PS4 5.05 BPF Double Free Kernel Exploit Writeup

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by babypuncher on Tuesday July 17, 2018 @12:58PM (#17551172)

What is Microsoft doing right that Nintendo and Sony can't seem to figure out? Near as I can tell, the Xbox 360 is still pretty ironclad short of risky hardware modifications. However all recent Sony and Nintendo consoles have been broken wide open with purely software exploits.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by ioblip on Tuesday July 17, 2018 @02:00PM (#17551690)

The exploit vector for softmods is almost always WebKit, no matter how recently updated. The problem isn't open source software, but poorly documented corporate-maintained open source software.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by duskwuff on Tuesday July 17, 2018 @02:09PM (#17551755)

> However all recent Sony and Nintendo consoles have been broken wide open with purely software exploits.

WebKit has a lot to do with that. It's not that it's particularly bad or insecure code... it's just a much larger attack surface than had previously been available on most consoles, and the console manufacturers haven't always been very good at keeping it up to date.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by gooseserbus on Tuesday July 17, 2018 @01:14PM (#17551300)

Maybe the closed source nature of the Xbox OS makes reverse engineering more difficult? While some of Sony's PS4 OS is proprietary, the majority of the source is open. Same goes for Nintendo I guess, both are using forks of FreeBSD. If a bug is in FreeBSD it's likely in the OS for both consoles.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by moolcool on Tuesday July 17, 2018 @01:17PM (#17551331)

The Switch exploit is a hardware one, not software

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by slantyyz on Tuesday July 17, 2018 @01:16PM (#17551323)

IIRC, while the 360 required hardware modifications, the later generations of mods were not that hard or that risky (of course, your definition of risky is dependent on confidence and skill level for those mods).

Addendum - the original XBox hardware mods were pretty easy too.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by babypuncher on Tuesday July 17, 2018 @01:49PM (#17551599)

While it may not be risky for those of us who are comfortable dismantling hardware and soldering third party chips to the motherboard, you have to admit that is a much higher barrier to entry than browsing to a website designed to leverage the latest webkit exploit. I think it's enough to severely limit the size of a given platforms homebrew community.

[ Parent | on HN ]

Re:PS4 5.05 BPF Double Free Kernel Exploit Writeup by nanidin on Tuesday July 17, 2018 @02:18PM (#17551829)

The 360 hack I’m familiar with was just a reflash of the DVD drive firmware to always return data to the console as if the disk were legitimate.

This became a cat and mouse game between hackers and MSFT as MSFT started measuring things like latency and expected angles between blocks of data on the physical media to tease out whether the reported legit disk was actually legit or an imperfect copy.

I remember a few ban waves where people using modified consoles had their Xbox Live accounts shut down, then I stopped following it after that.

[ Parent | on HN ]