PS3 3.56 Firmware “A Minor Drawback” To Hackers

Hacker says PS3 can never be fully re-secured due to “kindergarten mistakes” in system security.

Sony’s recently-released PlayStation 3 system software 3.56, which was solely intended to stop hackers and pirates in their tracks, only presents a “minor drawback” to the scene.

The new firmware, released last week, was quickly decrypted, but Sony has done enough to prevent installation of custom firmware, homebrew and piracy on PS3s that have updated to 3.56. Mathieu Hervais, a respected voice in the homebrew scene who prefers the term “reverse engineer” to “hacker”, told us that while Sony has done all it could in response, it can never fully re-secure its system.

[Paralex]

Oooo, I'm telling!

[GrieverSoul]

Dont bother! Sony knows who hacks now due to 3.56 firmware "talking" to Sony´s server whenever the console is booted online.

What is hilarious is the presumption attitude of this guys saying things like "kindergarten mistakes" in the PS3 security system and still those "kindergarten mistakes" kept them away from "reverse enginering" the PS3 for 4 years. Who is in kinderganden now?! -_-

[hay]

"The new firmware update includes updated security keys, including the random element that was absent from the original keys, which lead to the system being hacked."
Didn't "hackers" said it was impossible to patch 'cause it was hardware related?
Gotta love their BS.

[MAJ0R]

maybe a little more than minor, it did ban lots of COD hackers

[HSx9]

Sony didn't ban the Black Ops hackers, Treyarch implemented a security feature in Black Ops which can have you console banned if you are cheating in their game.

[Spitfire_Riggz]

They should do that for MW2

[hellzsupernova]

really??? I might have to check it out again if they have improved it. its the only CoD game i enjoyed playing

[blackburn5]

Yeah just keep being overconfident. I want to see the day Sony gets really serious and finds a way to permaban any one using these hacks. I personally would laugh at anyone coming on these sites and claiming that it is unfair that Sony banned them. These hackers are beginning to think that they are invincible and unstoppable. Some one should really put them in their place.

@ AKA yes that is a great idea. Give up Sony. Instead of trying to keep the dishonest people and the thieves out, like the security was meant to do, let's just let them in. But when some other genius thinks of ways to use the keys to manipulate your accounts, steal your PSN cash, ban you from games, steal your credit card numbers when you buy things or whatever the hell else you won't be so flippant about it.Like they said they have the keys and can do anything they want.I am certain you won't like that. Why don't you guys start blaming them for keeping Sony on the defensive instead of blaming Sony for trying to stop them?

[MintBerryCrunch]

seeing as how the hackers and ps jailbreakers cant go online at the moment...i fail to see how they could steal someone's info

[FantasyStar]

Your tin foil hat is on too tight buddy. People said the same thing with online purchases, and lolwutnao?

[Silly gameAr]

@blackburn

Dude, common sense and this gen just don't mix. It seems like everyone is screaming doom for Sony and the PS brand, yet, they are still here, Imagine that.

[JD_Shadow]

Who is doing that? All I have been seeing about this story out of the general N4G community is to have Geohot burned alive without any care for consumer rights and before doing any research about anything (seriously, people, doing research is not that hard to do, but we act like we've just discovered the internet or something).

Should it be illegal to be able to have homemade games on your PS3? Ignore that there isn't any known HB games available for it yet. If there were some available for you to play on your PS3, should you be allowed to play it on your PS3 without the threat of a ban? If not, then why? I don't think ANYONE has really answered that question (only dodges of "there hasn't been any yet", etc.).

It's not that there are different opinions here (everyone has their right to them). It's the amount of hatred that's being spewed to anyone that DARES to take Geohot's side on this. Anyone that even HINTS at taking his side is hit by a ton of disagrees and insults that make you wonder where the N4G mods are at. It only seems to happen HERE! Everywhere else I've seen that talks about this "hack", the crowd is either split down the middle, or on Geo's side. N4G seems to be the ONLY site so far that has the majority of their user base backing Sony on this, which is okay, but again, look at what the opposite side gets in return, and read the type of comments that we're seeing. No sense that this site has passed grade school. It's like the only people commenting on this subject are 4chan members trying to make a new internet meme, and I think we're all getting sick of 4chan's existence on the net.

Of course, I can expect nothing less of a site that can't even grasp the concept of how stories get popular on this site. I mean, how many times have we told people that it's because they go on a HHG article to bitch that his stories are getting heat on the site that his stories ARE getting site heat, yet they continue to do it and pretend that they aren't part of the problem. Those people are the same people that are bitching against the PS3 jailbreak as if they are Sony's lawyers here. Think about that!

[oicheshamhna]

@ darkpower

I have stopped reading most of the articles in relation to this hacking business but I do agree with Sony's side. Homebrew, OtherOS and CFW are great in practice but really who is going to just stop there? No one. I guarantee every single person who advocates reverse engineering of the PS3 will at one point play a pirated game on their system.

What amazes me is that people don't see the possible detrimental effects of having the PS3's security spread open for anyone to tinker with it. I feel that most of the hatred towards Hotz and the others comes from the fact that they did not have to publicly post their info, but they did. They made a dick move and they are getting backlash from it. Simple as that.

It's called the snowball effect. The information is out there. You're on a gaming site and there are always going to be hacking articles and little kids spouting nonsensical bullshit. It's just the nature of the beast.

[Orionsangel]

Oooh wow you guys are so elite.

[ASSASSYN 36o]

Sony can put their panties on briefly. But mr. Boom boom knows how to drop'em again and again for fun time.

[ASSASSYN 36o]

Drop those panties on your ps3 with the root key!

PS3 METLDR Root Key:

erk: C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B
riv: 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D
pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19

R: 80 6E 07 8F A1 52 97 90 CE 1A AE 02 BA DD 6F AA A6 AF 74 17
n: E1 3A 7E BC 3A CC EB 1C B5 6C C8 60 FC AB DB 6A 04 8C 55 E1
K: BA 90 55 91 68 61 B9 77 ED CB ED 92 00 50 92 F6 6C 7A 3D 8D
Da: C5 B2 BF A1 A4 13 DD 16 F2 6D 31 C0 F2 ED 47 20 DC FB 06 70

[timzone]

Kindergarten mistakes that took 3 years to find.

[AKA]

Lol true but funny
and sometimes we complicate our self to much
I bet they had it in front of them all this time and never knew...

[B_Rian89]

I was gonna post the same thing lol

[GrandTheftZamboni]

"kindergarten mistakes" which hackers couldn't notice until they graduated from a kindergarten.

[FantasyStar]

Dammit, wrong spot.

[Mahr]

"Kindergarten mistakes that took 3 years to find."

The complete bush-league incompetence of the mistake is not a reference to how easy it was for hackers to find but to how easily Sony could and should have prevented it.

Basic layered security metaphor: Pretend there is a safe, bolted to the ground, and it has a keypad, a card reader, and a retinal scanner. To unlock you safe, you need to input a 60-digit alphanumeric password, swipe a specially-made security keycard, *and* your eye has to belong to the owner of the safe. If you are missing even one of those three items, the safe will not open.

Now pretend that the owner of the safe has hired an armed guard to watch the safe and shoot anyone who approaches. After years of observation and of people getting shot, a thief discovers that the guard has a huge sweet-tooth and that if an ice cream truck goes by and stops a block over, he can get the armed guard to desert his post for about three minutes.

This gives a separate thief (we'll call him heogot) a window of time in which he runs up to the safe -- only to discover that none of the safe's three locks are actually engaged. They all work -- but the owner has not bothered to actually lock them. As a result, heogot doesn't need the password, doesn't need the key, and doesn't need the eyeball; the safe has been sitting there open. The. Entire. Time.

That the outer layer of security kept attackers out for the time that it did is commendable. But it has no bearing on the fact that the implementation of the inner layer security was mishandled in the most idiotic and catastrophic possible way.

[SnakeMustDie]

Oh, you mean stealing the official rootkey Sony uses.

[JD_Shadow]

How can you steal a number that you cannot officially own? There has been no one who has told anyone how that is possible. There's really no way you can claim ownership of a number, no matter HOW many ways you try to say that you can. And Sony could just as easily change those protocols.

This is what I cannot understand from these people. How can you stick up for Sony when you really don't know even a fourth of what this whole thing is ABOUT? I just don't understand it!

[oicheshamhna]

Well, if you're going to get into the small details of this thing then any digital information is just numbers, letters and icons. The fact of the matter is that there are license agreements and software agreements that no one bothers to read when they purchase something. I personally think EULA's and software agreements are bullshit but they are there for a reason.

The rootkey is just a bunch of numbers but those numbers are attached to proprietary software owned by Sony which shows, to some extent, ownership. When you buy a Playstation 3 you agree to their terms of service and EULA. However loosely worded they may be agreements are part of the gaming world and most people just overlook all of them.

[AKA]

Why to bother, let the hackers have fun. And stop trying to stop the unstopable,

Start giving us a better browser and few other better features and stop thinking about moeny.

enable facebook and other pages againg
i remenber when i could use hulu on my ps3 browser know i can't and that is b/s.

ps:
a disagree? (get a life)
for asking sony to start giving us features?
and asking them to stop wasting time and money on something they can't prevent?
every console has been hacked, SONY should be proud that it took this long to happen to them and move on.

[cyclonus007]

Hulu banned the ps3 browser not Sony.

[OrganicMachine]

another idiot tries to justify piracy...

[JD_Shadow]

1. "Idiot"! Against the rules here! I got banned for using it a few years ago! People do not learn.
2. How is he justifying piracy? He's asking Sony to stop trying to stop wasting time on something they will never really be able to stop (something that, if you would just go on the net and do some Google searches, you'd see that Geohot was trying to find a way to have the homebrew apps on the PS3 without having the piracy issues when Sony did their lawsuit) and focus more on giving us new features. How is that justifying piracy? Hell, when did he ever said he did?

[negroguy]

I dont watch Star Wars much but this reminds me of the Deathstar (I think it was called) which was that giant ship but had that tiny hole which made it vulnerable.

[Bathyj]

"while Sony has done all it could in response, it can never fully re-secure its system."

Thats probably true.
Its likely a given.

But all that talk is dragging the hackers down from the moral high ground they so desperately are trying to ascend to.

[ugabugaz]

There still isn't a CFW so I think it might be a little more than a minor bump. It's fun watching Sony and the hackers duel it out.

[UltimateIdiot911]

No it's not. Look what happen with the PSP.

I rather wish Sony can focus their attention to adding features instead of focusing on stopping hackers.

[radphil]

They're kinda the reason why PSP got hurt a bit.

Same thing with Dreamcast. Mainly on that one it was from the company, but it didn't help from the fact that you could literally burn a game onto a cd and play it from there.

[ugabugaz]

According to ME it is. You can disagree, but not just say, yeah no, it's not funny.
:\

[tatical]

Sony should hire GeoHotz. He's proven himself as a very skilled hacker & has shown interest in working for the other side. He even took steps not to enable game piracy while hacking (but it wasn't his priority though). The fact that he even THOUGHT about piracy at all should at least get him meeting with Sony's security team.

But Sony is probably to arrogant to even talk to someone who hacked their security system.

[cyclonus007]

If Geohot was looking for a job, publishing the Root key was a REALLY genius move...

He was only looking for the fame and publicity. I guess cracking the iPhone wasn't enough.

[UltimateIdiot911]

So would you hire someone to protect your Credit Card and Bank info if they stole it and then release it to everyone? This person prove himself to know how to steal really well, probably knows all the trick, but definitely not someone you can trust or want around.

Sony being arrogant, sometimes, this case, serving justice.

[tatical]

@UltimateIdiot911

My answer to your question the way you asked it is "No".
But as far as I know, GeHotz hasen't stolen anything. He searched for something hidden (on something that he owns) and found it. The master key enables people to use the PS3 in ways Sony doesn't intend I to be used. Sony's security team obviously isn't handeling business like it should.

GeoHotz saw some holes in the PS3's security a while ago. But TeamSony weren't thinking like elite hackers (they probably went to school & got some experience, then got hired by Sony). I know from experience that hackers have a different understanding of computer security than 'most' college graduates. Sony could use some insight from the otherside while designing the PS4.

[radphil]

"I know from experience that hackers have a different understanding of computer security than 'most' college graduates"

You're right. Some of them don't think things through on the long term. I can understand if this info was found, and then he reported to Sony all in detail about said information, that gives you a greater chance, than using said same information and just handing it out to the public.

[oicheshamhna]

I'm sure Hotz is a genius in cracking code and security but I can almost bet that his abilities in patching and fixing security holes are lacking.

[tatical]

You should watch some of his hacking presentations. You'll see that he also offers solutions to prevent his hacks, & identifies weak spots in the PS3 security system that he hasn't exploited yet. GeoHotz even says what Sony could have done to make it much, much harder for him to hack. Overall, he says that Sony's security scheme is really good, but they somehow made some critical & puzzling mistakes.

[Jihaad_cpt]

Hackers are cheap

[TheTruth89]

OHHH FUNNY THING, because 2 weeks ago his words were "sony' can't do nothing, at all!"

lol, what a fail.... the same happened with lot of ps3hax big heads (or i should call them dick heads?)

[darkdoom3000]

More than a minor drawback, the system startup "rootkey" callhome feature is a major drawback.

By reading lots of hacker forums, i've accumlated this knowledge.
-when the console starts up, it automatically calls the sony servers. the sony servers sends it a peice of code. and the console will execute it, upon execution the code will send a reply to sony informing them that the code was executed.

sony can change what that peice of code is. It could be to check whether you have a hacked console or cfw or anything. whatever sony chooses.

If they made a custom firmware where the code is not executed, the reply won't be sent, thus sony will know which PSN accounts/PS3s didn't execute the code, and thus must have custom firmware. so bam! console can't connect to sony servers.

This will essentially mean that hackers will be forced to stay off PSN. which is a perfect middle ground.

Hack or PSN. one or the other.

[lelo2play]

Well... 3.56 CFW hasn't been released yet... so it's more then a minor bump.

[denero1]

well the main hackers have all said they feel that to make a cfw for 3.56 would be the most useless thing ever.It doesn't feature any real upgrades, to make a cfw right now would only benefit cheaters getting back on psn.

[wissam]

The same thing can be said about FW 3.55. your point ? and believe me if they were able to make cfw they will make one
very fast just to make sony look stupid.

[denero1]

i think the first cfw for 3.55 was more just a thing for show -_- it was like saying hahaha look what we can do -_-