“In 2013 some kind of iron curtain came down on security , of the Xbox ecosystem, and the Xbox One never got hacked,” noted Gaasedelen in his introduction. The same is true of the Xbox One’s successors, and Microsoft was rightly proud. Seven years after its launch, Microsoft engineers would still assert that the Xbox One was “the most secure product Microsoft has ever produced.”
What made the Xbox One so secure, so special? Gaasedelen referenced prior work and presentations to convey this information. I’ve shared a summary slide about this, too, but let’s fast forward to the demo of the new Bliss hack, which takes place from about 46 minutes into the presentation.
You may like This Xbox One S mod hides a full Windows gaming PC within the original shell Linux hacked onto a PS5 to turn Sony's console into a Steam Machine The "Ningtendo PXBOX 5" is an all-in-one console featuring a PS5, Switch 2, and Xbox Series X in a single enclosure Since reset glitching wasn’t possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pin(s) the hacker targeted the momentary collapse of the CPU voltage rail. This was quite a feat, as Gaasedelen couldn’t ‘see’ into the Xbox One, so had to develop new hardware introspection tools.
Eventually, the Bliss exploit was formulated, where two precise voltage glitches were made to land in succession. One skipped the loop where the ARM Cortex memory protection was setup. Then the Memcpy operation was targeted during the header read, allowing him to jump to the attacker-controlled data.
(Image credit: Markus ‘Doom’ Gaasedelen video presentation ) (Image credit: Markus ‘Doom’ Gaasedelen video presentation ) (Image credit: Markus ‘Doom’ Gaasedelen video presentation ) As a hardware attack against the boot ROM in silicon, Gaasedelen says the attack in unpatchable. Thus it is a complete compromise of the console allowing for loading unsigned code at every level, including the Hypervisor and OS. Moreover, Bliss allows access to the security processor so games, firmware, and so on can be decrypted.
What happens next with this technique remains to be seen. Digital archivists should enjoy new levels of access to Xbox One firmware, OS, games. There could be subsequent emulation breakthroughs thanks to this effort. We also now have a route to making a Bliss-a-like mod chip to automate the precise electrical glitching required.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/video-games/console-gaming/SPONSORED_LINK_URL
- https://www.tomshardware.com/video-games/console-gaming/microsofts-unhackable-xbox-one-has-been-hacked-by-bliss-the-2013-console-finally-fell-to-voltage-glitching-allowing-the-loading-of-unsigned-code-at-every-level#main
- https://www.tomshardware.com
- As Open Models Spark AI Boom, NVIDIA Jetson Brings It to Life at the Edge
- Chinese GPU-maker Lisuan flaunts new design details for its LX 7G100 gaming card, also updates LX GPU product pages with server and workstation specs
- Tech titans team up to form optical interconnect alliance to solve the AI buildout's big data bottleneck — Nvidia, AMD, Broadcom & more set sights on building P
- ASML workers still in the dark seven weeks after 1,700 management cuts announced — cuts represent 4% of its global workforce
- The Nightmare Returns in the Cloud: GeForce NOW Unleashes Capcom’s ‘Resident Evil Requiem’
Informational only. No financial advice. Do your own research.