Hacking the Xbox

Chapter 7 - A Brief Primer on Security 117
In addition, protocol attacks find weaknesses in the way keys and data are
manipulated, or in the way strong ciphers are used. The WEP attack on
RC-4 and Mike Bond and Ross Anderson’s attack on the IBM 4758
Cryptoprocessor are both examples of protocol attacks. The red flags
for potential protocol attacks are systems that implement backwardcompatibility
measures, and systems that are implemented by engineers
whose primary job is not crypto-security.
Finally, in a system like the Xbox where one of the goals is to establish a
trustable client, back doors and buffer-overrun attacks are also viable attacks
on the trust state of a machine. No widely used commercial processors
embed execution privileges within instruction streams or data tags. Processors
blindly execute any piece of code that it is instructed to jump to,
whether or not the jump was induced through a transient hardware failure
or through maliciously placed code. Periodic hashes on the machine state can
be used to counter this deficiency, but even then the state checks can be
spoofed.
As discussed in the beginning of this chapter, establishing the trust state
of a client also requires a piece of tamper-resistant hardware to carry the
seed of trust. The amount of physical security must be enough to make it
uneconomical to defeat the security once, and robust enough such that
one instance of broken security does not enable trivial attacks on the
remainder of the consoles. Some of the trade-offs when designing
physical security as well as the decisions made by Microsoft to this end
are discussed in the next chapter.
The moral of this chapter is that security requires a well-designed system.
Although ciphers have become strong enough to make brute-force attacks
moot, systems have grown in complexity. This complexity increases the
likelihood of a viable protocol or back door attack, yet does little to save
users from the more traditional eavesdropping, rubber-hose and user-error
attacks.