-
Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.
PS3 OFW 3.56 New Feature: Rootkit (allegedly)
- Thread starter Vagabundo
- Start date
Last I checked, all of these are services the user decides whether and when to install, whether and when to run, and whether and when to limit or interrupt.kitch9 said:
That's hardly the same thing as mandatorily turning over control of your machine to a third party on bootup, with no knowledge or control as to what that third party may do with it.
Rhindle said:
Jesus where's all the fud come from?
You sign into Psn, the Psn server asks your ps3 to prove its legit by probably running code that performs hash checks on random files they know the hackers have been manipulating and once passed you are let on. What the hell to people keep on their ps3's that's so important apart from music and video files? If you were smart they would be backed up anyway.
marathonfool
Member
Appreciate you explaining these things. I've learned quite a bit from your posts. Helps me understand what Sony is trying to do.Argyle said:
SonOfABeep
Banned
Hanging onto OFW 3.55 until a game requires it that I want.
Don't see that happening until ICO/SotC collection, maybe.
Had homebrew but i wasn't using my ps3 any more than before that (which is to say, like once every few months) so I figured might as well leave it where I have options.
PSN might as well not exist to me. Zero friends on my list, don't play any games online.
Don't see that happening until ICO/SotC collection, maybe.
Had homebrew but i wasn't using my ps3 any more than before that (which is to say, like once every few months) so I figured might as well leave it where I have options.
PSN might as well not exist to me. Zero friends on my list, don't play any games online.
kitch9 said:
You don't have to sign in. You don't even need a PSN account. This check runs as soon as you start your PS3. Then there is also the little fact that it can execute code without you knowing it. That's not nice and the reason why we use anti virus software on our computers. If you were smart you checked your facts before calling others out.
test_account
XP-39C²
True, i dont think that this potentially rootkit (if that is the right word to use) is anything like the CD rootkit stuff, because as you say, i think that they have learned from that mistake.LiquidMetal14 said:
Ah ok, i see, that seems quite unlikely indeed.The Faceless Master said:
NinjaCodah
Member
It's not a rootkit. It's just a better way to verify the integrity of your PS3 when you log on to their PSN servers. That same code they're sending could very well be placed in an official firmware update, but then it would make it easy for hackers to work around it. This is the equivalent of a quick firmware update, but without the hassle and too fast for hackers to respond to it. It's not like they're stealing all your porn or anything, it's only meant to keep hacked PS3's off PSN. I'm all for it.
If you want to code stuff for the ps3 or run homebrew, and go on PSN and play the most recent games, just do as I did: buy a second PS3.
If you want to code stuff for the ps3 or run homebrew, and go on PSN and play the most recent games, just do as I did: buy a second PS3.
Ploid 3.0
Member
It seems the main issue people have with this system check is that it kinda makes them choose over PSN or homebrew. Get another system, or a PC for homebrew. Sony always had access to what you did on your ps3 before this firmware. What games you played, and what you bought. Hackers felt like they had to delete files before they logged onto PSN, and they developed something to do it automatically so everyone here was aware that sony already checked their system. So it can't be that surprising, keep the ps3 offline.
Install new firmware from new games and the PS3 won't be able to send your social security number to sony.
As for the fear that hackers will take over Sony and PSN to steal your ID's just remove the information from your PS3 and don't log on when it's on the news that sony lost control of PSN to hackers.
Install new firmware from new games and the PS3 won't be able to send your social security number to sony.
As for the fear that hackers will take over Sony and PSN to steal your ID's just remove the information from your PS3 and don't log on when it's on the news that sony lost control of PSN to hackers.
Argyle said:
Maybe. I don't think they could feasibly do blocking based on excessive time because network latency would trigger too may false positives. And if it was possible to boot the VM prior to the PSN sign-in, the performance difference would probably be indistinguishable from lag. But, I don't have a PS3 so I'm not familiar with the particulars of signing into PSN.
Clear
CliffyB's Cock Holster
Am I the only one getting really worn down by this endless "Sony are equal parts evil and stupid" mentality?
If you have serious misgivings just sell your PS3's and go buy one of their competitors products instead. Its really that simple.
The PS3 is an entertainment device, its not irreplaceable or by any stretch of the imagination a neccessity for anyone. In a word, its an *OPTION*, one which you aren't even contractually locked into exercising for a fixed term.
Newsflash: You aren't being oppressed by the big bad. Sony have one interest in all of this and that is to sell you their products. Part of that sales process is maintaining a quality of service they feel comfortable with by controlling that (platform and network) environment. Hacker actions threaten that control, and so OBVIOUSLY they are going to take steps to remedy the situation. What do you expect them to do, pretend nothing's changed and just roll over on a product line they've invested billions of dollars in?
As I wrote before, Geohot and Failoverflow's actions didn't occur in a vacuum, the repercussions were bound to be felt by ALL PS3/PSN irrespective of their stance on the legality/justification of their goals. This is just the beginning of the "cat and mouse" phase.
Last thing, before someone plays the "corporate ball-licker" card:
If you genuinely care about "consumer rights", here's a radical thought: Exercise your one immutable right as a consumer and don't do business with a company who's policies and practices you disagree with.
The only way you are going to effect change upon a business offering a non-essential service is by rescinding your custom, because I guarantee you all the rage and hand-wringing in the world aint going to do jack. And truthfully it shouldn't, because if you lack the commitment to "walk the walk" it critically undermines the whole premise of your complaint.
If you have serious misgivings just sell your PS3's and go buy one of their competitors products instead. Its really that simple.
The PS3 is an entertainment device, its not irreplaceable or by any stretch of the imagination a neccessity for anyone. In a word, its an *OPTION*, one which you aren't even contractually locked into exercising for a fixed term.
Newsflash: You aren't being oppressed by the big bad. Sony have one interest in all of this and that is to sell you their products. Part of that sales process is maintaining a quality of service they feel comfortable with by controlling that (platform and network) environment. Hacker actions threaten that control, and so OBVIOUSLY they are going to take steps to remedy the situation. What do you expect them to do, pretend nothing's changed and just roll over on a product line they've invested billions of dollars in?
As I wrote before, Geohot and Failoverflow's actions didn't occur in a vacuum, the repercussions were bound to be felt by ALL PS3/PSN irrespective of their stance on the legality/justification of their goals. This is just the beginning of the "cat and mouse" phase.
Last thing, before someone plays the "corporate ball-licker" card:
If you genuinely care about "consumer rights", here's a radical thought: Exercise your one immutable right as a consumer and don't do business with a company who's policies and practices you disagree with.
The only way you are going to effect change upon a business offering a non-essential service is by rescinding your custom, because I guarantee you all the rage and hand-wringing in the world aint going to do jack. And truthfully it shouldn't, because if you lack the commitment to "walk the walk" it critically undermines the whole premise of your complaint.
Clear said:
Heh, a lot of consumers have taken this approach.
This is a pretty brain-dead argument, so consumer rights now can be boiled down to if you don't like it don't buy it? Caveat emptor is all that is necessary now?
I don't quite understand the outrage, it certainly could be next to impossible to exploit if implemented correctly. Then again they still are using http for PSN.
It's kind of hard to just elect to not "do business with a company who's policies and practices you disagree with" after you've spent $300-$600 on their hardware and multiples of that on their software.Clear said:
Besides, I don't see why the choice should be between walking away and silently submitting to whatever is dished out to you.
What happens if I swallow both pills?Ploid 3.0 said:It seems the main issue people have with this system check is that it kinda makes them choose over PSN or homebrew. Get another system, or a PC for homebrew. Sony always had access to what you did on your ps3 before this firmware. What games you played, and what you bought. Hackers felt like they had to delete files before they logged onto PSN, and they developed something to do it automatically so everyone here was aware that sony already checked their system. So it can't be that surprising, keep the ps3 offline.
Install new firmware from new games and the PS3 won't be able to send your social security number to sony.
As for the fear that hackers will take over Sony and PSN to steal your ID's just remove the information from your PS3 and don't log on when it's on the news that sony lost control of PSN to hackers.
I'll have to disagree with you, though. What we're (allegedly) facing at the moment is the fact that Sony can, at any time, install an executable on your system, and run it whenever they please. They can make that file today and upload it to your system.
And then make another one which does other shit we don't know about tomorrow.
That's different than having a fixed set of data being uploaded every time you sign in.
All our base are belong to Sony now, and there's nothing we can do about it.
Ploid 3.0
Member
Despera said:
Sony showed what they're willing to do to protect their service, and try to stop the ugly side of homebrew. It's best to make it up in your mind to cut ties and move on to something else if you can't deal with whats happening. If you're willing to deal with it the issue isn't as big of a problem for you.
Moving on is hard though.
http://i.imgur.com/YngLR.jpg
No CFW or XMBC (I think) on it, but they don't install executable files on it (right?). It's safe for now.
marathonfool
Member
From my understanding, Microsoft has been using the same remote challenges Sony has just now instituted for years.Ploid 3.0 said:
Dr Frasier Crane
Member
Clear said:
Post of Kings!
Seriously, though people need to stop the gnashing of teeth. If you don't like it, go!
MoonsaultSlayer
Member
You wannabe hacker types are hilarious. All this fighting and e-peen stroking over running linux and roms on ANOTHER system "just because".... Hahaha.
Edit: oh yeah.. and the abiltity to boot up "back-ups" because the disc drive is too loud. Evil Sony for not allowing that feature from the get go.
Edit: oh yeah.. and the abiltity to boot up "back-ups" because the disc drive is too loud. Evil Sony for not allowing that feature from the get go.
Gokurakumaru
Banned
Zeal said:
I thought it was both witty and pertinent. Everybody making a big deal out of this "security hole" seems to have missed the point that your PS3 can't run malicious code from some hacker without you downloading it first. Your PS3 can't accidentally download code from a location other than PSN because of SSL. And an unhacked machine will detect any kind of spoofing as a man in the middle attack.
This security underpins the entire Internet. You don't fret about losing all your money every time you do online banking, do you? Don't hack your PS3 and no harm can come from it being able to execute code on startup.