Hacker News Reader

Comment by mrpippy | Hacker News Reader

> I would say that the Vita is the most secure consumer embedded device that's out today

Moreso than the PS4 and XBONE?

Or the 3DS.

It's funny, when it's our personal data or credit card numbers, they can't seem to manage the most basic of security procedures. Yet when it's DRM and they want to prevent unauthorized third party code from running (because they can't take their 60% cut), suddenly they're masters at sandboxing.

> suddenly

Ignoring the Gameboy, Gameboy Pocket, Gameboy Color, Gameboy Advanced, Gameboy Advanced SP, Gameboy Micro, all the various combinations of those machines, and then the Nintendo DS and combinations.

They've never been friendly to homebrew, but after DS flash cards it's not surprising they tightened things up.

Suddenly as in compared to securing customer data, not their previous consoles. Suddenly was used to indicate the contrast between their efforts and abilities in securing various segments of their platform.

The difference between a profit center and a cost center, I guess. It costs money to secure a bunch of systems that process credit card data or other stuff; it profits to be able to take that 60% cut.

Typical system behavior. Tax offices are uber fast at cross relating shallow data to spot potential fraud, but coudln't help you fill some form to save their life.

Well I don't consider them embedded, but I would say yes for the PS4. I haven't looked at the xbone yet so I can't say anything for that. PS4 uses FreeBSD9 as its kernel. Plus there is no KASLR. In theory, if you find an exploit in freebsd, you can exploit the ps4. Some people already got some kernel memory leaks to work. Meanwhile, the vita uses a custom os built from the PSP but is vaguely similar to it (I wouldn't be surprise if it was a complete rewrite).

The only thing standing between anyone executing their code on PS4 or Xbox One is a valid signing certificate. If you had it, or if you could trick the system into thinking it doesn't need one, you could just burn your data to a BD disc, or try running it from a USB stick. On the Vita you don't even have an attack vector. It uses propriatery cards for both games and extra storage,with no commercial readers/writers available. I have a Vita Devkit at work and the only way Sony provides for devs to write/read from these cards is through the devkit itself,it has an extra Mini-USB port to connect to PC through special connection. It's super secure from what it looks like.

Well if I can be pedantic for a second, "valid signing certificate" is much harder to find than any software exploit. In fact if you can find it without physically stealing the certificate, you just broke modern cryptography. And on the vita, if you can sign code, I can load it for you over wifi by faking an update package ;)

Yep, of course - but the PSP was originally broken by tricking the firmware into thinking that literally everything has a valid certificate. MS Pro Duo readers were popular, you could easily grab the eboot.pub and modify it yourself. With the Vita, if you haven't got a devkit you don't even know what the file layout on the memory card looks like.

Even if you had a devkit, you still won't know. The devkit is just as sandboxed and there's an additional processor whose sole job is to enforce security on the debugger and PC communications.

Really? My devkit just shows the memory card as another storage device when I plug it in, I can freely copy files to/from it. But granted, I only had to use it a few times, mostly work with PS4/X1 nowadays, so maybe I have missed something.

Reply on news.ycombinator.com