Xbox Firmware Hacked?

[bingo83]

News has surfaced that a flaw in the Xbox360 DVD firmware could possibly allow a hacker to install their own custom firmware. Thus allowing them to gain complete control over what the DVD will and will not accept.

DVD burns of games anyone?

All these claims are coming from a user who calls himself "TheSpecialist" who in the past was credited with a firmware hack. That particular hack never saw the light of day for several reasons.

Quote: "About the reasons for me not releasing a hack: EVERYBODY who has some brains could at least think of 1 VERY good reason not to release it. There are several very good reasons not to release it, while I couldn't think of *one* good release to release it. We hackers are really NOT interested in playing backup games. Man, I don't even have a 'live' account. The only reason I own a XBOX 1 is that I won one. We hackers are interested in security processes, finding flaws, the thrills, the suspense to go where no one has gone before ... The feeling of outsmartening the XBOX development team that worked several years on security. It's like a gigantic puzzle we love to solve, finding a way in ... THAT's what we love. We did that and had great fun all the way. But we realise that releasing a hack would have several results we really can't accept."

So we pickup where we left off; The latest news with a few quotes from TheSpecialist's latest posts.

"Word on the street is that some smart people of this board combined their forces, formed an underground team and are very, VERY close to getting the first 360 backup booting…Firmware. I doubt you’ll see some kind of OTHER hack soon, that lets you boot unsigned code for example. MS did a very good job on the 360 itself this time. However, they made a big mistake by forgetting about the firmware. They even didn’t remove the debug routines from the FW, quite amazing … The 360 has a little bit more advanced protection in its FW than the original xbox, but still, they did some stupid things (like forgetting about the debug routines, that were very helpful to us, hehe, and most importantly: not signing the firmware). I’m betting they’ll develop the MPU in the drive from scratch for their next gen consoles and sign the code in the FW."

As you can see from the post, it's all about the firmware not getting signed, which is a big no-no from a security standpoint. Even if Microsoft were to release an update via Live to fix the modification, a new firmware could be installed again.

But there is more to have to deal with besides just the firmware, since the other parts of the Xbox360 security is... well secure. It could be a while before we're seeing any homebrew appearing.

HACK VIDEO HERE (http://dl.qj.net/index.php?pg=12&fid=5373)

[mjmaskrey]

A video of a successful firmware hack is available here Link (http://dl.qj.net/index.php?pg=12&fid=5373)

TheSpecialist announced that he had in fact cracked the firmware, and to prove this he even released a video. However, he also stated that he will NOT release his methods to the public because he feels strongly against piracy. Unfortunately the border between running homebrew and booting up illegal game backups is too thin, but this should give up to aspiring 360 hackers elsewhere. Now that the gateway has been opened, it's only a matter of time before everyday gamers will be enjoying homebrew on their 360.

Whilst I modded my Xbox for Homebrew software (XBMP/C are awesome) it certainly has it's drawbacks with Live cheating/modding so I'm glad it's not being made public for 360 yet....but it's only a matter of time sadly.

:)

[phatmuther]

yeah i agree, XBMC is the bomb, but the cheating side sucks ass. but im sure microsoft have learnt they're lesson and are prepared for all this stuff

well id hope :unsure:

[mjmaskrey]

MS talked the talk on the protection side before 360 released but hmmmmm.....there's a video of a guy doing the 'hot swap' with a game and a backup...lol..that's the oldest trick in the book and still working!

The 'hot swap' video is on you tube but I can get the link if you want it.

:)

[phatmuther]

that hot swap one on youtube ( if its the same one im thinkin of) came out a while ago and was a fake i think, if it were real there would be a lot of talk of it about the net and a lot more hot swapin goin on right now!

[mjmaskrey]

Yeah it's been about since December...could be fake...depends how many people fancied stripping their 360 to test it! Certainly not me!

:)

[fatlip180]

i dont think its a fake (the hotswap video i mean) but you needed you original disk to do it with and could only hotswap for a short time until the xbox ran a media check again.

[fatlip180]

yeah i agree, XBMC is the bomb, but the cheating side sucks ass. but im sure microsoft have learnt they're lesson and are prepared for all this stuff

well id hope :unsure:


No MS havent learnt there lesson with this one as there wasnt a lesson to be learnt., The guy who did the hack said that if MS try to reflash the dvd firmware by xbox live update, then it would be a simple case of changig his own hack to combat MS' update, a simple 5 minute job.

The reason that they havent learnt their lesson is that the xbox wasnt hacked like this until a few weeks ago. The Specialist who hacked xbox 360, created the same hack on the xbox about 2 weeks before the xbox 360 hack.

It was a hole that MS seemed to have simply overlooked, because there was no security threat from this angle on the xbox, they didnt see it coming.

Apparantly they even left the debugging routines in the xbox360 firmware and this alowed the specialist in.

[mjmaskrey]

More hacking news:

PSP homebrew developer Nytrix, from our forums, has confirmed an earth shattering breakthrough in the Xbox 360 hacking scene today. As you know, we earlier, reported on the issue of backup games being playable on the Xbox 360. The author of the video was unwilling to give out the technique that he used to accomplish this feat. However, Nytrix has gone above and beyond and determined the methods used and claims to have duplicated the procedure, along with providing more information on exactly how and why this is possible. Apparently this is only applicable (at this time) on the Hitachi drives that come with the Xbox 360, however we expect to see breakthroughs in all drives very soon. Here is a quote from our forums from Nytrix.

I have figured out how it was done in the video. (the video of the guy playing the PGR3 backup) here's the instructions, I am currently playing Full Auto (Backed up).

It's a modified firmware of the Xbox 360 DVD-ROM drive. As you (should) know, all Xbox 360 executables (XEX files) are signed by Microsoft (with a private key only MS has). This means that if you try to change anything to the XEX file, the signature will be wrong and the file will not boot.

Now ... to protect from booting an exact 1:1 copy of a game from a DVD-+R, microsoft gave each XEX file a 'mediaflag'. This mediaflag tells the Xbox 360 from which media (cd-r, dvd-r, dvd+r, dvd-rw, hdd, dvdxbox, dvdxbox360, ...). Changing this mediaflag in XEX is not an option as it'll break the signature (see above), so ... what's done in this firmware hack is breaking the detection of the disc.

As you can see, he has found the flaw in Microsoft's self professed "bullet proof security" by simply modifying the firmware of the DVD drive to allow backup copies of official games to boot. Now as simple as this may sound, it does require some advanced soldering skills, and will probaby not be within the means of the average person. However, with this astonishing breakthrough, we do fully expect to see Xbox 360 DVD ROM's for sale on ebay with the hacked firmware soon.

:)

[bingo83]

The hacked firmware is now in the wild.

Just came across Hitachi-LG.DVD.FW.Replacement.XBOX360 on one of the less than legal sites that I visit.

[fatlip180]

its not real - dont bother with it

for starters you cant really use it and you have to (as of yet) remove your firmware chip and reprogram it to get this to work.

I would wait for team executer to figure someting out - it wont be long

[II AWESOME II]

To be onest what a damn legend!

[II AWESOME II]

Bingo what sites u vist?

[mjmaskrey]

If you have been following our previous reports on the Xbox 360 being hacked then this should be as no surprise. Microsoft has issued an official response to that XBOX 360 firmware hack. It looks like an MS required update will be in our near future...

The core security system has not been broken. However, it is reported that the authentication protocol between the optical disc drive and the console may be attacked, which if accurate could allow people to play illegally copied games. Our security team is aware of this and we are investigating potential solutions to this issue. The Xbox 360 platform was designed to be updated, and we are prepared to respond appropriately should any unauthorized activity be identified.

Everyone should keep in mind that Microsoft invests a great deal of time and effort to ensure that Xbox gamers enjoy the most powerful and exhilarating game experience available today. Genuine and unmodified Microsoft Xbox products provide gamers with the reliability, security, support and dynamic gaming experience that they expect. Microsoft works with a large group of legitimate business partners to sell and service genuine Microsoft Xbox products. Microsoft does not authorize or support any products or companies that modify or change the Xbox console in any way.

:)

[mjmaskrey]

Team Executer have made some progress when connecting the Xbox360 DVD ROM to a PC - reading the firmware and then writing back to it. Their goal is to make this plug and play - as simple as possible that anyone could do it with no fuss - and without any great expense.

They have a couple of products lined up to make life incredibly simple for the DVD drive modder - one of which will (in our opinion) be the "tool of choice" in the near future.

Here's a picture of a 360 DVD ROM connected to a PC.

http://www.xbox3sixty.co.uk/e107_images/newspost_images/pc_x360.jpg

:)

[bingo83]

Bingo what sites u vist?

Sorry m8, I wont be divulging that info. As I dont want anyone Admin / Staff here getting into trouble.