25C3: Console Hacking 2008: Wii Fail - Part 4

Console Hacking 2008: Wii Fail

Fourth part.

"Is implementation the enemy of design?

The Nintendo Wii game console has been one of the most popular of all time, selling almost as many units as all of its competitors combined. Despite being cheaper than the PS3 and Xbox360, it contains a sophisticated security architecture that withstood over a year of concerted effort to hack the device. The design itself is impressive; unfortunately, flaws in the implementation (both subtle and severe) render the device easily hacked, with little chance of recovery."

http://events.ccc.de/congress/2008/Fahrplan/events/2799.en.html

Category:

Gaming

Tags:

• 25C3
• Console
• Hacking
• 2008
• Wii
• Fail
• CCC
• 25th
• Chaos
• Communication
• Congress
• Twiizers

[sync258]

So does this mean if you use the bomb banner hack you don't have to do this cus they are the same thing?

[Scarjka]

Yeah, bannerbomb and the Twilight Hack essentially do the same thing; allow you to run unsigned code.

[coolkid602006]

That's.....FAIL!!!!!!!!!!! Pwnage mates, fucking pwnage you dudes rule.

[shoeboy83]

this is where the discussing gets really interesting

[XxXxGianfrancoxXxX]

"so if your signature has 00 anywhere, it stops comparing there."

Wow, for a milti-million dollar company they could have done better than that.

whoever designed that "security" must be fired by now.

Also, thanks for the upload, really interesting!

[juggalojefte]

WHAT THE FUCK IS THIS SHIT!?!?!?!?!?!?

[dookerized]

these are some smart mother fuckers, holy shit.

[marcan42]

The actual formula is 0^65537 mod (some really huge number), where the 0 is supposed to be (some other really huge number) if this were a real signature. The public exponent is the constant, 65537, and the huge mod number is the public modulus (i.e. the public key, a product of two huge prime numbers). The result of the exponentiation is just 0, and the mod does nothing because it only changes numbers that are greater than the modulus to begin with, so you get 0 as a result.

[retry64ever]

dolls cant get singd but wads can

[sync258]

Thanks

[vladhed]

Thanks for this - I knew the TP hack was a stack smash but I never understood the sign-bug. Good lesson for any software professional working on security.

[iiSuckz]

iNo it's not 0 ^ 0 it's. ^_^