tmbinc wrote a great post describing the history of hacking the Wii and why certain holes were not publicized. This comes on the heels of Datel releasing a loader that can be used to play copied games by exploiting an RSA signature verification bug. I last heard of Datel when they made the Action Replay debug cartridge for the C64, and it looks like they’ve stayed around, building the same kind of thing for newer platforms.
First, the hole itself is amazingly bad for a widely-deployed commercial product. I wrote a long series of articles with Thomas Ptacek a year ago on how RSA signature verification requires careful padding checks. You might want to re-read that to understand the background. However, the Wii bug is much worse. The list of flaws includes:
- Using strncmp() instead of memcmp() to compare the SHA hash
- The padding is not checked at all
The first bug is fatal by itself. As soon as a terminating nul byte is reached, strncmp() returns. As long as the hash matched up to that point, the result would be success. If the first byte was nul, no comparison would be done and the check would pass.
It’s easy to create a chunk of data that hashes to a leading 0x00 byte. Here’s some sample code:
a = "rdist security blog"
import binascii, hashlib
for i in range(256):
h = hashlib.sha1(chr(i)+a).digest()
if ord(h[0]) == 0:
print 'Found match with pad byte', i
print 'SHA1:', "".join([binascii.b2a_hex(x) for x in h])
break
else:
print 'No pre-image found, try increasing the range.'
I got the following for my choice of string:
Found match with pad byte 80 SHA1: 00d50719c58e45c485e7d497e4021b48d814df33
The second bug is more subtle to exploit, but would still be open if only the strncmp() was fixed. It is well-known that if only 1/3 of the modulus length is validated, forgeries can be generated. If only 2/3 of the modulus length is validated, existential forgeries can be found. It would take another series of articles to explain all this, so see the citations of the original article for more detail.
tmbinc questions Datel’s motive in releasing an exploit for this bug. He and his team kept it secret in order to keep it usable to explore the system to find deeper flaws. Since it was easily patchable in software, it would be quickly closed. It turns out Nintendo fixed it two weeks after the Datel product became available.
I am still amazed how bad this hole was. Since such an important component failed open, it’s clear higher assurance development techniques are needed for software protection and crypto. I continue to do research in this area and hope to be able to publish more about it this year.
rdist 