Feeds

Five-year-old discovers Xbox password bug, hacks dad's Live account

Boy, they're starting young these days

Beginner's guide to SSL certificates

A five-year-old boy has found and exploited a password flaw in his Xbox to hack into his father's Xbox Live account.

Still of Kristoffer playing on the Xbox

Look out, Mitnick ... Kristoffer Von Hassel on his Xbox (Credit: ABC 10 / KGTV)

The parents of Kristoffer Von Hassel, from Ocean Beach in San Diego, California, noticed after Christmas that the talented tot had broken into the account without knowing the password – allowing him to cheekily play games for adults that he wasn't supposed to touch.

The kid managed it by tapping in a wrong password at the console's login prompt, navigating to a password verification screen, and filling the password box with space characters before hitting the submit button. After that, the door was open.

“I was like, 'yea!'” Kristoffer told ABC News.

His father Robert Davies, who works as a computer security specialist, said the inquisitive infant has a record of doing this kind of thing. When Kristoffer was one year old, he defeated the toddler lock on his dad's phone by holding the home key down to disable the lockout – but the Xbox hack is the kid's best discovery to date, his father said.

"How awesome is that!" Davies said. “Just being five years old and being able to find a vulnerability and latch onto that. I thought that was pretty cool.”

Davies got in touch with Redmond and the problem has been fixed, allowing the family to go public with the discovery. Kristoffer received four games for free from Microsoft in recompense, along with a year's Xbox Live subscription and $50 (about 30 quid), as well as a mention on the company's vulnerabilities shoutout web page.

"We're always listening to our customers and thank them for bringing issues to our attention," a Microsoft spokesperson told El Reg. "We take security seriously at Xbox and fixed the issue as soon as we learned about it." ®

Security for virtualized datacentres

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Tim Cook: The classic iPod HAD to DIE, and this is WHY
Apple, er, couldn’t get the parts for HDD models
Apple spent just ONE DOLLAR beefing up the latest iPad Air 2
New iPads look a lot like the old one. There's a reason for that
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Caterham Seven 160 review: The Raspberry Pi of motoring
Back to driving's basics with a joyously legal high
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.