Hacker News Reader

Comment by kevingadd | Hacker News Reader

Feels like any time a console gets jailbroken, it's always a JavaScript use-after-free exploit in the browser webview that they use to open the user manual. IIRC this was true for the PS Vita, 3DS, Wii U, among others? I wonder if at some point console vendors will stop using webviews entirely?

View on HN

I think it's because webkit is an open source project with known bugs/vulnerabilities. Bugfixes in upstream webkit version may not be included in the console version of webkit yet, so hackers can have easier time testing for potential exploits simply by testing those known bugs.

Not always (some PS Vita jailbreaks relied on breaking out of PSP emulation, for example), but it's indeed a pretty common vector of liberation.

>vector of liberation

Ohh, I love that wording so much

I do suspect that this is a big part of why the PS5 doesn't include a browser, despite one being available on the PS4. It's a shame really, would love to be able to browse the web from my PS5.

Yep, this is exactly why. Sony got too scared of having a fully user-facing browser this time around because of all the Webkit exploits slamming the PS4.

It actually leads to frustration as an ISP employee; we get reports of end user devices getting slow speeds and the built-in PSN speedtests can often give us bad results (eg, a customer might be rated for 100x100 and the PSN test yields 20x5) -- running a browser-based speedtest we might be getting full speed to the device indicating a PSN issue. Removing the browser takes that troubleshooting option away from us.

It is amazing how consistently garbage PSN speed tests have been for over a decade. I remember the results being wildly off on my PS3, PS4, and now PS5.

PS5 had a bug where its Wifi speeds can become 80% slower if the rear USB ports are being used.

Switching to Ethernet bypasses this issue but I’m unaware if this was ever fixed.

That's as close to "changed radio channels and my wheels fell off" as you can get...

It does have one, e.g. for opening links in tweets, though it doesn't let you enter URLs directly.

So… you just tweet yourself any links that you want to open?

Yes. It's not terribly useful, but it exists, and could be exploitable.

Why aren't they using some sort of sandbox, apparmor or selinux based security? The places where foreign data and code are allowed in consoles should be pretty limited.

I still remember the dirty COW exploit on Android and it was useless because all you are getting is root in some heavily restricted namespace.

They often are heavily isolating the browser. This is the reason a kernel exploit is also needed, but getting the first foot in is often an important part and most easily accomplished with the browser.

Game consoles are some of the most secure and heavily exploited systems around, since there is a very strong financial incentive to secure them and a strong incentive to break 'em open (compared to almost any other consumer tech).

Reply on news.ycombinator.com