Major flaw in Nintendo's SSL implementation allows DS owners to get back online

[Master Disaster]

I'm not going to pretend i understand this exploit because i don't however its been confirmed to work with the DS (and could possibly also be ported to the Wii as well). All it takes is the user to change their DNS and they're back online.

 

Here's the details

Quote

Background information

 

On Nintendo's consoles, online communications are carried out over various protocols but the predominant of these is HTTPS - HTTP carried within encrypted SSL packets. After some initial unencrypted handshake steps in which the two parties exchange version information and capabilities, SSL servers will present an SSL certificate to the client containing the server's public key. The client uses the server's public key to encrypt a shared secret that the server will decrypt with its private key. This secret is used to protect a further key exchange step (e.g. Diffie-Hellman, although this can vary depending on the capabilities of each party) which will establish a new shared secret to be used to encrypt all further communications. Since SSL is a recognised web standard it is fairly simple for anyone competent to setup a compatible server - however, SSL certificates (and indeed X509 certificates in general) are almost always signed by a certifying authority so that the client knows it can trust the server it's connecting to. Unfortunately for us, the Nintendo SDK will refuse to connect to any server without a certificate signed by a trusted Nintendo CA, and Nintendo are of course not going to simply sign certificates for custom server authors to emulate theirs, leaving us unable to do anything without code patches... in theory.

The flaw

 

SSL certificate authorities can choose to add a flag to certificates they sign to state that this certificate is allowed to act as an intermediate CA too - that is, it can sign certificates. If the SSL server includes the intermediate CA's certificate with its own signed by that same intermediate, the client can follow the chain of trust back up to the root and will therefore accept the certificate. This, however, is where Nintendo's fatal flaw lies: in their implementation, they do not check if the intermediate certificate is supposed to sign other certs or not (indicated by a flag in the certificate's basicConstraints section - CA:TRUE or CA:FALSE, as appropriate - leading to the name we gave this flaw), and as such if one has any certificate signed by Nintendo with its accompanying private key, they can use it as an intermediate CA to sign their own certificates.

 

And as it happens, we do.

 

Nintendo consoles from the Wii onwards include a Nintendo-signed client certificate which it uses to authenticate with Nintendo servers, as well as the accompanying private key for it. This client certificate is signed by the same CA as Nintendo's server certificates and as such is trusted by the DS.

 

TL;DR: client certs can sign certs and the DS doesn't care!

To use this exploit you can setup your own private webserver (ain't nobody got time for that) and use the provided certificates however it relies on SSLV3 which has been disabled for security reasons so setup takes some knowledge. You can also simply change your DSes DNS settings to the following

Quote

In order to join Kaeru Team's official server, you can use the following DNS settings: Primary: 178.62.43.212 Secondary: 1.1.1.1 or 8.8.8.8

Source - https://github.com/KaeruTeam/nds-constraint

 

Wow Nintendo don't do security very well at all do they. Great for DS owners I suppose, hackless online mode is something a lot of people wanted.

[goodtofufriday]

Im in a discord server thats already using this

[sazrocks]

So theoretically this would work with the wii? If so I would really like to play some online MK.

[Master Disaster]

Just now, sazrocks said:

So theoretically this would work with the wii? If so I would really like to play some online MK.

Some users are saying yes, others are saying no. I can't find anyone who seems to know for sure.

[DrMacintosh]

So, like, I don't understand the significance of this

[goodtofufriday]

1 minute ago, DrMacintosh said:

So, like, I don't understand the significance of this

We can play ds games online again. Mainly multiplayer things

[williamcll]

I hope this gets included in emulators.

[Bcat00]

Umm, wouldn't this topic be against forum guidelines since it is technically spreading a partial guide on how to hack back into their online stuff?

 

Oh well, maybe I should go take my cousins DS and see if I can get this to work. He got banned like a month after he bought that thing a few years back and he nearly cried for it lol

[Aetheria]

9 hours ago, DrMacintosh said:

So, like, I don't understand the significance of this

It means custom multiplayer servers for a dead console Nintendo refuses to support anymore.

 

https://www.polygon.com/2014/2/26/5452114/nintendo-killing-nintendo-wi-fi-connection-service-for-ds-and-wii-may

[BuckGup]

9 hours ago, sazrocks said:

So theoretically this would work with the wii? If so I would really like to play some online MK.

Online mario kart hell yeah

[Trik'Stari]

I wonder how this is effected in the US by the recent change to copyright laws in regards to DRM and whatnot.

 

If the service provider no longer provides these services to these games, can they legitimately call bullshit when people hack through everything to make the games work again?

 

I mean, they shouldn't be able to. You're no longer offering that service that people have paid for, so it's not a direct threat to your current business. If it is, that's your own fault for stopping service and being an idiotic business.

[JoeCoke]

10 hours ago, sazrocks said:

So theoretically this would work with the wii? If so I would really like to play some online MK.

Wiimmfi already restores online play for most games, and riiconnect 24 restores messaging and most channel's online functionality.

 

(though I understand people wanting a hackless way.)

[Master Disaster]

5 hours ago, Bcat00 said:

Umm, wouldn't this topic be against forum guidelines since it is technically spreading a partial guide on how to hack back into their online stuff?

 

Oh well, maybe I should go take my cousins DS and see if I can get this to work. He got banned like a month after he bought that thing a few years back and he nearly cried for it lol

It's not hacking, that's the point. All you have to do is change DNS settings and it works, a feature supported OOTB on the DS.

[TacoSenpai]

15 hours ago, DrMacintosh said:

So, like, I don't understand the significance of this

The resurgence of the underground Mario Kart turf wars.  Toad vs Yoshi crack gangs don't f@&k around.

[Monkey Dust]

Cool. As internet enabled, then internet dependant, consoles ages we will need discoveries like this to keep them, and more importantly their games, alive. Video game preservation is in a pretty rubbish state, and with increasing numbers of games partly or wholly dependant on remote servers it's going to get worse without developments like this. 

[Sauron]

15 hours ago, sazrocks said:

So theoretically this would work with the wii? If so I would really like to play some online MK.

It's unclear from the article alone, but I think the answer is no. Consoles from the Wii onwards include a Nintendo certificate, however that alone is not enough for this to work - the software must be vulnerable to the exploit. In the case of the DS, it simply doesn't check whether or not the certificate used to sign the server's certificate was allowed to do so or not, which allows anyone with a Nintendo console (from the Wii onwards) to sign their own certificates in a way that the DS will accept. Maybe it's the same with the Wii, but I think the article would have mentioned it if that were the case.

[ZacoAttaco]

4 hours ago, Master Disaster said:

It's not hacking, that's the point. All you have to do is change DNS settings and it works, a feature supported OOTB on the DS.

That's what makes this story so interesting is that this design flaw has existed probably since the launch of the Wii/DS era and it's only recently been discovered. Who knows how many other flaws have existed and what functionality they can potentially provide. If Nintendo wanted to fix this, they'd have to patch DS and Wii devices and then perhaps make modifications to their own back-end? I'm sure they'll try something.

[Master Disaster]

1 minute ago, ZacoAttaco said:

That's what makes this story so interesting is that this design flaw has existed probably since the launch of the Wii/DS era and it's only recently been discovered. Who knows how many other flaws have existed and what functionality they can potentially provide. If Nintendo wanted to fix this, they'd have to patch DS and Wii devices and then perhaps make modifications to their own back-end? I'm sure they'll try something.

Nintendo can't fix this, no online means no way of pushing updates and they can change whatever they like on their own servers, this is a private server exploit.

 

Honestly if they take offense (and with Big N you just never know) they'll slap the server owner with a C&D but now the exploit is out there they pretty much can't stop it. There's nothing to stop anybody from creating their own server and running it privately.

[DeScruff]

10 hours ago, ZacoAttaco said:

they'd have to patch DS

How soon we forget. The DS didn't get OS updates. - at least not till the DSi
This is why R4 cards and piracy was so rampant on the DS.

[ZacoAttaco]

17 hours ago, Sypran said:

How soon we forget. The DS didn't get OS updates. - at least not till the DSi
This is why R4 cards and piracy was so rampant on the DS.

Thanks for the clarification, I was so young when I used the DS Lite but now that I remember, there were no updates. It really had very limited internet functionality especially compared to the rival PSP at the time.

[bcredeur97]

13 minutes ago, ZacoAttaco said:

Thanks for the clarification, I was so young when I used the DS Lite but now that I remember, there were no updates. It really had very limited internet functionality especially compared to the rival PSP at the time.

this is far more interesting for people who want to dust off their wii. 

But Nintendo is going to close it.... they have to.. it's a security issue. I wouldn't run out and buy an old wii. 

This does show they are completely capable of supporting the old hardware tho.. they just choose not to. go buy the new thing. They really should of just made it open after deprecating it...

[Okjoek]

This sounds amazing.

[imreloadin]

On 11/7/2018 at 10:43 AM, Aetheria said:

It means custom multiplayer servers for a dead console Nintendo refuses to support anymore.

 

https://www.polygon.com/2014/2/26/5452114/nintendo-killing-nintendo-wi-fi-connection-service-for-ds-and-wii-may

They'll bring back support just to fix this "bug"...

[Raspi454]

On 11/7/2018 at 6:44 AM, Bcat00 said:

Umm, wouldn't this topic be against forum guidelines since it is technically spreading a partial guide on how to hack back into their online stuff?

  

 Oh well, maybe I should go take my cousins DS and see if I can get this to work. He got banned like a month after he bought that thing a few years back and he nearly cried for it lol

Changing your dns settings isn't "hacking"

[SupremeGOAT]

lol because of nintendo's negligence they're getting sloppy in regards to their old devices... 11.8.0 is now fully user modable on the 3ds without opening the device... now this? lol keep it up nintendo...