Xbox One Hacked: First Exploit Found After 10 Years

The Xbox One, long considered a secure gaming console since its 2013 release, has been successfully hacked, a feat accomplished by developer Markus Gaasedelen utilizing a voltage glitch exploit. Gaasedelen revealed the method at the REverse Conference, demonstrating a previously thought impossible breach of the console’s security.

Microsoft designed the Xbox One with multiple layers of security, including compartimentalization, virtualization and revocation protocols, intended to prevent unauthorized access. According to Tony Chen of Microsoft, speaking at the 2019 Platform Security Summit, the entire chain of trust rested on maintaining control of the boot ROM. This boot ROM became the focal point of Gaasedelen’s efforts.

The hack, dubbed the “Bliss” exploit, involves triggering two consecutive voltage glitches. This allowed Gaasedelen to bypass microprocessor initialization and hijack the program counter as a user. This, in turn, enabled the corruption of the supervisor with shell code, granting access to the highest level of system privileges, as reported by TechSpot.

Gaasedelen clarified that this exploit is limited to the original Xbox One model. Newer Xbox Series X/S consoles remain unhackable, according to his findings. This distinction highlights the security improvements implemented in subsequent generations of the console. The successful hack is being hailed by some as a significant win for game preservation, as it could potentially allow for greater flexibility in how older games are accessed and played, as noted by Sportskeeda Tech.

The vulnerability exploited by Gaasedelen has prompted discussion about the ongoing arms race between security developers, and hackers. While Microsoft has not yet issued a statement regarding the exploit, the revelation raises questions about the long-term security of older gaming consoles and the potential for similar vulnerabilities to be discovered in other systems. Boing Boing reported that Microsoft currently has no patch available to address the issue.