"This arrogance undermines a basic security principle, never trust the client. [...] Notice it's only PSN that gave away all your personal data, not Xbox Live when the 360 was hacked, not iTunes when the iPhone was jailbroken, and not GMail when Android was rooted. Because other companies aren't crazy."
"[...] To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes."
The pipe analogy is interesting, because I've heard a related analogy in the other direction. I can't recall where I read it, but I think it was some textfile from the 80s, justifying breaking into large corporate computer systems to explore them as similar to breaking into and exploring steam tunnels, and guided by a similar ethos (e.g. don't vandalize them while exploring).
"You're the perfect example of someone who can't even grasp the simple concept of how YOUR actions have consequences for OTHER people. If Sony wanted to remove Other OS that's up to them, people like you and George should have just dealt with that. Instead like children you have this sense of entitlement and so the PS3 was hacked and root keys published. No thought was given to how this would be used by other people, all that crossed your tiny little minds was how this affected YOU."
You see people become inoculated by all sorts of kooky ideas (usually offering salvation or universal insight), but to see people get their mind twisted around some faceless video game company... the mind boggles...
There is a good chance that this particular comment came directly from Sony as a part of some sort of misdirection and damage control campaign. It does not read like something a teenager would write, it sounds more like a mom lecturing her adolescent, but I can't see parents taking time to comment in GeoHot's blog. So given the context it looks artificial.
If you think that's bad you should check out the Kotaku comments or the PSN forums. Some of them were promising bodily harm geohotz. I know people get worked up over cheaters but some of the comments were just right off the rails crazy. Seems to be a correlation the more time you spend playing the system the more you hate people that screw around with it.
I know people like to make fun of Mac and Android fans but some playstation fans took it way too personal.
A lot of PS3 users are NOT teenagers... I'm guessing PS3's user base will tend be slightly higher in age than Xbox owners, given that people who buy PS3s might buy them for the Blu-ray player as well to complement some home theater setup. Teenagers will most likely only have appeal for the gaming aspects of a console.
Which means I get moderated down too? I thought he had an interesting and valid point, saw his statement when it was grey and made my comment.
If I am incorrect, or have made a HN etiquette faux pas, I would appreciate knowing about it.
That was my immediate thought, as well. I'm willing to bet that a good number of those comments come from Sony shills trying to paint blame on external parties.
I happen to disagree with the commenter, but it doesn't sound kooky to me. Aside from the fact that the connection between the root keys and the PSN hack is a bit tenuous, it seems like a reasonable point.
It's disingenuous because the problem isn't that the root keys were released, but that Sony was singlehandedly trusting the security of all their customer information to the assumption that the client would never be compromised. It's bad (and even negligent) design, and while, yes, the root keys being released might have been a component of the break-in, if the system had been designed with the proper security principles in mind, then it wouldn't have been an issue at all.
To use an analogy, Sony's system seems to have been designed like a a car that starts with a push button, no key required. It's assumed that you'll never be able to start it without being the owner because you would have to open the door first. George, being the owner of one of these vehicles, figured out how to get into it without using his keys (in case he ever locked himself out), then people took that information and used it to steal these cars, because once you can open the driver door, there are no additional security checks (like an ignition lock) to prevent the car from being stolen.
but that Sony was singlehandedly trusting the security of all their customer information to the assumption that the client would never be compromised. It's bad (and even negligent) design
I agree with Geohot that Sony's mindset of security extending to the console is broken. But let's put it in perspective: for CC#s and passwords this is little different than an https website and customer-side browser. Sure, if you hack your console, you can set up a MitM and observe your own personal details.
It's possible that this helped to enable their backend breach but we don't know that yet.
There are very few designs in common use that can survive the compromise of an endpoint.
But compromise of one endpoint should not cause (or even help) compromise of the other endpoint, in this case at least not in the client->server direction (it's pretty obvious that you can compromise all PS3's at once if you take over control of whole PSN and that can be called an feature).
The idea that expecting a product you buy to have the features it was described by the seller as having is a "sense of entitlement" seems pretty kooky to me. We can't have a functioning market like that.
This is interesting: "Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can't trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server?"
I wonder if he's purely speculating or maybe knows something more. It's also good to see he can at least still talk about Sony security in general (or can he?)
See http://news.ycombinator.com/item?id=2480141 - it has been suggested on HN that Sony can't keep hacked Playstations out of the dev channel. It's likely that GeoHotz is much more knowledgeable/better connected (on this topic, at least).
And how would you use that hashed CC number on the server? Unhashing (impossible)? Send the hash to the CC company (good luck)?
Do you mean they should have pre-encrypted the CC number before encrypting it again in the standard SSL transaction?
Would that have helped? Because if the PS3 knows how to encrypt and you own the server, decrypting is as trivial as just looking at the plain text
For people who don't own the server and are listening in SSL is enough and for people with access to the server neither SSL nor any other encryption is enough.
They have done a lot of things wrongly, but this IMHO is not one of them.
> Do you mean they should have pre-encrypted the CC number before encrypting it again in the standard SSL transaction? Would that have helped? Because if the PS3 knows how to encrypt and you own the server, decrypting is as trivial as just looking at the plain text
You are wrong; They could have done that. That's the whole premise of public key cryptography (google/wikipedia if you are not familiar). It's possible, (and easy) for the client to encrypt something that a client cannot in general decrypt, nor can anyone else without the decryption key. And it is actually a good idea to not put the decryption key on the server you talk to - only on a server that actually talks to the payment gateway.
> And how would you use that hashed CC number on the server? Unhashing (impossible)? Send the hash to the CC company (good luck)?
Many credit card processors let you do something similar - i.e. you register the CC details once, get a "reference id", and then use that reference id to charge. I'm sure Sony could have used one of them if they cared.
> For people who don't own the server and are listening in SSL is enough and for people with access to the server neither SSL nor any other encryption is enough.
That is true. However, that is just one facet that needs defense, and one that has had almost no attacks in the last 5 years -- because SSL (if practiced correctly, which it rarely is) solves that problem, and attacking the server is usually easier than listening on the pipes.
> They have done a lot of things wrongly, but this IMHO is not one of them.
Everything they have done about this is wrong. And the fact you think they didn't, implies that you shouldn't be working on systems that have any sensitive information in them. I sincerely hope you don't, for the sake of your users.
It's possible, (and easy) for the client to encrypt something that a client cannot in general decrypt, nor can anyone else without the decryption key.
And that's exactly how your typical SSL/TLS handshake works.
The problem is how does the client know he's encrypting to the correct public key? He has to have something stored giving him the key in advance or telling him how to authenticate the public key he's asked to use.
This is how the protocol messages were decrypted. The hackers modified their own console to trust a new public key, one to which they had the private key.
> And that's exactly how your typical SSL/TLS handshake works.
True.
> The problem is how does the client know he's encrypting to the correct public key? He has to have something stored giving him the key in advance or telling him how to authenticate the public key he's asked to use.
True again. In the SSL/TLS, this is the "trusted roots" certificates, that the browser was created with.
Why wouldn't the PS3 have a "trusted root" as such?
> This is how the protocol messages were decrypted. The hackers modified their own console to trust a new public key, one to which they had the private key.
Cool. But that doesn't let them decode _other_ clients' transmissions -- much like putting a new root certificate in your own browser doesn't make a session less secure for anyone else.
Sony made many mistakes here, most of them due to either extreme hubris or extreme incompetence.
But that doesn't let them decode _other_ clients' transmissions -- much like putting a new root certificate in your own browser doesn't make a session less secure for anyone else.
Right, we don't know that's happened yet, except we hear that Sony's backend systems were compromised too. That could be completely unrelated, or the client and server hacks could combine in a way that makes every PS3 compromised. I find it an interesting question but we probably have to wait for more details from Sony.
I (and shareme I was responding to) wasn't talking about storing the numbers. I was talking about transmitting them. You can't transmit hashes of credit card numbers and then expect to do anything useful with them.
This is, for example, the md5-hash of my credit card number with "salt" prepended: 8cc8f5b89ae1ce45a8efce26c88b69e7.
Now good luck doing anything useful with this.
My point was just that it's totally fine to rely on SSL for securely transmitting the credit card number. There's no need to encrypt twice and salting isn't possible.
Storing the numbers (or, as you say, authorizations) is something else I a) know nothing about, b) wouldn't want to have to do (see a) and c) didn't comment about.
It should be feasible to hash a whole bunch of credit card numbers looking for a hash collision, especially when the first four digits depend only on the card type and the last one is a check digit or something. I'd have to look up the details, but that leaves me with just over a billion things to hash?
This is roughly the way password crackers work, incidentally. And why they keep telling people to use slow hashes, like bcrypt.
No worries. That's what I was thinking too. The hash isn't my credit card number. Still. This is a very impractical way to "encrypt" a credit card number for transmission
"in the clear over ssl instead of hashing them"? am i missing something here?
is ssl insecure? is there some way to charge a credit card that doesn't actually involve sending the number to anybody?
I'm not sure I understand you; CC numbers are not passwords. You can't salt and hash them on one end and then confirm on the other end; you need to send the whole number if you expect to process a charge against it.
The HN login sends your password over the internet. It doesn't even use SSL. It is in the clear, readily visible to anyone able to run a packet sniffer on your traffic.
No - parent mentioned SSL - originally people were claiming it was sent as a clear text POST - the part that people failed to recognize was that it was over SSL and that is what was debunked later on.
"And let's talk about Sony's use of the word illegal. It is illegal, criminally so, to break into someone else's servers. But when the same word is used to refer to streaming a song from a non RIAA approved website, or to gasp playing a homebrew game on your PS3, respect for the word and those who say it is lost."
Who is this kid? He's like 20 years old and he talks like this? Geohot, you have my respect thats for sure.
This is an excellent piece, my esteem for geohot got even higher. It vilifies Sony (rightly so) but also is balanced. The plumber analogy is spot on and funny:
"To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes. (Note that I do not endorse water piracy)"
On a pedantic note, is there a reason why large corporations 'regret' mistakes rather than apologize for them? Is it just so they don't want to go on the record as being wrong?
Maybe true, but I don't think that's the real reason. I think it has a lot more to do with ego and cowardice. (It perhaps also belies a shoot-the-messenger mentality that exists within many major corporations.)
On The Media did a piece a few months ago about how the 1982 Tylenol recall is pretty much the gold standard for corporate disaster PR: identify the problem, apologize, and explain what you're doing to prevent it in the future. It's not hard, but it takes guts. Even J&J itself didn't meet that standard in later recalls. http://www.onthemedia.org/transcripts/2010/02/12/01
Strange how many of the commenters on the article think the Sony was hacked from a rooted PS3. There's no evidence but I'll assume this was done from a PC until I see some reason why doing it from a PS3 would make it easier (in any way).
Not too strange when you consider that most people don't understand networking and the internet.
From the point of view of some people:
"It's the Playstation Network, obviously you have to use a Playstation to get on the Playstation Network. You can't use a computer, they aren't compatible!"
I can't come up with a direct analogy for a similar lack of comprehension, but I keep thinking of the apocryphal stories of people that lock themselves out of their cars with the windows down, and freak out because they don't think of reaching through the window to unlock it manually.
I agree with you that it was probably done from PC (or well just about anything including PS3, but not because it was required to use PS3), but on the other hand it seems plausible that information extracted from (probably rooted) PS3 was significant help.
Apart from the fact that it's already got all the hardware and software to communicate with the servers, and is thus a much better conduit for an exploit, you mean?
Well the protocol turns out to look a lot like HTTP talking to Apache over SSL. This is no surprise, it's easy to develop with and is the most likely to make through proxies and firewalls outbound.
Nevertheless, Sony seemed to assume that it guaranteed they would only receive valid messages from actual hardware they controlled. This is not a security feature of SSL/TLS which depends on the client doing its part to prevent the absence of a man-in-the-middle.
When the client was hacked, many of their assumptions were violated. We hear rumors of hackers "mapping" their systems onto some internal development networks. What this means exactly I don't know.
But if Sony's primary network defenses were the Maginot line, their dev network probably looked a lot like Belgium.
It wasn't just a xkcd reference I think, I think it really was a reference from the fail0verflow presentation where the security of the PS3 was totally dismantled (the device itself, not PSN).
I thought part of geohot's settlement with Sony was that he wasn't allowed to discuss what happened? Maybe that was just with his case and not with the latest incident. Regardless, I like his attitude, and hope he continues honing his hacking skills. As he points out, at least they used a very strong XKCD style randomization algorithm.
It's a real shame that Sony alienates their customers with these kinds of acts while building a flimsy infrastructure for gaming. I'm one of those people who bought the PS3 just for OtherOS(and thankfully never got the removal patch) and honestly, given the lackluster performance it has and this move, I'm highly tempted to just sell it. The rootkit debacle of several years ago still leaves a bad taste in my mouth.
My understanding is that the "battlefield graphic murder" online simulator games are quite popular and they've had a problem with cheaters. Players have built up quite a rage against these cheaters and they look to Sony to fix it.
When hackers come along having the goal of running their own OS on the PS3 or even restoring the ability to run as a guest of the hypervisor (OtherOS), many players don't see the difference. Probably any research into the inner workings of a PS3 has the potential to benefit cheat development as well, but I for one do not accept the idea that we would turn off our inquisitive nature and forgo our home supercomputers so that others might gain a more fair killing field.
But I think you need to respect the opposing viewpoint: that supporting OtherOS actually isn't worth the risk of new cheats for a lot of people. It is a game console after all.
* It's not a "game console" by definition. It's a box with semiconductors inside it which I can purchase for a few hundred bucks at any of many local stores. These semiconductors are equally well-suited for doing vector calculations in support of many applications, frivolous and serious alike.
* It's simply a mistake to think by not "supporting OtherOS" it will significantly reduce the "risk of new cheats" in anything but the very short term. OtherOS is happening whether it's supported or not. That's probably true of cheating too.
* But that's not even what Sony did though, Sony actively removed OtherOS from units people had previously purchased, and only then _after_ it had already provided its (relatively small) boost to hackers.
The idea of keeping secrets locked in a box that millions of people purchase and physically control is simply ludicrous and has failed every time it's been tried.
How many days out of the last year was the iPhone not jailbreakable without even opening the box?
And to be fair, the Dreamcast was about as open as a 7/11, but that didn't fair too well for Sega.
A. Reality does not owe us a successful business model. Thus even if we accept Sega as an example of a failed open console, it says nothing to imply that a closed-console model is a viable idea.
B. Disbelieving (A) is usually a quick route to failure. Apple is good at getting its customers to accept unreality, but does a pretty good job of understanding the reality for itself. (Perhaps this is why they react so violently to cracks in their reality distortion field.) Often companies begin to believe their own reality distortions with disastrous results.
C. The vast majority of businesses fail anyway and the console industry is particularly competitive. Like Nokia in reverse, they recognized their own ability to make a business out of hardware systems and remained alive in a different market (hedgehog simulator software). If they knew they were the weakest player in a market that would only support a limited number of systems, would a more-closed architecture really have saved Sega consoles? What if they had started making open-architecture DVRs or home theater PC boxes instead?
Are there any postmortems on the Dreamcast and why it failed? I'm genuinely curious. I don't know if the openness of the Dreamcast led to its downfall, but it has a fairly strong community of hackers using it currently.
The best I can muster. Being a fan at the time, I tend to follow the "it needed more third party support" and "Sony lied/"used false PR" (which seems oddly more acceptable) to hype the PS2 into unrealistic levels" lines of thought. Particularly the latter, claiming video as "gameplay."
You really get the sense that success in that business (at least at that time, in the minds of the executives they interviewed) is about everything except delivering the best possible value to the customer.
As a gamer, it annoys me to no end how people are quick to defend and identify with companies that have even a hand in their favorite game. Many will even defend publishers of games they enjoy in unrelated matters, as if the publisher had anything to do with it.
It truly makes me wonder sometimes about the person on the other end of the keyboard when this kind of personal data breach is written off completely, laughed at as no big thing. I mean, I don't even have a PS3 or PSN account (waiting for Team Ico's next game,) but I can tell it isn't "nothing."
Really want to be disappointed in gamers? Google Image search "Modern Warfare 2 boycott".
The word "hacker" has been corrupted by the media to the point it's nearly derogatory. We need a new term for what we do. Something like "techsmith." Any other ideas?
Meh, I'd rather just use "hacker", media be damned.
Maybe my perspective is warped, but I feel like the original meaning of "hacker" is gaining popularity lately. "Hackathons" have made their way into the media thanks to Facebook and Zuckerberg. And of course PG's writing and "Hacker News" are somewhat well known in the tech and startup circles.
Still it's far from the mainstream meaning. In some ways it's cool that it's not, it's almost like a secret handshake. If you know what I mean when I say "hacker" I have a little extra bit of respect for you.
This is not a recent phenomenon. Even in the 80s it had a negative connotation, fueled mostly, I think, by Sherry Turkle's The Second Self (I wonder how many young hackers are aware of that infamous book) where the hacker culture was shown to be macho, masochistic, and closed, see Sex/Machine (http://books.google.com/books?id=vo5b6XA2F30C&lpg=PA369&...) for a summary.
Although I agree that "hacker" has a new meaning (and has for a long time), much like how the LGBT community adopts otherwise derogatory terms, I don't think we should stop using "hacker" because of outside influences; the actual meaning implied (coder or script kiddie) is often obvious thanks to the context it gets used in (CNN using "hacker" in a news title is different to when Joel Spolsky uses it, for example).
"hacker" is fine. Yes, it's corrupted by the media, but then again, which word hasn't been at one time or another? Name one profession or job title that is always portrayed as positive in the news. Why care at all?
Personally, I kind of like the ambiguity of the term a little bit. It reminds us that things are not always as simple as they seem, that we can't cleanly divide our world into 'friends' and 'adversaries', or place our systems neatly into 'trusted' and 'untrusted' boxes.
I don't agree. A hacker is first of all characterized by the desire of knowledge and has little to do with coding itself. I don't believe that coding OS kernel all day is sufficient to call yourself hacker indeed.
You could be a "kernel hacker" though, particularly if you're working on kernel-mode device drivers without support from the hardware vendor.
To me, a "hacker" is someone who is involved in finding ways to get systems to perform in a manner outside the intention of its design. E.g., hotrodders could be considered car hackers.
"This arrogance undermines a basic security principle, never trust the client. [...] Notice it's only PSN that gave away all your personal data, not Xbox Live when the 360 was hacked, not iTunes when the iPhone was jailbroken, and not GMail when Android was rooted. Because other companies aren't crazy."
"[...] To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes."