Hacking 25th Chaos Communication Congress

[coolbho3000]

Yeah, but you missed the point they were trying to tell Nintendo and most of the other game console companies... that they are not perfect. So really what's the point? If it was a conference, convention, kiss and tell or whatever... it was pretty lame considering their approach to the conference... I meean conference... There was no real proof in the stream... I guess we had to be there? What happened behind the camera? Anyone want to speak for what we didn't see if they were making the point that they hacked their system with BootMii... anyone can go up there with some sort of "half-assed" skit and a fake demo... I am kind of agreeing with Wiicrazy's theory about the Wiimote conveniently not having batteries and the overhead display flails... That was totally unprepared or made to look like it was unprepared for some reason. So I guess it would be Nintendo's rebuttal (arguement) that there was no real proof if it was a public addressing statement to let them know that they were "stupid" or whatever word that Marcan used to describe their team of coders and engineers... So who was really looking like the fool there? Who has made millions and who has just made an ass out of themselves?

Who has made the Twilight Hack and the Homebrew Channel? Who has opened up the hole in Nintendo's regime?

This conference didn't really matter. What matters is what they've created.

 

[Wiisel]

Who has made the Twilight Hack and the Homebrew Channel? Who has opened up the hole in Nintendo's regime?

This conference didn't really matter. What matters is what they've created.
QUOTE"With great power comes great responsibility."

 

[IronMask]

"When it's done." is like the tomorrow that never comes.

 

[gundalf]

The convention doesnt claim in any manner to be professional(besides the content they are talking about).

It doesn't matter. They're hackers, not announcers.

That is what i am saying.

 

[Wiisel]

"When it's done." is like the tomorrow that never comes.

Yeah but to me it sounds more like a case of "its done but its more a case if were gonna let your pirate asses touch it"

 

[WiiCrazy]

Well it was shallow for us... but indeed it was deep for most of the audience

I tell my fellows about the wii's security system and they are getting astonished hearing about it... there are lots of people that do not have a single clue about the innerworkings of wii... no reason they should know about it actually...

It was just a review around the wii security, nothing more, nothing less... only there was that failed attempt to demo bootmii as extra...

They somehow overpraised they work and they neglected the ones who helped in the long run... that kind of a show that was...

Somewhat it sounded to me as "we fail" as much as "wii fail"...

Harshly criticizing Nintendo over getting an insecure system...

What they should know is finding someone's weakness is easy, exploiting that weakness is hard but it's the hardest to create a system with no weaknesses...

So when you are making a degrading comment of your opposition you should know your position...

When watching the *show* I was not giving out burst of laughters as they did those degrading comments...

The information they gave was already available publicly hence it was just a show for those uninformed watching the show...

my a few cents...

 

[remixer]

any youtube or valid download links yet??

 

[linkinworm]

i tried to upload to youtube, but the vids kept going out of sync by ALOT, so i just uploaded to my sharespace, there 2 vids inside, umm i didnt rename them, just play them both, the one that starts on blue screen is vid 1, fastforward to about 3 mins or so, USE VLC, its the best player, wmp will work if you have the codecs, VLC will jsut play regardless

i dont want 1000s downloading at once, so if you get slow download speeds just stop and try again later, its around 200mb large

http://www.filesavr.com/wiihackingvids

 

[bushing]

It was just a review around the wii security, nothing more, nothing less... only there was that failed attempt to demo bootmii as extra...

They somehow overpraised they work and they neglected the ones who helped in the long run... that kind of a show that was...
Who did we neglect? Please be specific.

QUOTESomewhat it sounded to me as "we fail" as much as "wii fail"...

Harshly criticizing Nintendo over getting an insecure system...

What they should know is finding someone's weakness is easy, exploiting that weakness is hard but it's the hardest to create a system with no weaknesses...

So when you are making a degrading comment of your opposition you should know your position...

Making a secure system is hard. Really hard. Hell, I couldn't do it -- and I think it's a waste of time and money to try. At the end of the presentation, mist explained why the PS3 security is mostly unhacked, even though they've spent less effort fixing bugs than Nintendo has.

That being said, if you're going to do something, you should do the best job you can. There are some mistakes that Nintendo made that are "honest mistakes" -- mistakes that any competent coder might make.

• a vulnerability in boot1
• DVD mode hole -- if they were going to ship a DVD player channel, there's not much they could have done to prevent this.
• reuse of crypto code in boot1, boot2, IOS
• insecure string handling in Zelda
• Not clearing memory when switching from IOS to MIOS

I do not criticize Nintendo for the above problems.

There are other mistakes Nintendo made which I believe are the result of them being sloppy. This is probably more an issue of tight deadlines and overworked engineers than of actual incompetence. However, each of these mistakes could have been -- and should have -- been easily prevented:

• Leaving boot1 unpatched for over a year, even though the architecture was designed to allow this to be quickly, cheaply and securely fixed.
• Leaving traces of DVD mode code in IOS, even though they never actually used it. (This is the most minor criticism of all, really)
• Rewriting RSA code from scratch instead of using well-tested, proven public-domain code
• Privilege escalation flaws in the IOS API that allow PPC code to manipulate IOS
• Taking a really long time to actually release patched versions of IOS
• Trying to put a quick band-aid fix in the system menu for the Zelda problem, instead of hardening IOS
• Repeatedly making trivial mistakes in a 10-line function to detect the Twilight Hack
• Having no easy way to report a vulnerability -- all you have to do is set up "[email protected]" and read it, for chrissakes.
• Storing keys in external RAM in IOS
• Spending time and money to fix the MIOS -> IOS thing when it no longer mattered

And, for the sake of completeness, I praise Nintendo for:

• Making a cheap console that actually turns a profit
• A fairly clever two-processor security architecture
• Clever boot0 design
• Good backwards-compatibility with GC

 

[linkinworm]

It was just a review around the wii security, nothing more, nothing less... only there was that failed attempt to demo bootmii as extra...

They somehow overpraised they work and they neglected the ones who helped in the long run... that kind of a show that was...
Who did we neglect? Please be specific.

QUOTESomewhat it sounded to me as "we fail" as much as "wii fail"...

Harshly criticizing Nintendo over getting an insecure system...

What they should know is finding someone's weakness is easy, exploiting that weakness is hard but it's the hardest to create a system with no weaknesses...

So when you are making a degrading comment of your opposition you should know your position...

Making a secure system is hard. Really hard. Hell, I couldn't do it -- and I think it's a waste of time and money to try. At the end of the presentation, mist explained why the PS3 security is mostly unhacked, even though they've spent less effort fixing bugs than Nintendo has.

That being said, if you're going to do something, you should do the best job you can. There are some mistakes that Nintendo made that are "honest mistakes" -- mistakes that any competent coder might make.

• a vulnerability in boot1
• DVD mode hole -- if they were going to ship a DVD player channel, there's not much they could have done to prevent this.
• reuse of crypto code in boot1, boot2, IOS
• insecure string handling in Zelda
• Not clearing memory when switching from IOS to MIOS

I do not criticize Nintendo for the above problems.

There are other mistakes Nintendo made which I believe are the result of them being sloppy. This is probably more an issue of tight deadlines and overworked engineers than of actual incompetence. However, each of these mistakes could have been -- and should have -- been easily prevented:

• Leaving boot1 unpatched for over a year, even though the architecture was designed to allow this to be quickly, cheaply and securely fixed.
• Leaving traces of DVD mode code in IOS, even though they never actually used it. (This is the most minor criticism of all, really)
• Rewriting RSA code from scratch instead of using well-tested, proven public-domain code
• Privilege escalation flaws in the IOS API that allow PPC code to manipulate IOS
• Taking a really long time to actually release patched versions of IOS
• Trying to put a quick band-aid fix in the system menu for the Zelda problem, instead of hardening IOS
• Repeatedly making trivial mistakes in a 10-line function to detect the Twilight Hack
• Having no easy way to report a vulnerability -- all you have to do is set up "[email protected]" and read it, for chrissakes.
• Storing keys in external RAM in IOS
• Spending time and money to fix the MIOS -> IOS thing when it no longer mattered

And, for the sake of completeness, I praise Nintendo for:

• Making a cheap console that actually turns a profit
• A fairly clever two-processor security architecture
• Clever boot0 design
• Good backwards-compatibility with GC

You shouldn't waist your time on here dude, half these kids dont even know hacking past warez.

 

[Slimmmmmm]

Thanks for stopping by Bushing and posting a rare sight here these days.
I thought the show went well, but as usual you have many that expected a lot more.
I think this year will see a huge response from Nintendo, but I bet your still a few steps ahead

Looking forward to bootmii, but don't rush it (I know you wont though

)

Hope you had a good christmas, and maybe next year you could ask santa for some rechargeable batteries

I am starting to wonder what you guys have cooking after bootmii......

Well time will tell, I'll wait knowing you've probably already started on your next project.

I ook forward to your in depth postings or marcans on hackmii, it's always a good read.

 

[telefunkin]

@bushing & marcan

thanks....

 

[WiiCrazy]

You shouldn't waist your time on here dude, half these kids dont even know hacking past warez.

Yeah and most of them can't even spell correctly...
Think twice before making assumptions on people's ages... When you were still trying hard to read and write at primary school I was writing
programs in several languages... (though in writing you still suck actually)

QUOTE(WiiCrazy @ Dec 30 2008, 12:25 AM) It was just a review around the wii security, nothing more, nothing less... only there was that failed attempt to demo bootmii as extra...

They somehow overpraised they work and they neglected the ones who helped in the long run... that kind of a show that was...

Who did we neglect? Please be specific.

Well I'm not talking about names, I'm talking about the event as a whole... It was a 'we did this', 'we did that stuff' mostly...

The names could be the answer of these questions, these form the basis that makes later hacks possible

1. Who found the sign check bug?
2. Who was first to fakesign a disc and run it in a wii?
3. Who first found the common decryption key?

List could be extended... just wrote the ones coming to my mind at the moment...

 

[ppc_gba]

*obligatory release bootmii now rant* (january release would be nice, im just saying lol)

@linkinworm: thx a lot for the link, maybe now i can actually see it. hopefully it'll find its way onto youtube sooner rather than later.

 

[tona]

1. Who found the sign check bug?
2. Who was first to fakesign a disc and run it in a wii?
3. Who first found the common decryption key?

1. Team Twiizers.
2. Team Twiizers.
3. Team Twiizers.

Edit: I don't know what you were expecting. Waninkoko or xt5? *shrug* Pretty much all of the work (besides independent homebrew) was done by Team Twiizers--and their ragtag crew who doesn't mind being included in that "we." That's who bushing and marcan were speaking for.

Edit2: And of course, bushing did mention some specific tasks performed by segher and tmbinc (which is some of what you're referring to)

 

[denzil]

It was a 'we did this', 'we did that stuff' mostly...

A "we" usually refers to "the community that revolves around that task", and it is commonly understood as such by the CCC attendees. Keep in mind that the hacking scene is by far not as rampantly egomanical as the warez scene.

 

[tona]

^ denzel washington makes another important point.

For some reason (possibly the ego mentioned above), most people here seem confused about what the target audience of this presentation was. It is certainly not gbatemp. It was the room full of hackers which stood before them. Obviously, what they're interested in and what you're interested in differ greatly.

 

[WiiCrazy]

1. Who found the sign check bug?
2. Who was first to fakesign a disc and run it in a wii?
3. Who first found the common decryption key?

1. Team Twiizers.
2. Team Twiizers.
3. Team Twiizers.

Edit: I don't know what you were expecting. Waninkoko or xt5? *shrug* Pretty much all of the work (besides independent homebrew) was done by Team Twiizers--and their ragtag crew who doesn't mind being included in that "we." That's who bushing and marcan were speaking for.

Edit2: And of course, bushing did mention some specific tasks performed by segher and tmbinc (which is some of what you're referring to)

Waninkoko? Oh no...
I take those answers of yours as merely just educated guesses...
And by saying "pretty much all of the work", are you including the devkitpro staff?
What about datel? I guess freeloader work was started long before zelda hack was created or fake sign bug is found..
http://www.gamespot.com/news/6163322.html

edit: or, had Datel got these hacks from homebrewers?

 

[Scolor]

Is there any video of twiizers' conference?

 

[FAST6191]

Many have asked for a video so I figured I would throw one together. Using the ogm streams linked from the streaming website and the avisynth script below I made an H264 video Ac3 audio MKV file (had to be h264 as the source was a bit grainy/noisy and I am not up for degraining a source right now). note profiles are he-AAC+PS, high profile- unlimited and so forth so some decoders may have trouble.
I did not remove any of the time wasting parts/technical errors (errors in the presentation not in the science behind it) as I was lazy and some had some important audio while it was happening. Again apologies for the join, my sources lacked that part so there was nothing I can do about that. I notice some sync issues (not sure how they got in there but you can sort that quite easily your end)

Current distribution at 4shared (entire file, can do split if necessary) Feel free to share links or rehost,
Downloads:
http://www.4shared.com/file/78190880/6856a...5c3wiifail.html


If you are having trouble playing it first set up CCCP ( http://www.cccp-project.net/ ) and then come back and speak if you still have trouble (resolution should be low enough that even an xbox should be able to do it).

Also if someone has a decent copy of the reverse engineering chips video (mine I could not get working) and a decent copy of the rapid prototyping lecture (the copy I found cut out about 20 minutes from the end) I would appreciate a heads up.

Avisynth script. directshowsource kept as ffmpegsource was messing me around and no external filters used. Directshow means FFdshow filters were used, only postprocessing was active.
CODEa=directshowsource("Tag2-Saal2-Slot21 45--ID2799-console_hacking_2008-Main-2008-12-28T21 45 08+0100.ogm").trim(288925,0)
b=directshowsource("Tag2-Saal2-Slot21 45--ID2799-console_hacking_2008-Main-2008-12-28T22 19 36+0100.ogm").trim(335750,0)
a+b
converttoyv12()