Playstation 3 Code Signing Cracked For Good

[wraggster]

It appears that Sony's PS3 has been fatally compromised. At the Chaos Communication Congress in Berlin, a team named 'fail0verflow' revealed that they had calculated the Private Keys, which would let them or anyone else, generate signed software for the PS3. Additionally, they also claim to have a method of jailbreaking the PS3 without the use of a Dongle, which is the current method. If all these statements are true, this opens the door to custom firmware, and homebrew software. Assuming that Sony doesn't take radical action and invalidate their private keys, this could mean that Jailbreaking is viable on all PS3, regardless of their firmware! From the article: 'Approximately a half hour in, the team revealed their new PS3 secrets, the moment we all were waiting for. One of the major highlights here was, dongle-less jailbreaking by overflowing the bootup NOR flash, giving complete control over the system. The other major feat, was calculating the public private keys (due to botched security), giving users the ability to sign their own SELFs Following this, the team declared Sony's security to be EPIC FAIL!'

http://games.slashdot.org/story/10/1...acked-For-Good

[Spyzius]

This is serious

[Hungry Horace]

One of the major highlights here was, dongle-less jailbreaking by overflowing the bootup NOR flash, giving complete control over the system.

This annoys me - just quoting an article that the fail0verflow team have already stated is inaccurate.

I guess this is the trouble with News being copied from site-to-site with no actual research.

Whoever originally wrote something about "overflowing the bootup NOR flash" needs to be shot (after watching the talk and paying attention)

also, the team are not claiming to be able to "sign any software". If you listen to the Q&A they quite clearly state that doesnt include game-signing, but (iirc) update files and the like.

[DPyro]

They can sign pkg files, which is all we need it for.

[BlueCrab]

To my understanding, they cannot sign game/application pkg files, just those within a update pup file.

[Fonixx]

Ha Ha Hah... And what stage do you think Ps3 hacking would be in if Sony just left OtherOS? I'm guessing still chipping away at Ps3 Linux with no piracy yet, and now it looks like Sony has completely lost the battle when they provoked this to happen.

[Hungry Horace]

To my understanding, they cannot sign game/application pkg files, just those within a update pup file.

at least somebody was listening!

[DPyro]

To my understanding, they cannot sign game/application pkg files, just those within a update pup file.

ok folks, you can now decrypt and sign anything on the playstation 3 system. Congrats geohot !

http://geohot.com/

[BlueCrab]

Well, nobody ever said they wouldn't progress today.

[Eviltaco64]

This is going to be interesting.