PS4-5.05-Kernel-Exploit: A fully implemented kernel exploit for the PS4 | Hacker News Reader

PS4-5.05-Kernel-Exploit: A fully implemented kernel exploit for the PS4

github.com

181 pointsaxiomdata31649 comments

This is awesome, it reminds me of the security course I took in school where we had to smash stacks and hunt for various buffer overflow exploits. It was one of my favorite classes, but also one of the most difficult!

To me this is one of the most impressive fields of CS/Software Engineering because of the skill required to understand and exploit full systems. Even though I'm a software dev, reading this makes me feel very humbled and shows how little I actually know.

Thanks for the read!

This is based off the below link which was posted in another comment. Much more informative than the github repo imo. http://crack.bargains/02r0.pdf

If you find that kind of thing fun, there are a bunch of free online CTF-style "wargames" that involve exploiting software with intentionally added bugs in a sandbox. Not nearly as difficult and impressive as this kind of real in-the-wild exploit, but definitely fun.

http://overthewire.org/wargames/

https://www.wechall.net/about_wechall

This type of stuff is also what does make me sad for not doing CS in college, cause it requires a lot of work to learn in my free time yet super interesting.

I can guarantee you that most people who went through CS in college never had a course like that.

> http://crack.bargains/505k/

Sigh, of course qwertyoruiopz would choose a site like that…

Probably goes without saying ... but don’t visit this in your actual browser if you like using the back button.

This annotated JavaScript describes the approach:

https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c39...

If you want to have a good laugh without owning and exploiting your PS4…

https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/...

For me it is the first time to see a low-level exploit implementation written in JS. Is the exploit done through a PS4's web browser? Quite interesting.

Yeah, it's pretty common on these platforms since it's a way to run code on an otherwise locked down device.

A lot of console (and iphone) exploits tend to share similar webkit exploit code. This ps4 exploit uses a ROP strategy from an earlier iOS exploit.

This is a pretty good overview (though from 2016) of the techniques used in the browser based exploits:

http://phrack.org/papers/attacking_javascript_engines.html

It seems nobody can properly sandbox webkit...

Part of the problem is that these devices tend to have custom operating systems and custom builds of webkit, both outdated or forked from outdated code. As a result they haven't benefited from the full set of security audits and improvements you get if you're running Safari on an iPhone, or Chrome on Windows. A couple PS4 attacks rely on the fact that the PS4 sandbox allows access to BPF from the content process, for example - that's an odd choice and I doubt it's one you'd see in the sandbox of a consumer web browser like Chrome or Safari on a desktop PC. It's a Sony oversight.

- fork OSS project

- add your proprietary locked down bullshit on top

- make sure you don't have manpower / time to reintegrate patches into your fork

- profit.....?

does the threat model require anything more? i haven't really been exposed to consoles since i was a kid, but i don't get the impression that end users do anything terribly sensitive on them. i thought that whatever security existed was mainly intended to combat piracy. if the majority of the risk falls on sony, i don't really care how well they secure the device.

An attacker might potentially be able to get at your card details, since you need to enter them in order to buy stuff on the PS Store.

Also, the PS4 has social media integration, so it might be possible to access your accounts somehow.

(I'm not saying that an attacker definitely can do this; I'm merely pointing out that there are potentially some bits of private information on the PS4.)

What's BPF? Quick googling and I couldn't find info on it.

https://en.wikipedia.org/wiki/Berkeley_Packet_Filter (First link from Google for BPF)

Thanks. I guess there's some level of localisation or peronalisation to the results:

BPF Home | British Property Federation (BPF) British Plastics Federation British Psychotherapy Foundation

Then the Berkley Packet Filter.

Original iPhone cracks (for third party apps, before Apple allowed them) used a website with a TIF image (TIFs have some executable code).

This one loops history.pushState() to trigger the leak, direct link to the line:

https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/...

JailbreakMe actually continued to work until iOS 4.3.3, though of course the exploit used needed to be continually updated as Apple patched iOS: https://en.wikipedia.org/wiki/JailbreakMe

Is there an explanation of what this is exploiting?

It's a double free in bpf.

Here's some slides from the author (from last week) with a more in depth explanation:

http://crack.bargains/02r0.pdf

Much more interesting than the raw code. I'd replace the link if I were a mod.

Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person).

I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering.

[1] https://www.freebsd.org/cgi/man.cgi?bpf(4)

These also exist in the Linux kernel (bpf/ebpf)

And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).

BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.

That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.

> I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface

Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet).

https://svnweb.freebsd.org/csrg?view=revision&revision=47584

https://svnweb.freebsd.org/csrg?view=revision&revision=47585

(Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.)

As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.

There's a full explanation for the previous vulnerable FW 4.55 but the defect is the same (IIRC) as Sony properly fixed the race condition only with FW 5.50.

https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

and of the previous 4.05 https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

I wished I was smart enough to even implement half of what I just read and I am a senior getting my BA in computer information systems with my focus being networking and security :(

PS4 is such an amazing device, I wish I could do more with it!

Also its price hasn't increased compared to graphics cards (due to cryptocurrency hype).

I would be rather surprised if the prices of graphics cards offering similar performance as the PS4 had been significantly affected by cryptocurrency mining.

Inflating the prices for the high-end also affects the price development of the mid to low end, because those don't exist in isolation from each other.

Unless you’re a multinational conglomerate with a contract to buy a huge amount at a particular price.

It isn't the graphics that impress me, so much, as the fact that my PS4 can actually send real 5.1 audio out to my home theater setup. It boggles my mind with how difficult that seems to be on my gaming PC.

Sure, my PC can sling a zillion triangles per second, but it can't make one stompy robot dinosaur shake my living room the way the PS4 can.

To be fair, the original XBox could do that via an optical audio port.

Does your PC not have digital optical audio out? Also any GPU made in the last 10 years should be able to do 7.1 over HDMI. If you have an Nvidia card make sure to install the "HD Audio" component when you install the driver.

Any PC can do even better, by sending multichannel PCM over HDMI

FYI: Xbox One developer mode has opened up to give UWP apps pretty much all of the resources of the device.

https://blogs.windows.com/buildingapps/2017/09/15/resources-...

Unrelated, but does anybody know the current status of GNU/Linux on the PS4 ?

I am looking for some little box to replace my aging home server and the PS4 looks powerful but small enough for the job.

I wouldn't say it's entirely unrelated, my first thought when I saw the headline was "does this mean we can run unrestricted GNU/Linux on PS4 now?" ;p

You can probably buy a better machine for that use case [1], unless you really want a built in Blu-ray drive or lots of memory bandwidth.

[1]: https://www.pcengines.ch/apu3a4.htm

That machine, while great (PC Engines, their best offer, Coreboot, good value for money), is designed to be a DIY router for running e.g. OPNSense.

You're probably better off with a NUC such as a Zotac or a Chinese knock off (example [1]). Why? Because given it has more horsepower and native hardware extensions for virtualization it can run VMs more efficiently.

[1] https://www.gearbest.com/mini-pc/pp_1698829.html?wid=1433363

Yes, a NUC, a miniITX PC, a commercial NAS, etc. would work. There are a lot of good options in this space.

I would note that the apu2 is more or less half of a PS4, ignoring the GPU (which probably wouldn't work that well anyway?).

    PS4              | apu2c4
    8x 1.6GHz Jaguar | 4x 1.0 GHz Jaguar
    8GB GDDR5        | 4GB DDR3-1333
    SATA, USB 3.0    | mSATA, SATA, USB 2.0/3.0, SD
    1G Ethernet      | 3x 1G Ethernet
    BT 2.1, WiFi N   | N/A
    HDMI, SPDIF      | N/A

IIRC audio over HDMI doesn't work yet (but the audio jack from the joypad works) and recently they added support for the slim and latest fat models HDMI video encoder chip.

The biggest drawback is the lack of persistence, especially if you want to use it as a server: you execute the exploit from the browser and load a Linux distribution from an external USB disk (not a real problem in itself as also the internal SATA HD is connected to the USB southbridge ^__^;)

There are some videos on YouTube that show working 3D HW acceleration tho.

I am so excited to test this. Praise the devs

Reply on news.ycombinator.com