Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft

The Xbox does not use AMD's Platform Security Processor, they have their own custom security chip with Microsoft hardware and their own custom BootROM. This custom security processor actually has its own bit of RAM entirely in the die and doesn't even go out to the DRAM at all. See the slide on Tony Chen's presentation about Xbox One security ▶ this video and this video from the person who hacked the Xbox One link

Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft: ▶ this video I like this video too, Tony Chen explains the overview of Xbox security system.

Tony Chen from Microsoft gave a talk called "Guarding Against Physical Attacks: The Xbox One Story" and he explains that they want any sort of physical attack to cost at least the price of 10 games ($600 at the time). ▶ this video

This fearmongering about Microsoft has existed since the very day the first TPM shipped, and it has never come closer to being real. Most of the security improvements shipping in Windows are leftovers from Xbox, but they very clearly state that Windows Security does not treat the user themselves as a threat. See the slide around 4 minutes into this talk: ▶ this video

I think you might be mixing up the Xbox 360 with the Xbox One, the former was ultimately compromised in several ways, but the latter's security has held up extremely well for 11 years and counting. The Xbox One and its successor are easily the most secure consoles ever made. Obligatory: ▶ this video

Modchips on newer Switches use fault injections (clock/voltage glitching) but there exist mitigations for those. The Xbox One is confirmed to use them. I encourage you to watch this video where Microsoft describes the security design of the Xbox One, which so far has been almost bulletproof. ▶ this video

no, that is the whole point of the Secure Encrypted Virtualization hypervisor (and remember, bare-metal is just another guest). Guests should not be able to jump to hypervisor control just because they type sudo, or just because they have physical presence. this all comes from the work AMD did on the xbox hypervisor, and obviously a console needs to be physically present (sitting in the attacker's living room) and survive a complete compromise of a guest partition (again, potentially including the OS/"bare-metal guest"). ▶ this video why would ring0 ever be intended to grant you access to ring -1 or -2? why even have rings -1 or -2 in that situation?

Is it not true? Not everything needs to be secure, just the right parts. The test is whether you can jailbreak the devices and not be detected by their RA scheme. As far as I know, there's no (public) way to do this. BTW, this tech isn't new. In practice if you are vertically integrating, it's possible to make things secure enough. Games consoles have been doing this for years. Even in the Xbox 360 era, the use of local exploits was detectable the moment you connected to Xbox Live, and AFAIK Xbox One remains completely unmoddable/unjailbroken even after a decade into its lifespan. There's a tech talk here by a member of the Xbox team who talk about how they secured it against physical attack: ▶ this video But bear in mind, RA was never the weak point even of the 360. Making remote attestation secure is a well studied problem in the industry. It's been done several times. You have to be a competent tech firm producing your own hardware/software combos, and you need a competent security team, but there are several companies that meet that criteria and Apple is definitely one of them.

This is the same attack (and same people who developed) faulTPM[1] that was previously discussed[2]. This article is the same people demonstrating that attack against Tesla vehicles. The paper[1] and previous discussion[2] address the underlying problems with AMD's Secure Processor (AMD-SP) that is embedded in their CPU SoCs and previously and more commonly known as Platform Security Processor (AMD-PSP). Unlike a web browser where W3C AntiFraudCG folk propose that websites would blacklist all impacted AMD-SP hardware and create massive amounts of e-waste[3], Tesla likely can't do much about this attack because Tesla (not users) would be responsible for a very expensive change of vehicle hardware. If it's not an easy-to-execute attack like faulTPM, there are more complex (but becoming more mainstream and cheaper) IC reverse engineering methods like polishing the die down to take photos of each metal layer and regenerating VHDL, FIB editing an operational IC to bypass tamper detection methods, etc[4]. A security architect of the Xbox One presented a talk[5] a few years ago which provides some good background too. Largely the Xbox One has managed to avoid piracy because they made it economically not worth anyone's time to attack due to competitive pricing models versus high cost of attack. Similar to use of Denuvo for a month or two after release of a PC game, attackers aren't going to bother if their work amounts to nothing a month later. Hacking a Tesla to enable additional fe

This talk[1] was interesting watch wrt that. They made DRAM encrypted and Secure Boot seems to be done right too… 1: ▶ this video

> would like to know how the answer is no TL;DR: cryptography and secure hardware (think TPM) This is a very interesting talk from Microsoft about how they made Xbox immune to physical attacks (modding) like you proposed. Now they are working on getting this tech into regular computers. ▶ this video Of course, we don't know if the solution Mercedes used is as robust. For all we know it can be hacked in 1 minute.

Obligatory link to the talk from MS where they covered the origins of Pluton on the Xbox: ▶ this video The video does a good job of the original threat model for this technology and how it works on Xbox.

There's a really good presentation, by a Microsoft Platform Security Engineer, detailing the lengths they went through to ensure only properly signed executables run on the Xbox One and really answers your question. One of the tools they developed, HVCI, was later incorporated into Windows Hyper-V. ▶ this video

A cheaply made smartcard chip should be much easier to breach than the main SoC. Both because it's way simpler, older process silicon… and much more importantly because you have an external bus going to it. Now that the big consoles use semi-custom SoCs, their NUMBER ONE principle is to not trust anything that's off the main silicon die. See the Xbox security talk: ▶ this video

This effectively already exists. The Xbox One SOC apparently monitors its own voltage and shuts down / doesn't function if it falls out of spec [1] as part of a totally OTT suite of anti-engineer techniques. As an aside, I hate all of this. If someone made an open console, I'd buy it in a second. I realise that's probably my computer running linux next to me, but still... [1] ▶ this video

The point of crypto locked controllers made by and for the manufacturer's console is that tampering will cause the device to refuse to run. Which leaves you at a robot to physically manipulate the device as I said. Since it doesn't have to be an standard like HDCP, this can be locked down pretty well like the xbox one is. [0] At that point the barrier to entry would be so annoying that online cheating will be reduced significantly, and pro tournaments will be done in person to let you prevent usage of robots. Also everyone will be using the same equipment probably provided by tournament organizers. [0] ▶ this video

DRM has only been successful in the space of making easily replicable attacks more expensive than what is being protected by the DRM. Microsoft has talked about this publicly in this great talk on the Xbox One's physical device security. 'We can't stop people hacking, but we can make each hack more expensive than what someone would spend on games on average'. ▶ this video SGX running on centralized servers turns that calculus on it's head by concentrating the benefits of the hack all in one place.

People said the Xbox one was just a Windows PC with a proprietary UI as well, but you really have to understand what went into making it before you determine if that’s true: ▶ this video But yes, if you could break the security and implement the (many) private APIs, you wouldn’t necessarily need to emulate (although it might be legally and technologically easier to emulate a ps5 than re-implement everything).

Here is an excellent talk about the Xbox One security (and Series X|S should be quite similar) by the person who is in charge of security on the Xbox platform. ▶ this video Basically it boils down to trust NOTHING outside the actual SoC chip (so stuff like RAM, Flash/HDD, optical dics, etc cannot be trusted). The SoC is made on 28nm (Series X|S 7nm) process so physically attacking it is very hard/expensive. Also goes into the difference between Windows (PC) and Xbox (Console) security. On PC the owner/admin wants the help keep the system secure as it gets attacked by malicious parties from the internet. On console the owner is usually the bad guy (the one doing the attacking) and thus needs a very different approach. Also stuff like Microsoft Pluton are direct descendants of the stuff done for Xbox and Live.

youtube-dl -f bestvideo[ext=mp4]+bestaudio[ext=m4a] -o "XBox One Story by Tony Chen.mp4" ▶ this video start "" "XBox One Story by Tony Chen.mp4"