Hacker News Reader

Comment by spencerflem | Hacker News Reader

Congratulations, haven't had a reason to mess with it myself, but I've heard it described online as the most secure piece of consumer hardware before or since

View on HN

I think you might be mixing up the Xbox 360 with the Xbox One, the former was ultimately compromised in several ways, but the latter's security has held up extremely well for 11 years and counting. The Xbox One and its successor are easily the most secure consoles ever made.

Obligatory: https://www.youtube.com/watch?v=U7VwtOrwceo

Found it! I misremembered, it was making a slightly different claim

"The Xbox 360 hypervisor is probably the most secure piece of code Microsoft has ever written." from the excellent article Tony Hawk's Pro Strcpy

https://icode4.coffee/?p=954

The Xbox 360 was overall a very, very secure device. While we don't know exactly how the folks who discovered the hypervisor syscall handler bug were able to get plaintext, it's theorized that it came from development kit and SDK leaks. With an SDK and dev kit someone could dump boot loaders and the HV.

Otherwise on a retail console you can't do much. The hard drives are not encrypted but all content that can possibly contain code / save data is signed. Save data cannot contain code but introduces scripting engine / save parsing attack surface, but you can't modify it without first dumping keys from a retail console.

To dump keys from a retail console you have to get code exec in the hypervisor. To attack the hypervisor you have be able to dump the hypervisor to audit it.

To dump the hypervisor you have to be able to read its contents or dump it from flash. The flash is encrypted with a per-console key (and I don't think you can sniff the bus?) and RAM is encrypted.

Realistically if it weren't for the original syscall handler bug and dev kits getting into researcher's hands, the Xbox 360 may have never been hacked.

Stupid question, is the reason that people cannot simply dump the ROM as they do with say routers is that the rom is encrypted? But if they have the SDK they can decrypt it?

The flash chip is encrypted with the console's CPU key, and the CPU key is unique per-console and encoded in efuses. So even if one person manages to dump keys they're mostly useless for hacking other consoles. The exception to this is the "keyvault" which is the console's own private key used for signing save games. You can take save games from console A and load them on console B, so console B is able to verify console A's signature based off the public key certificate embedded in the save. Microsoft had a revocation process for revoking keyvaults if they ever leaked but they just gave up once too many were in the wild.

Dev kits are keyed differently and most of the console's keys for signing / encryption are in various SDK DLLs that if you reverse engineer you can find.

Thanks, MS did take a lot of efforts on the security. Searching for X360 keyvault gives a lot of webpages. I'll read a bit.

https://free60.org/ probably has all the information you need.

Thank you! Now I need to buy a used XBox 360...

> The Xbox One and its successor are easily the most secure consoles ever made.

Microsoft also allowed any console to switch to developer mode and run homebrew, massively reducing the need for people to try find exploits.

I'm curious how it fares against a modern iPhone or similar, has that ever been compared?

iPhone has a fairly different threat model (and is more valuable to attack).

I have a hard time believing the ‘since’ part of that description. Intuition suggests the latest iPhone would take that crown each year.

Misremembered, it was saying it was the most secure code Microsoft has written, not anyone

From the excellent: https://icode4.coffee/?p=954

> the latest iPhone would take that crown each year

Apple continuously patches zero-day kernel exploits against the latest iOS and hardware, https://support.apple.com/en-us/100100

That is far from the only thing that would be relevant for such a metric. (For one thing, you also have to ask which kernel.)

iPhone and iPad devices have been breached by zero-days for years, unlike Xbox One.

Still simplistic. "Breached" can mean a number of things, and the incentives here are very different.

Breached = remote control of device, bypass all vendor and owner security policy, and exfiltration of non-public data.

And that was achieved?

Multiple times via iOS zero days. One example, https://www.theguardian.com/technology/2024/dec/20/whatsapp-...

> NSO Group Technologies, was accused in a lawsuit by Meta’s messaging app of infecting and surveilling the phones of 1,400 people over a two-week period in May 2019 via its notorious Pegasus software. The judge.. found the company had violated state and federal US hacking laws.. was used to infiltrate not only WhatsApp but also iPhones to extract pictures, emails and texts.. victims of the hack identified by Meta were senior government officials, journalists, human rights activists, political dissidents and diplomats.

5 years ago, by state level actors. How many state level actors are trying to breach the Xbox? Your original statement was “there are kernel vulnerabilities being fixed, therefore iPhones are less secure than the Xbox one”. It’s just not that simple. I can’t make any assessment about which of those are more secure without a serious look, but this isn’t it.

“How many state level actors are trying to breach the Xbox?”

The U.S. Guvmint for one: https://filesharingtalk.com/content/1654-US-government-hires...

Sure, but there are many more people looking at iPhone security than at Xboxes. The incentives, both monetary and otherwise, are much greater with iPhones than they ever were with consoles.

Reply on news.ycombinator.com