This blogpost makes the point that the advent of the Raspberry Pi microcontroller made it easier to interface with a variety of hardware.
And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance.
I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O.
Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection.
Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW.
Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that.
What did Microslop change in Xbox One that prevented it from being exploited much in the same way? Afaik Xbone is still undefeated in terms of security, either because it's so good or because it's just uninteresting console to own
They allowed people to run their own homebrew, and allowed more third party apps like Kodi (formerly known as XBMC -- XBox Media Center, that grew out of XBMP) on their store.
Homebrew software had been a driving force behind consoles being hacked in the past. The console is obviously more secure, but they also removed some incentives.
It has been defeated, but through hardware attacks (voltage glitching mostly). The author did an very interesting presentation about the process at reverseconf: https://www.youtube.com/watch?v=FTFn4UZsA5U&t
I was in the Xbox 360 scene back in the day before JTAG hacks existed -- modding savegames, getting a devkit, and building my own private homebrew. For the most part I left the scene around 2013.
The softmod had me seeing what the status quo is and things are... not great.
17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.
The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.
Hacking the console is complete. But the state of the scene is a bit sad.
At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).
The Rock Band Blitz demo was distributed as a roamable package -- i.e. no license that ties it to any particular console (this was intended for e.g. demos distributed on magazine CDs or whatever).
You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.
The software exploit works for all console revisions, but the persistent softmod does not.
There exist 3 main things in the software hack space for Xbox 360:
1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox.
2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox.
3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer.
At any rate, #1 and #2 do not provide early boot exploitation.
#3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom.
The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version and the SMC is reprogrammed to trigger a hypervisor bug, then using an additional hardware flash chip containing a different version of the OS reboots the console into that other version. Technically you can do something similar using Peer Pressure but without the required hardware.
The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain.
Still mind-boggling that it took almost 20 years for it to come out
>You can try to use the exploit with a SSD if you choose, however, for optimal boot times and reliability it's recommended to use a mechanical HDD instead
And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance.
I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O.
Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection.
Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW.
Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that.
Homebrew software had been a driving force behind consoles being hacked in the past. The console is obviously more secure, but they also removed some incentives.
Microsoft Security gave an excellent presentation on the topic: https://www.youtube.com/watch?v=quLa6kzzra0
The softmod had me seeing what the status quo is and things are... not great.
17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.
The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.
Hacking the console is complete. But the state of the scene is a bit sad.
At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).
No it's not. For starters the recently released softmod does not work on all Xbox 360 revisions.
With BadAvatar you get interactionless console exploitation that's good enough for most people.
You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.
There exist 3 main things in the software hack space for Xbox 360:
1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox.
2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox.
3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer.
More info on #3 here: https://youtu.be/ftEuor1asBM?t=96
At any rate, #1 and #2 do not provide early boot exploitation.
#3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom.
The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version and the SMC is reprogrammed to trigger a hypervisor bug, then using an additional hardware flash chip containing a different version of the OS reboots the console into that other version. Technically you can do something similar using Peer Pressure but without the required hardware.
The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain.
> Peer Pressure is a persistent softmod exploit for Xbox 360.
>You can try to use the exploit with a SSD if you choose, however, for optimal boot times and reliability it's recommended to use a mechanical HDD instead
is also very amusing to read