Top
Best
New

Posted by crtasm 4 hours ago

Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'(www.tomshardware.com)
339 points | 146 comments
autoexec 2 hours ago|
> Whether PC users, our core readership, will be interested in actually emulating Xbox One, looks unlikely. The 2013 system’s game library is largely overlapped in better quality on the PC platform.

And this explains why it's stayed unhacked so long. There was very little incentive to hack the system when the games are all playable on a PC. Pirates, cheaters, archivists, and hackers could just go there. Microsoft's best security measure was making something nobody cared enough about to hack in the first place

mikae1 4 minutes ago||
> There was very little incentive to hack the system when the games are all playable on a PC.

There's a terrific incentive: Being able to play games without Steam or DRM in a portable format (possibly one file per game). Emulation is beautiful[1] and this time it may come at native speeds considering the Xbox One uses x86 architecture.

[1] https://100r.co/site/uxn.html

giobox 2 hours ago|||
The other major incentive for hacking the console Microsoft removed was for the first time on a modern mainstream home console to allow side loading of homebrew code/emulators etc. The console supported a developer mode that allowed side loading of third party applications, so folks could get emulators and other traditionally "banned" content on the console through an officially supported route.

There's a great presentation by Tony Chen on the Xbox One's security features:

> https://www.platformsecuritysummit.com/2019/speaker/chen/

Examples of the kinda software you can put on the Xbox One in developer mode:

> https://xboxdevstore.github.io/

philistine 2 hours ago|||
You are 100% correct but they started clamping down on people using Dev mode strictly for emulators and homebrew. So here we are.
pjmlp 1 hour ago||
This is what killed Linux support on PS as well, Sony was disappointed with what was being done with PS2Linux, instead of indie titles.

Hence why PS3 Other OS no longer did hardware acceleration.

Keyframe 1 minute ago|||
Linux on playstation was a play by Sony not to have customs like on a toy but as a more favorable computer merchandise. They didn't care.
beAbU 52 minutes ago|||
The PS3 was incredible value dollar-to-flop, given that it was sold at a loss. This resulted in universities and other research institutes buying them en masse to create supercomputer clusters. Naturally buying thousands of consoles but not a single game puts sony in a difficult position. Although I think it's sad the hardware got locked down in later revisions, I fully understand why they did it.
mschild 43 minutes ago|||
The US Department of Defense went quite a bit further. They created the Condor Cluster in 2010 which was comprised of 1760 PS3s. At the time it was placed 33rd worldwide for a supercomputer.

https://phys.org/news/2010-12-air-playstation-3s-supercomput...

AlphaAndOmega0 24 minutes ago|||
I would be curious to know more precise numbers. My intuition suggests that when Sony sells millions of them, the number diverted for non-gaming purposes is maybe thousands or tens of thousands.
gjsman-1000 1 hour ago|||
I've seen this argument, but I strongly suspect that it's a cope argument. "We couldn't get in... because... we didn't care to! Even though we've hacked literally every other object on the planet just because."

The proof in the pudding of this will be when the Nintendo Switch 2 reaches 2035 with no cracks. That's my prophecy; that this time around the cat actually will catch the mouse. Between NVIDIA's heavily revised glitch-resistant RISC-V security architecture and Nintendo's impeccable microkernel, there's nowhere left to hide. DRM may turn out to have been a very slow long battle to "victory," not a "this will always be defeated."

mikepurvis 1 hour ago||
Well, and these systems are also designed with ratchet-type measures in place from the get-go, where holes are plugged, fuses are burned, and newly released titles will only decrypt/run on the latest OS.

So even if Switch 2 doesn't make it all the way to 2035 with zero cracks, there's a strong likelihood that any exploits found will be short-lived.

joseda-hg 22 minutes ago||
Which incentivizes people to hold on to exploits for as long as possible, ideally past the console life cycle, just to make sure it can be used, which already is a thing
Retr0id 1 hour ago|||
This is true, but it is also true that the Xbox One's security architecture and mitigations were ahead of its time. It would've taken a while to hack even with stronger incentives to hack it.
autoexec 2 minutes ago||
True, I'm not trying to diminish this guy's efforts to defeat all the obstacles MS put in his way.
Thaxll 37 minutes ago|||
This is not the reason, the reason is that the security is very strong. It's explained in the video.
louhike 1 hour ago|||
One thing PC does not have are the Xbox/Xbox 360 updated games. Microsoft did a great job of making the old games playable on Xbox One with better resolution, performance, etc. It would be nice to play the exclusive games of those consoles on PC through this.
pjmlp 1 hour ago||
It might be coming as per GDC news, lets see.
glenstein 1 hour ago|||
>The 2013 system’s game library is largely overlapped in better quality on the PC platform.

I get what this essentially means, but for those of us with a certain amount of love of language (or pedantry), it's fascinating to try and parse this literally because I don't quite think it works as intended.

Clearly the intended meaning is something like eclipsed in quality. And it may be overlapped in the sense that the same games are separately available on PC. But overlap isn't a relation of quality; quality is generally better or worse when it's comparative. So it's like a smushed together way simultaneously saying the selection of games on Xbone overlaps with what's available on PC and is also better quality on PC.

inertiatic 1 hour ago||
It's clear it means that there's a large overlap in titles and they are available in better quality on the PC platform?
glenstein 39 minutes ago||
I already acknowledged that part several times?
bombcar 2 hours ago|||
There was a time when it would have been a hot target, but everything the original modded Xbox could do could be done easier elsewhere.
chocochunks 2 hours ago|||
Most of what was done on an original modded Xbox can be done on a retail stock Xbox One/Xbox Series with the exception of pirated Xbox games. Kodi (formerly known as XBMC) is just in the Xbox store, emulators and homebrew can be setup through dev mode with a little effort and $20. It's really just pirated versions of Halo 5 and a few others missing.
jerf 1 hour ago|||
I know that's been dropping my level of interest for hacking consoles farther and farther. Why hack a console when it has almost no exclusives, even fewer of which I personally care about, and having a real computer hooked to a TV is no longer weird or difficult? I could fight to put an emulator on some locked down console or I can just install an emulator for almost everything ever made in like 10 minutes on my Steam Deck, so the choice is pretty obvious.
zadikian 1 hour ago|||
Maybe cheaters want to cheat somewhere nobody else cheats. Idk if these games do online cross platform nowadays.
bor_real 1 hour ago|||
The Xbox One has been emulated though (well not emulated, it's a compatibility layer like Wine). Before this hack, there was Collateral Damage. We were able to dump games with the exploit.

Minecraft: Xbox One Edition (the Legacy version) was of keen interest to our community as it would be playing LCE natively on a PC if you used a compatibility layer which never happened before.

So a few of my LCE cult friends contributed to WinDurango which was pretty much dead before they joined, and got Minecraft: Xbox One Edition to work.

Of course, you'd ask "why don't you just play Minecraft on PC normally?" Legacy Console Edition has so many minute differences and details that it's impossible to discuss all of them--things as big as the Minigames and as small as the mipmaps.

And then LCE source code from 2014 got leaked and that had a native PC port. Oh well.

foobiekr 1 hour ago|||
the main value is that it's way easier to make an emulator of a console than some point-in-time windows PC.
Forgeties79 2 hours ago||
Also getting a dev account and loading up RetroArch/emulators in general is trivial. Best use of an Xbox one for sure. Well documented and exploited at this point.

Not the same as emulating its titles, but a lot of interest in the Xbone/series line (outside of actual console users) is the dev accounts. So I imagine a lot more effort went there first.

mrandish 1 hour ago|||
I was vaguely aware this is possible although the "sign-up for a dev account and boot it in dev mode all the time", even if free, was still enough of a barrier that I haven't done yet. I'm hoping this hack eventually leads to a simpler "one-click" way to run emulation, home brew and mods while still maintaining full original game and media playing functionality.

Then I'll finally hook up the XBOne I have again and put it to some use on the downstairs TV. I already have a 'retired' PS4 filling similar role on the upstairs TV (although it must stay offline to remain 'liberated').

genthree 1 hour ago|||
How is this the first I’m hearing of it? Looks like I finally have a reason to own an x-box, aside from the best version of Perfect Dark (the HD release of the original with modern controls, I mean) being on the 360.
Forgeties79 25 minutes ago||
They used to charge too but now it’s free. I got mine set up after about 30min of work a few weeks ago just need to actually load it up now. It’s tedious and you have to share your personal ID but it’s not difficult.
Jerrrrrrrry 3 hours ago||
Created a voltage drop that exactly occurred to be timed to the key comparison, then a spike at the continuation.

Irl noop and forced execution control flow to effectively return true.

B e a utiful

Retr0id 2 hours ago||
No? It is crowbar voltage glitching, but you're significantly underselling it here. The glitching does not affect key comparisons.

It's a double-glitch. The second glitch takes control of PC during a memcpy. The first glitch effectively disables the MMU by skipping initialization (allowing the second glitch to gain shellcode exec). (I am also skipping a lot of details here, the whole talk is worth a watch)

btown 2 hours ago|||
It's fascinating - how does one defend against an attacker or red-team who controls the CPU voltage rails with enough precision to bypass any instruction one writes? It's an entirely new class of vulnerability, as far as I can tell.

This talk https://www.youtube.com/watch?v=BBXKhrHi2eY indicates that others have had success doing this on Intel microcode as well - only in the past few months. Going to be some really exciting exploits coming out here!

PUSH_AX 2 hours ago|||
> how does one defend against an attacker or red-team who controls the CPU voltage rails

The xbox does have defences against this, the talk explicitly mentions rail monitoring defences intended to detect that kind of attack. It had a lot of them, and he had to build around them. The exploit succeeds because he found two glitch points that bypassed the timing randomisation and containment model.

poemxo 1 hour ago||
I hope Apple is paying attention, since their first gen AirTags are vulnerable to voltage glitching to disable the speaker and the tracking warning.
mikepurvis 54 minutes ago|||
It's pretty trivial to just open up and disconnect the speaker too. I took one apart to make a custom wallet card out of it and broke the speaker in doing so; the rest of it worked perfectly fine (though obviously the warning would still work).
Vexs 1 hour ago||||
They're also, as it turns out, vulnerable to a drillbit
tjoff 8 minutes ago|||
Isn't airtags completely and utterly broken, or has anything changed?
mox1 6 minutes ago||||
Just so you know, hardware hackers have been doing this for 20+ years. Hacking satellite TV (google smart card glitching) was done the same way.

Its more that its really hard to do security when the attacker has unlimited physical access.

bri3d 2 hours ago||||
It's not new - fault injection as a vulnerability class has existed since the beginning of computing, as a security bypass mechanism (clock glitching) since at least the 1990s, and crowbar voltage glitching like this has been widespread since at least the early 2000s. It's extraordinarily hard to defend against but mitigations are also improving rapidly; for example this attack only works on early Xbox One revisions where more advanced glitch protection wasn't enabled (although the author speculates that since the glitch protection can be disabled via software / a fuse state, one could glitch out the glitch protection).
sabas123 2 hours ago||||
> It's an entirely new class of vulnerability, as far as I can tell.

It is know as voltage glitching. If you're interested our research group applies to Intel CPUs. https://download.vusec.net/papers/microspark_uasc26.pdf

thebruce87m 1 hour ago||||
The microcontrollers I worked on 15 years ago had low voltage detection:

https://en.wikipedia.org/wiki/Low-voltage_detect

phantom784 2 hours ago||||
Could a chip detect this and reset?
mkipper 2 hours ago|||
I'm not at all familiar with the Xbox One, but this is a feature that's generally available if you're designing "closed" hardware like a console. Most SoC these days have some sort of security processor that runs in its own little sandbox and can monitor different things that suggest tampering (e.g. temperatures, rail voltages, discrete tamper I/O) and take a corrective action. That might be as simple as resetting the chip, but often you can do more dramatic things like wiping security keys.

But this exploit shows that it's still almost impossible to protect yourself from motivated attackers with local access. All of that security stuff needs to get initialized by code that the SoC vendor puts in ROM, and if there's an exploit in that, you're hooped.

johncolanduoni 2 hours ago|||
Yes, and the Xbox One has mechanisms to do just that. But they turned out to not be fully sufficient.
jolan 2 hours ago||
This attack is on the early models that didn't have those protections enabled. The researcher surmised that later models do indeed have anti-glitching mechanisms enabled.
msla 2 hours ago||||
You can't. Console makers have these locked-down little systems with all the security they can economically justify... embedded in an arbitrarily-hostile environment created by people who have no need to economically justify anything. It's completely asymmetrical and the individual hackers hold most of the cards. There's no "this exploit is too bizarre" for people whose hobby is breaking consoles, and if even one of those bizarre exploits wins it's game over.

And if you predict the next dozen bizarre things someone might try, you both miss the thirteenth thing that's going to work and you make a console so over-engineered Sony can kick your ass just by mentioning the purchase price of their next console. ("$299", the number that echoed across E3.)

xnyan 2 hours ago||
> You can't

It's a moot point, they are not trying to prevent it. They only need to buy enough time to sell games in the lifespan of the hardware, which they did.

> all the security they can economically justify...

It seems like they did a perfect job, it lasted long enough to protect Microsoft game profits.

_kidlike 2 hours ago||||
not a new vulnerability class.

Extremely impressive feat nonetheless!

ActorNightly 2 hours ago|||
Basically if someone has physical access to device, its game over.

You can do things like efuses that basically brick devices if something gets accessed, but that becomes a matter of whether the attacker falls for the trap.

tverbeure 1 hour ago|||
> Basically if someone has physical access to device, its game over.

It took more than a decade to exploit this vulnerability and even then there are fairly trivial countermeasures that could have been used to prevent it (and that are implemented in other platforms.)

Nothing is unhackable, but it requires a very peculiar definition of "game over".

(And as others have pointed out: only early versions of this Xbos One where vulnerable to this attack.)

beachy 2 hours ago|||
Only if they leave a door open, which they did here.

If your argument is that you can't hope to close every door, then AI will make it easier to close all the doors in the future.

braunshedd 2 hours ago|||
The Xbox 360 was hacked in a simpler but nearly identical way [1]! Amazing that despite the various mitigations, the same process was enough to crack the Xbox One.

[1] https://consolemods.org/wiki/Xbox_360:RGH/RGH3

hedora 3 hours ago||
The earliest example I know of for this is CLKSCREW, but security hardware (like for holding root CA private keys) was hardened against this stuff way before that attack.

Has anyone heard of notable earlier examples?

bri3d 2 hours ago||
In terms of fault injection as a security attack vector (vs. just a test vector, where it of course dates back to the beginning of computing) in general, satellite TV cards were attacked with clock glitching at least dating back into the 1990s, like the "unlooper" (1997). There were also numerous attacks against various software RSA implementations that relied on brownout or crowbar glitching like this - I found https://ieeexplore.ieee.org/document/5412860 right off the bat but I remember using these techniques before then.
nxc18 3 hours ago||
I think it counts as effectively unhackable since it remained unhacked until five and a half years after its successor went on the market.

I wonder if, assuming they continue making Xbox, they find a way to mitigate this in the next generation.

fredoralive 3 hours ago||
The presentation notes that this hack currently only works with the first revision of silicon. Later variants have more protections, like some anti-glitching tech that wasn’t quite debugged for the early units being enabled for later runs, and further changes with the security / reset subsystems being split into two separate cores with revised consoles like the the One X. So these would be more of a challenge, even if there’s now an angle of attack to investigate.
darknavi 3 hours ago||
> assuming they continue making Xbox

It sounds like that's the plan:

https://news.xbox.com/en-us/2026/03/11/project-helix-buildin...

babypuncher 2 hours ago||
The new Xbox is going to be a specialized PC running Windows with full access to third party game stores (Steam, Epic, etc). It won't need to be "hacked" because anyone will already be able to run any software they want on it.
glenstein 1 hour ago|||
A conversation for another day and I can't wait to have it, but something about this seems seriously doomed, because Steam already owns this lane, owns it well, and these days I think Linux is objectively the better desktop for most personal, PC-style use cases.

Windows stopped feeling like it meant PC a long time ago, and there's a major risk of the whole Xbox identity disappearing into the PC computing. Probably a conversation for another day but when everything is an Xbox, nothing is an Xbox, and when an Xbox is a PC it might as well be fading away Marty McFly style from our plane of existence.

I suppose what would really impress me is a Roku-style omnivore approach that gives a first class console-style experience and interface to Epic, Steam, Itch.io, GOG and of course Xbox.

jfim 56 minutes ago||
You can run steam in big picture mode, and there are ways to add links to games from other game stores to steam such as https://github.com/PhilipK/BoilR

It's not automatic or perfect but it does work.

glenstein 52 minutes ago||
I'm aware, but that is indeed a great thing Steam offers. I think it's janky enough that if there's one way to out-steam Steam it might be making the broader PC gaming universe as plug-and-play into a console experience as possible.
SteveNuts 2 hours ago|||
What is the point of a device like this if the only difference is form factor? Why wouldn't someone just buy a pre-configured gaming PC?
genthree 1 hour ago|||
Every PC I’ve ever tried to repurpose as a gaming console of any sort has had way more jank to it than I’d ever tolerate in a console, in the 25ish years I’ve been hooking computers up to TVs. Even the Bazzite box I’ve got is pretty bad by comparison. Hell, my actual Steam Deck has a lot more undesirable “enthusiast” behavior to it, let’s say, than I’d want out of a Nintendo product for example, even though it’s just about the best I’ve seen (the actual best is Retroarch with a skin mimicking the PS3’s menu, on a dedicated distro that could take it from cold boot to interactive in like three seconds flat even on an rpi2… but that won’t play actual modern PC games, just emulated consoles and such, so it’s not a fair comparison)

A common failure is the controllers. It’s hard to get a combo of OS stack, Bluetooth chip, and controller that Just Works like they do on consoles. Something always needs fiddling-with.

Video or audio out are also often a problem. Glitched audio or audio mode-switching, trouble switching video modes, screwed-up HDR, all kinds of stuff. Maybe fine on your monitor with headphones. Not fine on a TV or projector with 5.1+ audio receiver.

The UIs also bug out or crash more often, and usually aren’t that great at being a TV UI in the first place (even Steam IMO is worse than most consoles, as far as the Big Picture UI)

It also gives devs a stable target with a known market, which is nice for both the devs and the owners of the devices.

mitkebes 2 hours ago||||
The main goal is money, an Xbox branded windows PC has potential to drive sales.

Microsoft can also hopefully target a smoother user experience than a typical windows PC provides. They want this to be a valid console competitor, but just slapping xbox brand on a windows PC isn't enough to do that.

Having a first party hardware device to target for PC games can also help devs with having a clear performance target for PCs, similar to how the Steam Deck is currently a minimum spec performance target for a lot of games.

hbn 2 hours ago||||
There's something to be said for having a standard, known SKU, both as something for developers to target if enough people own it, and for users to troubleshoot if they're e.g. having an issue running X game.

This kind of already exists with the "Deck Verified" label on Steam games.

That said, this sounds similar to Valve's upcoming Steam Machine and I'd much prefer that to be the standard console/PC hybrid to keep the Linux gaming momentum going, and perhaps one day I can ditch Windows for good.

ziml77 1 hour ago||||
If this is true then the reason that a console would be better than a custom PC is that it would also be designed to work better for that purpose. Turning on the device when the controller turns on and sending CEC commands are two huge things that aren't well supported outside of the console space. Also it would likely run a trimmed down version of Windows and would be set up to "just work" in a way that a system that can have any arbitrary set of hardware will never be able to do.

But the really nice thing about the concept of treating a PC and console as the same platform is that you don't have to worry about why people might prefer to go the route of buying the console. You can go with a regular gaming PC if that's what you prefer and your library will have all the same options.

ThrowawayB7 2 hours ago||||
It's a device with a fixed, known-good set of hardware for developers to target, which is all that any of the major consoles is. Your question applies just as much to the Steam Deck and upcoming Steam Machine.
axus 2 hours ago||||
Let's speculate that they need a carrot for Windows developers when they attempt to use a monopoly stick on the Steam Deck.
delecti 2 hours ago||||
I mean, at that point it is a pre-configured gaming PC. Hardware that's uniform across millions of units provides advantages, both for developers and users. IMO that's a big part of why the Steam Deck outsells more powerful competitors: there are so many of them that it gets targeted by developers, so more people buy them, in a virtuous cycle.
babypuncher 1 hour ago|||
There are a few points I can see

1. Console-like living room ready experience. It's surprisingly hard to get a PC made with off-the-shelf parts to integrate cleanly with a home theater system (think features like HDMI CEC, One Touch Play, etc). A custom SoC can solve this, something we are seeing Valve also do with the Steam Machine.

2. As the target hardware for basically all Xbox games, end-users who don't want to fret over system specs can easily just buy this and know they are getting the intended experience.

Whether that's enough to move units remains to be seen.

tetrisgm 3 hours ago||
This is great news. Hopefully this opens the floodgates towards emulation and homebrew. Not that there are really any exclusives, but it would be interesting.
jamesgeck0 3 hours ago||
Xbox One homebrew has effectively always been supported. Anyone can register a development account and boot the system into dev mode. IIRC in a talk about console security, a Microsoft developer noted that this was an intentional deterrent against hacking. An effort to split the community so that pirates and homebrew enthusiasts wouldn't have a reason to collaborate.
protimewaster 2 hours ago||
They did dumb things like limit memory availability in dev mode, though. Also they require a government ID to enable dev mode (but at least the quit charging $100 for it!). And they made it so you can't enable dev mode on consoles that are banned from Xbox services.

I understand it's still more than most console makers do, having dev mode at all, but it's maddening to me that Microsoft made dev mode so annoying and limited. I'd honestly just rather a hack be available so we have the option of using the entire memory or repurposing banned consoles.

mike_hearn 2 hours ago|||
Seems unlikely. Someone would have to turn this into a modchip, set up physical distribution networks (all very illegal under the DMCA), and it'd only work on the 2013 machines - Chen's team clearly anticipated this type of attack and were already working on mitigations around the time the Phat released. So as he says at the end, later silicon already has more glitch mitigations built in and has done for a long time. Current gen Xbox isn't even investigated but we can assume it's even harder. They were clearly paying for red teaming. Remember: ZERO software bugs in the boot rom.
cortesoft 2 hours ago||
I had a friend who ran a side business installing mod chips on the original Xbox in the early 2000s. There was a robust community around it, and you could buy chips easily.

This was all after the DMCA was in effect. I don’t think that will stop this sort of activity.

qingcharles 2 hours ago|||
Very few exclusives. Couple of Forzas? Halo 5? Practically everything else available elsewhere in similar quality.
tetrisgm 1 hour ago||
They are on PC afaik?
qingcharles 24 minutes ago||
Forza Motorsport 5 & 6 and Halo 5: Guardians all Xbox One exclusives, I think.
whalesalad 3 hours ago||
I'm just excited at the opportunity to re-purpose my old launch day XBone as some kind of little homelab linux box.
echelon_musk 2 hours ago||
He is one of us :)

https://news.ycombinator.com/user?id=gaasedelen

tencentshill 3 hours ago||
Note this only affects the very first original 2013 "VCR" hardware. Newer revisions and variants are still unaffected.
dlcarrier 2 hours ago|
They're pretty common and cheap on the used market, though. I bought mine from a thrifts store for $30, and the console itself regularly goes for ~$50 on eBay.
MichelleM2030 19 minutes ago||
This is great news. I’ve actually been spending my weekends learning how to modify my old 360 and play great games to relive some of those younger days, while my Series X gathers dust.
JoeAltmaier 2 hours ago||
Physical possession of a machine is pretty hard to make secure. It's a different level of secure, an order of magnitude less secure than remote attackers. This is expected?
jolan 2 hours ago||
Tony Chen from Microsoft gave a talk called "Guarding Against Physical Attacks: The Xbox One Story" and he explains that they want any sort of physical attack to cost at least the price of 10 games ($600 at the time).

https://www.youtube.com/watch?v=U7VwtOrwceo&t=715s

lxgr 36 minutes ago||
Depends on the size of the system you need to secure.

If kilobytes of storage and very limited computing power works for your use case, you can get very secure (smartcards and secure elements remain essentially undefeated at the hardware level; all attacks I know happened via weak ciphers).

For an entire current-gen gaming console, you'll have a much harder time.

missing_cipher 23 minutes ago||
Good think MS had a fallback to the RSA encryption if that ever failed, lol
natas 43 minutes ago|
I wonder... if microsoft can't secure a gaming console which they have full control on, from top to bottom, how do they secure "Azure Government"?
physicles 38 minutes ago|
When your hardware is in the physical custody of the attacker, the threat model changes significantly. Designing a console that takes years for attackers to crack is an impressive feat of engineering.
More comments...