1
00:00:00,660 --> 00:00:01,950
- Welcome everybody. Yeah.

2
00:00:01,950 --> 00:00:04,200
So, I'm gonna be talking about my journey

3
00:00:04,200 --> 00:00:09,200
the past few years, reverse
engineering Xbox Live.

4
00:00:09,330 --> 00:00:13,473
It was my COVID project,
for lack of a better word.

5
00:00:15,420 --> 00:00:16,253
I'm Tristan.

6
00:00:16,253 --> 00:00:18,690
Also go as Monocasa on the internet,

7
00:00:18,690 --> 00:00:22,590
when I have hot takes of
questionable veracity.

8
00:00:22,590 --> 00:00:24,190
So, that's what I'm using today.

9
00:00:27,210 --> 00:00:30,780
Today, I'm gonna go over background.

10
00:00:30,780 --> 00:00:34,050
We're gonna go deep into
what the protocols are

11
00:00:34,050 --> 00:00:35,433
themselves a bit,

12
00:00:36,570 --> 00:00:40,833
or look at how I took a look
at reverse engineering it.

13
00:00:42,720 --> 00:00:46,263
If somebody wanted to repeat this work,

14
00:00:47,138 --> 00:00:49,920
what you'd have to do to do that.

15
00:00:49,920 --> 00:00:52,800
I'm gonna talk a little bit

16
00:00:52,800 --> 00:00:54,510
about the replacement server architecture

17
00:00:54,510 --> 00:00:56,340
I've built up so far,

18
00:00:56,340 --> 00:01:00,903
where it's going, what
exists at the moment.

19
00:01:03,030 --> 00:01:05,703
And then, I'm gonna go into a brain dump.

20
00:01:10,860 --> 00:01:13,500
As I've gone through this,
I have very strong feelings

21
00:01:13,500 --> 00:01:18,467
about how to support people.

22
00:01:21,420 --> 00:01:22,253
How to put this?

23
00:01:24,150 --> 00:01:28,110
What's the ethical way to
support abandoned software

24
00:01:28,110 --> 00:01:30,033
in a increasingly networked world?

25
00:01:32,070 --> 00:01:34,590
And then, we're gonna go into questions.

26
00:01:34,590 --> 00:01:37,470
Unfortunately, the demo
gods weren't with us today.

27
00:01:37,470 --> 00:01:39,570
My Xbox actually got the click of death

28
00:01:39,570 --> 00:01:41,490
literally last night,

29
00:01:41,490 --> 00:01:44,523
so I'll put up a video tonight,

30
00:01:45,750 --> 00:01:48,813
but source is up too, so you
can go take a look at that.

31
00:01:50,460 --> 00:01:52,470
Starting off, who am I?

32
00:01:52,470 --> 00:01:55,383
I'm Monocasa, Tristan.

33
00:01:57,510 --> 00:01:59,901
I'm an engineer. I've
got a lot of experience,

34
00:01:59,901 --> 00:02:03,030
with binary reversing,
firmware development,

35
00:02:03,030 --> 00:02:05,400
cloud-based device and
identity management,

36
00:02:05,400 --> 00:02:09,390
and experience with
custom tunneling of IP.

37
00:02:09,390 --> 00:02:12,750
These are all a perfect
storm for taking a look

38
00:02:12,750 --> 00:02:14,643
at Xbox Live, taking it apart.

39
00:02:15,480 --> 00:02:17,040
There's the skill sets you would need

40
00:02:17,040 --> 00:02:20,340
to take a look at other
video game networks.

41
00:02:20,340 --> 00:02:24,680
If you wanna get in touch with
me, I'm monocasa@xombie.org.

42
00:02:25,950 --> 00:02:30,950
Xombie's the name of my
particular replacement

43
00:02:31,290 --> 00:02:33,360
Xbox Live infrastructure.

44
00:02:33,360 --> 00:02:36,600
It was live, then it
died for original Xbox,

45
00:02:36,600 --> 00:02:37,433
so now it's back again.

46
00:02:37,433 --> 00:02:40,623
I thought it was a cute play of words.

47
00:02:43,770 --> 00:02:44,820
Before we get much farther,

48
00:02:44,820 --> 00:02:49,820
I wanted to just give a
shout out to the other people

49
00:02:50,400 --> 00:02:52,470
working in the same space.

50
00:02:52,470 --> 00:02:55,800
There's M. Borgeson, who
has put in a ton of work

51
00:02:55,800 --> 00:03:00,660
into the emulators for
Xbox, called Xemu, X-E-M-U.

52
00:03:00,660 --> 00:03:03,060
There's also a guy by
the name of Luke Usher,

53
00:03:03,060 --> 00:03:07,380
who's working on similar
replacement server architecture

54
00:03:07,380 --> 00:03:11,370
called Insignia, for Xbox Live.

55
00:03:11,370 --> 00:03:13,020
I think they both have Patreons.

56
00:03:13,020 --> 00:03:14,520
I'm sure they both
would love some support.

57
00:03:14,520 --> 00:03:16,953
I've got nothing but love
for both those people.

58
00:03:19,140 --> 00:03:23,220
And interestingly, for a talk

59
00:03:23,220 --> 00:03:28,220
about early 2000s era Microsoft code,

60
00:03:29,640 --> 00:03:31,440
I am gonna rag on them a little bit,

61
00:03:31,440 --> 00:03:34,980
but I was actually kind of
surprised, looking back on this,

62
00:03:34,980 --> 00:03:38,250
with historical context,

63
00:03:38,250 --> 00:03:43,250
with at least most of the obvious flaws;

64
00:03:45,270 --> 00:03:46,353
Microsoft,

65
00:03:49,375 --> 00:03:50,573
it actually makes sense in context.

66
00:03:50,573 --> 00:03:53,130
This is actually a
pretty good protocol set,

67
00:03:53,130 --> 00:03:58,130
and from what I can
tell, it's 20 years old,

68
00:03:58,140 --> 00:04:03,140
but other than upgrading
the crypto primitives,

69
00:04:03,240 --> 00:04:04,950
a lot of the basics are still here,

70
00:04:04,950 --> 00:04:06,330
and a lot of the structure's still here,

71
00:04:06,330 --> 00:04:08,763
and a lot of it still
continues to make sense.

72
00:04:11,010 --> 00:04:11,843
Yeah.

73
00:04:13,860 --> 00:04:16,920
We're talking about Xbox Live today.

74
00:04:16,920 --> 00:04:21,153
My focus has really been on
for the original console.

75
00:04:22,260 --> 00:04:25,080
That's the only system
that Microsoft so far

76
00:04:25,080 --> 00:04:27,663
has shut down access for.

77
00:04:28,860 --> 00:04:33,860
That was from November,
2002 until April, 2010.

78
00:04:35,190 --> 00:04:36,810
There were some people that managed

79
00:04:36,810 --> 00:04:40,680
to keep their in-game sessions
going for a month later,

80
00:04:40,680 --> 00:04:42,130
which was really interesting,

81
00:04:43,080 --> 00:04:45,390
because ultimately as we'll see,

82
00:04:45,390 --> 00:04:49,440
a lot of Xbox Live is ultimately
the signaling pathway,

83
00:04:49,440 --> 00:04:50,973
and then they generate.

84
00:04:51,960 --> 00:04:54,240
Once you have an in-game session,

85
00:04:54,240 --> 00:04:57,990
that's for most games,
doesn't actually communicate

86
00:04:57,990 --> 00:04:59,493
that much with the backend.

87
00:05:02,220 --> 00:05:07,220
It's like web RTC in that regard,
for a more modern context.

88
00:05:09,013 --> 00:05:13,920
I'm also trying to stay away from systems

89
00:05:13,920 --> 00:05:16,920
that are still online,

90
00:05:16,920 --> 00:05:18,801
and give Microsoft some space,

91
00:05:18,801 --> 00:05:21,753
to where they're still making their money.

92
00:05:26,250 --> 00:05:27,600
In the Xbox hacking scene,

93
00:05:27,600 --> 00:05:32,407
there was some people
who didn't quite live

94
00:05:33,480 --> 00:05:34,590
by that same standard,

95
00:05:34,590 --> 00:05:37,893
and I don't think anybody won that game.

96
00:05:41,070 --> 00:05:41,970
Yeah.

97
00:05:41,970 --> 00:05:43,470
Going back, Xbox Live

98
00:05:43,470 --> 00:05:46,730
is really the first
modern video game network,

99
00:05:46,730 --> 00:05:47,563
in a lot of ways.

100
00:05:47,563 --> 00:05:49,533
There's a lot of other ones before it.

101
00:05:52,080 --> 00:05:54,680
It obviously took a lot of
inspiration from Seganet.

102
00:05:56,981 --> 00:05:59,670
But I mean, video game networks
actually go really far back.

103
00:05:59,670 --> 00:06:03,540
There was this really
cool network called X band

104
00:06:03,540 --> 00:06:07,800
in the mid-90s, that was a game genie,

105
00:06:07,800 --> 00:06:09,270
and a modem stuck on it.

106
00:06:09,270 --> 00:06:14,270
And then, they would ROM-hack,
more or less in real time,

107
00:06:14,730 --> 00:06:19,730
to add online multiplayer
to SNES cartridges.

108
00:06:20,520 --> 00:06:21,870
Then this was a commercial product

109
00:06:21,870 --> 00:06:24,810
that I didn't even hear of at the time.

110
00:06:24,810 --> 00:06:25,643
Super cool.

111
00:06:26,550 --> 00:06:27,780
But like I said,

112
00:06:27,780 --> 00:06:31,350
Xbox Live is the first modern
video game console network.

113
00:06:31,350 --> 00:06:35,460
And by that, we mean
there's a cohesive service

114
00:06:35,460 --> 00:06:37,083
across the games.

115
00:06:37,980 --> 00:06:41,340
Otherwise, previously,

116
00:06:41,340 --> 00:06:45,690
these networks will
provide network services,

117
00:06:45,690 --> 00:06:50,690
but otherwise, each game is
sort of an island unto itself.

118
00:06:53,970 --> 00:06:58,290
At release, it expected
broadband to exist.

119
00:06:58,290 --> 00:07:02,220
They did try to support
modems, it looked like,

120
00:07:02,220 --> 00:07:03,213
in development,

121
00:07:04,170 --> 00:07:06,120
but they didn't actually
release with that,

122
00:07:06,120 --> 00:07:10,470
and so, it set a standard of bandwidth

123
00:07:10,470 --> 00:07:13,950
of you essentially have to have been able

124
00:07:13,950 --> 00:07:16,110
to stream a simple Netflix,

125
00:07:16,110 --> 00:07:21,110
which is a very nice baseline
for these sorts of services

126
00:07:22,980 --> 00:07:25,053
we expect out of modern systems.

127
00:07:26,542 --> 00:07:30,510
The Xbox shipped with a
hard drive on the console,

128
00:07:30,510 --> 00:07:34,413
which might have been the first
to ship with a hard drive.

129
00:07:35,340 --> 00:07:38,760
Was definitely the first to expect

130
00:07:38,760 --> 00:07:41,013
that kind of large amount of storage.

131
00:07:43,470 --> 00:07:46,860
That gives you enough local storage

132
00:07:46,860 --> 00:07:49,410
to be able to update games,

133
00:07:49,410 --> 00:07:51,483
make sure everybody's consistent.

134
00:07:52,500 --> 00:07:57,183
It brought up DLC, which I've
got mixed feelings about,

135
00:07:58,170 --> 00:08:01,143
but it can be used for good
and can be used for bad.

136
00:08:02,070 --> 00:08:06,690
It was actually moderated
for one of the first times,

137
00:08:06,690 --> 00:08:11,690
so you can attempt to have
a pleasant experience,

138
00:08:12,000 --> 00:08:14,250
despite the other people
you're playing with.

139
00:08:16,290 --> 00:08:17,820
These are all new features,

140
00:08:17,820 --> 00:08:21,810
and these are all table stakes
now for a video game network,

141
00:08:21,810 --> 00:08:25,500
so it's really interesting
to, at least in my mind,

142
00:08:25,500 --> 00:08:29,733
take a look at the first stab
of how these got created.

143
00:08:32,130 --> 00:08:33,960
We're gonna jump right in.

144
00:08:33,960 --> 00:08:38,960
The base protocols it uses: it's all IPv4,

145
00:08:39,630 --> 00:08:43,050
so if anyone has a slash 24
they want to give me for free,

146
00:08:43,050 --> 00:08:46,233
I'd appreciate that, but
probably not gonna happen.

147
00:08:48,990 --> 00:08:52,500
Uses DNS then, to actually bootstrap up

148
00:08:52,500 --> 00:08:54,690
to the different services.

149
00:08:54,690 --> 00:08:58,297
Ends up using Kerberos to work

150
00:09:00,720 --> 00:09:03,843
as the Authz and Authn component,

151
00:09:04,920 --> 00:09:07,140
which is actually really core

152
00:09:07,140 --> 00:09:09,780
to the security infrastructure.

153
00:09:09,780 --> 00:09:13,470
And then, there's always
been this mysterious UDP

154
00:09:13,470 --> 00:09:18,470
port 3074, which is a custom VPN protocol.

155
00:09:20,280 --> 00:09:25,280
That's really the core of
honestly all Xbox networking,

156
00:09:26,160 --> 00:09:27,690
including system link,

157
00:09:27,690 --> 00:09:32,190
but is also the core of how
boxes communicate to Xbox Live

158
00:09:32,190 --> 00:09:36,330
and each other, is this VPN that uses

159
00:09:36,330 --> 00:09:41,330
the cryptographic attestations
of identity from the Kerberos

160
00:09:43,110 --> 00:09:45,260
to connect and communicate
with each other.

161
00:09:47,280 --> 00:09:48,113
Crypto primitives:

162
00:09:48,113 --> 00:09:51,870
this is where that
historical context comes in.

163
00:09:51,870 --> 00:09:55,470
This is a great who's
who of crypto primitives

164
00:09:55,470 --> 00:09:57,393
you shouldn't really use anymore.

165
00:09:59,370 --> 00:10:04,370
MD5, SHA1 for hashing, RC4
for symmetric encryption,

166
00:10:04,920 --> 00:10:09,920
and DES and 3DES for symmetric
encryption on the VPN.

167
00:10:14,340 --> 00:10:17,670
Yeah, you shouldn't use
any of these anymore.

168
00:10:17,670 --> 00:10:19,230
Microsoft agrees with you.

169
00:10:19,230 --> 00:10:22,620
That's probably why original Xboxes

170
00:10:22,620 --> 00:10:24,090
aren't allowed on Live anymore.

171
00:10:24,090 --> 00:10:29,090
That, combined with there were
some of the other constraints

172
00:10:29,760 --> 00:10:33,783
and the Xboxes themselves.

173
00:10:37,740 --> 00:10:39,840
All these Xbox Live libraries

174
00:10:39,840 --> 00:10:42,150
are statically compiled into each game

175
00:10:42,150 --> 00:10:43,080
on original Xbox.

176
00:10:43,080 --> 00:10:45,210
That's something they fixed in the 360.

177
00:10:45,210 --> 00:10:48,240
But they would have to go
back and release updates

178
00:10:48,240 --> 00:10:52,383
for literally every original
Xbox title to allow it.

179
00:10:53,400 --> 00:10:58,350
So, that explains why they
ended up cutting them off,

180
00:10:58,350 --> 00:11:01,143
but still allow 360s,
which are pretty old.

181
00:11:02,880 --> 00:11:04,530
So, DNS.

182
00:11:04,530 --> 00:11:08,280
We actually only hit three
different DNS targets.

183
00:11:08,280 --> 00:11:10,593
There's MACS, which we'll get into.

184
00:11:11,575 --> 00:11:16,575
AS and TGS are fairly
standard Kerberos servers.

185
00:11:17,850 --> 00:11:21,820
And then, SG012N

186
00:11:23,040 --> 00:11:25,890
is the security gateway

187
00:11:25,890 --> 00:11:28,743
that is the VPN itself.

188
00:11:30,030 --> 00:11:33,840
And then all other communications
go through that VPN,

189
00:11:33,840 --> 00:11:36,093
other than talking to other boxes.

190
00:11:39,030 --> 00:11:41,490
If you get into the binary reversing,

191
00:11:41,490 --> 00:11:44,670
you'll see hints of Partner Net,

192
00:11:44,670 --> 00:11:48,000
which is Microsoft's private instances

193
00:11:48,000 --> 00:11:50,100
of all this stuff used for testing.

194
00:11:50,100 --> 00:11:53,343
So, it'll be as.part.xboxlive.

195
00:11:54,390 --> 00:11:57,783
If you see that, that's
what that stuff is.

196
00:11:59,250 --> 00:12:01,050
That's Microsoft's. They can have that.

197
00:12:01,050 --> 00:12:03,453
I don't want to touch
that, or piss them off.

198
00:12:05,730 --> 00:12:06,563
Sweet.

199
00:12:08,670 --> 00:12:12,843
Once you are up and
talking to these servers,

200
00:12:14,280 --> 00:12:19,280
like we said, we're using
Kerberos for Authz, Authn.

201
00:12:21,390 --> 00:12:23,820
If you've played with Oauth,

202
00:12:23,820 --> 00:12:28,820
it's very similar ideas from
a very 1980s perspective.

203
00:12:31,320 --> 00:12:34,590
It uses this thing called ASN.1,

204
00:12:34,590 --> 00:12:36,390
specifically the DER version,

205
00:12:36,390 --> 00:12:41,390
instead of JSON for their communications.

206
00:12:41,640 --> 00:12:44,730
And particularly, they use
tickets instead of jots,

207
00:12:44,730 --> 00:12:46,233
or tickets instead of tokens.

208
00:12:47,910 --> 00:12:51,723
ASN.1 is actually really interesting;

209
00:12:54,210 --> 00:12:59,210
if proto buff had a ton of
different possible encoding,

210
00:13:01,080 --> 00:13:06,080
where DER is a fairly
byte-packed encoding,

211
00:13:06,773 --> 00:13:08,313
if that makes sense?

212
00:13:09,330 --> 00:13:12,510
You'll also see that
too in exit 509 tickets

213
00:13:12,510 --> 00:13:14,283
are DER-encoded.

214
00:13:15,360 --> 00:13:20,360
If you care about every
bit, there's a PEM encoding.

215
00:13:23,040 --> 00:13:25,170
But there's also JSON encoding.

216
00:13:25,170 --> 00:13:27,870
There's an XML encoding.

217
00:13:27,870 --> 00:13:29,340
It's really from the '80s,

218
00:13:29,340 --> 00:13:34,340
and has picked up a new encoding
every time somebody cared.

219
00:13:35,340 --> 00:13:40,263
It's also been a thorn
in the side of security,

220
00:13:42,000 --> 00:13:44,040
particularly like blue
team kind of people.

221
00:13:44,040 --> 00:13:47,553
I guess been really nice,
for red team people.

222
00:13:49,170 --> 00:13:51,630
It's an extremely complex spec,

223
00:13:51,630 --> 00:13:56,630
and a lot of our encoding for
security purposes these days

224
00:13:57,570 --> 00:14:02,100
takes ASN.1 in context,

225
00:14:02,100 --> 00:14:06,180
and tries to not be that, and
tries to be a lot simpler,

226
00:14:06,180 --> 00:14:11,070
because pretty much until the advent

227
00:14:11,070 --> 00:14:13,203
of memory safe languages,

228
00:14:14,160 --> 00:14:17,790
there weren't safe ASN.1 parsers.

229
00:14:17,790 --> 00:14:21,390
Up through the '90s, up
through the early 2000s,

230
00:14:21,390 --> 00:14:26,390
ASN.1 was really easy to
find buffer overflows in,

231
00:14:26,910 --> 00:14:29,070
for a very long time.

232
00:14:29,070 --> 00:14:31,260
That's why we don't use it anymore.

233
00:14:31,260 --> 00:14:34,060
But this

234
00:14:36,840 --> 00:14:39,450
was what you used at the time.

235
00:14:39,450 --> 00:14:40,953
Super interestingly,

236
00:14:42,540 --> 00:14:43,920
even though it's Authz Authn,

237
00:14:43,920 --> 00:14:46,980
it doesn't use public private crypto.

238
00:14:46,980 --> 00:14:51,980
There's no signed by a private key

239
00:14:53,700 --> 00:14:55,850
that could be validated
by a public search,

240
00:14:56,760 --> 00:14:58,650
although that was technically added

241
00:14:58,650 --> 00:15:01,470
as a extension to the RFC.

242
00:15:01,470 --> 00:15:05,730
I think it came out in the
newer RFC. That's an option.

243
00:15:05,730 --> 00:15:07,800
But that's not the core of how it works.

244
00:15:07,800 --> 00:15:12,800
And it's all about pre-shared keys,

245
00:15:13,080 --> 00:15:16,020
and having a key here
and having a key here

246
00:15:16,020 --> 00:15:19,770
means I can encrypt in
HMAC different pieces.

247
00:15:19,770 --> 00:15:24,770
And then, I can use that to then negotiate

248
00:15:25,050 --> 00:15:27,963
the next key of the process in private.

249
00:15:29,820 --> 00:15:33,000
This is all ultimately
the underlying piece

250
00:15:33,000 --> 00:15:36,720
of how Windows domain logins work.

251
00:15:36,720 --> 00:15:41,720
Your pre-shared key in that
case is your actual password

252
00:15:41,820 --> 00:15:43,740
you type in on the Xbox.

253
00:15:43,740 --> 00:15:47,170
It ends up being keys that

254
00:15:48,600 --> 00:15:53,600
were pre-added to the console
at manufacturing time.

255
00:15:54,720 --> 00:15:58,170
And so, there's an EPROM on every console

256
00:15:58,170 --> 00:16:02,370
that has all sorts of
manufacturing time information.

257
00:16:02,370 --> 00:16:04,473
And there's a little online key.

258
00:16:07,200 --> 00:16:11,130
It's a heavily extensible
protocol as well,

259
00:16:11,130 --> 00:16:15,000
so there's these arbitrary dumping ground

260
00:16:15,000 --> 00:16:17,133
of pre-auth data fields.

261
00:16:20,640 --> 00:16:23,793
Microsoft ends up using
these very, very heavily.

262
00:16:25,320 --> 00:16:28,470
We skipped over MACS originally,

263
00:16:28,470 --> 00:16:30,993
which is the machine
account creation service.

264
00:16:33,060 --> 00:16:37,650
MACS uses Kerberos, but
arguably to the point

265
00:16:37,650 --> 00:16:39,540
of not even being Kerberos anymore,

266
00:16:39,540 --> 00:16:43,860
and is just using those
pre-auth data fields

267
00:16:43,860 --> 00:16:47,400
to communicate not tokens,

268
00:16:47,400 --> 00:16:52,400
but other information that
we'll get to right now.

269
00:16:53,280 --> 00:16:56,343
Yeah, MACS is the machine
account creation service.

270
00:16:58,260 --> 00:17:00,240
Original Xboxes,

271
00:17:00,240 --> 00:17:03,510
I haven't quite figured
out why this is the case.

272
00:17:03,510 --> 00:17:07,952
They have a key available in the EPROM

273
00:17:07,952 --> 00:17:10,860
that was put there at manufacturing time.

274
00:17:10,860 --> 00:17:14,580
Then, an Xbox will use the Kerberos

275
00:17:14,580 --> 00:17:19,580
to convert that secret on the EPROM

276
00:17:19,740 --> 00:17:24,033
into a full account for the box itself.

277
00:17:27,450 --> 00:17:30,240
However, that account, that
key has exactly the same

278
00:17:30,240 --> 00:17:33,930
key length that was negotiated.

279
00:17:33,930 --> 00:17:38,100
So, it turns a 16 byte key
into another 16 byte key

280
00:17:38,100 --> 00:17:42,510
for reasons I'm not totally clear about.

281
00:17:42,510 --> 00:17:47,510
Maybe they were still
figuring out the Xbox.

282
00:17:51,270 --> 00:17:53,130
Maybe they were still figuring out Live,

283
00:17:53,130 --> 00:17:57,783
and they just wanted to get
all those pieces together,

284
00:17:59,730 --> 00:18:01,800
so that when they released Live later,

285
00:18:01,800 --> 00:18:03,540
they'd have something.

286
00:18:03,540 --> 00:18:08,400
I'm not really sure, but we move on.

287
00:18:08,400 --> 00:18:12,360
It ends up using just standard
Kerberos AS-REQs, AS-REPs

288
00:18:12,360 --> 00:18:16,110
to verify that shared
secret, create an account,

289
00:18:16,110 --> 00:18:21,110
and from then on, the
machine uses that account

290
00:18:21,750 --> 00:18:26,750
to present itself to the security gateway.

291
00:18:29,100 --> 00:18:32,373
Like we were saying, there's
a bunch of extra pre-auths.

292
00:18:34,440 --> 00:18:37,950
There's a client version
that you sign with secrets,

293
00:18:37,950 --> 00:18:41,550
which basically tells you what executable

294
00:18:41,550 --> 00:18:43,380
is being used here.

295
00:18:43,380 --> 00:18:44,483
So, it a lot of times ends up,

296
00:18:47,744 --> 00:18:49,922
if it's just the machine itself

297
00:18:49,922 --> 00:18:51,796
and just trying to bootstrap this thing,

298
00:18:51,796 --> 00:18:55,546
it ends up looking like
the Xbox's dashboard.

299
00:18:59,070 --> 00:19:02,640
You've got this thing that
they call the pre-pre-auth,

300
00:19:02,640 --> 00:19:04,593
that I don't really understand.

301
00:19:05,970 --> 00:19:10,800
It just hashes the
console serial and secrets

302
00:19:10,800 --> 00:19:12,153
in an interesting way.

303
00:19:14,160 --> 00:19:15,870
The only thing that makes any sense to me

304
00:19:15,870 --> 00:19:20,870
is it helps some look up that they have,

305
00:19:21,480 --> 00:19:23,490
but it's not really necessary,

306
00:19:23,490 --> 00:19:27,870
and doesn't really add anything
from a security perspective

307
00:19:27,870 --> 00:19:28,703
that I can see.

308
00:19:32,430 --> 00:19:35,190
Then there's this 131,

309
00:19:35,190 --> 00:19:38,100
that's a constraint on user data in a way

310
00:19:38,100 --> 00:19:40,590
that's sort of meaningless.

311
00:19:40,590 --> 00:19:42,060
It's a MS-KILE thing,

312
00:19:42,060 --> 00:19:45,060
which is another extension to Kerberos.

313
00:19:45,060 --> 00:19:48,390
And then the current time stamp.

314
00:19:48,390 --> 00:19:50,823
Otherwise, it looks like
a normal AS request.

315
00:19:52,500 --> 00:19:55,560
Then the MACS service
comes back to the console.

316
00:19:55,560 --> 00:19:56,940
It gives it a ticket.

317
00:19:56,940 --> 00:19:58,680
Like we said, it's like a 0auth token

318
00:19:58,680 --> 00:20:01,920
that doesn't make sense
and gets thrown away.

319
00:20:01,920 --> 00:20:05,940
In my case, I set the
expiration to Unix Epoch,

320
00:20:05,940 --> 00:20:09,510
just to make sure that it
can't be used for anything.

321
00:20:09,510 --> 00:20:13,560
And then, it gives it a
account creation pre-auth,

322
00:20:13,560 --> 00:20:17,283
which contains the whole
machine user identity.

323
00:20:18,360 --> 00:20:20,400
And the box then ends up storing all this

324
00:20:20,400 --> 00:20:23,880
on this un-partitioned
space on the hard drive.

325
00:20:23,880 --> 00:20:26,463
I haven't really figured out why.

326
00:20:27,600 --> 00:20:31,410
There's this, I wanna
say, a half-Meg space

327
00:20:31,410 --> 00:20:33,993
on the hard drive that
isn't in any partition,

328
00:20:35,460 --> 00:20:37,590
and I haven't really
been able to figure out

329
00:20:37,590 --> 00:20:41,370
why information gets stored there.

330
00:20:41,370 --> 00:20:46,370
The best theory I have is that
the underlying storage there

331
00:20:49,800 --> 00:20:52,710
was originally supposed to be on a flash,

332
00:20:52,710 --> 00:20:53,910
and they migrated it,

333
00:20:53,910 --> 00:20:55,530
because they didn't have an extra flash,

334
00:20:55,530 --> 00:20:57,780
or didn't wanna touch
the flash or something.

335
00:21:00,180 --> 00:21:03,300
But it's not really hiding that much,

336
00:21:03,300 --> 00:21:08,300
because it's very clear from
the binary what's happening,

337
00:21:08,340 --> 00:21:13,340
because it's the only thing
that's opening the raw partition

338
00:21:16,110 --> 00:21:18,240
pretty much on the system.

339
00:21:18,240 --> 00:21:21,033
So, it's not really even a
good obfuscation technique.

340
00:21:21,900 --> 00:21:24,810
I mean, maybe if you were looking at it,

341
00:21:24,810 --> 00:21:26,760
but they're already using weird partitions

342
00:21:26,760 --> 00:21:28,323
and weird partitioning schemes.

343
00:21:30,960 --> 00:21:32,280
I don't know, it never really made sense,

344
00:21:32,280 --> 00:21:34,170
but that's where it is.

345
00:21:34,170 --> 00:21:37,020
That's what that partition space is.

346
00:21:37,020 --> 00:21:39,420
Ultimately, all of that
un-partitioned space

347
00:21:39,420 --> 00:21:42,603
is cached information,

348
00:21:43,650 --> 00:21:48,480
so anybody who is super
concerned about preservation

349
00:21:48,480 --> 00:21:50,310
of that un-partitioned space,

350
00:21:50,310 --> 00:21:54,993
and afraid that if they
modded their console,

351
00:21:54,993 --> 00:21:59,400
and never restored that piece,

352
00:21:59,400 --> 00:22:01,020
you can still get on Live.

353
00:22:01,020 --> 00:22:03,120
All that information isn't there,

354
00:22:03,120 --> 00:22:07,683
isn't necessary to get on
Live re-implementations,

355
00:22:08,790 --> 00:22:09,623
which is good news.

356
00:22:09,623 --> 00:22:10,890
A lot of people were very scared

357
00:22:10,890 --> 00:22:14,610
that they had written their way

358
00:22:14,610 --> 00:22:16,210
out of being able to be on Live.

359
00:22:18,780 --> 00:22:22,050
Users. User is this really
interesting concept in Xbox Live.

360
00:22:22,050 --> 00:22:24,210
This is probably one of the cooler things,

361
00:22:24,210 --> 00:22:28,383
that made me want to
talk in front of DEFCON.

362
00:22:31,080 --> 00:22:35,580
A user on Xbox Live is
a very broad concept.

363
00:22:35,580 --> 00:22:38,310
The machine itself is a user,

364
00:22:38,310 --> 00:22:40,650
in addition to what you would think of

365
00:22:40,650 --> 00:22:42,750
as people sitting there with controllers

366
00:22:42,750 --> 00:22:44,750
in their hands, in each controller port.

367
00:22:50,340 --> 00:22:52,140
It's a really interesting take

368
00:22:52,140 --> 00:22:56,940
of one of the first stabs of IOT security,

369
00:22:56,940 --> 00:22:59,910
and this idea of the machine itself

370
00:22:59,910 --> 00:23:01,533
being given a full identity.

371
00:23:05,640 --> 00:23:08,640
For a lot of Authz Authn systems,

372
00:23:08,640 --> 00:23:13,470
you see what device they're on

373
00:23:13,470 --> 00:23:17,070
end up being metadata for the user,

374
00:23:17,070 --> 00:23:21,060
as opposed to combined,

375
00:23:21,060 --> 00:23:23,040
like a user in its own sense,

376
00:23:23,040 --> 00:23:25,920
and then smearing users together

377
00:23:25,920 --> 00:23:28,713
into a combined authorization.

378
00:23:34,470 --> 00:23:36,657
Boxes have their own ID.

379
00:23:36,657 --> 00:23:38,700
They have their own gamer tags.

380
00:23:38,700 --> 00:23:42,697
It ends up being like SN.serialnumber.

381
00:23:45,150 --> 00:23:48,060
I ended up sticking them in
a different Kerberos realm,

382
00:23:48,060 --> 00:23:52,470
but I haven't been able to find
an original machine account,

383
00:23:52,470 --> 00:23:54,820
so I don't know what
Microsoft originally does.

384
00:23:57,300 --> 00:24:00,300
Just like regular users, machine users,

385
00:24:00,300 --> 00:24:02,550
they both have 16-byte shared secret.

386
00:24:02,550 --> 00:24:07,550
That's ultimately the
bootstrapping of Kerberos.

387
00:24:08,730 --> 00:24:11,820
They have domains and realms,

388
00:24:11,820 --> 00:24:14,370
which are just basically name spaces.

389
00:24:14,370 --> 00:24:17,133
So, you can think, @blahblahblah.com,

390
00:24:17,133 --> 00:24:19,143
@blahblahblah.net.

391
00:24:20,550 --> 00:24:24,423
Everyone's got a XUID,
which is a 64-bit user ID.

392
00:24:25,650 --> 00:24:29,880
Everything on original Xbox
seems to start with 0009,

393
00:24:29,880 --> 00:24:30,713
for some reason.

394
00:24:30,713 --> 00:24:35,570
I don't know why that is, but
the boxes don't seem to care.

395
00:24:38,430 --> 00:24:43,320
And then, non-machine users
will have flags and a passcode.

396
00:24:43,320 --> 00:24:44,373
There's this flags.

397
00:24:45,840 --> 00:24:48,600
There has two different concepts.

398
00:24:48,600 --> 00:24:51,720
One is for guest accounts.

399
00:24:51,720 --> 00:24:53,280
If you ever wondered how that worked,

400
00:24:53,280 --> 00:24:57,930
you have the same XUID as your host user.

401
00:24:57,930 --> 00:25:00,967
You just have different
bits in the flags that say,

402
00:25:00,967 --> 00:25:03,387
"I'm a guest account of this user."

403
00:25:04,260 --> 00:25:06,907
Then the rest of the
flags are things like,

404
00:25:06,907 --> 00:25:09,990
"I was a shithead, and
therefore I am completely banned

405
00:25:09,990 --> 00:25:12,657
from speaking on everything, globally."

406
00:25:14,460 --> 00:25:19,150
Those sort of cross-communications

407
00:25:20,040 --> 00:25:22,860
black marks on the user are put in there.

408
00:25:22,860 --> 00:25:25,800
And then, also in the user account,

409
00:25:25,800 --> 00:25:29,257
they've got the passcode,
which is a pretty simple,

410
00:25:29,257 --> 00:25:33,300
"Keeping your little brother
from getting on your account."

411
00:25:33,300 --> 00:25:36,213
It'll just be, "AABB
up down," or something.

412
00:25:38,040 --> 00:25:38,873
Cool.

413
00:25:40,050 --> 00:25:44,130
That brings us to the
actual authorization flow

414
00:25:44,130 --> 00:25:45,030
at this point.

415
00:25:45,030 --> 00:25:48,510
At this point, your Xbox
is signed into MACS,

416
00:25:48,510 --> 00:25:51,000
it's gotten a full account.

417
00:25:51,000 --> 00:25:56,000
Then, it moves into
actually trying to connect.

418
00:25:57,210 --> 00:26:00,660
And so, this is a pretty
standard Kerberos flow,

419
00:26:00,660 --> 00:26:01,593
for the most part.

420
00:26:02,550 --> 00:26:05,970
We end up creating a
ticket granting ticket

421
00:26:05,970 --> 00:26:09,600
that gives you a cryptographic
proof of identity

422
00:26:09,600 --> 00:26:11,250
of the pre-shared key,

423
00:26:11,250 --> 00:26:16,110
and gives you a ticket
that you can present

424
00:26:16,110 --> 00:26:18,690
to the next piece.

425
00:26:18,690 --> 00:26:20,823
It's like a 0auth bearer token.

426
00:26:24,810 --> 00:26:28,530
It essentially lets you prove that you are

427
00:26:28,530 --> 00:26:33,063
who you think you are to other entities.

428
00:26:34,860 --> 00:26:36,810
It can be a very multi-step process.

429
00:26:36,810 --> 00:26:38,880
This is what I was getting at,

430
00:26:38,880 --> 00:26:43,110
where it'll first build up
a ticket granting ticket

431
00:26:43,110 --> 00:26:47,070
with the machine's account.

432
00:26:47,070 --> 00:26:49,740
And then, it does this
combined identity thing,

433
00:26:49,740 --> 00:26:54,330
where it starts layering all
of the other users on top of it

434
00:26:54,330 --> 00:26:57,060
and sort of smears all of
the identities together

435
00:26:57,060 --> 00:27:02,060
into this one cryptographic
version of identity,

436
00:27:03,630 --> 00:27:05,310
which is a really interesting concept,

437
00:27:05,310 --> 00:27:10,310
and one I haven't seen
used very much these days.

438
00:27:13,470 --> 00:27:14,700
Cool.

439
00:27:14,700 --> 00:27:18,330
From there, we talk to TGS,

440
00:27:18,330 --> 00:27:20,010
which is the ticket granting service.

441
00:27:20,010 --> 00:27:22,200
You give it a ticket granting ticket.

442
00:27:22,200 --> 00:27:27,090
It gives you back a service
ticket. Pretty simple.

443
00:27:27,090 --> 00:27:32,090
This will be a little
bit shorter timeframes.

444
00:27:35,493 --> 00:27:40,493
You'll tell it that you want
certain backend services,

445
00:27:40,620 --> 00:27:43,470
and it'll give you a ticket
for those backend services

446
00:27:43,470 --> 00:27:45,240
for those users.

447
00:27:45,240 --> 00:27:46,470
At the end of the day,

448
00:27:46,470 --> 00:27:48,510
this is another really interesting part.

449
00:27:48,510 --> 00:27:51,240
Probably, one of the
cooler parts of Xbox Live

450
00:27:51,240 --> 00:27:56,070
is even before you are fully connected,

451
00:27:56,070 --> 00:28:01,070
you have this cryptographic
attestation of identity

452
00:28:01,170 --> 00:28:05,500
that is combined with
which backend services

453
00:28:06,930 --> 00:28:08,343
you can talk to.

454
00:28:09,360 --> 00:28:13,620
That's the mid-level of
their backend system,

455
00:28:13,620 --> 00:28:16,140
which is really, really neat.

456
00:28:16,140 --> 00:28:21,140
It reminds me of how Facebook has added

457
00:28:23,850 --> 00:28:26,763
to their TLS connections on their backend.

458
00:28:28,770 --> 00:28:32,880
They really try to tag
the identity of the user

459
00:28:32,880 --> 00:28:36,150
that was the cause of the
request to everything,

460
00:28:36,150 --> 00:28:37,920
so that they can really track
it through their systems

461
00:28:37,920 --> 00:28:38,753
very well.

462
00:28:40,290 --> 00:28:44,280
This could give you the same way to do

463
00:28:44,280 --> 00:28:45,750
that kind of information;

464
00:28:45,750 --> 00:28:50,550
to track user identities through requests,

465
00:28:50,550 --> 00:28:55,550
to restrict users on a
per-game basis, per-user basis,

466
00:29:00,780 --> 00:29:04,170
and handle it all very holistically,

467
00:29:04,170 --> 00:29:09,170
all underneath the
individual game protocols.

468
00:29:09,630 --> 00:29:11,880
All the other protocols
and what they expect.

469
00:29:14,010 --> 00:29:16,140
It brings it back to their pre-auths.

470
00:29:16,140 --> 00:29:20,490
They've got 201, 202, so
we have a service request,

471
00:29:20,490 --> 00:29:22,597
which is basically the game saying,

472
00:29:22,597 --> 00:29:27,597
"Hey, I want to talk to
matchmaking. I wanna talk to stats."

473
00:29:27,600 --> 00:29:30,000
And then the service address.

474
00:29:30,000 --> 00:29:35,000
You'll get a address of
which security gateway

475
00:29:36,300 --> 00:29:37,170
you can talk to,

476
00:29:37,170 --> 00:29:41,763
and which underlying ports to talk to.

477
00:29:45,778 --> 00:29:48,240
Well, security gateway
was gonna be on 3074,

478
00:29:48,240 --> 00:29:53,240
but also, once you've
connected into the VPN,

479
00:29:54,150 --> 00:29:55,350
which ports you can talk to,

480
00:29:55,350 --> 00:29:57,663
and which services they're connected to.

481
00:30:00,265 --> 00:30:03,660
It has very almost SDN kind
of underlying components,

482
00:30:03,660 --> 00:30:07,620
which for something that
was created in 2002,

483
00:30:07,620 --> 00:30:09,483
is kind of nutty to me.

484
00:30:12,420 --> 00:30:14,313
Brings us to the security gateway.

485
00:30:16,056 --> 00:30:18,300
That's that port 3074.

486
00:30:18,300 --> 00:30:20,430
This is a custom VPN.

487
00:30:20,430 --> 00:30:22,773
It really looks like IPSEC.

488
00:30:24,120 --> 00:30:25,800
Also really looks like wireguard,

489
00:30:25,800 --> 00:30:27,993
which looks like IPSEC a lot.

490
00:30:30,180 --> 00:30:33,240
It signs and encrypts
pretty much all traffic.

491
00:30:33,240 --> 00:30:34,713
It sits at layer two.

492
00:30:36,150 --> 00:30:41,150
It smears TCP and UDP
into itself in a way,

493
00:30:44,010 --> 00:30:48,273
that you also kind of
see an IPSEC to a degree.

494
00:30:51,030 --> 00:30:55,380
It's very, very, very, very
focused on saving bytes

495
00:30:55,380 --> 00:30:57,180
wherever it can.

496
00:30:57,180 --> 00:30:58,890
I think some of that probably relates

497
00:30:58,890 --> 00:31:01,740
to trying to get this thing
running on modems originally,

498
00:31:01,740 --> 00:31:03,540
like it seemed like they were doing,

499
00:31:05,280 --> 00:31:07,987
because they go to absolutely heroic ways

500
00:31:10,380 --> 00:31:12,723
to save a byte here, save a byte there.

501
00:31:15,210 --> 00:31:16,043
Yeah.

502
00:31:17,280 --> 00:31:18,113
Cool.

503
00:31:18,113 --> 00:31:19,863
Here's the underlying packet format.

504
00:31:26,970 --> 00:31:29,283
First byte contains padding and an opcode.

505
00:31:39,210 --> 00:31:40,080
How about this?

506
00:31:40,080 --> 00:31:42,930
The padding for the actual payload

507
00:31:42,930 --> 00:31:44,670
ends up being eight-byte aligned,

508
00:31:44,670 --> 00:31:47,100
because that's the block cipher size,

509
00:31:47,100 --> 00:31:52,100
so the padding tells you
how much of the block cipher

510
00:31:53,250 --> 00:31:55,113
goes past the payload.

511
00:31:56,190 --> 00:31:57,300
You've got an opcode.

512
00:31:57,300 --> 00:32:00,180
So, zero ends up being control packets.

513
00:32:00,180 --> 00:32:04,110
Then you've got three each for TCP, UDP,

514
00:32:04,110 --> 00:32:06,363
and another protocol called VDP.

515
00:32:07,230 --> 00:32:08,880
You've got three bytes for a SPI.

516
00:32:10,530 --> 00:32:13,260
That is security parameters index.

517
00:32:13,260 --> 00:32:15,260
That's essentially a session identifier.

518
00:32:17,130 --> 00:32:21,000
You've got payload, which
when we talked about.

519
00:32:21,000 --> 00:32:22,413
That can just be anything.

520
00:32:24,645 --> 00:32:29,370
For things like TCP, that'll
be the actual fragment data.

521
00:32:29,370 --> 00:32:32,043
It won't be the headers or
that kind of information.

522
00:32:33,030 --> 00:32:37,860
For the control packets,

523
00:32:37,860 --> 00:32:41,130
it'll be just kind of arbitrary data.

524
00:32:41,130 --> 00:32:41,963
Diffie Hellman.

525
00:32:41,963 --> 00:32:46,963
It'll be all those sort of pieces

526
00:32:47,130 --> 00:32:48,543
that need to be negotiated.

527
00:32:49,590 --> 00:32:52,606
Pretty arbitrary amounts of data.

528
00:32:52,606 --> 00:32:57,300
For TCP, UDP and VDP, you have a footer,

529
00:32:57,300 --> 00:32:58,920
which contains what would normally be

530
00:32:58,920 --> 00:33:00,520
their header information

531
00:33:01,380 --> 00:33:06,380
in a really cool, but one of those ways

532
00:33:06,690 --> 00:33:09,453
Microsoft is going to
heroic ways to save bytes.

533
00:33:13,883 --> 00:33:16,020
The protocol footer doesn't
need to be encrypted.

534
00:33:16,020 --> 00:33:20,040
It'll be signed, but if there's padding,

535
00:33:20,040 --> 00:33:23,640
it can be stored up.

536
00:33:23,640 --> 00:33:25,650
It can basically be optionally encrypted,

537
00:33:25,650 --> 00:33:28,170
if that helps you save bytes,

538
00:33:28,170 --> 00:33:30,900
because the encryption step will happen

539
00:33:30,900 --> 00:33:33,183
before trying to parse
the protocol footer.

540
00:33:34,980 --> 00:33:36,630
We'll have two bytes of sequence number.

541
00:33:36,630 --> 00:33:40,230
Then there's also sequence number.

542
00:33:40,230 --> 00:33:42,330
There's also an additional
two hidden bytes

543
00:33:42,330 --> 00:33:43,733
of sequence number,

544
00:33:43,733 --> 00:33:48,733
where you just have to
remember where you were.

545
00:33:48,960 --> 00:33:50,220
You start at zero.

546
00:33:50,220 --> 00:33:52,800
Once it rolls over,
each side will bump up.

547
00:33:52,800 --> 00:33:54,840
They're higher bytes,

548
00:33:54,840 --> 00:33:57,720
but they don't actually communicate that.

549
00:33:57,720 --> 00:34:00,120
I think that's also true of IPSEC though.

550
00:34:00,120 --> 00:34:01,863
That's not a super crazy thing.

551
00:34:02,940 --> 00:34:04,320
Then, there's also a signature,

552
00:34:04,320 --> 00:34:08,670
which is 10 bytes of a
truncated SHA1 of everything,

553
00:34:08,670 --> 00:34:11,073
including the hidden sequence bytes,

554
00:34:11,940 --> 00:34:14,220
with keys that were
negotiated at the same time

555
00:34:14,220 --> 00:34:15,633
as the Diffie Hellman.

556
00:34:17,910 --> 00:34:20,010
One thing I am gonna rag on a little bit

557
00:34:20,010 --> 00:34:24,420
is the way the signature
check is computed here.

558
00:34:24,420 --> 00:34:29,420
It ends up being you do it
over the protocol footer,

559
00:34:30,300 --> 00:34:35,300
then the header, then
the rest of the payload,

560
00:34:35,400 --> 00:34:37,056
then the sequence number.

561
00:34:37,056 --> 00:34:38,880
Something like that.

562
00:34:38,880 --> 00:34:41,580
It pulls them all out,

563
00:34:41,580 --> 00:34:45,840
which means that you have
to do a significant amount

564
00:34:45,840 --> 00:34:48,960
of processing of this packet

565
00:34:48,960 --> 00:34:50,970
to understand where the boundaries

566
00:34:50,970 --> 00:34:52,380
of these different pieces are,

567
00:34:52,380 --> 00:34:55,263
before you validated the signature.

568
00:34:57,210 --> 00:35:00,360
I mean, don't roll your own
crypto is kind of rule one

569
00:35:00,360 --> 00:35:02,160
and two and three and five.

570
00:35:02,160 --> 00:35:03,720
But if we're at rule six,

571
00:35:03,720 --> 00:35:05,943
and you are implementing your own crypto,

572
00:35:08,190 --> 00:35:11,922
just keep it simple and sign
everything in a linear way.

573
00:35:11,922 --> 00:35:16,467
Don't force somebody
to interpret something

574
00:35:18,960 --> 00:35:21,933
before they've been able to
verify the signature on it.

575
00:35:24,030 --> 00:35:26,013
It looks like Microsoft did it right.

576
00:35:26,910 --> 00:35:31,620
I didn't find any bugs in it.
It's just hard to get right,

577
00:35:31,620 --> 00:35:34,370
and I wouldn't trust myself
to get it right, basically.

578
00:35:35,220 --> 00:35:36,750
Cool.

579
00:35:36,750 --> 00:35:39,570
Yeah, we've got the control packets.

580
00:35:39,570 --> 00:35:40,770
It's opcode zero.

581
00:35:40,770 --> 00:35:44,670
A lot of Diffie Hellman
parameter negotiation.

582
00:35:44,670 --> 00:35:46,830
If you're shutting down
the VPN to talk to it,

583
00:35:46,830 --> 00:35:48,540
there's a piece for that.

584
00:35:48,540 --> 00:35:52,140
There's kind of keep alives,
that keep the connection going,

585
00:35:52,140 --> 00:35:55,320
and the service will kill it off

586
00:35:55,320 --> 00:35:58,293
if it doesn't see keep alives in a while.

587
00:36:01,230 --> 00:36:06,230
Interestingly, there's
this event queue too,

588
00:36:06,600 --> 00:36:10,710
that sits at this protocol layer,

589
00:36:10,710 --> 00:36:15,710
where a lot of server side events happen

590
00:36:16,740 --> 00:36:19,890
at this layer two,

591
00:36:19,890 --> 00:36:23,793
sitting underneath the TCP and all that.

592
00:36:25,110 --> 00:36:28,290
If you've ever seen your
friend wants to invite you

593
00:36:28,290 --> 00:36:29,460
to a game,

594
00:36:29,460 --> 00:36:32,520
or they started playing another thing,

595
00:36:32,520 --> 00:36:35,490
and it pushes an event to your console,

596
00:36:35,490 --> 00:36:37,503
and it makes a little pop-up,

597
00:36:41,400 --> 00:36:45,600
that event ends up getting
pushed down at that layer two,

598
00:36:45,600 --> 00:36:46,740
which is really interesting to me.

599
00:36:46,740 --> 00:36:50,130
There isn't a equivalent of a web socket

600
00:36:50,130 --> 00:36:51,270
or something that they have.

601
00:36:51,270 --> 00:36:53,100
Obviously, they didn't
have web sockets in 2002,

602
00:36:53,100 --> 00:36:57,480
but there isn't some higher level protocol

603
00:36:57,480 --> 00:36:59,160
that's being kept together,

604
00:36:59,160 --> 00:37:03,960
but it's all sort of
negotiated at this low level

605
00:37:03,960 --> 00:37:05,970
that these events are taking place,

606
00:37:05,970 --> 00:37:07,443
which is really interesting.

607
00:37:08,430 --> 00:37:12,360
There's also a bunch of
throttling and QOS management

608
00:37:12,360 --> 00:37:15,603
that happens in negotiating at this layer.

609
00:37:16,980 --> 00:37:20,610
The other opcodes, we have UDP and TCP,

610
00:37:20,610 --> 00:37:22,590
but they remove a bunch of stuff.

611
00:37:22,590 --> 00:37:26,223
If every packet is signed,
then you don't need check sums.

612
00:37:27,720 --> 00:37:31,189
I think they removed the urgent bit

613
00:37:31,189 --> 00:37:36,189
out of their TCP stack, which is awesome.

614
00:37:37,320 --> 00:37:40,383
Urgents, awful. I wish
everybody could remove urgent.

615
00:37:43,320 --> 00:37:47,010
Each of these has actually three opcodes,

616
00:37:47,010 --> 00:37:51,963
because they do a cute scheme
where, if you're port 1024,

617
00:37:55,880 --> 00:37:58,290
you don't actually have to list the ports.

618
00:37:58,290 --> 00:38:02,130
If you're within like 127 of that port,

619
00:38:02,130 --> 00:38:07,113
then you can list the ports
as just single byte offsets.

620
00:38:08,490 --> 00:38:09,690
But if you're one of the other ports,

621
00:38:09,690 --> 00:38:12,633
you do normal two byte
ports, like you would expect.

622
00:38:14,160 --> 00:38:16,440
There's also VDP, which I hinted at.

623
00:38:16,440 --> 00:38:19,890
And so, that's UDP, but
with part of the payload

624
00:38:19,890 --> 00:38:22,590
that is outside of the encrypted segment,

625
00:38:22,590 --> 00:38:24,633
and that's where it stores voice,

626
00:38:26,850 --> 00:38:30,810
which means that voice in
Xbox Live is unencrypted

627
00:38:30,810 --> 00:38:31,740
in the air.

628
00:38:31,740 --> 00:38:35,550
And that is ostensibly
for lawful intercept,

629
00:38:35,550 --> 00:38:40,550
so that the cops can
get a wire and trace you

630
00:38:41,790 --> 00:38:44,463
and look at everything you're saying.

631
00:38:46,590 --> 00:38:47,853
That is what that is.

632
00:38:49,200 --> 00:38:54,200
Don't plan an insurrection over Xbox Live,

633
00:38:54,990 --> 00:38:56,463
I guess is the point there.

634
00:38:58,290 --> 00:38:59,139
Cool.

635
00:38:59,139 --> 00:39:01,680
And then, at that point
you have a full connection

636
00:39:01,680 --> 00:39:02,513
into the VPN.

637
00:39:02,513 --> 00:39:05,790
You have a cryptographic
attestation to your identity.

638
00:39:05,790 --> 00:39:10,790
That identity also contains
which services on the backend

639
00:39:12,360 --> 00:39:14,190
you're allowed to talk to.

640
00:39:14,190 --> 00:39:17,310
There's about 20 of them,
at least on the original.

641
00:39:17,310 --> 00:39:19,053
I haven't checked in recently.

642
00:39:20,790 --> 00:39:24,273
There's this one called
presence that always gets used;

643
00:39:25,440 --> 00:39:28,740
essentially, that's where you
end up pushing your event,

644
00:39:28,740 --> 00:39:30,633
that you are in a game,

645
00:39:32,190 --> 00:39:34,830
and it ends up being a dumping ground

646
00:39:34,830 --> 00:39:39,830
for a lot of

647
00:39:40,320 --> 00:39:43,620
the ancillary pieces

648
00:39:43,620 --> 00:39:45,243
of Xbox Live, as well.

649
00:39:46,950 --> 00:39:49,470
Games can have custom services.

650
00:39:49,470 --> 00:39:54,120
So, if you think, classic ones are MMOs,

651
00:39:54,120 --> 00:39:57,150
will have custom services
for their backends,

652
00:39:57,150 --> 00:39:59,400
so they'll just negotiate a different one,

653
00:39:59,400 --> 00:40:01,830
and they'll connect through there.

654
00:40:01,830 --> 00:40:05,013
Even if you're an MMO and
you're running your own servers,

655
00:40:07,590 --> 00:40:09,450
all of these communications still end up

656
00:40:09,450 --> 00:40:11,313
initially hitting this VPN.

657
00:40:12,480 --> 00:40:16,860
Everything is encrypted
through and through,

658
00:40:16,860 --> 00:40:19,620
and is this one protocol stack.

659
00:40:19,620 --> 00:40:22,360
Unfortunately, as I've been

660
00:40:24,542 --> 00:40:26,280
reimplementing the stuff,

661
00:40:26,280 --> 00:40:28,290
I played a lot of Halo 2 as a teenager.

662
00:40:28,290 --> 00:40:30,810
I joke that I am doing this,

663
00:40:30,810 --> 00:40:32,640
so that when I hit my midlife crisis,

664
00:40:32,640 --> 00:40:36,153
I have what I wanted to do
when I was a teenager as well.

665
00:40:37,200 --> 00:40:40,860
But Halo 2 uses a custom service as well,

666
00:40:40,860 --> 00:40:42,813
so it doesn't come for free,

667
00:40:43,680 --> 00:40:47,343
but I'm sure we'll get there.

668
00:40:49,590 --> 00:40:52,740
These backend services
actually tend to be HTTP.

669
00:40:52,740 --> 00:40:56,700
They tend to be with
custom binary payloads

670
00:40:56,700 --> 00:40:58,710
on a per-service basis,

671
00:40:58,710 --> 00:41:02,070
but I wasn't really expecting something

672
00:41:02,070 --> 00:41:03,423
as forward-looking.

673
00:41:05,100 --> 00:41:07,890
Really, really strong inclinations

674
00:41:07,890 --> 00:41:12,750
that they're primarily
written in C# ASP.net servers.

675
00:41:12,750 --> 00:41:16,350
There's a lot of .ASHX endpoints,

676
00:41:16,350 --> 00:41:19,650
which in context, would've
been like a beta version

677
00:41:19,650 --> 00:41:22,173
of ASP.net, I think,

678
00:41:23,160 --> 00:41:27,450
which is really, really,
really forward looking

679
00:41:27,450 --> 00:41:29,913
for, at least in my mind,

680
00:41:32,910 --> 00:41:37,910
how to release internet
connected service for 2002.

681
00:41:37,980 --> 00:41:42,390
And really, once you have TCP up,

682
00:41:42,390 --> 00:41:46,860
to just treat everything
as HTTP, for 2002 era,

683
00:41:46,860 --> 00:41:50,703
was quite forward looking.

684
00:41:52,080 --> 00:41:55,590
So, going through it, presence,
like we said, always exists.

685
00:41:55,590 --> 00:41:57,870
That's where client push events come from.

686
00:41:57,870 --> 00:42:00,600
Like we said, there is
that event queue where,

687
00:42:00,600 --> 00:42:02,340
for server pushed events,

688
00:42:02,340 --> 00:42:04,710
this is where the client
pushed events for the most part

689
00:42:04,710 --> 00:42:05,973
end up coming from.

690
00:42:07,080 --> 00:42:07,950
Matchmaking.

691
00:42:07,950 --> 00:42:11,100
This is a matchmaking service that will,

692
00:42:11,100 --> 00:42:16,100
for games that aren't
ranked, for the most part,

693
00:42:19,410 --> 00:42:22,560
but you're just trying to
find somebody close to you,

694
00:42:22,560 --> 00:42:24,270
maybe somebody close to your Geo IP,

695
00:42:24,270 --> 00:42:29,270
or somebody with low
ping, for whatever reason,

696
00:42:29,370 --> 00:42:32,100
ends up going through matchmaking service.

697
00:42:32,100 --> 00:42:33,630
There's a string service

698
00:42:33,630 --> 00:42:36,330
that I think does internationalization

699
00:42:36,330 --> 00:42:41,330
and maybe sanitization for
moderation so they can update,

700
00:42:41,377 --> 00:42:44,607
"These are the words you're
not allowed to say and query."

701
00:42:45,840 --> 00:42:50,840
There's feedback, which is,
"This guy called me a slur."

702
00:42:52,290 --> 00:42:54,840
So, moderation requests
end up going through there.

703
00:42:56,100 --> 00:43:00,033
Stats. There's leaderboards
go through there.

704
00:43:04,950 --> 00:43:07,320
I figured out a couple more of these

705
00:43:07,320 --> 00:43:08,820
since I wrote up these slides.

706
00:43:11,190 --> 00:43:14,640
For ranked matches, that's
where it ends up building up

707
00:43:14,640 --> 00:43:18,120
your ELO and or whatever algorithm

708
00:43:18,120 --> 00:43:20,520
is off of the stats information.

709
00:43:20,520 --> 00:43:22,440
There's also a arbitration service

710
00:43:22,440 --> 00:43:25,770
that looks a lot like matchmaking,

711
00:43:25,770 --> 00:43:29,883
but it ends up generating
sessions for ranked play.

712
00:43:32,010 --> 00:43:36,990
Messaging: you can send
users messages, pretty clear.

713
00:43:36,990 --> 00:43:38,163
Auto-update.

714
00:43:39,000 --> 00:43:42,870
This is one of those key
pieces that was, like I said,

715
00:43:42,870 --> 00:43:44,580
newer to Xbox Live,

716
00:43:44,580 --> 00:43:47,850
because they had the
storage on each console

717
00:43:47,850 --> 00:43:49,440
necessary to do this.

718
00:43:49,440 --> 00:43:51,150
Making sure that everybody's
playing the same version

719
00:43:51,150 --> 00:43:52,173
of the game.

720
00:43:53,400 --> 00:43:56,163
And then, there's team
management, is a team service.

721
00:43:58,080 --> 00:43:59,250
Let's see.

722
00:43:59,250 --> 00:44:02,580
Oh, and there's also a
NAT detection service

723
00:44:02,580 --> 00:44:06,960
that'll let you do NAT punching,

724
00:44:06,960 --> 00:44:09,660
and at least NAT understanding.

725
00:44:09,660 --> 00:44:12,810
A lot of the NAT stuff
is actually interesting,

726
00:44:12,810 --> 00:44:16,533
because by sticking
everything on that port 3074,

727
00:44:17,970 --> 00:44:20,550
you get a lot of NAT punching for free,

728
00:44:20,550 --> 00:44:22,860
because you've already communicated

729
00:44:22,860 --> 00:44:26,220
to the external services.

730
00:44:26,220 --> 00:44:29,130
And therefore, any incoming game request

731
00:44:29,130 --> 00:44:30,630
can also come in on that port,

732
00:44:30,630 --> 00:44:34,353
because you've already
done 80% of NAT punching.

733
00:44:35,700 --> 00:44:38,523
So, it's a nice way to do that.

734
00:44:40,170 --> 00:44:41,340
Sweet.

735
00:44:41,340 --> 00:44:45,000
Then, we have match, or
just joining a game session.

736
00:44:45,000 --> 00:44:46,536
What does that look like?

737
00:44:46,536 --> 00:44:49,440
You end up using the
matchmaking service to query for

738
00:44:49,440 --> 00:44:51,483
or create a session.

739
00:44:52,620 --> 00:44:55,410
That session information
ends up containing a host,

740
00:44:55,410 --> 00:44:59,730
and a lot of the random parameters

741
00:44:59,730 --> 00:45:01,983
of what a game will contain.

742
00:45:03,150 --> 00:45:04,860
There'll be a session identifier,

743
00:45:04,860 --> 00:45:07,950
there'll be a key exchange key,

744
00:45:07,950 --> 00:45:10,110
which lets boxes talk to each other

745
00:45:10,110 --> 00:45:12,303
without Diffie Hellm-ing to each other.

746
00:45:14,580 --> 00:45:19,580
Once a box gets a list of
potential hosts to join a game in,

747
00:45:23,040 --> 00:45:25,680
they end up logging into that host

748
00:45:25,680 --> 00:45:28,053
with more or less the same VPN protocol.

749
00:45:30,510 --> 00:45:35,510
That VPN is ultimately the base layer

750
00:45:36,780 --> 00:45:41,780
of even that piece, and
system link as well.

751
00:45:45,780 --> 00:45:47,613
We already covered NAT punching.

752
00:45:50,880 --> 00:45:51,783
System link.

753
00:45:54,600 --> 00:45:55,433
Yeah.

754
00:45:55,433 --> 00:45:56,350
System link's about the same.

755
00:45:59,130 --> 00:46:01,500
They will throw out a broadcast packet

756
00:46:01,500 --> 00:46:04,290
encrypted with essentially the same key,

757
00:46:04,290 --> 00:46:05,123
but

758
00:46:09,930 --> 00:46:14,370
it'll be like a per-game
key that's on the disc,

759
00:46:14,370 --> 00:46:18,240
so that they can see each
other's game announcements.

760
00:46:18,240 --> 00:46:23,240
And then, ultimately, the host
box will set up a VPN server

761
00:46:23,700 --> 00:46:26,130
and the other boxes will VPN into it,

762
00:46:26,130 --> 00:46:28,280
and that's how system
link ends up working.

763
00:46:29,580 --> 00:46:33,210
It looks like actually games
don't have a TCP stack,

764
00:46:33,210 --> 00:46:38,210
other than based on this VPN protocol.

765
00:46:38,520 --> 00:46:40,823
So, they couldn't even do
anything if they wanted to.

766
00:46:42,360 --> 00:46:43,380
Cool.

767
00:46:43,380 --> 00:46:46,080
How do you go about reversing this stuff?

768
00:46:46,080 --> 00:46:47,493
Lot of staring at Ghidra.

769
00:46:51,720 --> 00:46:54,750
I wanna give a shout out
to whatever contractor

770
00:46:54,750 --> 00:46:58,890
had to add Xbox executable
support to Ghidra.

771
00:46:58,890 --> 00:47:02,790
It probably didn't need to
happen at that point anymore,

772
00:47:02,790 --> 00:47:04,170
and he probably was
wondering what he was doing

773
00:47:04,170 --> 00:47:07,337
with his life, but I really appreciate it.

774
00:47:07,337 --> 00:47:10,287
It was probably one of the best
uses of my defense dollars.

775
00:47:12,270 --> 00:47:14,160
Going looking at it,

776
00:47:14,160 --> 00:47:18,810
Gauntlet Dark Legacy ships
with a PDB just on the disc.

777
00:47:18,810 --> 00:47:21,720
It doesn't have the online capabilities,

778
00:47:21,720 --> 00:47:24,720
but you can get your bearings

779
00:47:24,720 --> 00:47:27,000
about what an Xbox game looks like.

780
00:47:27,000 --> 00:47:29,850
Red Star is an online game that ships

781
00:47:29,850 --> 00:47:31,050
with the full symbol map,

782
00:47:31,050 --> 00:47:34,833
including the online shared libraries.

783
00:47:36,030 --> 00:47:41,030
Jedi Knight: Jedi Academy
GPLed their Xbox version,

784
00:47:41,610 --> 00:47:42,730
and that includes

785
00:47:47,340 --> 00:47:49,920
all of the online components,

786
00:47:49,920 --> 00:47:53,280
not the Microsoft code
directly, but how to call it.

787
00:47:53,280 --> 00:47:55,950
And then, in every
executable XONLINE, XNET

788
00:47:55,950 --> 00:48:00,150
is broken out into separate sections.

789
00:48:00,150 --> 00:48:03,540
XONLINE is the online component.

790
00:48:03,540 --> 00:48:06,063
XNET is what you just
need for a system link,

791
00:48:07,380 --> 00:48:09,900
and contains the VPN stack, essentially.

792
00:48:09,900 --> 00:48:12,390
All crypto is cleanly
exported by the kernel,

793
00:48:12,390 --> 00:48:14,340
so you can see that on the import list.

794
00:48:16,140 --> 00:48:19,830
You can go here,
github.com/xombieonline/xombie

795
00:48:19,830 --> 00:48:22,620
is AGPL source for reimplementation.

796
00:48:22,620 --> 00:48:23,883
Very proof of concept.

797
00:48:25,440 --> 00:48:26,910
PRs are welcome.

798
00:48:26,910 --> 00:48:30,180
Xombie.org, whenever I end
up updating DNS entries,

799
00:48:30,180 --> 00:48:32,560
will be where you go
to sign up for an alpha

800
00:48:33,630 --> 00:48:35,763
to get at it back online.

801
00:48:39,270 --> 00:48:40,103
Yeah.

802
00:48:40,103 --> 00:48:41,010
I kind of wanna move the industry

803
00:48:41,010 --> 00:48:45,030
towards a theory of software
security harm reduction

804
00:48:45,030 --> 00:48:48,573
when it comes to network services.

805
00:48:51,399 --> 00:48:52,449
And so, where I'm at:

806
00:48:55,530 --> 00:48:59,610
people are gonna use software now online

807
00:48:59,610 --> 00:49:01,503
that they can't update anymore.

808
00:49:05,010 --> 00:49:09,240
Rule one is don't do that,
but people are gonna do that.

809
00:49:09,240 --> 00:49:12,540
So, I'm open sourcing a lot of this stuff

810
00:49:12,540 --> 00:49:17,280
to really start thinking about
how we can protect people,

811
00:49:17,280 --> 00:49:21,150
even in these very unsafe conditions,

812
00:49:21,150 --> 00:49:23,760
and start opening things up,

813
00:49:23,760 --> 00:49:28,713
and doing so by shining a
light and adding knowledge.

814
00:49:33,706 --> 00:49:36,690
I don't think we have time
for the demo as given,

815
00:49:36,690 --> 00:49:38,190
and I don't think it's gonna work.

816
00:49:38,190 --> 00:49:39,023
Yeah.

817
00:49:39,023 --> 00:49:40,378
So, sweet.

818
00:49:40,378 --> 00:49:43,378
(audience applauds)