Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft on HackerTube: recommended by 8 Hacker News commenters across 8 separate months, 2019–2026.
talk · advanced · evergreen
Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.
HN points to it constantly in console, DRM and hardware-security threads as the authoritative account of Xbox One's threat model.
“This is a very interesting talk from Microsoft about how they made Xbox immune to physical attacks”
20 Hacker News comments link this video. Each one links back to its thread.
Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft: ▶ this video I like this video too, Tony Chen explains the overview of Xbox security system.
in “Breaking the console: a brief history of video game security” · View on HN
Modchips on newer Switches use fault injections (clock/voltage glitching) but there exist mitigations for those. The Xbox One is confirmed to use them. I encourage you to watch this video where Microsoft describes the security design of the Xbox One, which so far has been almost bulletproof. ▶ this video
in “Switch 2 will be backwards compatible with Switch” · View on HN
This talk[1] was interesting watch wrt that. They made DRAM encrypted and Secure Boot seems to be done right too… 1: ▶ this video
in “Linux on the 7th Generation of Consoles Part 1: Xbox 360” · View on HN
> would like to know how the answer is no TL;DR: cryptography and secure hardware (think TPM) This is a very interesting talk from Microsoft about how they made Xbox immune to physical attacks (modding) like you proposed. Now they are working on getting this tech into regular computers. ▶ this video Of course, we don't know if the solution Mercedes used is as robust. For all we know it can be hacked in 1 minute.
in “Mercedes Makes Better Performance a $1,200 Subscription in Its EVs” · View on HN
Obligatory link to the talk from MS where they covered the origins of Pluton on the Xbox: ▶ this video The video does a good job of the original threat model for this technology and how it works on Xbox.
in “The Dangers of Microsoft Pluton” · View on HN
There's a really good presentation, by a Microsoft Platform Security Engineer, detailing the lengths they went through to ensure only properly signed executables run on the Xbox One and really answers your question. One of the tools they developed, HVCI, was later incorporated into Windows Hyper-V. ▶ this video
in “Nintendo Switch prevents downgrades by irreparably blowing its own fuses (2020)” · View on HN
DRM has only been successful in the space of making easily replicable attacks more expensive than what is being protected by the DRM. Microsoft has talked about this publicly in this great talk on the Xbox One's physical device security. 'We can't stop people hacking, but we can make each hack more expensive than what someone would spend on games on average'. ▶ this video SGX running on centralized servers turns that calculus on it's head by concentrating the benefits of the hack all in one place.
in “Signal Server code on GitHub is up to date again” · View on HN
Here is an excellent talk about the Xbox One security (and Series X|S should be quite similar) by the person who is in charge of security on the Xbox platform. ▶ this video Basically it boils down to trust NOTHING outside the actual SoC chip (so stuff like RAM, Flash/HDD, optical dics, etc cannot be trusted). The SoC is made on 28nm (Series X|S 7nm) process so physically attacking it is very hard/expensive. Also goes into the difference between Windows (PC) and Xbox (Console) security. On PC the owner/admin wants the help keep the system secure as it gets attacked by malicious parties from the internet. On console the owner is usually the bad guy (the one doing the attacking) and thus needs a very different approach. Also stuff like Microsoft Pluton are direct descendants of the stuff done for Xbox and Live.
in “How to turn your Xbox Series X/S into an emulation powerhouse” · View on HN
The Xbox does not use AMD's Platform Security Processor, they have their own custom security chip with Microsoft hardware and their own custom BootROM. This custom security processor actually has its own bit of RAM entirely in the die and doesn't even go out to the DRAM at all. See the slide on Tony Chen's presentation about Xbox One security ▶ this video and this video from the person who hacked the Xbox One [link]
in “Spaghettifying DRAM” · View on HN
Tony Chen from Microsoft gave a talk called "Guarding Against Physical Attacks: The Xbox One Story" and he explains that they want any sort of physical attack to cost at least the price of 10 games ($600 at the time). ▶ this video
in “Microsoft's 'unhackable' Xbox One has been hacked by 'Bliss'” · View on HN
This fearmongering about Microsoft has existed since the very day the first TPM shipped, and it has never come closer to being real. Most of the security improvements shipping in Windows are leftovers from Xbox, but they very clearly state that Windows Security does not treat the user themselves as a threat. See the slide around 4 minutes into this talk: ▶ this video
in “New Windows 11 build makes mandatory Microsoft sign-in even more mandatory” · View on HN
I think you might be mixing up the Xbox 360 with the Xbox One, the former was ultimately compromised in several ways, but the latter's security has held up extremely well for 11 years and counting. The Xbox One and its successor are easily the most secure consoles ever made. Obligatory: ▶ this video
in “Hardware Security Exploit Research – Xbox 360” · View on HN
no, that is the whole point of the Secure Encrypted Virtualization hypervisor (and remember, bare-metal is just another guest). Guests should not be able to jump to hypervisor control just because they type sudo, or just because they have physical presence. this all comes from the work AMD did on the xbox hypervisor, and obviously a console needs to be physically present (sitting in the attacker's living room) and survive a complete compromise of a guest partition (again, potentially including the OS/"bare-metal guest"). ▶ this video why would ring0 ever be intended to grant you access to ring -1 or -2? why even have rings -1 or -2 in that situation?
in “Researchers discover potentially catastrophic exploit present in AMD chips” · View on HN
This is the same attack (and same people who developed) faulTPM[1] that was previously discussed[2]. This article is the same people demonstrating that attack against Tesla vehicles. The paper[1] and previous discussion[2] address the underlying problems with AMD's Secure Processor (AMD-SP) that is embedded in their CPU SoCs and previously and more commonly known as Platform Security Processor (AMD-PSP). Unlike a web browser where W3C AntiFraudCG folk propose that websites would blacklist all impacted AMD-SP hardware and create massive amounts of e-waste[3], Tesla likely can't do much about this attack because Tesla (not users) would be responsible for a very expensive change of vehicle hardware. If it's not an easy-to-execute attack like faulTPM, there are more complex (but becoming more mainstream and cheaper) IC reverse engineering methods like polishing the die down to take photos of each metal layer and regenerating VHDL, FIB editing an operational IC to bypass tamper detection methods, etc[4]. A security architect of the Xbox One presented a talk[5] a few years ago which provides some good background too. Largely the Xbox One has managed to avoid piracy because they made it economically not worth anyone's time to attack due to competitive pricing models versus high cost of attack. Similar to use of Denuvo for a month or two after release of a PC game, attackers aren't going to bother if their work amounts to nothing a month later. Hacking a Tesla to enable additional fe
in “Hackers manage to unlock Tesla software-locked features” · View on HN
Is it not true? Not everything needs to be secure, just the right parts. The test is whether you can jailbreak the devices and not be detected by their RA scheme. As far as I know, there's no (public) way to do this. BTW, this tech isn't new. In practice if you are vertically integrating, it's possible to make things secure enough. Games consoles have been doing this for years. Even in the Xbox 360 era, the use of local exploits was detectable the moment you connected to Xbox Live, and AFAIK Xbox One remains completely unmoddable/unjailbroken even after a decade into its lifespan. There's a tech talk here by a member of the Xbox team who talk about how they secured it against physical attack: ▶ this video But bear in mind, RA was never the weak point even of the 360. Making remote attestation secure is a well studied problem in the industry. It's been done several times. You have to be a competent tech firm producing your own hardware/software combos, and you need a competent security team, but there are several companies that meet that criteria and Apple is definitely one of them.
in “Analysis of Obfuscation Techniques Found in Apple FairPlay” · View on HN
This effectively already exists. The Xbox One SOC apparently monitors its own voltage and shuts down / doesn't function if it falls out of spec [1] as part of a totally OTT suite of anti-engineer techniques. As an aside, I hate all of this. If someone made an open console, I'd buy it in a second. I realise that's probably my computer running linux next to me, but still... [1] ▶ this video
in “Full key extraction of Nvidia TSEC” · View on HN
A cheaply made smartcard chip should be much easier to breach than the main SoC. Both because it's way simpler, older process silicon… and much more importantly because you have an external bus going to it. Now that the big consoles use semi-custom SoCs, their NUMBER ONE principle is to not trust anything that's off the main silicon die. See the Xbox security talk: ▶ this video
in “Full key extraction of Nvidia TSEC” · View on HN
The point of crypto locked controllers made by and for the manufacturer's console is that tampering will cause the device to refuse to run. Which leaves you at a robot to physically manipulate the device as I said. Since it doesn't have to be an standard like HDCP, this can be locked down pretty well like the xbox one is. [0] At that point the barrier to entry would be so annoying that online cheating will be reduced significantly, and pro tournaments will be done in person to let you prevent usage of robots. Also everyone will be using the same equipment probably provided by tournament organizers. [0] ▶ this video
in “Epic launches anti-cheat support for Linux, Mac, and Steam Deck” · View on HN
People said the Xbox one was just a Windows PC with a proprietary UI as well, but you really have to understand what went into making it before you determine if that’s true: ▶ this video But yes, if you could break the security and implement the (many) private APIs, you wouldn’t necessarily need to emulate (although it might be legally and technologically easier to emulate a ps5 than re-implement everything).
in “Yuzu (Nintendo Switch Emulator) Progress Report January 2021” · View on HN
youtube-dl -f bestvideo[ext=mp4]+bestaudio[ext=m4a] -o "XBox One Story by Tony Chen.mp4" ▶ this video start "" "XBox One Story by Tony Chen.mp4"
in “Guarding Against Physical Attacks: The Xbox One Story [video]” · View on HN