Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That is true, but SciresM has exhaustively reverse engineered the latest Switch kernels from end to end and stated confidently that there's nothing there to exploit. It's a tiny microkernel so auditing the entire thing is actually feasible, nothing like the enormous potential attack surface of the Playstations FreeBSD kernel.

https://twitter.com/SciresM/status/1486787208333774848

"I don't expect another software hack to release ever for the switch." - the person with probably the deepest knowlege of the Switch OS outside of Nintendo



There is one other glitch recently discovered that affects all Switches; the Tegra X1 has no protections against voltage glitching attacks. Therefore, a mod chip (or RP2040) can cause a power drop at the right moment and bypass the signature check, and reboot and try again a few times if it didn’t work.

Most likely a Tegra X1 successor would (like modern security chips) have circuitry to detect such glitching and force an automatic reboot if it occurs.


Yeah, Microsoft got blindsided by voltage glitching on the 360 and they went on to implement a watchdog system in the XB1 which forces a reboot if it detects voltages, clocks or temperatures going out of sensible ranges. They also audited their first stage bootloader to ensure that even if you manage to sneak one glitch past the watchdog, the code is structured such that any single branch going the wrong way won't lead to a compromised state. The combination of those has successfully prevented any such attacks from happening again.

Voltage glitching is the kind of play you only get to make once unfortunately.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: