations,new levels...)

3)i comment on Twitter before,but now with the acces to "trusted zone" , could be done and/or are you interesting on create a Android port to switch ?

Thanks for all
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    BakerMan @ BakerMan: well then show them how to scratch it (this is a verbalase joke)