Here's what they said on the blog
# Felix Says:
May 13th, 2007 at 5:25 am
Why hurting? Working together with Microsoft actually made it possible to speak about this hack in public at all, and releasing information (including that proof-of-concept) about it. My/our intention was never to spoil homebrew. No, there was no money and no job involved in the disclosure to Microsoft. I have good-paying job, and hacking stops being fun if money is involved, at least for me. (which reminds me about that gray every-day life which will start again after I enter the plane tomorrow - i really had a great time here at Bluehat and Toorcon - thanks Bunnie, thanks microsoft, thanks toorcon and all the other people involved!)
The real enemy is not Microsoft in general, they are their lawyers. That are the people I wanted to keep on distance. It worked out. The reason to stay anonymous so long was not that being mysterious is so cool or whatever - it was just about not getting sued. But after Bluehat, it become clear that this was no issue anymore.
And my strict demand for working on a project like free60 is that i can publish stuff in public, under my real name, without hiding anything, and still be able to sleep well at night. This would not have been possible if we hadn’t worked together with Microsoft.
And I would be the very last person not wanting free60 to become successful. The world is just not that black and white.
# bunnie Says:
May 13th, 2007 at 5:37 am
Actually, we are very strongly for homebrew and Linux. We had a very long talk with the security architects at Microsoft about splitting up security into separate modules for anti-piracy, anti-cheating, DRM, code signing, etc. for the next generation so that homebrew can run, without enabling piracy. Hopefully they have listened.
The problem with the exploit is that it can be directly abused for piracy, as their architecture used a single core security module which, when compromised, caused everything to be compromised. The potential liability of such an exploit is immense. The likely crack-down on the homebrew effort due to legal backlash would not have been productive in the long term and there were strong indications of such a possibility — after all, it is the exploit developers who are putting their necks on the line.
It is also clear in 20/20 hindsight that if we had not taken the path we did, Microsoft would have quickly reverse engineered our exploit installer and developed a patch, and we would have lost the opportunity to discuss the situation with them while creating potential legal havoc for ourselves due to the ambiguity of our intentions from their standpoint. At least this way we had a chance to share our views. And, to reiterate the obvious, the homebrew-fans would be in exactly the same place as they are now (e.g. having to stop at a certain patch level/potentially buy new hardware) because the “strength” of the exploit wasn’t great enough to stand on its own for more than a few days. Under all circumstances you would eventually have to buy one box to play Xbox Live, and another box to do homebrew, full stop. That’s how good the 360’s security architecture is.
Furthermore, it is standard practice in the security profession to contact the vendor to attempt to resolve the issue prior to disclosure. There is no monetary reward for this behavior; it is simple professionalism and an act of good faith. I would like to point out that this is identical to the path we started last time — when I hacked the original Xbox security the first thing we did prior to public disclosure was to notify Microsoft of the vulnerability — but last time Microsoft wasn’t responsive, and furthermore, even if they wanted to do something, they couldn’t because of how they had burned a single key and codebase into every box out there. This time, they have an improved system with sufficient agility to respond to such a threat, and they also listened to us and invited us to their house so they can learn and improve, and hopefully improve relationships with potential developers like the homebrew community. We gladly obliged because as security professionals our ultimate goal is to improve the state of the art and social policy in security, and open negotiation is more productive than a protracted guerilla warfare.
Simply put, we are locksmiths, and we love locks. We see locks as protecting possessions, homes, and families. We understand how to pick locks, and we also understand how to make better locks. Locks can be abused by preventing access to public places, but we believe it is best to go to the biggest lock maker and help them improve their locks (for the love of the art) and also help them set policies on deploying locks (for the love of the people). Microsoft will continue to improve their locks with or without us, but I doubt they would ever even consider making a policy change without us.
And, I think we left a clear message at Microsoft that until they do provide a signing key to enable homebrew, inevitably every new generation will be attacked until an exploit is found that enables homebrew (and other aspects), possibly by a new adversary that is not as white-hat as us. Creating a multi-faceted security strategy that enables homebrew effectively diffuses the threat model and thereby enhances security. Open hardware platforms are inevitable; hardware is inherently open.
Finally, those who are interested in homebrew may have read the security focus bugtraq release back in February and understood that enabling homebrew on your box is as simple as not accepting the latest patch updates. The modest interest the post generated was probably a reasonable indicator that the vast majority of the potentially affected parties didn’t actually care for homebrew, as game copying was already possible for many months now. I apologize to the homebrewers who did miss on the opportunity, but you can probably also still obtain unpatched boxes in the standing inventory of stores today.
Because of this, Linux development is still very active in the homebrew community, no new piracy or cheating was enabled, and thankfully we can continue our work with little fear of legal action. I think many would agree that this is in fact probably the best compromise solution available. You can’t make everybody happy, but I think all parties acting true to their stated intentions should be happy.
This post has been edited by sunn02: May 13 2007, 03:53 PM
Author
Topic: Bunnie, Mist and Tmbinc meet Designer of the Xbox360 Security (Read 620 times)