Breaking the console: a brief history of video game security | Hacker News Reader

Breaking the console: a brief history of video game security

sergioprado.blog

96 pointssprado26 comments

So, I don't know if this is AI generated or whether the author is actually unaware, but Atari cartridges and floppies commonly had copy protections. My uncle was active in the scene at the time, and as an electrical engineer came up with a solution. When I inherited his Atari 800 in the 90s there was a physical button wired into the floppy drive which would force a bad sector onto the disk as it was being written. He had notebooks about the timing for these bad sectors per game.

So, yeah. The "article" is incorrect from nearly the get-go about the "wild west" Atari age.

Thanks for the comment.

No, it is not AI generated. It was based on my research.

I think there is a mix-up here between Atari home consoles and Atari home computers.

In that section I was talking about early console platforms such as the Atari 2600, where the cartridge interface itself had no lockout/authentication mechanism comparable to what Nintendo later did with the 10NES. That is why third-party cartridges could exist and Atari’s main response was legal rather than technical.

What you describe for the Atari 800 is real, but it belongs to a different context: the Atari 8-bit computer line, especially floppy-disk software, where copy-protection tricks such as intentional bad sectors and timing-based checks were indeed common.

So I agree that Atari computer software often used copy protection, but that does not contradict the point I was making about the early console era.

Hi, quick note on "For modern Xbox platforms, public 2024 work exposed SystemOS kernel exploitation on both Xbox One and Xbox Series"

I'm a former Xbox hacker, then former Microsoft employee, and (long after) leaving Microsoft helped with the Collateral Damage post-exploitation payload.

The design of the Xbox One security predates me, but Microsoft has always known that SystemOS would be a weak link that would almost guaranteed to be compromised and shoved most of their attack surface that can be trivially attacked in there. The system shell, 3rd-party apps, guide, etc. all run in SystemOS.

The key things they focused on though were:

1. Extremely strong defense-in-depth

2. Making full or partial exploitation not economical

3rd party apps and the web browser were seen as being obviously untrusted _and_ needed JIT because they'd mostly be based on .NET or the JS VM. But practically speaking there should be nothing interesting in that VM: its compromise shouldn't enable piracy/cheating and ideally shouldn't leak game plaintext.

What some others found though was that for some reason plaintext was actually visible to SystemOS, but didn't enable piracy on console. You can take those games though and run them on PC using XWine1: https://github.com/xwine1

Technically speaking there's no reason why Collateral Damage couldn't have happened waayyyyy earlier in the Xbox One's lifecycle except for motivation. Even still you could probably take some Hyper-V N-day and compromise HostOS through.

Over there years there have been other "exploits" too: some folks have managed to tamper with gamesaves via cloud connected storage and other shenanigans, XSS in the system shell (some of these apps are JS), etc., but most of this was relatively benign and easily patchable. And there has been a very, very small group of people with similar but less capable exploits to Collat.

Collat allowed compromise of plaintext.

Bliss breaks everything :)

I find it interesting that all the way back in 1985, in Atari vs NES, we had proof that consumers preferred walled gardens. The walled garden exploded from a completely dead market, while the already-existing open system killed itself. Apple proceeded to make a killing of their own on this reality, Microsoft invented a pseudo-walled garden that has become a technical dead end, while FOSS communities are still in denial about how things shouldn't be that way rather than accepting reality and inventing their own curated experience with enforced rules.

> Microsoft invented a pseudo-walled garden that has become a technical dead end

If you're referring to Windows, this is not very walled at all. You barely need a computer to write and release windows apps, let alone money.

Office, perhaps? Or a variety of other products.

Windows is an open platform for developers... if you ignore all of the security checks and Windows Defender and the stagnant platform which is about 2 decades behind everyone else, across the board, in terms of native tooling (e.g. which UI framework should I use and is it good?).

However, Windows also has many, many, walled garden things bolted onto it. You aren't distributing your own drivers without Microsoft's approval. You aren't running Microsoft Office on Wine. You aren't connecting to Active Directory without Microsoft's blessing. You aren't making group policies that work on Linux for MDM. You aren't manufacturing Windows devices, at all, unless they meet Microsoft's system requirements and mandates (e.g. a Windows icon on the keyboard). Your BIOS must follow strict rules about where the activation key is fused. Etc.

In that respect, Windows is only open from an end user perspective. In all other respects, it is closed, and it is closed tightly.

> You aren't distributing your own drivers without Microsoft's approval.

Only kernel drivers.

> You aren't connecting to Active Directory without Microsoft's blessing.

I think you're talking about EntraID. That is true enough. You can just spin up Windows Server and create a domain controller, no problem. You don't need Microsoft for domain services, though - you can use other domain controller types. (You don't get GPO and other things - that's not a 'walled garden' thing, that's a feature set which other systems don't have)

> In that respect, Windows is only open from an end user perspective. In all other respects, it is closed, and it is closed tightly.

Not so tight as you seem to think. And anyways, I was specifically referring to building windows apps - which you did not disagree with. You absolutely can pull down various free tools, build an app, package it up as a .zip or .msi and distribute it from a variety of places. The Windows app store is a walled garden, but you don't have to use it.

I think consumers chose quality and convenience. It just so happens that the walled garden is the easiest way to accomplish this. Electronics, especially computers, were extremely expensive back then. I can't blame people for buying a console that just works. Compatibility was an issue well into the late 90s because so many people didn't know how computers worked.

I disagree, it wasn't about consumers, but rather other businesses. The walled garden approach Nintendo took in America was needed to convince retailers to stock video games on store shelves again. And of course the Famicom didn't have that same approach, and while Nintendo hated the fact third parties could easily make Famicom carts, the open nature of the system certainly didn't hurt it in Japan.

I think the takeaway is consumers want to trust the products they are buying are as advertised.

Also another incorrect factoid: "The original Xbox (2001) was built on familiar PC hardware (Pentium III derivative, Intel GPU, standard hard drive)"

(it was an NV GPU)

Good catch. Indeed the GPU was Nvidia’s NV2A, not an Intel GPU. I will correct that in the article. Thanks for pointing it out.

After some time without posting on my blog, I decided to get back to it — and my first post after the break is about the history of video game security! There are also some great stories along the way, like Atari reverse-engineering Nintendo’s lockout system, or how simply changing the name of Link's horse became an attack vector on the Nintendo Wii. I had a lot of fun researching and writing this article, and I learned a lot in the process. I hope you enjoy it too!

Thanks I did enjoy it! One thing is, I feel like the PS1 wobble disc protection, although bypassed with swaps and mod chips, it has never been possible (besides one historic example: Datel) for someone other than Sony to make a disc bootable on the console. I feel like most PS1's weren't modded so it was quite a well done lockout. But I understand that wasn't your main point - just that it was a surprisingly effective copy protection.

The best part of the 10NES design, as a consumer, was that it was fail-safe, rather than fail-secure. The console defaulted to booting. So, if your NES started having the infamous boot-reset flashing light, all you had to do was unscrew the NES enclosure and clip the power pin on the 10NES chip. And these were huge pins, it didn't require any subtlety. You could do it with a nail clipper.

The modern consoles are pretty close to perfect with how they use PKI and certificates. Even if you clone the cryptographic identity of a valid console, the vendor can quickly detect this impossible access scenario.

Correct. And identity management is so important nowadays that most security-related certifications and regulations require it.

The cat and mouse between console makers and hackers is one of the more honest stories in tech. Both sides kept making each other better.

True!

Back in the day I remember my brother got his hands on a PS1 modchip, but it didn't require any soldering- you just plugged it into the "parallel I/O" port in back of the console and it let us run games on burned CDs. We really got our moneys worth at blockbuster after that

My buddies brother did the same thing with a PS1 and maybe sent his Xbox off somewhere to get it modded. However he was an asshole hermit and wouldn’t let us play or burn any games.

My dad would never cheat or do anything illegal even though he was an EE who could’ve done the mod himself. Today he might do it but there was a strict no stealing policy even for digital things. Like the time he freaked out because I was grabbing stuff from The Scene and wrote down a bunch of terms to research, he saw the word Warez and freaked out.

Bewarez warez

interesting video I was seeing the other day: https://www.youtube.com/watch?v=FTFn4UZsA5U

Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft:

https://www.youtube.com/watch?v=U7VwtOrwceo

I like this video too, Tony Chen explains the overview of Xbox security system.

Thanks for such an interesting read. Would be awesome to get sort of a "follow up" about modern sophisticated digital solutions we have now (denuvo and so on)

That would be a great follow up. Added to my list of next articles. Thanks for the suggestion!

Reply on news.ycombinator.com