News for hackers. Stuff that matters.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @02:06PM (#1874181)
They're "furious"? I don't get that. What I get is "If necessary, we're going to outspend Limor by roughly two orders of magnitude on this problem alone"; based on the caliber of people MSFT has ready access to, I'd put my chips on Microsoft in this arms race.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by cryptoz on Friday November 05, 2010 @02:19PM (#1874221)
No corporation has ever shut out the hackers. In every machine ever built, if hackers want to control it they will. Especially if they're allowed to take the machine home.

What makes you think this case is any different? Microsoft can't keep Office or Windows under wraps, nor the XBOX, nor anything else.

The hackers will win, as always.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @03:00PM (#1874387)
Patently false. For one example: DirecTV shut out the off-the-shelf smartcard hackers.

You're falling into a narrative trap. It's not actually "hackers vs. Microsoft". Microsoft pays some of the best in the world. Most examples of hackers beating companies involve companies that did not invest seriously in countermeasures. That's not a problem Microsoft has.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by javanix on Friday November 05, 2010 @04:05PM (#1874658)
That's not quite the same situation as hardware hacking - DirectTV's countermeasures basically come down to detecting fraud and disabling the users, not preventing it completely.

What just about all consumer electronics companies have failed to do is lock down their hardware from being hacked in the first place - after all, Sony and Apple also pay some of the best in the world, and the PS3 and iPhone have been cracked wide open with software.

Microsoft is certainly better than most (the 360 doesn't yet have a software patch - there are hardware solutions - that can be used for piracy), but they are by no means immune to hackers.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @04:28PM (#1874775)
I believe you're wrong about the nature of DirectTV's countermeasures, although we may be in a semantic tar pit here. The measures DirectTV took to stop the emulators were very, very technical; they involve encryption at the level of HDL.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by jonmc12 on Friday November 05, 2010 @03:28PM (#1874502)
There is a difference between hacking a machine (Kinect) and hacking a service (DirecTV).
Re:Microsoft furious at $2,000 bounty for open source Kinect... by jrockway on Friday November 05, 2010 @05:18PM (#1874965)
I don't really see the difference. The Kinect is a piece of plastic and lead-free solder that you buy. DirectTV is a radio transmission that they broadcast into your house.

Once the Kinect is in my house, who cares what I do with it? I can smash it with a hammer, I can send it USB commands. My Kinect, my house, my rules.

DirectTV is the same. Once the radio waves are in my house, why can't I decrypt them to watch TV for free? If DirectTV wants me to pay for TV, why are they sending the signal into my house!?

Re:Microsoft furious at $2,000 bounty for open source Kinect... by wnoise on Friday November 05, 2010 @05:57PM (#1875098)
I completely agree in terms of ethics and what the legalities should be. In terms of what's possible to do, and to do so easily, the satellite TV vendors have managed to stay neck-and-neck with those trying to watch TV for free, precisely because of little details like being able to alter the format and update the software to work with it.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @07:56PM (#1875427)
If you agree with 'jrockway, then you must also believe it's perfectly ethical for me to listen to your cellphone calls.

Otherwise, this argument is a bit more nuanced than either of you are acknowledging.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by jrockway on Friday November 05, 2010 @09:07PM (#1875564)
Break the crypto and enjoy.

The difference between cell phones and DirectTV is that you have session keys for your phone calls, but there is one global key for every user in the country for DirectTV. Such is the nature of broadcasting.

They chose a "cheap" method to distribute TV to users, but it's also very "insecure". The cell-phone companies, on the other hand, developed a very expensive infrastructure, and it's more secure as a result.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @03:32PM (#1874522)
I don't see the difference between hacking the machine that makes DirecTV work and the machine that makes Kinect work, but since we're a community of nerds, I'm sure there's at least 1223 distinctions to be drawn here.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by alextgordon on Friday November 05, 2010 @05:35PM (#1875027)
The utility of DirecTV is the service it provides. The box has no utility per se. Because being able to receive DirecTV's service is dependant on having compatible software, there has to be some way for the box (hacked or not) to receive updates. If the pirates don't patch, they lose their utility.

The utility of Kinect is a physical piece of equipment. There's no service (although it may be used with a service), therefore there's no requirement to receive updates once hacked. Microsoft only gets one chance to deploy their defences: when the Kinect is in the factory.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @07:59PM (#1875434)
You apparently think the Pay TV providers can issue new smart cards on a semiregular basis. No, they can't. They operate under approximatelly the same constraint Microsoft does; updates to their core protection scheme are ludicrously expensive.

(Microsoft could use the exact same scheme by bricking their devices with fuses when they fail some routine checkup; they could also brick every device and then issue a recall/reissue. They have better options than that, though).

Re:Microsoft furious at $2,000 bounty for open source Kinect... by pyre on Friday November 05, 2010 @04:53PM (#1874887)
DirectTV is a service. You hack the machine to receive the service for free. It can never be impossible for them to detect that and shut you down.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @08:00PM (#1875436)
I don't follow. People used to hack DirecTV machines to receive the service for free. DirecTV detected that, and shut all those people down. How much does it cost today to obtain a device that gets free pay-per-view?
Re:Microsoft furious at $2,000 bounty for open source Kinect... by pyre on Saturday November 06, 2010 @01:00AM (#1876118)
There are still people that do it, so far as I understand, but it is a dedicated bunch and takes enough time that it's not something that will easily be in the hands of people that don't have intimate knowledge of the systems.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Saturday November 06, 2010 @01:23AM (#1876194)
It used to cost $150? to get unlimited free pay-per-view. I know; I had a hacked card (we paid for DTV, but I liked being able to record The Simpsons from every local network carried on DTV, back when The Simpsons was actually decent).

What does it cost now?

Re:Microsoft furious at $2,000 bounty for open source Kinect... by PostOnce on Friday November 05, 2010 @05:03PM (#1874916)
Do you not see the difference between pirating a game and pirating cellphone service? One is easier to detect and cancel out on the provider's end.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @07:02PM (#1875280)
(a) No.

(b) Limor isn't putting a bounty on pirating a game. She's putting a bounty on forced interoperability with a hostile proprietary peripheral. The bounty is great (even though I think "her team" will lose). I think it's kind of insulting to compare it to pirating games, which is indefensible.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by CamperBob on Friday November 05, 2010 @05:04PM (#1874917)
The difference is this: The machine that makes DirectTV work lives in another city, in an air-conditioned building behind a barbed-wire fence.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @07:03PM (#1875286)
If I understand this comment correctly, that's pretty much not at all the way DirecTV works. The people who "broke" DirecTV in the '90s didn't do it by hacking into DirecTV's servers.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by CamperBob on Friday November 05, 2010 @07:18PM (#1875338)
It just means that the usual arms race between defenders and attackers isn't as clear-cut as it is when both the peripheral and the host are sitting in your living room or lab.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @07:54PM (#1875426)
No, I'm serious: the arms race we're talking about in DirecTV's case happened entirely in the living room.

They did something with consumer hardware that made tampering with it economically infeasible.

The exact same technique they use is available to Microsoft, should they be willing to pay to integrate and (more painfully) license it.

What Pay TV providers did to stop Pay TV hackers is an open secret, but I don't work in Pay TV and don't know exactly how "open" the secret is, which is why I'm dancing around this argument rather than just killing it with facts.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by mkramlich on Saturday November 06, 2010 @05:39AM (#1876542)
> Microsoft pays some of the best in the world.

Some of the best. And most of the best are "out there" and not on their payroll. Plus it's not impossible that some of these supposed best on their payroll may also contribute, on the side, to helping hack/crack their products, anonymously. Regardless though, I bet for every 1 world-class hacker inside Microsoft there are 100+ outside of it, and some of the latter will have the interest and time and skills to hack it.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by daeken on Friday November 05, 2010 @03:26PM (#1874490)
Another good one: the 360. While there have been attacks against it, hackers have by no means won.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by Psyonic on Friday November 05, 2010 @05:15PM (#1874955)
Yes they have, you just can't play on Live. The service hasn't been hacked, but the machine has. Same with the ps3.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by chadgeidel on Friday November 05, 2010 @02:31PM (#1874272)
As with much security "win" is relative. If Microsoft can keep the hackers at bay until their next console release (or, perhaps the subsequent release) they will have essentially "won".
Re:Microsoft furious at $2,000 bounty for open source Kinect... by teh on Saturday November 06, 2010 @10:06AM (#1876900)
As someone who as sunk considerable amounts of time into PS3 hacking I can say that sony do a pretty good job. Not initially, but their current firmware (3.5) is pretty closed.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by DannoHung on Friday November 05, 2010 @02:37PM (#1874295)
This is all because they want o put Kinect into Windows and mobile as a competitive advantage agains other desktop and phone platforms. Xbox is to make consumers familiar with it
Re:Microsoft furious at $2,000 bounty for open source Kinect... by caf on Friday November 05, 2010 @10:17PM (#1875705)
So it's a "Reverse Apple". Apple sold much hardware on the basis of their software's appeal (going to lengths to prevent people running OS X on generic hardware); Microsoft wants to sell software on the basis of their hardware's appeal (so they need to prevent people using their hardware with other software).
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @03:08PM (#1874423)
Sounds like a reasonable business move to me. Businesses should be able to develop competitive advantages.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by DannoHung on Saturday November 06, 2010 @01:23AM (#1876195)
What I don't get is why they care. It's not gonna be popular on other platforms unless the other platforms build in interface support for the Kinect capacities. Having drivers is interesting for hackers and researchers, but sales to those guys are never going to be a drop in the bucket of normal sales.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by CamperBob on Friday November 05, 2010 @05:06PM (#1874924)
But the integrity of their business model is not my problem.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Friday November 05, 2010 @08:03PM (#1875446)
If "might is right" is the ethical/legal regime we're all going to be working under, you realize Microsoft has access to talent of the same caliber as Bunnie Huang, and in significantly larger quantities?

These arguments make sense if you believe that "DRM" (software protection) has lost the technological war. But it hasn't! You just don't see the high-end stuff deployed in places where hackers care about it --- with the possible exception of the hypervisor-secured game consoles.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by nitrogen on Friday November 05, 2010 @09:47PM (#1875639)
This assumes that "talent" is a magical dust that makes everything better when you sprinkle it on. I have a few counterarguments:

1. No doubt there are incredibly intelligent, motivated people working for Microsoft, but talent requires an appropriate environment to reach its potential. 2. The mistake is often made of assuming that the "good guys" are the only ones with smart people on their side. This mistake is most frequently seen in discussions of national security and nuclear technology. 3. All it takes to defeat a non-service-based DRM scheme is one vulnerability. If the Kinect has to continually stream motion data to Microsoft servers for processing (kind of like Android speech recognition), then Microsoft can keep changing the protocol and encryption. If Microsoft's 100 talented engineers leave just one gap, and one talented hacker finds it, then hackers "win." 4. "Might makes right" should absolutely apply to what talented hackers do with products they own. I value individual property rights above corporate business model preservation. It is the duty of the giant and powerful corporations to ensure their business models aren't vulnerable to the whims of talented hackers, and using the law to make it so is unethical.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by nitrogen on Saturday November 06, 2010 @12:05AM (#1875953)
Apologies for the poor formatting. I forgot that I have to use \n\n instead of just \n to get new paragraphs, and ran into maxvisit so I couldn't change it before the editing window closed.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Saturday November 06, 2010 @01:24AM (#1876197)
Microsoft doesn't have to and won't rely on its own internal engineers if it decides to care enough about Kinect to stop this kind of thing.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by nitrogen on Saturday November 06, 2010 @03:54AM (#1876440)
That's why I added the final clause of item 4, "and using the law to make it so is unethical." I don't blame you if you didn't make it that far with the botched formatting. It's also worth noting that I'm commenting on how I believe things should be, not how they are. "Might makes right" currently has hackers ~= Microsoft, but Microsoft+lawyers+lobbyists >> hackers.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Saturday November 06, 2010 @12:36PM (#1877209)
No, I meant, Microsoft will contract to teams of outside engineers who have made this problem their life's work.
Re:Microsoft furious at $2,000 bounty for open source Kinect... by Natsu on Saturday November 06, 2010 @02:38AM (#1876345)
> These arguments make sense if you believe that "DRM" (software protection) has lost the technological war. But it hasn't! You just don't see the high-end stuff deployed in places where hackers care about it --- with the possible exception of the hypervisor-secured game consoles.

Where is it, then? And if it's where I think it is, don't most such places keep tight control of their hardware? (As opposed to letting random consumers buy and own it.)

Re:Microsoft furious at $2,000 bounty for open source Kinect... by tptacek on Saturday November 06, 2010 @12:37PM (#1877211)
How about DTV cards, or BD+ Blu-Ray disks?
Re:Microsoft furious at $2,000 bounty for open source Kinect... by Natsu on Saturday November 06, 2010 @04:13PM (#1877663)
Fair enough, but I wouldn't consider any of those to be "won" as if nobody's ever going to hack them.

BD+ in particular, I thought some commercial program was already able to emulate. And I haven't heard of any movies where there are no pirated versions available, but I don't watch them at all, so I might be out of the loop.

And mere Blu-Ray (for those disks without BD+), is pretty well cracked at this point if one is to believe the hexadecimal numbers going around the internet.

Re:Microsoft furious at $2,000 bounty for open source Kinect... by CamperBob on Friday November 05, 2010 @09:37PM (#1875619)
If "might is right" is the ethical/legal regime we're all going to be working under, you realize Microsoft has access to talent of the same caliber as Bunnie Huang, and in significantly larger quantities?

They have access to talent of that caliber, but apparently ( http://en.wikipedia.org/wiki/Xbox_360_technical_problems ) they aren't willing to pay for it.