PlayStation 3 Hacker Must Allow Sony to Inspect His Hard Drive(wired.com)
wired.com
PlayStation 3 Hacker Must Allow Sony to Inspect His Hard Drive
http://www.wired.com/threatlevel/2011/02/playstation3-hacker-files/
57 comments
Even Kevin Butler, VP at PlayStation, retweeted the PS3 dongle key: http://twitpic.com/3xwe6h
Edit: OK, he's not really a VP. He's a character played by Jerry Lambert. The advertising company Deutsch/LA controls his Twitter feed. And check out the titles he gives himself in their ads: http://www.youtube.com/watch?v=WgwNyb80L0s&playnext=1...
Edit: OK, he's not really a VP. He's a character played by Jerry Lambert. The advertising company Deutsch/LA controls his Twitter feed. And check out the titles he gives himself in their ads: http://www.youtube.com/watch?v=WgwNyb80L0s&playnext=1...
I'm getting 28,900 results for the erk string:
http://www.google.com/search?q=C0+CE+FE+84+C2+27+F7+5B+D0+7A...
Maybe they should just ask Google for a list of everyone that hasn't seen that string...
Not sure what your point is. Anyone who could possibly find the key useful certainly has it by now.
Sony isn't trying to put the genie back in the bottle, they're trying to punish the kid who uncorked it.
Sony isn't trying to put the genie back in the bottle, they're trying to punish the kid who uncorked it.
This is discovery for a trial, right? What's newsworthy about this? You don't have a right to be free from search and seizure period, only to be free from unreasonable search and seizure, which is to say: (1) demands to compromise your privacy and security have to be mitigate by due process, and (2) Congress can't in the long run be allowed to enact laws that unduly compromise that due process.
It isn't the DMCA per se that's allowing Sony to search the guy's drive, is it? It's civil law procedure. Companies routinely have to fork over years and years worth of mail spools for similar reasons.
It isn't the DMCA per se that's allowing Sony to search the guy's drive, is it? It's civil law procedure. Companies routinely have to fork over years and years worth of mail spools for similar reasons.
http://www.wired.com/images_blogs/threatlevel/2011/02/google...
> Sony is also asking Judge Illston to order Google to surrender the IP addresses [.pdf] and other identifying information of those who have viewed or commented about the jailbreak video on Hotz’ private YouTube page. The game maker is also demanding that Twitter provide the identities of a host of hackers who first unveiled a limited version of the hack in December.
Do you think the above is "reasonable" per definition? In essence, anyone who stumbled across some page where the youtube video was embedded is now suspect. Anyone who made comments on twitter is now suspect. And if you slide down the slippery slope, all of us are now suspect for discussing it here on HN.
The above is excessive, and hence, unreasonable. The lawyers of the plaintiff intentionally asked for the moon, gift wrapped, and the judge agreed. The lawyers from Sony did their job correctly, as they are expected to ask for everything they possibly can to help their case. The judge, Susan Illston, failed to do her job. She was supposed to take the expected unreasonable requests from the lawyers, weigh their merit, and rule on a limited compromise to both enable discovery and protect the privacy of the people. The discovery process is not an excuse for excessive privacy invasion.
That's just the above issue of other parties.
As for the issue of searching the hard disk of George Hotz... --it's an interesting debacle. Discovery is very important but it comes down to where and how one draws the lines. Opinions of reasonable and unreasonable will vary.
> Sony is also asking Judge Illston to order Google to surrender the IP addresses [.pdf] and other identifying information of those who have viewed or commented about the jailbreak video on Hotz’ private YouTube page. The game maker is also demanding that Twitter provide the identities of a host of hackers who first unveiled a limited version of the hack in December.
Do you think the above is "reasonable" per definition? In essence, anyone who stumbled across some page where the youtube video was embedded is now suspect. Anyone who made comments on twitter is now suspect. And if you slide down the slippery slope, all of us are now suspect for discussing it here on HN.
The above is excessive, and hence, unreasonable. The lawyers of the plaintiff intentionally asked for the moon, gift wrapped, and the judge agreed. The lawyers from Sony did their job correctly, as they are expected to ask for everything they possibly can to help their case. The judge, Susan Illston, failed to do her job. She was supposed to take the expected unreasonable requests from the lawyers, weigh their merit, and rule on a limited compromise to both enable discovery and protect the privacy of the people. The discovery process is not an excuse for excessive privacy invasion.
That's just the above issue of other parties.
As for the issue of searching the hard disk of George Hotz... --it's an interesting debacle. Discovery is very important but it comes down to where and how one draws the lines. Opinions of reasonable and unreasonable will vary.
The very next sentence after what you quoted is "A hearing on that is scheduled next month." That's in the future. Shouldn't you wait until after the hearing to say the judge "failed"?
Great point Ted! I totally missed that.
This was exactly what I dove into the comments to say. You're 100% correct; this is routine discovery.
Look, do I like the merits of Sony's arguments? Absolutely not. Do I hope this kid wins? Yes. But there's nothing that nuts going on so far; save your anger for the verdict.
As an aside, who ever is advising Sony is an idiot. The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.
Look, do I like the merits of Sony's arguments? Absolutely not. Do I hope this kid wins? Yes. But there's nothing that nuts going on so far; save your anger for the verdict.
As an aside, who ever is advising Sony is an idiot. The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.
As an aside, who ever is advising Sony is an idiot. The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.
Not sure I agree. Who is not buying a PS3 because of this? Who has stopped buying games? Nearly nobody, and the lawyers are on salary anyway.
The risk that Sony takes by allowing "hacking" to happen is that nobody will write software for their platform, and then the platform dies. Content-creating megacorps want uber-strict DRM, or they take their ball and go home (or to Microsoft). It's stupid of them, but Sony doesn't want to go to a meeting with a content house and say, "anyone can pirate your stuff if they want to".
Hence all the DRM schemes that don't work. They are not to prevent you from copying things, they are so Sony (or Amazon, or Hulu, or...) can tell the content creators "oh yeah, your shit will be secure". It's not, but they made the bean counters happy.
So really, this seems like the right action for a psychopathic corporation to take. Maximize BS and maximize profits.
It's a shame someone with a clue is caught in the middle.
Not sure I agree. Who is not buying a PS3 because of this? Who has stopped buying games? Nearly nobody, and the lawyers are on salary anyway.
The risk that Sony takes by allowing "hacking" to happen is that nobody will write software for their platform, and then the platform dies. Content-creating megacorps want uber-strict DRM, or they take their ball and go home (or to Microsoft). It's stupid of them, but Sony doesn't want to go to a meeting with a content house and say, "anyone can pirate your stuff if they want to".
Hence all the DRM schemes that don't work. They are not to prevent you from copying things, they are so Sony (or Amazon, or Hulu, or...) can tell the content creators "oh yeah, your shit will be secure". It's not, but they made the bean counters happy.
So really, this seems like the right action for a psychopathic corporation to take. Maximize BS and maximize profits.
It's a shame someone with a clue is caught in the middle.
> Not sure I agree. Who is not buying a PS3 because of this? Who has stopped buying games?
I've boycotted Sony since the rootkit. I guess I might be "nearly nobody" but I have put Sony products back on the shelf several times in the past few years.
I've boycotted Sony since the rootkit. I guess I might be "nearly nobody" but I have put Sony products back on the shelf several times in the past few years.
With almost 50 million units sold, I can assure you that the consumers that a fraction of a fraction of those consumers know what a "rootkit" is. The costs of the lawsuit are likely much greater than the opportunity cost in lost sales due to bad publicity, so they are well aware of the costs involved. I don't agree with their stance regarding this issue, but you can't blame them for wanting to protect their platform.
Not sure I agree. Who is not buying a PS3 because of this? Who has stopped buying games? Nearly nobody, and the lawyers are on salary anyway.
I take your point, I have yet to see an organized boycott. Nor would this by itself cause me to have any hesitation about Sony.
Yet, this taken together with some of their many other actions in attempting to control the PS, primarily removing the other OS option, has affected my opinion of Sony and what they are likely to do in the future. I'm not about to take a sledgehammer the PS3 I have now. Yet, when the next generation of consoles comes out, it will weight as one factor about which one I go with.
I take your point, I have yet to see an organized boycott. Nor would this by itself cause me to have any hesitation about Sony.
Yet, this taken together with some of their many other actions in attempting to control the PS, primarily removing the other OS option, has affected my opinion of Sony and what they are likely to do in the future. I'm not about to take a sledgehammer the PS3 I have now. Yet, when the next generation of consoles comes out, it will weight as one factor about which one I go with.
> Who is not buying a PS3 because of this?
Yeah, everyone who's disgusted by Sony enough to care will have stopped buying their products a long time ago, probably starting with the rootkit debacle.
Yeah, everyone who's disgusted by Sony enough to care will have stopped buying their products a long time ago, probably starting with the rootkit debacle.
The bad publicity this is getting Sony has already far outweighed the value of any verdict they get (in both monetary and deterrent value), and anyone could have seen that before they even filed the lawsuit.
Sony shipped rootkits on audio CDs, and people still line up to give them money. I don't think a DMCA trial, or 100,000 of them, is going to matter to Sony's loyal customers.
Sony shipped rootkits on audio CDs, and people still line up to give them money. I don't think a DMCA trial, or 100,000 of them, is going to matter to Sony's loyal customers.
hmmm, your definition of due process seems to be different than "good things happen to people we like, bad things happen to people we don't like." Are you sure that's how things are supposed to work?
I absolutely do not understand what you are trying to say with this comment. Can you make your point more directly? My point is: hard drives and mail spools get handed over to the opposition in civil cases all the time. It's called "discovery".
And his point seemed to be a simple joke on how most people expect the justice system to work. No big deal.
yes.
I believe he was being sarcastic.
We may be needing Sheldon's sarcasm sign after all...
In discovery, if the hard drive is encrypted and you forgot the passphrase, what happens?
If you genuinely forgot it, after having long encrypted it in good faith with the intent of simply accessing it more securely? Nothing.
Otherwise: somewhat uncertain.
You probably can't be compelled to testify against yourself, but you definitely can't deliberately use encryption as a defense against discovery anymore than you can destroy evidence by degaussing your hard drive.
Otherwise: somewhat uncertain.
You probably can't be compelled to testify against yourself, but you definitely can't deliberately use encryption as a defense against discovery anymore than you can destroy evidence by degaussing your hard drive.
> you definitely can't deliberately use encryption as a defense against discovery anymore than you can destroy evidence by degaussing your hard drive.
The main problem with "forgetting" the passphrase is that they're unlikely to believe you and the judge may rule that the jury is allowed to hold it against you. You're absolutely right about that.
That said, there's a more subtle problem with DRMed media: it's entirely possible to have large, random files on your computer that are, in fact, movies and such that you no longer have the rights to play. If you can't prove that the expired movies are just that, rather than encrypted files of your own, you might get in trouble.
Hopefully, they'd notice that you had an account with whatever service and the movies in question were expired and they were in such-and-such a directory with the appropriate filenames and whatnot, but you never know. I mean, Sony hid a rootkit on a music CD. You never know what crazy things they'll try to put on your computer.
The main problem with "forgetting" the passphrase is that they're unlikely to believe you and the judge may rule that the jury is allowed to hold it against you. You're absolutely right about that.
That said, there's a more subtle problem with DRMed media: it's entirely possible to have large, random files on your computer that are, in fact, movies and such that you no longer have the rights to play. If you can't prove that the expired movies are just that, rather than encrypted files of your own, you might get in trouble.
Hopefully, they'd notice that you had an account with whatever service and the movies in question were expired and they were in such-and-such a directory with the appropriate filenames and whatnot, but you never know. I mean, Sony hid a rootkit on a music CD. You never know what crazy things they'll try to put on your computer.
This is why things like TrueCrypt's plausible deniability feature are good. Just toss some embarrassing (but not illegal) scat porn on the "fake" encrypted partition and give them that password instead.
http://www.truecrypt.org/docs/?s=plausible-deniability
http://www.truecrypt.org/docs/?s=plausible-deniability
Word. I hope he encrypted everything before he published the key so it can't be said that he is obstructing justice by encrypting his disks before he hands them over.
Ah kids, gather here by the fire with me, and let me tell you a story of the olden times when you bought a car and could do whatever the hell you wanted with it. Because when you bought the car, you made it your property. You could modify it in whatever way you want. Sure, there were rules if you wanted to take it our for a ride, because others could get hurt. But if you were doing it just for the fun at home, no-one could stop you. You could even go over to your neighbor's house and help him change his car, too. Those were the times.
Not only that, but you could run a business where all you did was modify cars for other people!
> The judge also backed off on an order that Hotz “retrieve” the code from anybody who he may have forwarded it to.
Good to see the judge is knowledgeable in this area! I'm sure this will end well.
Good to see the judge is knowledgeable in this area! I'm sure this will end well.
If, by "end well", you mean "the judge readily conceded that there was no practical way for this to happen and apologized for the ill-thought-out demand", then know (by reading just a few sentences further) that this already happened.
It's a little disturbing the order was ever made, though, because the fact that information can't be retrieved isn't some unique computer complication, it's just generally true. There aren't any media in which you can uncommunicate. (A couple of computer media try to hack it in but they can't recover copies either.) If I were being tried by a judge who did that, I would realize that I've basically already lost, pretty much no matter what happens next.
(Which in this case is probably a null issue. This is an open-and-shut DMCA violation. I disagree with the DMCA but that doesn't change the fact that it's an open-and-shut DMCA violation.)
(Which in this case is probably a null issue. This is an open-and-shut DMCA violation. I disagree with the DMCA but that doesn't change the fact that it's an open-and-shut DMCA violation.)
I'm not even a little bit disturbed the order was made. I'm thrilled that the judge backed off and apologized for making the request. Tells me that she's actually listening to the defendant; will be helpful down the road.
There's not much detail about the order, but it seems reasonable to me. Don't interpret code strictly as the bits, but possibly as media. I think that's a reasonable interpretation, unless you're the kind of person who makes corrections like "it's not a movie, it's a DVD containing a movie".
"Defendant gave the code to person X. He should get it back." Here, "the code" could reasonably be a USB stick, a printout, or whatnot. If the request didn't make clear it was distributed over the internet, why would the order?
"Defendant gave the code to person X. He should get it back." Here, "the code" could reasonably be a USB stick, a printout, or whatnot. If the request didn't make clear it was distributed over the internet, why would the order?
The order being made at all is what I'm most concerned about. This is an important case about technology with a judge that demonstrably does not understand technology. Perfect recipe for a lose-lose situation.
First, we're probably hyperventilating about the extent to which this request was nonsensical. It could have been an oversight on the judge's part, or there could have been a rationale behind the request that simply didn't turn out to be reasonable in hindsight. We may never know, because the judge (properly) conceded the point quickly.
Second, it is not the job of a judge to "understand technology". We may not even want judges that are specifically steeped in technical knowledge. What we need them to be is fair arbiters of the law and of the ways the law allows facts to be introduced into evidence.
Second, it is not the job of a judge to "understand technology". We may not even want judges that are specifically steeped in technical knowledge. What we need them to be is fair arbiters of the law and of the ways the law allows facts to be introduced into evidence.
Surely in a case which revolves around technology like this it's reasonable to expect the judge to have some technical knowledge? The job of a judge is to interpret the law as it applies to a particular case; if they have no knowledge of the context in which the case has arisen they could very well come up with a bad/nonsense interpretation.
Uh, "readily conceded?" The judge took several weeks to finally realize that she made an "ill-thought-thought out demand" to "retrieve the codes".
Several weeks is milliseconds in legal hearing time. Have you ever taken something simple to actual civil court before? It doesn't look like this got dragged out; the defense objected to the request, the judge reconsidered, and then apologized. What more can you reasonably ask for?
I could reasonably ask for the judge to have the common sense not to make such an outlandish request in the first place.
The accused has to led the accuser inspect his data? Scary!
I sure hope they use forensic standards such as not the actual hard drive but an image of it. Otherwise the chances to plant some evidence are truly disturbing.
I sure hope they use forensic standards such as not the actual hard drive but an image of it. Otherwise the chances to plant some evidence are truly disturbing.
Sony won't be involved directly with any part of the forensics.
Their attorneys will contract with a forensics firm who will make an image of the drives (using a write-blocked device like the ones made by Wiebetech or an Encase Fastbloc).
Analysis will not be performed on the actual drive, but on the image.
The defendant's attorney will also receive a copy of this image, ensuring that chain of custody was followed (or else they can sure to try and argue that the evidence has been tampered with).
The images will be checksummed, and I would argue that the odds of evidence being tampered are pretty slim in this instance.
Their attorneys will contract with a forensics firm who will make an image of the drives (using a write-blocked device like the ones made by Wiebetech or an Encase Fastbloc).
Analysis will not be performed on the actual drive, but on the image.
The defendant's attorney will also receive a copy of this image, ensuring that chain of custody was followed (or else they can sure to try and argue that the evidence has been tampered with).
The images will be checksummed, and I would argue that the odds of evidence being tampered are pretty slim in this instance.
> I would argue that the odds of evidence being tampered are pretty slim in this instance.
Very slim. Not least because if the defendant's legal team get wind of it that's it for any evidence from the drive, period.
Too much risk.
Very slim. Not least because if the defendant's legal team get wind of it that's it for any evidence from the drive, period.
Too much risk.
Every geek in the world thinks and says this whenever any legal proceeding involves inspecting hard drives. In the real world, it's just not that big a deal. There are chain-of-custody rules that apply any time digital evidence is handled in court. The reality is that the penalty for deliberately planting evidence would be so severe, the likelihood of success so uncertain, that no major corporation (or their zillion-dollar law firm) would risk it over a small-ball case like this.
(Like 'm0nastic points out, Sony can also pay a pittance relative to their legal fees to contract this out to Mandiant).
(Like 'm0nastic points out, Sony can also pay a pittance relative to their legal fees to contract this out to Mandiant).
I wonder if, for situations like this, you could have a neutral third party image your drive, keep one for themselves and push the image over to Sony.
You won't likely find such a party in cases like this.
What is more likely is that each side will hire a forensics firm to image the drive, and as long as both their checksums match, than there isn't much disagreement.
What is more likely is that each side will hire a forensics firm to image the drive, and as long as both their checksums match, than there isn't much disagreement.
I remember one P2P case that was swiftly dropped because of smart lawyering by the defendant's lawyers.
To deal with the "expedited discovery" bit, the lawyer himself took custody of their hard drives. As an officer of the court, he could take responsibility for preventing evidence from being destroyed. He then offered to make it available to third-party forensics experts for imaging, and they would be able to get a ruling from a judge concerning exactly which things those experts would be ordered to search for (rather than letting the plaintiff's lawyers trawl through everything at their leisure).
I'm not quite clear on how much of that is happening here. One might hope this would be the ordinary procedure, but I have to worry about any judge who signs an order telling someone to retrieve information from the internet, period. I realize it was swiftly reconsidered and amended.
For that, I give them due credit, even though I worry about any state of affairs wherein an absurd order could be issued in the first place.
To deal with the "expedited discovery" bit, the lawyer himself took custody of their hard drives. As an officer of the court, he could take responsibility for preventing evidence from being destroyed. He then offered to make it available to third-party forensics experts for imaging, and they would be able to get a ruling from a judge concerning exactly which things those experts would be ordered to search for (rather than letting the plaintiff's lawyers trawl through everything at their leisure).
I'm not quite clear on how much of that is happening here. One might hope this would be the ordinary procedure, but I have to worry about any judge who signs an order telling someone to retrieve information from the internet, period. I realize it was swiftly reconsidered and amended.
For that, I give them due credit, even though I worry about any state of affairs wherein an absurd order could be issued in the first place.
What a f* initiative from The Master of Rootkits Company.
Never ever again I'm going to purchase a Sony product.
Never ever again I'm going to purchase a Sony product.
Not much of a compromise. Who wants a computer that can't run Linux, an MP3 player that only plays ATRAC, and a digital camera that can't take SD cards?
Sony is an evil company, and their products don't make up for it.
Sony is an evil company, and their products don't make up for it.
Never attribute to malice that which can be adequately explained by stupidity.
52 comments. tptacek has made 48 of them.
Sounds like a use case for a TrueCrypt hidden volume.
And if he encrypts the data behind true crypt and refuses to give the key, what then? Will he be thrown in jail?
Top comments on both this wired article and other linked ones has the code[2].
This judge is sorely out of touch with what's going on.
Also, "Sony is also asking Judge Illston to order Google to surrender the IP addresses [.pdf] and other identifying information of those who have viewed or commented about the jailbreak video on Hotz’ private YouTube page. The game maker is also demanding that Twitter provide the identities of a host of hackers who first unveiled a limited version of the hack in December." ...take from that what you will.
Searching[3] for the strings in question[4] yields 11k+ results.
[1]: http://en.wikipedia.org/wiki/Streisand_effect
[2]: http://www.wired.com/threatlevel/2011/02/playstation3-hacker...
[3]: http://www.google.com/search?&q=erk:+C0+CE+FE+84+C2+27+F...
[4]:
erk: C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B
riv: 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D
pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19
R: 80 6E 07 8F A1 52 97 90 CE 1A AE 02 BA DD 6F AA A6 AF 74 17
n: E1 3A 7E BC 3A CC EB 1C B5 6C C8 60 FC AB DB 6A 04 8C 55 E1
K: BA 90 55 91 68 61 B9 77 ED CB ED 92 00 50 92 F6 6C 7A 3D 8D
Da: C5 B2 BF A1 A4 13 DD 16 F2 6D 31 C0 F2 ED 47 20 DC FB 06 70