5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability

[dredmorbius]

NB: what is it about small and local news sites, usually TV stations, but also newspapers and such, which cannot * CLEARLY * indicate where in the world they are?

"Ocean Beach" is a pleasantly anonymous place name (I can think of several neighborhoods matching this, the U.S. Gazetteer of Places identifies it as Ocean Beach, NY), affording very little by way of actual location.

In an age before widespread Internet use, I experienced similar frustrations while listening to clear channel AM radio broadcasts in the back country. It wasn't uncommon to pull in strong signals from hundreds to a thousand miles away. And while there's something delightfully surreal in listening to the mundania of local traffic and news reports, if you happen to be in a wilderness location trying to find a reliable weather forecast, "area conditions" doesn't do much for you.

[fps]

I've noticed the same thing, and I can't figure out why they do it. You can usually get hints about where they are by the advertisers they have, or in the case of TV or radio stations, by looking up their call letters on wikipedia: http://en.wikipedia.org/wiki/KGTV

FYI, Ocean Beach in this case isn't even a town, it's a neighborhood in San Diego, CA. Ocean Beach, NY is a beach town with very, very few permanent residents because it's only accessible by ferry or bicycle.

[ef47d35620c1]

A local news outlet in the town of Springfield doesn't typically need to place the town name in absolute terms. The locals know what they mean. Springfield is the place (right here) that they all know and love.

The onus falls on national/international news outlets to make those clarifications when necessary.

Also, for accurate weather, you should tune your radio accordingly:

    http://www.nws.noaa.gov/nwr/nwrbro.htm

[atacrawl]

Completely agree. "Where are you?" is basic information when location is at all relevant, and site designers frequently make the false assumption that every visitor is a local who knows exactly what you meant.

And it's not just news sites -- I once made a service reservation at a Toyota dealership in another state because it had the same name as the one I wanted and no indication of where it was in any global assets (it was buried on a "directions" page).

[eddieroger]

I don't mind a local news channel using local references in headlines, but it would have been nice for the submission title to be modified accordingly.

[anarchy8]

http://en.wikipedia.org/wiki/KGTV San Diego, California

[furyofantares]

I can see an argument for intentionally leaving that info off. They are a local site and don't really care about one off traffic like mine or yours, we won't be coming back anyway. And specifying that info may make the site feel less local to the actual repeat audience.

[chanced]

"At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key."

Not to be "that guy" or anything but I suspect it is pretty normal for a child to hold down a button.

First, what kind of lousy lock wouldn't safeguard against, what was likely either the only or one of a few buttons, being held down?

Second, sounds like proud father has made at least a few false connections. He is a geeky equivalent of a creationist museum tourist.

[0xbadcafebee]

Wow. This is the mavis beacon typing tutor hack.

Years ago (jesus, has it been 15 years?), I was in computer class on the old Macintoshes they had with Mavis Beacon Typing Tutor. We were supposed to type out the sentences we read to increase our typing speed, and learn the home row. I hated home row, and insisted that hunt-and-peck was more comfortable for me. But the teacher was adamant I use home row only, which was annoying. I was also not very fast at either form of typing.

I discovered by accident that if I hit the spacebar for each letter in each word, the program interpreted it as a successful spelling. All I had to do was keep typing the spacebar to complete the words. So i'd put my fingers on the home row, moving my fingers up and down, and pressing the spacebar with my thumb. I got 120 words per minute.

[davidb_]

I remember discovering a similar (maybe the same) bug in my typing classes. I was a fairly good typist, so I would finish the assignment as quickly as I could and then play games on the computer. The teacher wasn't very happy with this and wanted me to continue typing. So, in frustration and boredom, I just typed a bunch of spaces and was quite surprised when it accepted it as correct. I told a few of my friends about this and it quickly spread. The teacher became suspicious of the scores, and I got blamed for discovering the flaw. The teacher then decided she had to watch me complete every one of the typing excercises to make sure I wasn't cheating. Luckily for me, after a few weeks of that she let me go back to completing the assignments quickly and playing games. I still wish my school would have had a more knowledgeable computer teacher to push me to do programming excercises or something more productive than wasting that time playing games.

[72deluxe]

Haha that's stupid. Did the program not bother checking to see what the keycodes were? Did it have just a function OnKeyPress that incremented the counter?

Laziness! Why do I bother writing decent software when there's so much junk floating around that people BUY?

[kilink]

In high school we had a similar class that required us to use Mavis Beacon (or some similar typing application) and report our words per minute. I thought this a waste of time and annoying, so I wrote a program to simulate the keystrokes and type for me. I think the teacher knew something was amiss though when it showed that I was typing at over 5000 words per minute.

[quackerhacker]

So I told this story to my wife, because at first I was a little envious (wishing my boy did this)...then her being the devil's advocate made me realize something...if a 5-year-old can bypass Xbox's verification by pressing space keys and enter then it says volumes about Xbox's verification checks.

Who was sleeping at the wheel when Xbox didn't add empty strings to password verification checks?

[kmfrk]

On another note, the whitehat bounty seems ridiculously low, if we're to take him as a peer:

    Kristoffer will receive four games, $50 and a year-long
    subscription to Xbox Live from Microsoft.

[quux]

As I read the article I kept expecting the part where he was suspended from school for the rest of the semester for breaking the school's zero tolerance policy on "cyber attacks" or something.

[yincrash]

It's really refreshing to see a family embrace their son's inventiveness and tenacity rather than reprimand the kid for breaking past the parental controls

[theandrewbailey]

It's really refreshing to see a company embrace their customer's inventiveness and tenacity rather than suing them for breaking their products.

[samelawrence]

Is it just me, or should they have given him more than $120 for exposing this major flaw?

[watty]

It may have just been a way to get into local accounts, which I wouldn't consider "major". Also four games, one year of live, and $50 is more than $120.

[wil421]

Why are the obligated to give something out for finding a flaw?

[zacharytamas]

I was thinking the same. If you value a video game at $50, it comes closer to $300 but that still seems paltry for a vulnerability that seems to give full access (from the console at least) to a user's account.

[ilbe]

Spaces, really? Can someone speculate what might be happening under the hood?

[binarymax]

It was noted as a backdoor. Presumably that means it was purposefully programmed in for testing (and possibly even production), and made its way into the delivered software. So the under-the-hood speculation being a simple if statement allowing for all-space passwords to grant access.

[rgo]

Not sure, but I had a similar bug once due to a trim() combined with an out-of-order string length check. But that would imply that Xbox Live does not allow passwords with spaces or something.

[zemo]

what level of crime is this? Does this count as computer trespass in NY? If so, that's a class E felony.

  § 156.10 Computer trespass.
    A person is guilty of computer trespass when he or she knowingly uses,
  causes to be used, or accesses a computer, computer service, or computer
  network without authorization and:
    1.  he or she does so with an intent to commit or attempt to commit or
  further the commission of any felony; or
    2. he or she thereby knowingly gains access to computer material.
    Computer trespass is a class E felony.

http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAW...

[dkrich]

Well, first the father would have to press charges against his 5-year-old son. Probably not likely, and, eh, I just can't.

[lawnchair_larry]

CFAA violation, affecting interstate commerce. Definitely also wire fraud. This kid better watch out for Carmen Ortiz and Stephen Heymann.

[vectorpush]

Look out homakov. :)

[crystalmace]

Oh sure. When he bypasses child locks he gets rewarded by his parents and Microsoft. When I bypassed child locks and parental controls when I was younger, I got in trouble and my computer taken away. :D

[elwell]

This is indicative of disorganized program structure. Form validation shouldn't be unique to separate forms; they should all be piped through the same place, where validation is done.

[Aardwolf]

When I was 5 years old all I could do was sort Duplo blocks by color, and I don't even have a memory of it :(. I get sort of jealous if I see how smart small kids can be.

[SwiftCeipt]

I don't think its that surprising, kids have all the time in the world. When I was a kid I worked on cracking the Fridge lock.. Perhaps my time was poorly spent.

[Evolved]

If you scroll down to the bottom where it says "Trending Now" all of the headlines (including this one) state 10news.com KGTV ABC San Diego.

[S4M]

Seriously, is this true or a late April's fool?

[raptorious]

This was my first thought also. But his name is actually on the list of security researchers (or someone who has the same name of course ;). http://technet.microsoft.com/en-us/security/cc308589.aspx

[snorkel]

Sennnsatioonal!!!

> At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key.

... uh ... pretty sure because that's because he watched his father doing in order to use the phone.

[elwell]

“I was like yea!”

[67726e]

Maybe I'm just cynical, but given that the father is a security researcher, does anyone else think that he himself found the vulnerability but concocted the story to get some free press?

[FLUX-YOU]

Wouldn't be the first time parents did the work for their kids to give them a line item on their 'resume'.

As an aside, this gave me an idea: Grey hat SEO/reputation consulting for your kids' reputations.

[Gracana]

You don't have to be a security researcher to type stuff into a password box and try it out. It doesn't seem so far-fetched to me.

[pervycreeper]

No, but surely it had something to do with the way the vulnerability was reported rather than merely shrugged off.

[wzy]

And after all that plotting he accepted $50, 4 game a year free Xbox Live? That seems very 'un-ambitious'