Hypervisor exploit discovered

[SuperFarStucker]

A vulnerability in the Xbox360 kernel hypervisor has been discovered. I.e. unsigned code execution. Honestly thought it'd never happen. It was introduced in an October patch to the kernel.

It's already been patched (over a month ago) but of course a few people have versions of the vulnerable kernels. Homebrew scene would explode, except it seems that Microsoft had the foresight to predict this situation and implemented some kind of 'electronic fuse' which prevents a kernel downgrade to the vulnerable versions, so perhaps only a few xbox360s in existance can take advantage of the vulnerability (and the number is constantly shrinking).

I think it impresses me more that microsoft even planned for a way to irreversibly patch systems in the event of an unsigned code execution vulnerability.

http://www.digg.com/gaming_news/Xbox360_Hypervisor_Vulnerability_Released_Homebrew _on_360

[ziggo0]

This is like the PSP...with enough determination anything will be possible.

[rainless]

This is like the PSP...with enough determination anything will be possible.

Actually it's UNLIKE the PSP in that:

1. Microsoft... despite what the pretend with XP and Vista... actually knows what the hell their doing when it comes to machines they have absolute control over.
2. The 360, for the most part, is always on line... or, at the very least, you have to be online for Live.

This is revolutionary in that, any deviation from the company line, and Microsoft can ban you in a heartbeat. It simply isn't worth it to play backups and imports (particularly if you already live in the U.S.) at the expense of never being able to use Live! again.

[-_{MoW}_-Assasi]

:beer: Actually it's UNLIKE the PSP in that:

1. Microsoft... despite what the pretend with XP and Vista... actually knows what the hell their doing when it comes to machines they have absolute control over.
2. The 360, for the most part, is always on line... or, at the very least, you have to be online for Live.

This is revolutionary in that, any deviation from the company line, and Microsoft can ban you in a heartbeat. It simply isn't worth it to play backups and imports (particularly if you already live in the U.S.) at the expense of never being able to use Live! again.

Who said anything about backups and imports? :beer:

Im pretty sure we were talking about homebrew here
More on the lines on Folding? :beer:

[genghisjohn]

I agree with Rainless. Live is so much better now than it was on the xbox. I don't think it's worth not having Live to run homebrew.

[blueswitch]

Good point Rainman, I've always felt the best way fight piracy isn't to spend all your resources and energy locking your products airtight because 1.) it only annoys and hurts the honest consumer and 2.) nothing is airtight. You should be enticing people with content that makes piracy not worth it like fantastic online play. Thats where the MIAA went wrong, they could have been the ones with itunes instead they spent their energy attacking and alienating their customer base and now they have to split profits with Apple, and Microsoft, and Yahoo.

[Maviryk]

I'm sure most of the people who would have wanted to exploit this have already had their 360 console patched to prevent that vulnerability already, especially if they've bought a game recently. The last few games I've played required me to connect to Xbox Live in order to play the game.

[tenchi86]

Cool, does sound like a PSP. Awhile back they could not be flashed to custom Firmware and you had to be lucky enough to get an early model, now though that's long been cracked.

[rainless]

Cool, does sound like a PSP. Awhile back they could not be flashed to custom Firmware and you had to be lucky enough to get an early model, now though that's long been cracked.

Yeah but, like I pointed out, the PSP isn't online and Sony security has NO IDEA what the hell they're doing. I mean Dark Alex is probably some sixteen year old kid (which would explain why they haven't prosecuted him.) And think about that stupid DRM thing they created... That was probably the work of ANOTHER sixteen year old kid...

...only less talented.

[tenchi86]

Being online is probably the main thing, but yeah Microsoft does have a lot more experience in the security area. (Whether it shows in Windows or not) Anyway would be cool if some stuff was released for people who do not have live, because according to sales numbers there are still millions who do not have it. I know I am personally hoping the PS3 is cracked very soon, and if I owned and Xbox I would think it be the same.

[rainless]

Being online is probably the main thing, but yeah Microsoft does have a lot more experience in the security area. (Whether it shows in Windows or not) Anyway would be cool if some stuff was released for people who do not have live, because according to sales numbers there are still millions who do not have it. I know I am personally hoping the PS3 is cracked very soon, and if I owned and Xbox I would think it be the same.

Well, being a fellow OCforums INTELLECTUAL POWERHOUSE (oh the gall... the gall...) I can imagine quite a few ways around it. You could create some sort of script that automatically disconnects the Xbox's network drivers and THEN runs the exploit, then automatically changes everything back to the way it was before (this whole thing could be accomplished via USB key so there wouldn't PHYSICALLY be any evidence to speak of for the Live! servers to find.)

You could also have a completely seperate dashboard on a USB key or external HD that's completely legit (though there would be ways to check this...) while you have an exploit installed on the 360 itself.

There are ways... but no matter how you do it, it would mean not being able to play on Live!, which, even excluding a majority, is most of the point in having a 360 to begin with.

[tenchi86]

Yeah, there are ways around of course connecting to the net like simply not plugging it in. Being blocked from Live though for me personally would kill the deal, however for those who do not have live it could be a rather nifty feature.

[FudgeNuggets]

They can lock it down all they want (*makes "Nixon fingers*) "I am not a crook", just so long as I NEVER get a virus, spyware or any other malware on my consoles. Homebrew shmomebrew, that wore thin pretty quick on the DreamCast as it did the PS2 and Xbox.

[rainless]

They can lock it down all they want (*makes "Nixon fingers*) "I am not a crook", just so long as I NEVER get a virus, spyware or any other malware on my consoles. Homebrew shmomebrew, that wore thin pretty quick on the DreamCast as it did the PS2 and Xbox.


Heh... I don't think it ever wore thin on the PS2... and it SURE AS HELL hasn't worn thin on the PSP. I've got a calculator, a remote control that can control my TV, PS2, AND the 360, an entire legion of emulators... the list goes on.

And viruses are about as rare on consoles as they are on Macs. If you get your homebrew on a respectable site (and of course wait for a couple million other people to try it first) then you're in no danger at all.

Seriously, homebrew apps can be a wonderful thing (I especially like running linux on my router), I just don't think there's really a place for them on the 360. Even people that aren't using Live! right now might WANT it when some game they want comes out.

[tenchi86]

Well if the Hacks could allow custom HDDs, and the ability to backup on them then I think they certainly could find their way onto many 360 owners systems.