XBox Security?

How possible would it be for a virus or worm to target online gaming consoles such as XBox or Playstation2?

Probably possible because the XBox is basicly a stripped down version of windows 2000.

Well, you may have some trouble getting M$ to digitally sign your virus code. The X-box will not execute unsigned code.(Without a hack of course :))



-Maestr0

Well I'm no X-Box expert :D But you know as well as I do that Online Games have their fair share of problems and are sometimes exploitable. That would open up a foothold for a virus or worm to get in. But without something to store itself it would only run as long as the box stays turned on. CodeRed i.e. does the same, it doesn't drop any files and runs completely from memory but was still able to create havok.

sirdice- While what you are saying is true, the security that is on an xbox is really pretty good. First, no applications will run unless they are digitally signed by MS. That I am aware of, nobody has figured out how to get an illigetimate file signed properly. Now you can alter the BIOS to get around that digital signature, but it requires a hardware modification, or a game-save xploit.

In terms of xbox live, it is my understanding that MS has this service locked down pretty secure. If you are running any type of modified xbox code, your xbox mac will be banned. I really don't see how you could get a virus into that particular network. Xbox connect is totally different, and it is possible that a buffer overflow could be found and exploited.

Quote:

---

But without something to store itself it would only run as long as the box stays turned on.

---

The X-box stores game information on a regular old joe hard disk. If the xbox was xploited that xploit could include access to the permanent storage media.

A virus could concievably exploit a running piece of signed code (aka an X-box live exploit targeted at a specific game) but even if you were able to store the virus code on the HDD it would still not be signed and would be unable to execute the next time the X-box was started because of a lack of digital signature. It would have to run as SirDice suggested, hopping from box to box which is running the exploitable code. Not sure what you could do with it other than maybe erase savedgames on the victims HDD and propagate, still would be a fun POC if you could find a remote exploit in an X-box live enabled app.

-Maestr0

Lets make one... Oh yah.. ;) Sounds like it can happen, next thing you know NAV is on your XBOX lol.

-Cheers-

SirDIce is right. Only M$ signed code will run on the Xbox unless a mod chip installed. If however a mod chip is installed and in use at the time (as it would be for unsigned code to run) Then you would already have been kicked off Xbox live. So people online gaming should be ok (Especially as new mod chips wont let you dial out to Xbox live while they are active). If however you were running a modded xbox on a network thats connected to the internet then there may be a possability for such a hack.

Quote:

---

How possible would it be for a virus or worm to target online gaming consoles such as XBox or Playstation2

---

I been playing my xbox online for a long time now and I never had any promblems with viruses, worms, and trojans nothing malicious like that. But I also have my xbox hooked up to my D-Link Router/Firewall that is configured very well for security purposes of course. Heres a pic of my setup.