iQD: PS3 is Hacked - The Urban Legend Continues
Below is iQD's statement regarding the recent GeoHot PS3 Hack news, partly it really seems as if he does not read any docs :P
The most he claims to be surprising is mentioned in the IBM docs hehe^^
To quote: "So the PS3 is hacked ? Well that's nothing more than an urban legend.
Altough it's nice to capture all these HV calls and stuff from a plain (not encrypted) lv1 binary, but this will never lead to a hacked PS3.
Let's have a look. The major security architecture on the PS3 is called the "Secure Processing Vault" and is the most important thing regarding "hacking" the PS3.
There is NO WAY for the PPU or even the HV to gain access to the SPU, which is an application running inside of an isolated SPU.
Well you can kick out the isolated SPU, like geohot mentioned, but this gives you nothing, as ALL the encryption and execution of applications (HDD encryption, app encryption, decryption, executing, signature checking, root key extraction) happens inside the isolated SPU.
To run homebrew on the PS3 you would have to reassemble the whole functionality from the SPU inside a binary running on the PPU. For this you will need the root key.
The root key is stored in hardware (not even close to the things on the iPhone). The root key cannot be extracted by any software or hardware means and is essential to ALL encryption/decryption, executing and checking routines.
The only way to get the root key is inside of an isolated SPU, as it is kick-starting the hardware encryption facility. There is no other way to do that !
Let's just assume that geohot or some other guys are able to break into the local store of the isolated SPE. There they will just find some encrypted binaries.
The key for decryption is encrypted by the root key ! You won't get anywhere without the root key.
Let's assume that someone managed to do all those stuff from the isolated SPU on the PPU and creates a CFW.
There is still a secure booting environment. The first module loaded/bootet is integrity checked by the hardware crypto facility utilizing the root key. So you have also to address this booting stuff. Again, no root key, no booting.
So there's always runtime patching you might ask ? Not possible on the PS3 because the hardware crypto facility is able to check the signatures whenever it wants to.
And which part is responsible for this ? Exactly, the isolated SPU. So if you kick out the isolated SPU the system will not boot/run anymore.
The PS3 is neither an PSP nor an iPhone. It's the most secure system architecture of this time !
The girl behind this stuff, Kanna Shimizu, is not somebody. Messing around with this is not like saying Bruce Schneier is a n00b.
Btw.: forget about all those stories, that certain hackers are or will be employed by SONY. That's nothing more than another urban legend.
@geohot It is OBVIOUS that the HV is PPC. The Cell BE is a PPC architecture, you know Better read those IBM papers in first place !
More PlayStation 3 News...
ahm.. ehmm.. ahmm.. dammit ??! That's the first time I read such a clear answer why the ps3 is so hard to hack.
The keys are like what ? a 5 page long password ?
01-26-2010 #3Banned User
- Join Date
- Dec 2009
Mhm sorry SKFU but it's just that you're text seems like bashing against Geohot. It's not like i think hes god or something but honestly? This guy is working on his own and telling about his progress. Thats why i'm impressed.
And about the Cell BE / PPE part , i don't think he was suprised. He just wanted to say that PPE & C++ isn't exactly what he's trained at.
I'm just curious what he's going to do now...
Too bad I'm busy myself lately with other stuff else I would have helped out, since C/C++ is my thing (embedded as well)
But what I find weird is that C++ was used instead of assembly
so what does everyone think... XD lol
SKFU doesn't think the ps3 can be hacked... once again someone in the wrong hobby...
My respect for SKFU for his contribution but what he has to admit is that what GH did, he hasn't done it before (in many years).
It's a fact, and whether this exploit is useful or not, nobody can deny it.
i'm just a noob but it seems like iqd and skfu are flaming about geohot ?
This is why the ps3 hasn't been hacked in 3 years and probably wouldnt be without geohot working on it.