Console Security – Nintendo Switch [video]

  • Beyond preventing the distribution of pirated games, why do console manufacturers put so much effort into preventing unvetted code from running on their hardware?

    Does Nintendo actually stand to lose anything if a homebrew community evolved?

    Shouldn't we put time limits on DRM like we do on copyright so that eventually owners of these devices are allowed to use them however they like?

    My sony PSP and nintendo DS are collecting dust because I already played all the licensed games I was going to on them. Now these devices are worthless to me and get tiny prices on the 2nd hand market. If their owners released firmware signing keys, these devices could have a new lease on useful life as homebrew machines, but instead their owners tell us no, they'd rather the devices became prematurely useless and that we can't get any use out of them unless they can cash in on it... It's weird now that I think about it.

  • This is really cool stuff!

    I think it's a particularly novel idea of using on-die fuses to prevent firmware downgrade. I don't know how common that is in the console security world, but the amount of actual firmware updates vs. software updates in any given device would be pretty low and from what I've read the number of fuses is large enough they're never really going to run out of it.

    But I also absolutely love the use of the uninitialized PID argument value to be PID 0. There's a poor engineer sitting at Nintendo looking at that slide and just going "well... shit."

  • The demo and Q&A section is missing on this video and on YouTube, but you can watch it here: (demo starts at around 01:08:00) https://streaming.media.ccc.de/34c3/relive/8941

  • Most secure OS, but no lock screen, cloud backup, or “find your Switch” option. If somebody steals your Switch or you lose it, you can forget about it—which is why I protect mine like a newborn child.

  • I'm getting a page not found. Did it die?

  • I bought a couple of games from ebay once. I thought it would be the serial codes to input in the store, but the seller had me create a new Nintendo account and send him the name.

    They added funds to the account and bought the games themselves and told me to play from other accounts. Then I realized it might had been carding.

    The games downloaded and worked fine. After some weeks the bad account has an admiration sign in it's icon and I can't log into the store with it, but the games still work and even get updates.

    IIRC, the 3DS had the record of which games were bought tied to the console instead of the account, which made it easy for pirates to download the games once the console was jailbroken. It seems to be the same route for the Switch.

  • Funny how the first item in an exploit chain is always WebKit for.. those devices.

  • The "bypass the SMMU" part was so funny :)

  • I wished these guys would use youtube for videos. The streaming sucks.

  • interesting video, but man that website hates 21:9 monitors.