Hacking Discussion Why FreeShop is still possible on the Switch, and what should have been done to prevent it.

[Viri]

Nintendo found you!

 

[kevin_1351]

Its seems the shopN we are using is no longer working

It's the script that isn't working, the cert is still ok.

 

[Type_O_Dev]

It's the script that isn't working, the cert is still ok.

do we know the updated query

 

[kevin_1351]

do we know the updated query

A dependency of the script is the source of the issue. Let's leave it at that. By removing that dependency, the script works.

 

[lukhart]

Coincidence? I don't think so.

Nintendo likes to visit GBAtemp

 

[morrison22]

Coincidence? I don't think so.

Nintendo likes to visit GBAtemp

Nintendo took a swing and now CDNSP down.. for now.. at least until we swing back.

"Request rejected by server! Check your cert."

Let the cat and mouse games begin!

 

[kevin_1351]

Nintendo took a swing and now CDNSP down.. for now.. at least until we swing back.

"Request rejected by server! Check your cert."

Let the cat and mouse games begin!

The cert isn't blocked tho. The error message is wrong. Wait a few hours and you'll see what pops up..

 

[Darth Meteos]

This is a cool writeup, nice work. As for the remainder, this seems like the best outcome for piracy on a console- that being no online being available.

Put on your tin foil hats, boys... What if Nintendo designed this specifically to make playing games online impossible, but didn't go out of their way to make the actual piracy itself difficult? More studies are released every day that point to piracy ending up having a net positive effect on sales, and Nintendo sure wasn't trying to curb sales. So many people on this thread are saying "this is trivial to fix, this would have been fixed if I was in charge, this isn't difficult to deal with... etc." So what if... It was left out deliberately? The online authentication is all but bulletproof, but this... I don't know, they're not stupid.

EDIT: feel free to call me a stupid kid mcstupid pants for this, it's just worth mentioning

 

[comput3rus3r]

This is a cool writeup, nice work. As for the remainder, this seems like the best outcome for piracy on a console- that being no online being available.

Put on your tin foil hats, boys... What if Nintendo designed this specifically to make playing games online impossible, but didn't go out of their way to make the actual piracy itself difficult? More studies are released every day that point to piracy ending up having a net positive effect on sales, and Nintendo sure wasn't trying to curb sales. So many people on this thread are saying "this is trivial to fix, this would have been fixed if I was in charge, this isn't difficult to deal with... etc." So what if... It was left out deliberately? The online authentication is all but bulletproof, but this... I don't know, they're not stupid.

EDIT: feel free to call me a stupid kid mcstupid pants for this, it's just worth mentioning

I said something similar earlier.

 

[nWo]

I can see in a few months, a magnificent freeshop-esque creation. Just you wait and see. Good days to be alive for gamers.

 

[SimonMKWii]

They only patched shogun.get, the least problematic bit, but not shogun.getwithidtoken or shogun.post...

 

[SimonMKWii]

So, at this point, the following issues need to be fixed:

• Atum should check your account for ownership of a certain title before returning the content, period.
• Since they already log all requests, right now they collect stuff for a period of time, filter out the requests, then do a mass ban based on the dodgy ones.
• I personally believe, from a security standpoint, you should be banned immediately on detection, as the difference in response time would be negligible considering modern internet speeds, so latency wouldn't be a huge issue.
• It shouldn't be that difficult to implement verification procedures via communication between the atum and bugyo servers.

• GetWithIdToken still doesn't require the X-DeviceAuthorization bearer auth token, only the Nintendo Account id token is needed, therefore still allowing arbitrary title downloads.
• The /download endpoint of owned_titles still doesn't perform any checks to see whether the title is owned or not.

 

[GamingAori]

So, at this point, the following issues need to be fixed:

• Atum should check your account for ownership of a certain title before returning the content, period.
• Since they already log all requests, right now they collect stuff for a period of time, filter out the requests, then do a mass ban based on the dodgy ones.
• I personally believe, from a security standpoint, you should be banned immediately on detection, as the difference in response time would be negligible considering modern internet speeds, so latency wouldn't be a huge issue.
• It shouldn't be that difficult to implement verification procedures via communication between the atum and bugyo servers.

• GetWithIdToken still doesn't require the X-DeviceAuthorization bearer auth token, only the Nintendo Account id token is needed, therefore still allowing arbitrary title downloads.
• The /download endpoint of owned_titles still doesn't perform any checks to see whether the title is owned or not.

so how bad is it for us? It sounds horrible for me at least

 

[RAGER]

Well, Nintendo full online service is still upcoming so yeah... I even wonder why they started the bans before actually having their full online paid service, but oh well...

As far as I know when the new online system comes into place, most likely there will be a lot of changes and they will probably give more apps like youtube or other things since ppl will be paying.

They needed to act cuz of online multiplayer cheaters and p0rn posters. Also a paid online service is a good idea, additional barrier to cheaters.

 

[Deathscreton]

They needed to act cuz of online multiplayer cheaters and p0rn posters. Also a paid online service is a good idea, additional barrier to cheaters.

I think a better barrier is a 300 dollar brick. I could care less about my account, that's 20 a year. I care more about my 300 Switch being blocked from online activities.

 

[RAGER]

I think a better barrier is a 300 dollar brick. I could care less about my account, that's 20 a year. I care more about my 300 Switch being blocked from online activities.

It is too bold to call a banned console a "brick". It is just you need that online features and you also cant softmod your console in any way. I think it would be a good option to play pirated games, HB, etc and play legit online games on one console, but the only option for now is to have two consoles, and that is stupid. It is better to spend this 250$ on legit games, or dont waste 250$ and just pirate all offline.

 

[Deathscreton]

It is too bold to call a banned console a "brick". It is just you need that online features and you also cant softmod your console in any way.

If a hackers sole purpose is to go online and hack, then a console with no ability to go online is effectively a brick for that user. The term used in the way I did is indeed gray, but the general results in which a brick is used is still correct. A console a gamer uses to game that can no longer run games is a brick; a console a hacker uses to hack online that can no longer go online is a brick.

 

[RAGER]

If a hackers sole purpose is to go online and hack, then a console with no ability to go online is effectively a brick for that user. The term used in the way I did is indeed gray, but the general results in which a brick is used is still correct. A console a gamer uses to game that can no longer run games is a brick; a console a hacker uses to hack online that can no longer go online is a brick.

I agree, but do you know those hackers? 99% a stupid kid with an idea like why not? He watched his friend cheated Mario Kart to the top, so he can also. And there are tons of this kind of hackers. So Nintendo started react pretty fast.

 

[Deathscreton]

I agree, but do you know those hackers? 99% a stupid kid with an idea like why not? He watched his friend cheated Mario Kart to the top, so he can also. And there are tons of this kind of hackers. So Nintendo started react pretty fast.

I'm not positive what this has to do with the definition of 'brick', but sure.

 

[lukhart]

Thing is, most of the switch games don't even have online play. You can almost count them on your finger.