Xbox One Exploit Proof of Concept Released, Based on Chakra Exploit

[colemickens]

I don't know much at all about the Xbox One architecture (and what I do is from public information obviously), but it seems safe to assume that this exploit would only land in the "Application" portion of the system. As I understand there are two (three?) hypervisor-level isolated portions of the system... particularly for cases like this in order to prevent a compromised application from being able to enable piracy of the "GameOS" portion.

[gambiting]

There are actually 3 different OSes running on the Xbox One. Applications are in their own OS, so any "kernel" exploit would only grant them access to that very limited OS that can't run games. Unless, of course, they somehow manage to escape that container and force VM to run their own modified version of GameOS.

[watsonc73]

"I do not have an xbox one and cannot verify that the exploit indeed works. With that being said, there’s enough hints pointing to this being real so if you have an XBox running on the affected firmware, feel free to give it a try and comment."

I've no doubt this exploit is legit but it would be nice for reporters to actually verify these issues themselves before posting online.

The above basically reads to me I'M TOO LAZY TO CHECK MYSELF

[spondyl]

I would struggle to call wololo a reporter. The site is more of a "scene" blog so I don't actually know what resources he has.

For example, you might expect Ars Technica to own an Xbox One but wololo may not have one himself but yeah, I know what you mean.

EDIT: Oh, I overlooked the part where he says "yup, I still don’t have an Xbox One…" so there ya go

[lawl]

He said he doesn't have an xbox one in TFA. What do you want him to do? Go buy one so he can make a blog post?

[wpietri]

Looking around, this appears to be a hobbyist news and discussion site. Here's the news portion:

http://wololo.net/category/news/

Even if this were the New York Times talking about an exploit, I'd expect their reporters to, well, report, not necessarily directly verify something themselves. And this is quite clear that it's unconfirmed. What he does do is report what the developer is saying, adding sufficient context for non-experts to understand, and giving links so those interested can learn more. Presumably once it's verified, there will be another article saying so.

Given that, it seems like perfectly fine amateur journalism. Why do you expect it to be something else?

[matt_wulfeck]

Sounds more like a liability thing to me. "I've never actually done it wink wink"

[userbinator]

It reminds me of the Knuth quote: "Beware of bugs in the above code; I have only proved it correct, not tried it."