Feeds

Tricky Xbox 360 hack claimed to work 1 try in 4

New slim Redmond console pwned like a bitch

Secure remote control for conventional and virtual desktops

Hackers reckon they have come up with a way to circumvent the security of Xbox 360 gaming consoles via an attack that allows them to inject unsigned code into the heart of the system.

The so-called Reset Glitch Hack, developed by hackers GliGli and Tyros, creates a means to load code into a console's CPU. This makes it more sophisticated than previous approaches, some of which relied on bugs within gaming software.

The hack relies on slowing the CPU during the boot-up sequence, using an "externally accessible HANA chip bus (I2C) to overwrite the divider registers in the clock generator", as H Security explains. With the clock sequence slowed down it becomes possible to inject a reset pulse that both resets the clock speed and injects code of the hackers' choosing into memory. The approach is less than elegant but, given a bit of luck (the exploit is only successful 25 per cent of the time), the hacking duo showed it was possible to smuggle their own customised bootloader onto the system.

The hack works by essentially destabilising the console in order to trick it into believing the hackers' code is hashed and signed.

In a demonstration video, the hackers launched a Linux loader and Nintendo 64 (N64) emulator. The approach works regardless of firmware version. Both the new slim console and some previous versions of XBox 360 console (Jasper) are potentially vulnerable. Earlier versions of XBox 360 (Xenon, Falcon) are not. Microsoft may have its work cut out in blocking the hack because a simple software update would not be enough to block the exploit, according to the hackers.

The hackers stated that the hack had only been developed for the purposes of running homebrew code, and not for gaming piracy or similar malfeasance.

More details on the hack can be found here. ®

Beginner's guide to SSL certificates

More from The Register

next story
Xperia Z3: Crikey, Sony – ANOTHER flagship phondleslab?
The Fourth Amendment... and it IS better
Don't wait for that big iPad, order a NEXUS 9 instead, industry little bird says
Google said to debut next big slab, Android L ahead of Apple event
Microsoft to enter the STRUGGLE of the HUMAN WRIST
It's not just a thumb war, it's total digit war
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
A drone of one's own: Reg buyers' guide for UAV fanciers
Hardware: Check. Software: Huh? Licence: Licence...?
The Apple launch AS IT HAPPENED: Totally SERIOUS coverage, not for haters
Fandroids, Windows Phone fringe-oids – you wouldn't understand
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.