Support NeoGAF

[Zombie James]

http://cturt.github.io/ps4.html

Really long, in-depth article on the system's security so here's the final summary:

From the information currently available, the PS4's kernel seems to be very similar to the stock FreeBSD 9.0 kernel.

Importantly, the differences that are present appear to be from standard kernel configuration changes (such as disabling SCTP sockets), rather than from modified code. Sony have also added several of their own custom system calls to the kernel, but apart from this, the rest of the kernel seems fairly untouched.

In this respect, I'm inclined to believe that the PS4 shares most of the same juicy vulnerabilities as FreeBSD 9.0's kernel!

Unfortunately, most kernel exploits cannot be triggered from the WebKit entry point that we currently have due to sandboxing constraints (likely to be just stock FreeBSD jails).

And with FreeBSD 10 being out, it's unlikely that anyone is stashing away any private exploits for FreeBSD 9, so unless a new one is suddenly released, we're stuck with what is currently available.

It may not be impossible to exploit the PS4 kernel by leveraging some of the existing kernel memory corruption vulnerabilities, but it certainly would't be easy.

The best approach from here seems to be reverse engineering all of the modules which can be dumped, in order to document as many of Sony's custom system calls as possible; I have a hunch that we will have more luck targeting these, than the standard FreeBSD system calls.

Recently Jaicrab has discovered two UART ports on the PS4 which shows us that there are hardware hackers interested in the PS4. Although the role of hardware hackers has traditionally been to dump the RAM of a system, like with the DSi, which we can already do thanks to the WebKit exploit, there's also the possibility of a hardware triggered kernel vulnerability being found, like geohot's original PS3 hypervisor hack. It remains most likely that a kernel exploit will be found on the PS4 through system call vulnerabilities though.

This person did gain access to some parts of file system:

Unfortunately, due to sandboxing we don't have complete access to the file system. Trying to read files and directories that do exist but are restricted will give you error 2, ENOENT, "No such file or directory".

We do have access to a lot of interesting stuff though including encrypted save data, trophies, and account information. I will go over more of the filesystem in my next article.

UPDATE

This person claimed he got code to execute two days ago but no details: https://twitter.com/CTurtE/status/633607314818379776

 

[Trojan]

Sony...you need to step it up. Glad this article was written.

 

[Rich!]

Interesting. Would be nice to see what it can do when hacked, but I'm struggling to see the reasoning. It's already region free and plays a variety of media. Emulation would be cool, but no better than what can be offered via retroarch on the PC.

Hardly a Wii U/3DS situation where they rightly deserve to have the shit hacked out of them due to the archaic account system and region lock.

 

[1.21Gigawatts]

I somehow doubt that hacking the current gen console would be very popular, with the amount of online integration of current games I don't think many people would be willing to keep their console offline for the sake of having a CFW.

I'm struggling to see the reasoning. It's already region free and plays a variety of media. Emulation would be cool, but no better than what can be offered via retroarch on the PC.

Piracy.

 

[SURGEdude]

Interesting. Would be nice to see what it can do when hacked, but I'm struggling to see the reasoning. It's already region free and plays a variety of media. Emulation would be cool, but no better than what can be offered via retroarch on the PC.

Hardly a Wii U/3DS situation where they rightly deserve to have the shit hacked out of them due to the archaic account system and region lock.

I could imagine some pretty sick homebrew on these boxes. Of course for most people the drive to hack them at least during their active lifecycle is piracy.

 

[sturgboski]

Hmm would it be hard to push out FreeBSD 10.X to PS4 to upgrade the system from 9.0? Also would it be a benefit outside of security purposes?

 

[lyrick]

It's already region free and plays a variety of media. Emulation would be cool, but no better than what can be offered via retroarch on the PC.

Enabling the ability to play our PSOne and PSTwo Classics Sounds like as good a reason as any to break the fucker wide open.

 

[Zombie James]

Enabling the ability to play our PSOne and PSTwo Classics Sounds like as good a reason as any to break the fucker wide open.

Sounds like you're assuming the PS4 has PSX and PS2 emulators hidden away somewhere.

 

[Herpes Reasons]

I somehow doubt that hacking the current gen console would be very popular, with the amount of online integration of current games I don't think many people would be willing to keep their console offline for the sake of having a CFW.




Piracy.

So you're going to argue that people would only want to hack it for piracy? Perhaps you don't realize but there is general condemnation on this board about such an argument.

 

[lyrick]

Sounds like you're assuming the PS4 has PSX and PS2 emulators hidden away somewhere.

not at all, but homebrewing something like that in sounds like a just reason to take advantage of any system vulnerability. It's a damn shame It's not available through Sony themselves.

 

[Hamster Plugin]

Really hope they never get anywhere. At least let me finish Dark Souls 3 first without cheaters ruining the game.

 

[mackattk]

So you're going to argue that people would only want to hack it for piracy? Perhaps you don't realize but there is general condemnation on this board about such an argument.

I am sure its not what everyone would want, but it would be safe to say that piracy is something that would warrant installing CFW for many people.

 

[Tal Shiar Agent]

I'm more worried about cheating than piracy. Just look at the older CODs or GTAs on PS3. They are unplayable because of cheaters.

 

[mackattk]

I'm more worried about cheating than piracy. Just look at the older CODs or GTAs on PS3. They are unplayable because of cheaters.

I agree with you there. cheating/hacking effects everyone on the network, not just the people who are partaking in that activity.

 

[TC McQueen]

How bad are the PS4's stock apps? Because the Vita's stock apps are pretty garbage in terms of performance and/or feature set.

 

[androvsky]

Sounds like you're assuming the PS4 has PSX and PS2 emulators hidden away somewhere.

It probably doesn't now, but you'll have a hard time convincing me Sony and Disney felt it was worth while to port Star Wars Pod Racing Revenge, Jedi Starfighter, and Bounty Hunter as native PS4 games.

 

[BHK3]

I worry about cheating, developers don't do shit about that on consoles. There's nothing they can do to 'ban' you or stop you, or anything at all because of the consoles infrastructure. Worse I see is back in my 360 days achievement hackers would get wiped and their comment section turned to "Terms of Service". I don't even know if MS still does that nowadays.

 

[SolidSnakex]

It probably doesn't now, but you'll have a hard time convincing me Sony and Disney felt it was worth while to port Star Wars Pod Racing Revenge, Jedi Starfighter, and Bounty Hunter as native PS4 games.

Those games all have trophy support, so they'd have to be native PS4 games rather than just ROM dumps.

 

[ANDS]

So you're going to argue that people would only want to hack it for piracy? Perhaps you don't realize but there is general condemnation on this board about such an argument.

You're putting words in the posters mouth. They gave a reason individuals would want to hack the PS4, not an exhaustive list.

 

[lyrick]

Those games all have trophy support, so they'd have to be native PS4 games rather than just ROM dumps.

I recently bought N2O on Steam, it has Steam Achievements and could easily be classified as a "ROM dump".

 

[AndyD]

How bad are the PS4's stock apps? Because the Vita's stock apps are pretty garbage in terms of performance and/or feature set.

There's not that many of them. If you don't count media ones like Netflix, HBO... which are likely developed (or dictated) by the respective companies.

There's the media player, the screenshot viewer, the share app, and that's about it.

 

[Freedom = $1.05]

Piracy.

maybe, but now that Sony has been allowing for digital downloads to be completely removed from people's accounts it might help for preservation, too. this might be the only way PT can get into more hands in the future, for example.

 

[Noobcraft]

According to twitter he has unsigned code execution now.

 

[luca_29_bg]

there is already code execution from the same guy....

 

[androvsky]

Those games all have trophy support, so they'd have to be native PS4 games rather than just ROM dumps.

I might agree if Sony hadn't patented adding trophy support to emulated games. And ties in with the part of the Eurogamer rumor about Sony adding PS1 and PS2 emulation to the PS4 with enhanced graphics... which is exactly what's happening here.

I recently bought N2O on Steam, it has Steam Achievements and could easily be classified as a "ROM dump".

That's also true. I believe a well-known neogaf poster (can't remember who) added achievements to emulated NES games for the hell of it.

 

[JetSetRadio]

No jeff rigby thread?

 

[Alo0oy]

Sony...you need to step it up. Glad this article was written.

You actually didn't read it, did you?

This article is talking about the PS4 (you might know it as the homebrew and/or piracy community), not PSN.

 

[Valnen]

You actually didn't read it, did you?

This article is talking about the PS4 (you might know it as the homebrew and/or piracy community), not PSN.

Hardware hacks lead to cheaters, as the PS3 has shown us and people have mentioned in this thread.

 

[zephervack]

For everyone trying to rationalize this, it really is as simple as "because its a challenge".

Thats it.

 

[Jonnax]

For everyone trying to rationalize this, it really is as simple as "because its a challenge".

Thats it.

That's silly. There are plenty of people that will profit off a piracy hack.

For instance, shops doing modding for a price or if there's any hardware involved the people producing it will profit.

The reason why I'm against this hardware hacking is that it leads to hacks that destroy online games. It devalues everyone's console purchase so that a 'pro hacker' can get some fame.

 

[Game Guru]

I might agree if Sony hadn't patented adding trophy support to emulated games. And ties in with the part of the Eurogamer rumor about Sony adding PS1 and PS2 emulation to the PS4 with enhanced graphics... which is exactly what's happening here.

Well, all except one of the Classic Star Wars games coming to PS4 are PS2 games, and the lone non-PS2 game, Super Star Wars, is a SNES game.

 

[Vuze]

Nice write up. Mostly looking forward to unpacking games to extract models and assets in the short term and emulation in the long term. But you better bet Sony is following this closely.

 

[biglittleps]

This is why Sony not allowing to use USB devices like MS and restricting not to copy files to HDD because that can help hackers due to using open source OS.

 

[Freedom = $1.05]

The reason why I'm against this hardware hacking is that it leads to hacks that destroy online games. It devalues everyone's console purchase so that a 'pro hacker' can get some fame.

yup. That's why online gaming is dead on PCs, anyone can access the files and hack them. no one plays online games on PCs anymore

wait what

 

[herod]

Hardly a Wii U/3DS situation where they rightly deserve to have the shit hacked out of them due to the archaic account system and region lock.

"deserve" ?

So the company who had completely inadequate online security of their 'modern' account system leading to enormous personal information leaks and also hacked every consumer they could with trojans on their audio CDs are less deserving?

What a load of fucking bullshit.

 

[hesido]

"deserve" ?

So the company who had completely inadequate online security of their 'modern' account system leading to enormous personal information leaks and also hacked every consumer they could with trojans on their audio CDs are less deserving?

What a load of fucking bullshit.

Holding a grudge for too long is bad for one's health. I thought "consumers" got even when PS3 was cracked open?

Oh, I don't think Wii U deserves it either.