Playstation 3 Code Signing Cracked For Good

[Qmark]

Of course, the logical course of action is to invalidate all existing keys in a FW update, push updates and patches of all existing software to use the new keys, then brutally banhammer and possibly invoke legal action on anyone seen on PSN running 'oldsigned' anything.

[BlueCrab]

The problem with that is that they cannot invalidate the metldr key, if I recall correctly. The metldr key is known now, and with just that you can load any other loader and extract the keys from it using the fail0verflow method. Now, they could in theory update all the loaders that they can update with new keys and fix the overflow problem and bad "random" value, which might prevent people from getting any new keys... That doesn't fix the whole problem as it stands though, since metldr will still be vulnerable. (This is all to my understanding... I'm no expert on PS3 stuff, so I may be wrong)

They'd not only have to replace all software, they'd have to replace the hardware as well (to fix the fact that the metldr key is out). Somehow I don't think they'll be doing that.