Hacker News Reader

Comment by kbumsik | Hacker News Reader

For me it is the first time to see a low-level exploit implementation written in JS. Is the exploit done through a PS4's web browser? Quite interesting.

View on HN

Yeah, it's pretty common on these platforms since it's a way to run code on an otherwise locked down device.

A lot of console (and iphone) exploits tend to share similar webkit exploit code. This ps4 exploit uses a ROP strategy from an earlier iOS exploit.

This is a pretty good overview (though from 2016) of the techniques used in the browser based exploits:

http://phrack.org/papers/attacking_javascript_engines.html

Original iPhone cracks (for third party apps, before Apple allowed them) used a website with a TIF image (TIFs have some executable code).

This one loops history.pushState() to trigger the leak, direct link to the line:

https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/...

JailbreakMe actually continued to work until iOS 4.3.3, though of course the exploit used needed to be continually updated as Apple patched iOS: https://en.wikipedia.org/wiki/JailbreakMe

It seems nobody can properly sandbox webkit...

Part of the problem is that these devices tend to have custom operating systems and custom builds of webkit, both outdated or forked from outdated code. As a result they haven't benefited from the full set of security audits and improvements you get if you're running Safari on an iPhone, or Chrome on Windows. A couple PS4 attacks rely on the fact that the PS4 sandbox allows access to BPF from the content process, for example - that's an odd choice and I doubt it's one you'd see in the sandbox of a consumer web browser like Chrome or Safari on a desktop PC. It's a Sony oversight.

- fork OSS project

- add your proprietary locked down bullshit on top

- make sure you don't have manpower / time to reintegrate patches into your fork

- profit.....?

does the threat model require anything more? i haven't really been exposed to consoles since i was a kid, but i don't get the impression that end users do anything terribly sensitive on them. i thought that whatever security existed was mainly intended to combat piracy. if the majority of the risk falls on sony, i don't really care how well they secure the device.

An attacker might potentially be able to get at your card details, since you need to enter them in order to buy stuff on the PS Store.

Also, the PS4 has social media integration, so it might be possible to access your accounts somehow.

(I'm not saying that an attacker definitely can do this; I'm merely pointing out that there are potentially some bits of private information on the PS4.)

What's BPF? Quick googling and I couldn't find info on it.

https://en.wikipedia.org/wiki/Berkeley_Packet_Filter (First link from Google for BPF)

Thanks. I guess there's some level of localisation or peronalisation to the results:

BPF Home | British Property Federation (BPF) British Plastics Federation British Psychotherapy Foundation

Then the Berkley Packet Filter.

Reply on news.ycombinator.com