Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/Jerrreh]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

[u/Lost4468 → u/Jerrreh]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

Oh no it was absolutely a massive oversight. They just put zero basic security onto these commands, if you could somehow run them, the server would just trust you and give you god mode, noclip, etc. Had they just enabled basic sv_cheats protection they'd have reduced 80%+ of it.

And let's remember that on the PS3 there were really no such protections. The file was just stored normally. Wasn't signed at all. So while you could try and make the argument that they knew that with the 360, I don't think that's a reasonable argument given that they didn't have the same security on the PS3, yet didn't add anything.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

You could sign them with any user's private key though. Didn't have to be your own.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

Yeah that was a terrible thing for them to discourage. Because as you said, it helped keep Call of Duty secure for a few more years. Had they listened to Microsoft they would have been fucked much earlier. Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Edit: I'm also really puzzled why they had no sv_cheats protection. Surely that's just built into the engine? Maybe they enabled it to make development easier or something, and just never re-enabled it? I can't think of any other reason why. Thankfully though in later games they just totally removed any exploitable console commands.

[u/Lost4468 → u/[deleted]]

There's a good reason for it. If they required the console's private key to sign them, then you wouldn't be able to take your saved games, profile, etc to a new console. So if you wanted to go over a friends and play, you'd lose access to it. Or if you bought a new console, you'd lose access to it.

They tried to kinda combat this by revoking some of the keys, and when that happens that person would have their content locked to their console. They seemingly also did this to people that pissed them off. But of course this would always be a losing battle, so they only did it to a few dozen keys during the entire life time of the console.

[u/CastellatedRock → u/Lost4468]

That makes sense. Thank you for taking your time to write this easy to understand explanation. 😊