Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
XBox (Games) Microsoft Security

Five-Year-Old Uncovers Xbox One Login Flaw 196

New submitter Smiffa2001 writes: "The BBC reports that five-year-old Kristoffer Von Hassel from San Diego has uncovered a (frankly embarrassing) security flaw within the Xbox One login screen. Apparently by entering an incorrect password in the first prompt and then filling the second field with spaces, a user can log in without knowing a password to an account. Young Kristoffer's dad submitted the flaw to Microsoft — who have patched the flaw — and have generously provided four free games, $50, a year-long subscription to Xbox Live and an entry on their list of Security Researcher Acknowledgments."
This discussion has been archived. No new comments can be posted.

Five-Year-Old Uncovers Xbox One Login Flaw

Comments Filter:
  • $300? (Score:5, Insightful)

    by schneidafunk ( 795759 ) on Friday April 04, 2014 @03:11PM (#46663679)

    What does that come out to, about $300 for a severe bug? I thought Microsoft just paid out $100k for a Windows 8 flaw.

    • Re: (Score:3, Insightful)

      Such a small prize for a million dollar flaw. Basic QA should've caught this.
      • Re: (Score:2, Funny)

        by Anonymous Coward

        Basic QA should've caught this.

        For all the times we suspected it, now we have proof that they were all spaced out!

      • Re:$300? (Score:4, Insightful)

        by subanark ( 937286 ) on Friday April 04, 2014 @04:43PM (#46664795)

        "Filling out a text field with spaces" isn't something that usually gets tested. I can only imagine what kind of code flaw would cause this to work, but not some other set of characters.

        • Re: (Score:3, Interesting)

          My guess would be it was a debugging "feature" that someone forgot to turn off.

          But filling up password fields with certain common characters probably IS something that should be tested, even if it wasn't standard before.

        • Re:$300? (Score:4, Insightful)

          by organgtool ( 966989 ) on Friday April 04, 2014 @07:52PM (#46666113)

          "Filling out a text field with spaces" isn't something that usually gets tested.

          Which is why peer reviews of code changes are conducted at many places these days.

        • by rhizome ( 115711 )

          > isn't something that usually gets tested.

          I bet it does now, and competent developers *do* test corner cases.

      • QA? This bug is way too stupid. It should never even have existed, unless it was intentional. I mean, imagine the code; there's no possible variation where you get this sort of bugs.

    • by sl3xd ( 111641 ) on Friday April 04, 2014 @03:21PM (#46663835) Journal

      I'm sure the reason the reward was so paltry was because the rest of the reward went to cleaning the development team's underwear.

    • Re:$300? (Score:5, Informative)

      by DigitAl56K ( 805623 ) on Friday April 04, 2014 @03:26PM (#46663903)

      To put it in perspective, that $100K was for bypassing exploit mitigation features that cross all processes on the system, and would severely undermine Windows 8.1's security features. This one seems to require you to be standing in front of a specific console.

      Still, what a stupid bug to have.

      • Sounds like a way to log in to any console, anywhere, at any time... but, the physical presence thing is some measure of containment. At least one five year old can't take down every machine on the planet at once.

        • Sure he can. Lock him up before he hacks the planet!

          • Zero Cool? Crashed fifteen hundred and seven computers in one day? Biggest crash in history, front page New York Times August 10th, 1988. I thought you was black man. YO THIS IS ZERO COOL!
          • Not very long ago that comment would have made me chuckle at the sheer absurdity of tossing a 5 year old hacker into prison, with recent cases such as the one of Aaron Swartz in mind it only bring a disillusioned smile to my lips.

            On a side note, seriously Microsoft! that was one fucking cheap ass reward you came up with there, couple of games and a one year subscription. Do you actually want people to report bugs to you or do you want to encourage them to find a higher bidder, in this case an Indian street

    • Re:$300? (Score:4, Funny)

      by jones_supa ( 887896 ) on Friday April 04, 2014 @03:39PM (#46664055)
      At least they did the right thing and rewarded the kid about the discovery, instead of suing the father for "tampering with their security".
    • Re:$300? (Score:5, Interesting)

      by Redmancometh ( 2676319 ) on Friday April 04, 2014 @04:58PM (#46664917)

      I found a flaw in skype that allowed the dumping of usernames from regional nodes. I could run it on multiple threads and dump literally as high as 2048 per second (never tried with more threads...) Finding the other regional nodes wasn't exactly difficult.

      There are surprisingly dark uses for that ability.

      They sent me an Xbox 360 (this was less than a week before the Xbox one launch) bundle (kinect), 2 games, an Xbox Live Card, and a researcher acknowledgement on Technet (same as this kid) for August of 2013..I'm one of the "individual" entries with no link.

      I did get invited to bluehat as well which was absolutely incredible, but I paid for the flight, hotel (at a discounted rate, at the Westin, Seattle!), etc.

      It was a f*cking awesome conference.

      Skype isn't cover by their bug bounty program, so they said they had nothing they could do. I was pretty insistent that I really needed the money, because I really really needed the money. That was a brief period in my life of spam sandwiches and ramen.

      I'm not complaining, but I am saying if something isn't covered by their bounty program you're not going to get money from it.

      • What were the details of the skype bug? I'm curious how you found it.

        • Re:$300? (Score:5, Interesting)

          by Redmancometh ( 2676319 ) on Friday April 04, 2014 @05:19PM (#46665035)

          The last person who asked me that turned out to actually work with skype at bluehat. The whole team came over and THEN told me who they were -_-.
            I was just looking for a table with people who weren't anti-social, and one of the people happened to work for skype. Very very friendly people by the way.

          Basically I was trying to get into a friends machine (we were doing a mini CTF) and as a joke he gave me the IP to a skype regional node.

          I fuzzed said regional node and started getting really weird responses. I was trying a port that was open (same port as oracle..7776 I think?) Eventually I figured out that an arbitrary 4 bytes would result in a response with a plaintext string at the bottom of the packet.

          My first thought was that my friend was running a gameserver, botnet, chat room, or really just something..weird.

          Eventually I figured out they were skype usernames. Complete accident that I stumbled upon it. I'm only mentioning the details here because A) Microsoft knows exactly how I found it B) It's patched.

          I believe it would have actually have had use as a DDoS amplification platform. The responses sent back were 50-90x the size of the request.

          They never told me why this worked. The first engineer I had talked to asked one of them if it was an edge case, and the other shook his head "no," and aaaalmost said what it was. Then he noticed I wasn't an MS employee and said he couldn't tell me that.

  • Who? How? (Score:5, Insightful)

    by i kan reed ( 749298 ) on Friday April 04, 2014 @03:11PM (#46663689) Homepage Journal

    Who takes shortcuts for code when you're developing a damned password entry system? I mean... really? When the sole purpose of the code is security, who goes "oh, whatever, we'll just match against whatever?"

    I mean, it's not like hashing or string comparison are hard problems.

    • Re:Who? How? (Score:4, Informative)

      by Pope ( 17780 ) on Friday April 04, 2014 @03:16PM (#46663759)

      You'd be surprised. There's a LOT of bad security out there. Something this bad really takes the cake though.

    • Re: (Score:3, Funny)

      by Anonymous Coward

      I don't know who could get this wrong or how you could get this wrong.

      Does it work if you have the same number of characters?

      len(input) == len(password)?


      input == password OR (len(input) == len(password) AND string_is_all_spaces(input))

      You'd really have to go out of your way in a most bizarre manner to screw this up. I mean, this is like tell someone to make an omelette and they accidentally build a time-machine. What the heck were they doing here??

      • Re: (Score:2, Informative)

        by Anonymous Coward

        It's not that hard to do.
        Basically could be
        a) debug code for QA left in to bypass login

        b) buffer overflow (off by one); and an exception thrown that was caught outside the password system; that exited back to the main run-time.
        Testing that your code can actually handle the maximum number of characters allowable by the input field, is ... rarely tested by QA.
        I've personally crashed websites that don't restrcit the form input length on the password field. Apparently putting in 4096 character passers does ten

        • I bet it's due to a single equals sign.

          if (password_retry = account_password) {...

          • personally im a huge fan of the way powershell does it--
              * Comparison: $num1 -eq $num2
              * Assignment: $num1 = $num2

            • Not just PS, that's a common pattern in many scripting languages, especially shell scripts. Microsoft picked from the best (there's a number of bash-isms in Powershell, for example) when writing that thing.

              The compiler really *should* complain about assignment in a test statement, because it's a really common error to make. Or you can remove that option entirely (make assignments valueless statements, in which case that's a syntax error and won't compile at all) but then A) you're forking the languages, and

    • I wonder...
      Either this is some developer/tester login thing.
      Or the developer did something weird were he removed whitespace, and a "correct" match was found when the manipulated/tested string was length 0.

      • by lgw ( 121541 )

        It almost has to be a deliberate backdoor for testing that someone forgot to take out. I can't imagine "Trim()ing as password. But then I couldn't have believed anyone would smash case on a password before I heard Blizzard did it. I guess there's nothing so stupid that we should rule it out.

        • But this is not a keyboard/computer password. Allowances are made for less effective input devices. If extra spaces are a common problem when using Xbox text input, no one would think twice about it. Also, it is possible they just did not allow whitespace in a password, so instead of a warning they just removed it at creation and use (so it would work even if they thought your password has a space in it).

          • by lgw ( 121541 )

            All of which would be bugfuck insane from a security perspective, but after Bliz admitting their password are case insensitive, I'll believe anything.

            • My online banking passwords are case insensitive too. And both banks explicitly said it's intentional and they aren't changing it.

              Then again, my Australian bank account is protected by a password which must be exactly 6 characters, case insensitive, and cannot contain special characters of any kind. Oh, and must be entered by clicking static buttons on the page.

      • But it only happens on the second attempt. That implies some state is being carried over. I find it hard to believe that even a drunken monkey could do that by accident.

    • Possibly... (Score:5, Informative)

      by Viol8 ( 599362 ) on Friday April 04, 2014 @03:37PM (#46664033) Homepage

      ... the matching algo checks for zero length strings *before* it strips out whitespace so lets this through. Once it has stripped out this whitespace it *then* has a zero length string but doesn't know it and then the rest of the algo fails due to it.

      I'll bet it something stupid like:

      hashed_pwd = strip(input_pwd);

      for(*ptr = hashed_pwd;*ptr;++ptr)
      { // Match
              if (hash char doesnt match) return BAD;
      return MATCH;

    • The people who are waiting for you to develop secure password login libraries.

    • who goes "oh, whatever, we'll just match against whatever?"

      As someone else suggested it's probably debug code that found its way into production. It's not a lack of skill problem it's a process problem, code reviews should have picked it up but obviously didn't, how it got as far as customers is the question MS should be asking.

    • I'm quite curious as to what sort of shortcut they took. I can't picture any sort of code that might end up with an issue as particular as this one. :-/

  • by Anonymous Coward on Friday April 04, 2014 @03:16PM (#46663761)

    Why is this criminal being celebrated rather than prosecuted for hacking into a protected computer system across state lines? The child is A FELON and must go to jail. The father acted as an accessory and should also be prosecuted.

  • I bet every undergraduate CS Department in the country will want him. :p

  • A year? Seriously? (Score:4, Interesting)

    by shaitand ( 626655 ) on Friday April 04, 2014 @03:20PM (#46663815) Journal
    This might have been a simple to find bug but that's exactly why it would have been so damaging. They could at least give the kid a permanent XBox Live subscription. He would have effectively had one if he hadn't disclosed the bug.
  • by pegr ( 46683 ) on Friday April 04, 2014 @03:20PM (#46663823) Homepage Journal

    Yeah, are you sick of that story of the Indian kid who got his CISSP at the age of 12? Well, here's a 5 year old with a published vulnerability!

    • That's nothing. I've discovered flaws using quantum random input fuzzing on URLs that amounted to keys pounded on by a six month old baby.

      The trick is not to disclose who discovered the flaw and breeched the security unless the Computer Fraud and Abuse Act is in play. If they come down on you, just point them to the private youtube video of an infant breeching their security and tell them it's only a matter of time before the babe randomly clicks the "make this video public" button.

  • by JcMorin ( 930466 ) on Friday April 04, 2014 @03:21PM (#46663841)
    I means what kind of code can allow a space password to be approved... the MD5 didn't surely checked... oh wait... another buffer overflow because the length of the password that too big? Why the space? It is a like a backdoor the developer forgot to removed?
    • Good question. I can't imagine the code that would generate this bug.

      • by Anrego ( 830717 ) *

        My guess is it's an algorithm that starts with the assumption that the password is correct until proven incorrect, and something in that algorithm is breaking, leaving the correct assumption to stand.

        This is of course lazy programming, but not entirely uncommon.

    • by jandrese ( 485 ) <> on Friday April 04, 2014 @03:27PM (#46663917) Homepage Journal
      Yeah. Space is a full blown character. This reeks of intentional backdoor, there's really no other plausible scenario in my mind.

      That's not to say the backdoor was necessarily malicious. Maybe the guy in charge of the password login system was always breaking stuff and locking himself out of his box, so he put a bypass in there so he could get in an fix it, but forgot to remove it later. It's at best really sloppy.
      • by janoc ( 699997 )

        It rather shows that Microsoft *still* does not review security-sensitive code properly. How this could have passed any code review is beyond me.

        Either they are so incredibly sloppy and incompetent (do you really want to entrust them your credit card then?!) or this was intentional. I am not sure which one is actually worse ...

      • Returning a boolean for password good bad, when the API returns false/zero for no error and nonzero error code for error is plausible.

        MSDN is full of API documentation where the return value is counter intuitive, until you really consider the intent of the operation. So it is not outside the realm of possibility. I have had such problems myself using win32.

        I actually debugged code where my C# sample was converted to vb, and the return value of ValidateCredentials was checked incorrectly after the conversion

  • Typical Microsoft security... :(
  • What caused it? (Score:2, Interesting)

    by jones_supa ( 887896 )

    Apparently by entering an incorrect password in the first prompt and then filling the second field with spaces, a user can log in without knowing a password to an account.

    That's interesting. Let's speculate a bit about the bug.

    Do you have any theories how the login part of the Xbox One software was programmed which caused it to behave like that?

    • What is this "second password verification screen"? Was it secondary identification questions (like mother's maiden name) or the same password again? I don't have an Xbox, so I have no idea what that means.

    • Default allow. Other possibilities, but this seems most probable.

      Valid = true
      For each character
      If mismatch, valid is false

      Given ac reply, they may be using a forgiving algo because it is not an actual password. I get irritated at security questions like favorite author, because did I enter first name, initial, or just surname? I'm curious if it can be bypassed using substrings as well.

      I would not be surprised to find a forgiving check being financially more favorable than support calls.

  • Fortunately the 5 years olds are easily bribed by a few games and an ice cream before they try to hack something more dangerous.

    This sort of issue really instills a lot of confidence in the quality of that system *facepalm*.

  • by Anonymous Coward on Friday April 04, 2014 @03:58PM (#46664311)

    Posting anonymous because I'm still afraid that pepsi goons will break down my door any minute now.

    Quite a few years ago, I found that sombody had shown my preschooler that you could enter code numbers from inside the caps of pepsi products to get "free" merch.

    He just started entering random numbers and characters until he found a pattern that worked every time. He thought that was the point! He spent hours at it and then proudly showed me that he'd "solved the puzzle" and Pepsi was going to send him truckloads of free stuff.

    I quickly popped through a couple DHCPs on the cable modem and told him not to do that anymore.

  • How in God's green tarnation does somebody manage to produce a bug like that?

  • by Jecel Assumpcao Jr ( 5602 ) on Friday April 04, 2014 @04:02PM (#46664365) Homepage

    I guess their team of advisors is incomplete: []

    "12. One of my advisors will be an average five-year-old child. Any flaws in my plan that he is able to spot will be corrected before implementation."


    "60. My five-year-old child advisor will also be asked to decipher any code I am thinking of using. If he breaks the code in under 30 seconds, it will not be used. Note: this also applies to passwords."

    Perhaps Microsoft doesn't consider itself evil? Lots of people no longer do. At least they followed rule 32 in this case.

  • Stop complaining.

    Microsoft fixed it, didn't they?

    Microsoft takes security seriously.

    (Hey, stop it. Stop laughing. Hey, I said STOP LAUGHING!)
  • I have a "backdoor" branch on some of my git repos. After I merge the working branch into "master" I merge "master" into "backdoor". This allows me to keep backdoors out of the public distributable / viewable code which makes it into releases. The ease of in-place branch and merge in Git is one of its greatest strengths IMO. Even if I accidentally push the "backdoor" code to the public build system, it builds from a "main" branch and doesn't introduce the testing backdoors into the binaries.

    • This is more easily handled in Mercurial's queues system. You can keep a bunch of patches in a queue like that, and those patches will just be magically applied. It's pretty useful for a whole lot of situations.

  • ...but they were gracious about it. Microsoft surprise!

  • That right there should be a serious warning to anyone using or considering Microsoft products.

  • From TFA:

    It's not the first time Kristoffer has flashed his tech skills.
    “He’s figured out vulnerabilities 3 or 4 times,” said Davies.
    At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key.

  • That entry on the list is worth more than them combined. Just think when li'l Krissy is looking for a job in ITSEC two decades from now and when asked for "how long he's been in the business", he'll be the first person in history to be able to fulfill the usual "no older than 25 with at least 20 years of experience" requirement.

  • A child will find bugs than an adult will miss, because an adult will only do reasonable things, while kids will try things that don't really make sense. Developers sometimes use little programs that just click things at random to try to catch these kinds of weird bugs, sometimes called "monkey testing."

Loose bits sink chips.