Kakartokos veröffentlicht seine geheimen Infos bezüglich seiner bisherigen Arbeit / Recherche

wololo hat auch etwas dazu geschrieben, ist sehr lesenswert

Zitat

wololo via Wololo.net

PS3 Blown open, Scene chaos, LV0 keys Leaked and Working!

Leaks, chaos and drama have been something common, and on the heels of the PsVita chaos comes the PS3s turn with both good and bad news. This event is so huge that it will completely change the PS3 hacking scene and leave Sony in the wake.

Sony will be turning in their graves today as the PS3 has been basically blown wide open thanks to other events leading up to that. In the wake of this leaves Sony in huge trouble and mostly exhausted due to the amount of progress the hacking scene has made on their devices especially with the recent Psvita PSP EMU kernel exploit. It’s been absolute chaos in the PS3 scene for the last few days and fair enough to say has been chaotic over the last few years. Ill break down what happened and what this means for the developers and users, keep reading….

Background Information

The similarity in events is extremely blatant but its started a little over two years ago when the first piracy-enabled firmware and USB dongle combo named the “PS3Jailbreak” was released. The release nuked a weakness in the PS3′s simple USB protocols. This in return created a hole allowing the OS to be patched that furthermore allowed content to run from the HDD. In the aftermath the group fail0verflow allowed people to encrypt files in a mirror system that replicated Sony s methods. Of course this lead to tons of piracy and eventually Geohot’s public release of the “metldr” root key. Sony got really mad in short and decided to bring the ban hammer down on Geohot who has yet to be heard from recently. Sony found a way to protect their system by fixing everything in the system with the 3.60 firmware update. The jailbreak was patched, the USB exploit patched and left the system somewhat secure, until now in association with the new PS3 4.30 firmware update.

So what happened?

The jerks, which is an understatement, that have been behind the PS3 dongle business will always be hated and trashed constantly and the recent stunt from the people behind the BlueDiscCFW team just put a nail in the coffin. A hacking group called “The Three Musketeers,”, in short, had the Lvl0 keys which were leaked. The Three Musketeers were not going to release the keys because of the known outcome of doing so. The Chinese hacking team “BlueDiscCFW,” somehow got a hold of the keys and planned to charge money for users who wanted the exploit. Its disgusting they would do that and The Musketeers realized this. With that in mind, The Three Musketeers tried to immediately stop BlueDiscCFW’s profiting from the LV0 exploit, The Three Musketeers released the LV0 custom firmware free to the public. The funny part is the BDCFW was taken down immedietly. The Three Musketeers released a statement on it saying

“You can be sure that if it wouldn’t have been for this leak, this key would never have seen the light of day, only the fear of our work being used by others to make money out of it has forced us to release this now.”

It was a two faced leak and is oddly similar to that Sam Jordam incident or Linux hack. They then released a full announcement and statement on the matter:

As this was a group effort, we wouldn’t normally have lost a word about it
ever, but as we’re done with PS3 now anyways, we think it doesn’t matter
anymore [http://pastie.org/4462324]. Congratulations to the guy that leaked
stuff, you, sir, are a 1337 haxx0r, jk, you’re an asshole.

Try this bytes…
– [erk=CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A]
– [riv=F9205F46F6021697E670F13DFA726212]
– [pub=A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D
41EEB54DD128700D]
– [priv=001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3]
– [ctype=33]
…and be amazed.

People should know that crooked personalities are widespread in this so
called ‘scene’. Some people try to achieve something for fun together and make
the wrong decision to trust others and share their results with them, but ofc
there got to be the attention seeking fame wh*** that has to leak stuff to
feel a little bit better about him-/herself.
Now the catch is that it works like this in every ‘scene’, just that in
|others it usually doesn’t come to light.
The only sad thing is, that the others who worked on this won’t get the
attention they deserve because they probably want to remain anonymous (also
they don’t care about E-fame <3).
PS: This is neither about drama nor E-fame nor ‘OMG WE HAZ BEEN FIRST’, we
just thought you should know that we’re disappointed in certain people. You
can be sure that if it wouldn’t have been for this leak, this key would never
have seen the light of day, only the fear of our work being used by others to
make money out of it has forced us to release this now.
[-The Three Musketeers]

What does this mean?

With the release of the LV0 keys mean, eventually, having all the keys available. The LV0 is not patchable, which is to say there is nothing at all Sony can do to fix this. The final bullet in the chamber as hit Sony hard. What actions they will take are not known, but if things continue in the scene I can garuntee they will be pushing the date of the PS4 closer as new hardware is really all they can do. Sony already moved all the loaders. The only other option would be to put the loaders in bootldr, but that isn’t possible since bootldr is locked to being console specific and is impossible to update. Behind LV0 is just bootldr, which is encrypted with specific console keys. This leak will in time lead to a 4.25 CFW which can be installed on mostly any PS3 even on Slims and the recent new slim models. Keep in mind that fail0verflow released metldr private keys like I said above. Well, surprise, metldr is loaded by lv0ldr, even on 3.60+. The leak contains a private key, it’s the string after PRIV=. The greatest part is that the key isn’t tied up to a specific firmware. The problem with 3k model Playstation3 consoles is that they have a new LV0 version named lv0.2, which means new keys for the loader. What this means is that consoles which are able to downgrade to 3.55 can install 4.25 CFW even if they’re on 4.25 OFW. The bad news incorporated with this is that 3K and higher consoles’ LV0 keys are static, they are not console specific. Sony can change LV0 with a new firmware update. But, bootldr is per console and is the way of decryption for LV0. If we have bootldr then the console is wide open and a CFW could be made to work on any console. Bootldr cannot be changed or denied unless there is a hardware change. Even if we had bootldr then anyone with a downgradable console could have a CFW firmware. Whoever has bootldr and wanted to leak it would bring the greatest massacre and ban-hammer of all time by any company ever, I can garuntee whoever releases it will have no where to run or hide so it would of course need to be anonymous to highest level with no traces to be found. Bootldr is something that’s way more protected and valuable than metldr.

Closing Statement
This is the beginning of a very long and heavily scheduled future of the PS3 hacking scene. The release of the LV0 key means that any system update released by Sony going forward can be decrypted fully with no effort. Sony has no cards in this game. As of today LV0 is now decrypted for ever until the end of time. There is alot of reverse engineering to get the decrypted loaders from it since Sony had changed a lot of security algorithms to protect these loaders inside LV0 however, rest assure every PS3 developer is hot on the news of everything going on. No one will be able to find 4.XX LV1, LV2_kernel, AppLDR keys inside the decrypted LV0 so there would need to be an investigation regarding how Sony store these keys right now. Already hard at work Multiman and Rogero have released new CFW along with other developers working hard. Rogeros new CEX 4.21 CFW FFA was pulled however due to bricking issues, so be alert to that. With this we may in some vary valuable information, in a way, that’ll help get some much needed help in also hacking the Vita but that’s not something to be confirmed. Although in given time more information and understanding on this will come, so stay tuned.

Alles anzeigen

Quelle: Wololo.net

[SIZE=5]Edit toto67 ;)[/SIZE]

Jetzt wo ne cfw rauskommt , enthüllt der seine geheimnisse um doch noch etwas anerkennung zu stehlen... hätte er das früher enthüllt, würde ich ihm dankbar sein... aber jetzt finde ich das einfach nur traurig.

ich find seine aktion ein absoluter fehlschlag. keiner interessiert sich mehr für ihn sieht man schon anhand der unglaublich vielen kommentaren hier im thread

Das war klar das er sie erst jetzt enthüllt den mit Sonys Anwälten ist nicht zu spaßen

Hier ist der Rest

Zitat

[span=black]Closing Statement[/span]

This is the beginning of a very long and heavily scheduled future of the PS3 hacking scene. The release of the LV0 key means that any system update released by Sony going forward can be decrypted fully with no effort. Sony has no cards in this game. As of today LV0 is now decrypted for ever until the end of time.

There is a lot of reverse engineering to get the decrypted loaders from it since Sony had changed a lot of security algorithms to protect these loaders inside LV0 however, rest assure every PS3 developer is hot on the news of everything going on. No one will be able to find 4.XX LV1, LV2_kernel, AppLDR keys inside the decrypted LV0 so there would need to be an investigation regarding how Sony store these keys right now.

Already hard at work Multiman and Rogero have released new CFW along with other developers working hard. Rogeros new CEX 4.21 CFW FFA was pulled however due to bricking issues, so be alert to that. With this we may in some vary valuable information, in a way, that’ll help get some much needed help in also hacking the Vita but that’s not something to be confirmed. Although in given time more information and understanding on this will come, so stay tuned.

Update: Here is another update from wololo (via wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/), to quote:

[span=black]Clarifying the confusion on the PS3 development[/span]

If you read my post about the LV0 keys being leaked recently then you know it could be a lot to take in and hard to understand. Hopefully this will help clear up everything.

Marcan, who is a valuable asset of the Wii and PS3 hacking scene has made some posts that will help clear the air on things, it helps clarify and break things down even more than what I had previously said in the original article both in technicality and in simplicity. I’ve bolded the important parts that you should pay attention to in his answers.

[span=black]More Technical Information[/span]

“The first-stage bootloader is in ROM and has a per-console key which is effectively in tamper-resistant silicon. The second-stage bootloader (bootldr) is encrypted with the per-console key, but is not upgradable and is the same for all consoles (other than the encryption wrapper around it).

This second-stage bootloader verifies lv0. Sony signed lv0 using the same broken process that they used for everything else, which leaks their private key. This means that the lv0 private key was doomed from the start, ever since we demonstrated the screwup at the Chaos Communication Congress two years ago.

However, because lv0 is also encrypted, including its signature block, we need that decryption key (which is part of bootldr) before we can decrypt the signature and apply the algorithm to derive the private key. We did this for several later-stage loaders by using an exploit to dump them, and Geohot did it for metldr (the “second root” in the PS3 bizarre boot process) using a different exploit (we replicated this, although our exploit might be different).

At the time, this was enough to break the security of all released firmware to date, since everything that mattered was rooted in metldr (which is bootldr’s brother and is also decrypted by the per-console key). However, Sony took a last ditch effort after that hack and wrapped everything after metldr into lv0, effectively using the only security they had left (bootldr and lv0) to attempt to re-secure their platform.

Bootldr suffers from the same exploit as metldr, so it was also doomed. However, because bootldr is designed to run from a cold boot, it cannot be loaded into a “sandboxed” SPU like metldr can from the comfort of OS-mode code execution (which we had via the USB lv2 exploit), so the exploit is harder to pull off because you don’t have control over the rest of the software.

For the exploit that we knew about, it would’ve required hardware assistance to repeatedly reboot the PS3 and some kind of flash emulator to set up the exploit with varying parameters each boot, and it probably would’ve taken several hours or days of automated attempts to hit the right combination (basically the exploit would work by executing random garbage as code, and hoping that it jumps to somewhere within a segment that we control – the probabilities are high enough that it would work out within a reasonable timeframe). We never bothered to do this after the whole lawsuit episode.

Presumably, 18 months later, some other group has finally figured this out and either used our exploit and the hardware assistance, or some other equivalent trick/exploit, to dump bootldr. Once the lv0 decryption key is known, the signing private key can be computed (thanks to Sony’s epic failure).

The effect of this is essentially the same that the metldr key release had: all existing and future firmwares can be decrypted, except Sony no longer has the lv0 trick up their sleeve. What this means is that there is no way for Sony to wrap future firmware to hide it from anyone, because old PS3s must be able to use all future firmware (assuming Sony doesn’t just decide to brick them all...), and those old PS3s now have no remaining seeds of security that aren’t known.

This means that all future firmwares and all future games are decryptable, and this time around they really can’t do anything about it. By extension, this means that given the usual cat-and-mouse game of analyzing and patching firmware, every current user of vulnerable or hacked firmware should be able to maintain that state through all future updates, as all future firmwares can be decrypted and patched and resigned for old PS3s.

From the homebrew side, it means that it should be possible to have hombrew/linux and current games at the same time. From the piracy side, it means that all future games can be pirated. Note that this doesn’t mean that these things will be easy (Sony can obfuscate things to annoy people as much as their want), but from the fundamental security standpoint, Sony doesn’t have any security leg to stand on now.

It does not mean that current firmwares are exploitable. Firmware upgrades are still signed, so you need an exploit in your current firmware to downgrade. Also, newer PS3s presumably have fixed this (probably by using newer bootldr/metldrs as trust roots, and proper signing all along).”

They are indeed the bootldr keys (I was able to decrypt an lv0 with them). Consider this confirmation that the story is not fake.

Can this be used to sign binaries to run homebrew on OFW PS3s (ala the PSP key leak)? Are those private keys sufficient to sign homebrew software such that they will run in unmodified firmware?

No. The keys are used for two purposes: chain of trust and chain of secrecy. The compromise of the keys fully compromises the secrecy of the PS3 platform permanently, as you can just follow the links down the chain (off-line, on a PC) and decrypt any past, current, or future firmware version. Current consoles must be able to use any future firmware update, and we now have access to 100% of the common key material of current PS3s, so it follows that any future firmware decryptable by current PS3s is also decryptable by anyone on a PC.

However, the chain of trust can be re-established at any point along the line that can be updated. The chain of trust is safely rooted in hardware that is near impossible to modify (i.e. the CPU’s ROM and eFuse key). The next link down the chain has been compromised (bootldr), and this link cannot be updated as it is specific to each console, so the chain of trust now has a permanent weak second link. However, the third link, lv0, can be updated as it is located in flash memory and signed using public key crypto.

This allows Sony to secure the entire chain from there onwards. Unless you find a vulnerability in these updated links, you will not be able to attack them directly (applications, e.g. homebrew software, are verified much further down the chain). The only guaranteed way to break the chain is to attack the weak link directly, which means using a flash writer to overwrite lv0. Once you do so, the entire chain collapses (well, you still need to do some work to modify every subsequent link to turn off security, but that is easy).

If you have old firmware, you have at least some other weak links that, when compromised, allow you direct access to break the bootldr link (replacing lv0), but if you run up to date firmware you’re out of luck unless you can find a weakness or you use hardware.

Old PS3s are now in the same boat as an old Wii, and in fact we can draw a direct comparison of the boot process. On an old Wii, boot0 (the on-die ROM) securely loads boot1 from flash, which is securely checked against an eFuse hash, and boot1 loads boot2 but insecurely checks its signature. On an old PS3, the Cell boot ROM securely loads bootldr from flash, which is securely decrypted and checked using an eFuse key, and then bootldr loads lv0 but checks its signature against a hardcoded public key whose private counterpart is now known.

In both cases, the system can be persistently compromised if you can write to flash, or if you already have code execution in system context (which lets you write to flash). However, in both cases, you need to use some kind of high-level exploit to break into the firmware initially, particularly if you have up-to-date firmware. It just happens that this is trivial on the Wii because there is no game patch system and Nintendo seems to have stopped caring, while this is significantly harder on the PS3 because the system software has more security layers and there is a game patch system.

Breaking it down into simple and easy to understand words

Since Marcan’s answers can be a bit difficult to digest, I’ve broken them up into the form of questions and answers with the special help of ViRGE on this. This will clear alot of it up for those less technical.

[span=black]Q: What exactly has been recovered?[/span]

A: The keys used by bootldr to decrypt/verify lv0, and by reversing the process the private keys used by Sony to sign lv0. If we consult our handy 3.60+ chain of trust diagram, we can see that bootldr is at the very root of the chain of trust, with lv0 being the first module it loads.

[span=black]Q: So what can we do with the lv0 signing key?[/span]

A: In short, we can use it to decrypt lv0, modify it to patch out any lv0 security checks, and resign it with a legitimate key that bootldr will accept. With the chain of trust broken and lv0 no longer enforcing the security of the modules that it controls, we can then start modifying lv1ldr, lv2ldr, appldr, isoldr, etc to patch out their security checks and add CFW functionality.

[span=black]Q: Can Sony “fix” this like they did for the 3.55 exploit?[/span]

A: No. With 3.55 the keys metldr used to verify its dependent modules were recovered. So Sony simply stopped using the now-insecure metldr and started using bootldr (which was still secure) to load.. Sony doesn’t have any more secure modules like bootldr left so like I said in my original post they have no options and cant fix anything; without getting too technical, we now have the keys to every “common” hardware module that is able to decrypt Sony-signed modules. The only thing left are the modules that use per-console keys, which are useless for booting common firmware (which must be decryptable by every PS3)

[span=black]Q: So bootldr is fixed in hardware?[/span]

A: Correct. Like metldr, bootldr cannot be software updated by Sony. It’s hard-coded in hardware. As a reminder, bootldr/metldr themselves can’t be exploited, but because of the keys we have recovered we can make them load anything we want, nullifying whatever security they provide.

[span=black]Q: What about future firmwares?[/span]

A: Good news! We can decrypt those too. Sony can use various coding tricks to make the process more difficult (this is called obfuscation), but they can’t stop us by using keys. We will always be able to decrypt lv0, and as long as we can figure out how to navigate lv0 we can figure out how to decrypt and modify its dependent modules. For those of you that follow Sony hardware this is much like how the earlier PSPs were hacked. So we can always decrypt the firmware and will be able to create newer CFWs as long as we can get past any obfuscation by Sony.

Q: So the PS3 is utterly and completely broken?

A: To an extant yes, debatable but unlike the 3.55 hack we have mostly everything needed. Sony will never be able to re-secure existing consoles.

Q: What about consoles running firmware newer than 3.55?

A: Because all “old” consoles use the same keys to verify modules like lv0, at a minimum we can decrypt, patch, and resign the firmware. The problem is that we need a way to convince the PS3 to flash our modified firmware.

With 3.55 and below that was easy enough to do because of the keys recovered, but 3.56 and later change that so that flashing is more complex than just using the recovered keys. This isn’t an insurmountable problem – hardware flashers will always work – but for easy software flashing we need to find new exploits in the PS3 software stack to convince OFW consoles to flash CFW.

[span=black]Q: What about newer consoles?[/span]

A: So there’s the real problem. [span=black]Remember how we said bootldr and metldr are fixed in hardware? Sony can create new hardware, and update those modules in the process. By using new hardware in conjunction with new firmware for that hardware, Sony could completely change the keys used to secure the system. Without getting too technical, all of this progress comes from the fact that Sony was sloppy and did a poor job of implementing their security on earlier consoles, which is what lead to the first keys being leaked.[/span]

Sony could always issue new hardware with new keys and a fixed security system at which point we’d be completely locked out of that new hardware. It’s entirely possible they’ll do this (if they haven’t done so already), so much like the PSP we’re going to end up with a limited number of consoles that have hardware-based flaws that can be exploited. Of course we then found new ways of exploiting the PSP anyhow, and ultimately were able to exploit every PSP made in one way or another.

If you are on anything higher than 3.55 it doesn’t mean you are out, there are ways to downgrade if your model is one thats able, otherwise you are just not able to do anything right now until more dev work is done. So sit tight and hold on. Again stay tuned, more info and news will be definitely coming.

In summary, all future PS3 games will be crackable and CFW versions of all future firmware can be made. However, 3.56+ (3k Slim and 4k Super Slim) ship with Bootldr2 which we do not have keys for, still require hardware to downgrade and of course many newer PS3s remain protected from downgrading.

Quelle: ps3news.com

Alles anzeigen

Gibts zu den Infos ne kurze Deutsche zusammenfassung?
Rein ma Interesse halber.

Ganz grob zusammengefasst:

Kakaroto hat diverse Wege aufgezeigt wie man an lv0keys rankommt.

Diese lv0keys sind nun gehackt und kursieren schon im Internet.
Anhand dieser lv0keys ist es möglich alle (auch die zukünftigen) Firmwares zu knacken (Ausangspunkt ist dabei allerdings soweit ich weiß erstmal immer eine 3.55er Firmware).
Das könnte heißen (falls nicht irgendwelche neuen abgefahrenen, vielleicht hardwaretechnischen Sicherheitsmaßnahmen eingefügt werden), dass alle zukünftigen Spiele kopierbar & spielbar sein werden, Linux voll funktionsfähig sein wird usw.

Bin kein Experte, aber ein aufmerksamer Leser hier und hoffe alles richtig verstanden zu haben.
Bei so langen englischen und dabei noch so mit Fachsprache versehenen Texten komme ich allerdings auch an meine Grenzen

Hier ist noch ein deutscher Artikel, der das ganze meiner Meinung nach sehr gut zusammenfasst:

http://www.heise.de/newsticker/meldung/PlayStation-3-angeblich-final-gehackt-1736203.html

Roice2000:
Ich denke nicht, dass die wenigen Kommentare in diesem Board zeigen, dass Kakarotos Erfolge nicht zu würdigen sind.
Nur, weil sich 90% der Leute hier sabbernd und gedankenlos auf Rogeros CFW 4.21 stürzen, um aktuelle Raubkopien spielen zu können, dann nichtmal lesen, ihre PS3 bricken und dann auf über 40 Seiten ihr Leid klagen, heißt das nicht, dass dieses Topic hier zu vernachlässigen ist.

Du hälst seine Aktion für einen absoluten Fehlschlag? Der Typ hat mehr zur PS3 Community beigetragen als du, oder?

Dank dir Perkele,

ich finde auch wenn jetzt grad die 4.21 ganz groß in der Diskussion ist, das dies hier trotzdem ne sehr interessante Info ist.

Sehr interessant das ganze

One of fail0verflows devs Marcan speaks of the new lvl0 leak:

Zitat

via Wololo.net

by marcansoft (727665) on Tuesday October 23, @09:04PM (#41747075) Homepage

The first-stage bootloader is in ROM and has a per-console key which is effectively in tamper-resistant silicon. The second-stage bootloader (bootldr) is encrypted with the per-console key, but is not upgradable and is the same for all consoles (other than the encryption wrapper around it). This second-stage bootloader verifies lv0. Sony signed lv0 using the same broken process that they used for everything else, which leaks their private key. This means that the lv0 private key was doomed from the start, ever since we demonstrated the screwup at the Chaos Communication Congress two years ago.

However, because lv0 is also encrypted, including its signature block, we need that decryption key (which is part of bootldr) before we can decrypt the signature and apply the algorithm to derive the private key. We did this for several later-stage loaders by using an exploit to dump them, and Geohot did it for metldr (the “second root” in the PS3′s bizarre boot process) using a different exploit (we replicated this, although our exploit might be different). At the time, this was enough to break the security of all released firmware to date, since everything that mattered was rooted in metldr (which is bootldr’s brother and is also decrypted by the per-console key). However, Sony took a last ditch effort after that hack and wrapped everything after metldr into lv0, effectively using the only security they had left (bootldr and lv0) to attempt to re-secure their platform.

Bootldr suffers from the same exploit as metldr, so it was also doomed. However, because bootldr is designed to run from a cold boot, it cannot be loaded into a “sandboxed” SPU like metldr can from the comfort of OS-mode code execution (which we had via the USB lv2 exploit), so the exploit is harder to pull off because you don’t have control over the rest of the software. For the exploit that we knew about, it would’ve required hardware assistance to repeatedly reboot the PS3 and some kind of flash emulator to set up the exploit with varying parameters each boot, and it probably would’ve taken several hours or days of automated attempts to hit the right combination (basically the exploit would work by executing random garbage as code, and hoping that it jumps to somewhere within a segment that we control – the probabilities are high enough that it would work out within a reasonable timeframe). We never bothered to do this after the whole lawsuit episode.

Presumably, 18 months later, some other group has finally figured this out and either used our exploit and the hardware assistance, or some other equivalent trick/exploit, to dump bootldr. Once the lv0 decryption key is known, the signing private key can be computed (thanks to Sony’s epic failure).

The effect of this is essentially the same that the metldr key release had: all existing and future firmwares can be decrypted, except Sony no longer has the lv0 trick up their sleeve. What this means is that there is no way for Sony to wrap future firmware to hide it from anyone, because old PS3s must be able to use all future firmware (assuming Sony doesn’t just decide to brick them all…), and those old PS3s now have no remaining seeds of security that aren’t known. This means that all future firmwares and all future games are decryptable, and this time around they really can’t do anything about it. By extension, this means that given the usual cat-and-mouse game of analyzing and patching firmware, every current user of vulnerable or hacked firmware should be able to maintain that state through all future updates, as all future firmwares can be decrypted and patched and resigned for old PS3s. From the homebrew side, it means that it should be possible to have hombrew/linux and current games at the same time. From the piracy side, it means that all future games can be pirated. Note that this doesn’t mean that these things will be easy (Sony can obfuscate things to annoy people as much as their want), but from the fundamental security standpoint, Sony doesn’t have any security leg to stand on now.

It does not mean that current firmwares are exploitable. Firmware upgrades are still signed, so you need an exploit in your current firmware to downgrade. Also, newer PS3s presumably have fixed this (probably by using newer bootldr/metldrs as trust roots, and proper signing all along).

….

The keys are used for two purposes: chain of trust and chain of secrecy. The compromise of the keys fully compromises the secrecy of the PS3 platform permanently, as you can just follow the links down the chain (off-line, on a PC) and decrypt any past, current, or future firmware version. Current consoles must be able to use any future firmware update, and we now have access to 100% of the common key material of current PS3s, so it follows that any future firmware decryptable by current PS3s is also decryptable by anyone on a PC.

However, the chain of trust can be re-established at any point along the line that can be updated. The chain of trust is safely rooted in hardware that is near impossible to modify (i.e. the CPU’s ROM and eFuse key). The next link down the chain has been compromised (bootldr), and this link cannot be updated as it is specific to each console, so the chain of trust now has a permanent weak second link. However, the third link, lv0, can be updated as it is located in flash memory and signed using public key crypto. This allows Sony to secure the entire chain from there onwards. Unless you find a vulnerability in these updated links, you will not be able to attack them directly (applications, e.g. homebrew software, are verified much further down the chain). The only guaranteed way to break the chain is to attack the weak link directly, which means using a flash writer to overwrite lv0. Once you do so, the entire chain collapses (well, you still need to do some work to modify every subsequent link to turn off security, but that is easy). If you have old firmware, you have at least some other weak links that, when compromised, allow you direct access to break the bootldr link (replacing lv0), but if you run up to date firmware you’re out of luck unless you can find a weakness or you use hardware.

Old PS3s are now in the same boat as an old Wii, and in fact we can draw a direct comparison of the boot process. On an old Wii, boot0 (the on-die ROM) securely loads boot1 from flash, which is securely checked against an eFuse hash, and boot1 loads boot2 but insecurely checks its signature. On an old PS3, the Cell boot ROM securely loads bootldr from flash, which is securely decrypted and checked using an eFuse key, and then bootldr loads lv0 but checks its signature against a hardcoded public key whose private counterpart is now known. In both cases, the system can be persistently compromised if you can write to flash, or if you already have code execution in system context (which lets you write to flash). However, in both cases, you need to use some kind of high-level exploit to break into the firmware initially, particularly if you have up-to-date firmware. It just happens that this is trivial on the Wii because there is no game patch system and Nintendo seems to have stopped caring, while this is significantly harder on the PS3 because the system software has more security layers and there is a game patch system.

….

The name is presumably wrong – they would be the bootldr keys, as the keyset is considered to “belong” to the entity that uses those keys to check and decrypt the next thing down the chain – just like the metldr keys are the keys metldr uses to decrypt and verify other *ldrs, the bootldr keys are the keys bootldr uses to decrypt and verify lv0.

Anyway, you’re confusing secrecy with trust. These keys let you decrypt any future firmware; as you say, if they were to “fix” that, that would mean new updates would not work on older machines. However, decrypting firmware doesn’t imply that you can run homebrew or anything else. It just means you can see the firmware, not actually exploit it if you’re running it.

The only trust that is broken by this keyset (assuming they are the bootldr keys) is the trust in lv0, the first upgradable component in the boot process (and both it and bootldr are definitely software, not hardware, but bootldr is not upgradable/replaceable so this cannot be fixed). This means that you can use them to sign lv0. Period. Nothing more, nothing less. The only things that these keys let you modify is lv0. In order to modify anything else, you have to modify everything between it and lv0 first. This means that these keys are only useful if you have write access to lv0, which means a hardware flasher, or an already exploited console, or a system exploit that lets you do so.

….

Oh, one more thing. I’m assuming that these keys actually should be called the bootldr keys (as in the keys that bootldr uses to verify lv0), and that the name “lv0″ is just a misnomer (because lv0 is, itself, signed using these keys).

If this keyset is just what Sony introduced in lv0 after the original hack, and they are used to sign everything *under* lv0 and that is loaded *by* lv0, then this whole thing is not newsworthy and none of what I said applies. It just means that all firmwares *to date* can be decrypted. Sony will replace this keyset and update lv0 and everything will be back at step 1 again. lv0 is updatable, unlike bootldr, and is most definitely not a fixed root of trust (unlike metldr, which was, until the architecture hack/change wrapped everything in lv0). If this is the case, color me unimpressed.

…..

by marcansoft on Wednesday October 24, @01:04AM (#41748707) Attached to: PS3 Encryption Keys Leaked

Nevermind, I just checked. They are indeed the bootldr keys (I was able to decrypt an lv0 with them). Consider this confirmation that the story is not fake.

Alles anzeigen

Edit toto67: BITTE KEINE TEXTE ODER AUSSCHNITTE OHNE KORREKTE QUELLENANGABE POSTEN !!!

Ich hab gelesen das es einen USB Dongle geben soll der eine PS3 von OFW 4.25 downgraden lässt und sich somit eine CFW 4.21 oder in Zukunft auch höher installieren lässt.
Stimmt das?
Gruß Klaus