Hacker News Reader

Comment by rcarmo | Hacker News Reader

Console manufacturers don't run unsigned code, so I expect they'll just sit still until the next hardware refresh.

I wouldn't be so sure of that. They at least run Javascript through their web browser.

The Nintendo Switch generally only allows white-listed pages. So the attack vector is pretty small. The other consoles, yes, should be possible. But I think not too many people use their consoles for browsing.

It will show any captive WiFi-portal however so perhaps watch out for that.

In addition they do have a store with indie games which seems to be more or less open to anyone (I assume there are some checks but I wouldn't trust them completely) much like Steam.

The requirements for getting onto the various platforms are pretty stringent. It's nowhere near as easy as getting onto Steam. You have to go through quite a rigorous certification process before you are allowed to ship your game on the online stores.

Only the hacker needs to do it for there to be a problem

I wonder if you can use Spectre to steal signing keys from the device and jailbreak them. I guess they probably only have the public keys though, for verification.

The Switch only allows whitelisted pages, but sometimes loads them over HTTP (notably Puyo Puyo Tetris opens a web applet to http://sega.jp), so you can MITM yourself and load arbitrary content including your own JS.

Modern consoles now come with web browsers, and the researchers proved that the attacks could be performed via web browsers, did they not?

Next patch: we enhanced your security by disabling execution of JavaScript from untrusted domains. In unrelated news, we now block ads!

If they are going to block JavaScript, they need to do it for all domains, not just untrusted domains. For example, if I can MITM my own website activity (which I can, by having a device that sits between a router and a console), then I can change the JavaScript coming from trusted domains.

In other words, if I visit a site like Google or Facebook on an affected device, I can change the JavaScript that is run, and make it still appear like it came from a trusted domain.

You can be prevented from a successful MITM by enforcing HTTPS using HSTS and pinning the keys of trusted sites. That's not a viable solution for accessing the internet at large, but for a console that is only incidentally used for web browsing, it's absolutely an option.

There are dozens of ways to prevent this, viable because you fully control the hardware and software stack of the terminal (and only allow contacting servers of your choosing).

I imagine they are more concerned about game authors snooping keys or whatnot.

You can't just mitm when the JavaScript is served over https, unless you also can install your own certificates on the machine you're trying to hack. But when you have permissions to install new certificates you probably don't need the hack in the first place.

Not unsigned code, but Xbox One runs apps from the Store. There should be a fair amount of checks before an app lands on the store, but you can never be sure.

Reply on news.ycombinator.com