Telnet into Dreamcast? 441
Jeos wrote to us with a fun Saturday afternoon project: "OK so today I was bored, and I did what anyone with a Dreamcast and a portscanner would do, I did a port scan on my Dreamcast. The results are interesting"-click below to read more.Update: 09/12 08:02 by H : Yes, this is a hoax - or sources from inside Sega say it is.
Starting nmap V. 2.12 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Host (129.***.**.***) appears to be up ... good.
Initiating TCP connect() scan against (129.***.**.***)
Port State Protocol Service
23 open tcp telnet
80 filtered tcp http
113 open tcp auth
179 open tcp bgp
12345 filtered tcp NetBus
12346 filtered tcp NetBus
TCP Sequence Prediction: Class=random positive increments
Difficulty=561888 (Good luck!)
Sequence numbers: 2B26AFA0 2B49A760 2B5316DA 2B647480 2B7655AB 2B852F62
No OS matches for host (see for more info)
Nmap run completed -- 1 IP address (1 host up) scanned in 33 seconds
The OS fingerprinting didn't guess the OS, big surprise, but the interesting thing is all the ports that are open. The ones that interested me the most were 23 and 80, the normal telnet and web server ports. I tried to connect to my Dreamcast with a web browser, no luck there. Then I tired to telnet into it, jackpot! I was able to telnet in, and prompted to give a username/password. Of course I had no idea what the username or password would be, I wonder if it's some sort of backdoor for Sega?
Now i have to see if I can do anything interesting with the other ports.
Re:GD-ROMs are easy to copy... (Score:1)
---
Joseph Foley
InCert Software Corp.
Re:Convergence (Score:1)
I've used it in both 640x480 underscan and 800x600 overscan. (both PAL) You lose a few lines, but it copes.
I'm sure with HDTV, or even a "normal" Sony Trinitron, it would be perfectly workable. Then the issue is the web browser program itself.
CJ.
Re:ethernet connection (Score:1)
I remember having one BigAss(tm) fight with the compuserve dialup software in Hungary some years ago, until i realized that the damn modem didn't consider the Hungarian dialtone to be a dialtone!
dufke
_______________________________________________
Re:Need GD-ROM specifications please! (Score:1)
Re:GD-ROMs are easy to copy... (Score:2)
Knock people off the game service??? i dont think (Score:1)
Re:A Little more info (Score:1)
visit http://www.mav.net/teddyr/access/info.shtml
dial in via ppp with a normal pc/mac/etc/machine, find out what the ip address that is assigned to your machine is (the domain name); then check the page above if its within the same "range"... (ie; if it says proxy or cache in the machine name... then it is transparantly proxied; same if the machine ip shown is not the same as winipcfg or pppd tells you that you have....
https://www.mav.net/teddyr/syousif/ [mav.net]
Re:Convergence (Score:1)
Actually, that's only part of the cool thing. The other is that a Dreamcast costs between 10% and 20% of a good "gaming" PC, and somewhat less than a more basic model. If Sega is on the ball, this could be a huge selling point with parents: "Buy the Dreamcast. It's cheaper than a PC, your kid can browse the web with it, and it's at least a US$1000 less than a computer that'll play the same games." Sounds like a winning pitch to me.
Attn:Dreamcast owners can you DCC in IRC ? (Score:1)
Re:Need GD-ROM specifications please! (Score:1)
don't lose sleep over it (Score:1)
I don't know about you guys, but I wouldn't store any personal documents on my game system (I don't even think I could), so Sega can have all the backdoors they want on my dreamcast (not that I even own one, yet).
It is interesting however. Maybe they could use it to check for illegally bootlegged games (If the games come on CD, I'm pretty uneducated on the subject).
The real story (Score:2)
Re:Need GD-ROM specifications please! (Score:1)
Re:modem (Score:1)
(It rules by the way. I have sonic and soul calibur and I'm having a blast.)
Re:Need GD-ROM specifications please! (Score:1)
--
This, ladies and Gentlemen (Score:2)
Re:or put linux on it!!! (Score:1)
Re:Need GD-ROM specifications please! (Score:1)
Dreamcast Hacking Contest? (Score:4)
Re:A Little more info (Score:1)
The remote site only tells you the IP of the packets it gets from you.. which probably come from a proxy.
Whoa (Score:1)
1. (dumb one) How was this thing getting its TCP/IP? Ethernet port, serial PPP, what?
2. Doesn't the Dreamcast run WinCE?
Re:Whoa (Score:1)
The only thing my perception's been warped by is the video on the demo disk. I think the graphics look muddy and washed out, and most of the boats are really small. Of course, the arcade version could feature muddy, washed out graphics, I dunno.
Re:Whoa (Score:1)
Re:The real story (Score:1)
Just some thoughts.. (Score:2)
It's a shame that the docs of the hardware don't cover this or at least give some insight into why those particular ports are open, etc.. I think users that actually spend hard earned money (or not so hard earned) to buy the product deserve to know.
Matthew
_____________________________________
What kind of crack are you ingesting? (Score:4)
just ask sega (Score:2)
hopefully its not a defualt username and pwd for every machine...
=P
Re:Whoa (Score:1)
It really sounds like he portscanned a router (Score:5)
up to be the router that does the NAT:ing.
The open ports are consistant with this (telnet, BGP4, http), all are services that are running
on pretty much every cisco router.
Great. More firewall rules. (Score:1)
I'll be dialing up to a Linux box sitting about 2 feet away from it, and connecting it to the 'net through a gateway to my ISP.
This means that I'll have a machine sitting behind my firewall giving God-knows-what responses to God-knows-what requests.
Great.
It never occurred to me that my video games would be a security risk...
finding user/pw (Score:1)
Oh boy.. (Score:1)
Uh, oh. I wonder... (Score:1)
-- Moondog
Re:How DVDs really work. (Score:1)
Re:AOL on Dreamcast (Score:1)
What you're thinking of is internet access that comes via a tunneled IP protocol atop AOL's proprietary internal communication protocol.
PPP dialup is in beta testing for the newer clients (and what better test platform than all them Dreamcast users -(
Slashdotting (Score:1)
If we dont, someone might think we dont exist anymore, and therefore that Linux is dead, that since WinCE runs on the Dreamcast and we failed to slashdot the Dreamcast that Sega is actually MS and that Bill Gates is actually Sonic and that Im waaaay off topic. What a world.
Time to go to bed.
Proxy? (Score:1)
Bored??? (Score:1)
------------------------------------------
Byron Ray
Re:don't lose sleep over it (Score:1)
It can be easy for a developer (either intentionally or via a rogue cracker/disgrunteled employee) to install a sniffer or other trojan running on a game console {that is if they do get an ethernet port.. which I hope that it does}... The amount of data that can be gatherd would be phenominal..
A paranoid person would consider ANY dreamcast cd that is given away free to be suspect...
[extremely paranoid mode
https://www.mav.net/teddyr/syousif/ [mav.net]
TV display quality (Score:1)
Re:clueless jerkey (Score:2)
a: no. i tried scanning for open ports on my dreamcast, i saw telnet was open, and i tried using telnet to access it. i did this from my dsl-connected computer. i got the login and password prompt in the telnet window. the dreamcast works fine, even when i'm using telnet.
r: whoa, man. i dunno.
a: alright..
r: i couldn't give you any dns or anything
a: yeah?
r: that'd be ILLEGAL!
It seemed that he was starting to catch on towards the end there.
CNN Article on Dreamcast (Score:1)
http://www.cnn.com/TECH/computing/9909/10/dc.pr
PS: I know this isn't directly related to port-scanning the box, please don't moderate me down!
spending money (Score:1)
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
Re:Whoa (Score:1)
1> Runs Windows CE
2> Leaves open Port 21
3> Has an obvious Shared directory
Questions:
1> Is Share to gain OS access or is it an encryted password given to each box to allow them to talk?
2> Is the OS accessable at all or is the default set so that universal access to the OS is read only to prevent us from screwing it up?
3> Why would Sega need a back door into your dreamcast system in the first place.
Didn't work for me - hoax? (Score:1)
Anyone else tried this and had it work? What disc did you have running in the DC?
Re:A Little more info (Score:2)
Windows CE development (Score:2)
http://msdn.microsoft.com/cetools/ [microsoft.com] for more info. but I don't know if you would need to burn CE on the CD as well or not.
writing a CE application would probably be easyer then writing somthing that would actualy run on a DreamCast.
also, was the 'dream cast portscan' done while a game that used CE was running? I would think that nmap would detect CE. Or was it just the sega ROM that was scanned?
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
then, a Beowulf Cluster!!!!! (Score:2)
Actualy, I belive that work was done to get NetBSD to run on the thing, so you may not need to port linux.
I don't know how usefull the system is for *general purpose* computing (IE they spent all there money on sweet graphics chips). With built in networking it might be posible to build a beowulf cluster, but I don't know how easy it would be to get a program to run on dreamcast (Sega may have 'locked it down' to prevent game piracy, and unlicensd games)
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
that posting was bogus. (Score:4)
Insightful?? (Score:2)
modem and wince (Score:3)
The OS issue is not as clear cut. The dreamcast supports two OS's, and games are allowed to pick and choose which one they want to run on top of. A heavily modified version of WinCE is one choice, which should allow for easy ports of PC games (or rather, would make for easy ports to Win32 from the Dreamcast I would be willing to bet). The other choice is Sega's own proprietry OS, that is rumored to be based on the Saturn's OS. It would be interesting to know if the person who did this TCP/IP scan was running the web browser CD when he did this, or one of the games that supports internet play, such as Sonic Adventure.
Re:Whoa (Score:4)
How many times do we have to explain it! This has been rehashed countless times over Slashdot, and al it really amounts to is FUD. Anyway, to explain it read this. [slashdot.org]
I work at Sega Tech Support. (Score:2)
Re:just ask sega (Score:2)
but what the hell would you do once you were in the system?
if it is actually used as a backdoor, the commands may not be obvious either. the purpose of it as a backdoor would most likely be to disconnnect the user from the game services. somebody should start working on cracking it just for the hell of it, because i doubt sega will give out info about a backdoor.
Debugging (Score:2)
I theorise no consperacies here. Although I acknowledge that games for console systems aren't developed on the consoles, bugs may arise at a later date.
I am willing to bet that the telnet entrance gives the user read-only access to registers, and maybe even snapshots of memory. Such tools could be useful to have memory snapshots show up in a web browser on the same PC as the development going on.
Unfortunately, I haven't followed the specs of the system, but I'll assume also, that Sega may exploit open ports with later addon products.
More Information Please! (Is this a Hoax?) (Score:2)
1) Through what means was the portscan performed? Was the modem attached to some sort of ISP or what?
2) What about the other protocols running:
23 open tcp telnet
80 filtered tcp http
113 open tcp auth
179 open tcp bgp
12345 filtered tcp NetBus
12346 filtered tcp NetBus
Did anyone try to access the web server and see what was open (if not exactly what happened)? What about the two "NetBus" ports? Is there a version of NetBus for WinCE (or whatever Dreamcast runs) that I don't know about? If people are concerned about telnet insecurities, wouldn't NetBus be a larger risk?
3) Has anyone attempted to brute-force their way through telnet, or any known exploits for the other protocols to check against a faulty implementation?
I find this information very interesting, but honestly I'm not sure whether or not I believe it without further details!
Convergence (Score:5)
I would suspect Sega enabled this feature as a way to debug the Dreamcast - I would also suspect most other console manufacturers do the same, only with proprietary hardware interfaces.
But what really interests me in how well the Dreamcast pulls off this 'convergence' thing that big companies like Microsoft, Sun, and others have been harping about. I mean, last year, these two companies were saying "We're gonna make it easy for everyone to access and use the Internet! Just watch!"
Here we are a year later and out of nowhere comes Sega with this console that not only plays some really great games, but also connects to the Internet and enables you to browse the web. But what's so special about that - I can hook up my computer's G400 to a TV display, too. The really cool thing is the power of the Dreamcast is hidden from the user.
Many of us here complaints that computers are too hard to use - there's no simple way to operate a computer like a television (push a button, and you're there). (We all know we hate these comments, but almost have to admit it.) The good thing about Dreamcast is that any John Q. Gamer (even their parents) can use this thing - they don't have to be computer literate! On the other hand, there's enough power in the device that real computer hackers like us can go to the length of making interfaces to the device (provided there are external ports and such) to harness that power - and the fact of the matter is, we will if given the chance.
- Shaheen
Port 80 redirects (Score:5)
A side effect of this is that nmap will *always* show an open port 80, because when nmap sends packets aimed at port 80, they wind up going to Netcom's proxy server and not the intended host. Also means that if nmap is doing its fingerprint testing against that port 80, it will get the fingerprint of the proxy, not of the actual host.
If the machine you're portscanning from is going through a Netcom dialup, you're probably just seeing the port 80 on their proxy, and not on the dreamcast. The fact that 12345 and 12346 are also both showing up is also indicative that a router somewhere between your scanner and the dreamcast is doing some filtering/proxying/monitoring. Unless it's just coincidence, I can't imagine why Sega would open those ports.
Re:If its got a protocol stack well then... (Score:3)
Re:Whoa (Score:3)
Since he was booting with the the web browser disc (I'd assume) it most likely is running CE however...
OS is only on the disc. (Score:2)
Re:Windows CE development (Score:2)
---
"'Is not a quine' is not a quine" is a quine.
Re:ethernet connection (Score:2)
Re:A Little more info (Score:2)
If you're running a linux box it should be possible to set it up as a mini provider. You'd probably have to set up a DHCP server, PPP and telephony obviously. Your provider would then be taken out of the loop and the IP address of the dreamcast box would be easily detectable. If nmap or whatever still detected open ports you could be pretty sure that it was the real deal.
I think this is pretty interesting, I may run out and buy one just to check.
Telnetting into a game (Score:2)
Debugging.
A programmer could telnet into the machine and look at or change variables, do step execution, etc.
Anyone who has done any embedded development can see the logic in this. Game consoles are, in fact, embedded applications. I used to work with ZWorld controllers that allowed me to monitor the execution of the software through the serial port. It was a godsend. IIRC, Sony's AIBO was debugged by telnetting into it.
Re:ethernet connection (Score:2)
Re:Convergence (Score:2)
I know what I'm talking about, I've seen it in action and I've used a Amiga+TV to browse with when my monitor broke. I soon grew made and jumped of a cliff...
/emj
Just scanned a Dreamcast (Score:5)
user/password (Score:2)
Boy... they weren't helpful... (Score:4)
Re:hm (Score:2)
I thought this would make a good joke but then I realised it wasn't the least bit funny.
--
Backdoor and converting the DC to a "PC" (Score:2)
Re:Sega Hides true host (Score:2)
"UNIQUEID.anon.ircnetwork.com" or
"UNIQUEID.realnetworkname.com" where the hostname (first item till the first dot) was replaced by a uniqueid/sessionid... The IRC Ops can see the real information, and the log does contain the mapping info...
so to repeat... if they connect to a fixed irc server, then it is trivial to make the server hide the hostname info, or even "totally fake it"....
https://www.mav.net/teddyr/syousif/ [mav.net]
Re:GD-ROMs are easy to copy... (Score:2)
http://www.johny.sk/cdrinfo/reviews/dreamcast/ind
Re:Just scanned a Dreamcast (Score:2)
Re:ethernet connection (Score:2)
1-Dorm rooms with Ethernet
There are many of those cropping up every day
2-Cable modems (ethernet interface)
It would be worth it to pay the extra $5 to get a second ip for a dream cast since I already have a cable modem
3-ADSL modems (ethernet interface)
This would probably be a better bet than an integrated ADSL modem..
4-Home network
friends brings their dreamcasts to play multiplayer in a home lan.
5-LAN parties
If there is a Quake2 for the dreamcast, i have a feeling that it will quickly become the lan party tool of choice for many
an ethernet port opens up MANY more multiplayer possibilities... thus more sales... (of hardware and software).. [the question becomes; can the IP address be configured manually, or does it have to use DHCP; or will it use that autonegotiation stuff in 98 and macos; falling back to dhcp]
https://www.mav.net/teddyr/syousif/ [mav.net]
Everyone has missed the big question (Score:3)
GD-ROMs are easy to copy... (Score:2)
Re:IE (Score:3)
AOL on Dreamcast (Score:2)
Don't underestimate AOL, we all hate them, but they're the biggest "ISP". There's already 300,000 Dreamcasts operating in the US and Canada, and that's one large and easy market for them to go after. Pop in the disc, and turn it on. Jacob Rens Daily Videogame News and Info: http://www.the-nextlevel.com
"It's Thinking" (Score:2)
Their ads jokingly say that it knows everything about you, but maybe it's logged into some vast database Sega has assembled with everything about you.
Hmm... trading info back and forth between the machine and the server while you play. Major conspiricy theory stuff here ;-)
- Jacob Rens
Daily Videogame News and Info: http://www.the-nextlevel.com
Any chance for an RC5 client? (Score:2)
;)
Re:hrm. (Score:2)
NetBSD (Score:2)
How it really went... (Score:5)
Sega:Ummm, sorry sir, I don't know about any maps or netting.... The extra ports on your computer are for possible expansion in the future, to allow for new featu-
DaveO:What are you talking about?!? This is an invasion of my and every American's privacy! You people make me sick!
Sega:I'm sorry you feel this way. Honestly, there have been additional connectors on SEGAs console systems for years, allowing for future upgradability, such as more controllers, external storage, etc. I don't really see how this affects your privacy. You could always return the system if you can't live with this.
DaveO:This is ridiculous, I can't believe you thing you are going to get away with this you ^##%@#%$@
-click-
cot.
"Filtered" in nmap (Score:4)
23 open tcp telnet
80 filtered tcp http
113 open tcp auth
179 open tcp bgp
12345 filtered tcp NetBus
12346 filtered tcp NetBus
The 'filtered' in the above means that those ports are actually intercepted somewhere in between
--
Ports open for system info/upgrading (Score:2)
Re:Just scanned a Dreamcast (Score:2)
In any case you don't have anywhere near enough information to make a judgement on whether Jeos' 'blundered' or was 'full of it'. If the Dreamcast user on your site was connecting to you through any sort of device that does network address translation (i.e. a firewall or cablemodem sharing device such as a UMAX UGate-Plus) or the provider they were connecting through did any filtering on incoming requests then they would fail. You don't even know if the user got bored, turned off their Dreamcast and turned on their PC.
Re:Whoa (Score:2)
Question 1 : The dreamcast comes with a web browser, and a 56kbs modem. It lets you set up a connection to whatever service you like, or you can use worldnet, which is Sega's "preferred provider". I'd assume that when you've got the browser up and running, you've also got these ports open so Sega can nefariously check your system out. Muah ha ha!
Question 2 : The Dreamcast CAN run Wince. It doesn't have to. Games load everything from the GD, so a developer could roll his own, go with sega's or go with Wince.
So far, the only wince game I've seen (Hydrothunder) looks Really Bad.
and there you are
Wow! Dreamcast as an affordable router! (Score:4)
According to this portscan, the dreamcast supports BGP! For those of you who aren't familar with BGP, it's a policy-based routing protocol used (for instance) at the NAPs.
So does this mean that Sega is going to start selling routing cards for the dreamcast? It's good to see that someone's finally working on an internet device that isn't just a client, but an affordable router! It's high-time I got rid of that crappy Cisco we have over here and replaced it with a fine piece of networking machinery, like a Sega. I'm so happy to see a router that's not just cheap - but you can also play games on!!!
Seriously, though, it does indeed appear that your ISP is doing something silly redirecting ports. This is particularly probably since nobody else can recreate this test. Either that or Sega chose a really bad port number to bind on.
X for Dreamcast ! -sounds crazy, but wonder... (Score:2)
Ok, what do we have here ? We have a machine that allows data input (the CD drive and the telnet port), remote access and data output (outgoing ports).
So far, we do not know how the stuff inside works. For example, we do not have any Dreamcast emulator. But this may happen soon.
IF we manage to understand the inner protocols of the system (after all, it has been done for the playstation, it is probably feasible for a WinCE machine, isn't it ?), then we might produce slightly modified CDs to have the console do rather cool things
Remote Dreamcast playing on your computer. Setting some mechanism to redirect display directives through the outgoing port, and accept commands from incoming. Ever tried a 20-players Destruction Derby over the internet ?...
This might work the other way round : by telnetting into the console and interfering with its display output, we might modify the look of the games at will - imagine : themes for your Dreamcast !
X servers for Dreamcast. Yeah. Now this may have implications that I cannot even imagine - or it may just be plain bullshit as well. I don't know. I don't even want to know. The very concept in itself (come on, X on a console !) is enough to make me wonder.
Thomas Miconi
Karma Police - enforcing peace of mind by all possible means
Re:IE (Score:2)
My browser disc didn't work so I returned the whole thing for a new one... everything works now except I cancelled the internet registration half-way through and now it thinks I'm registered. I can't figure out how to get back to registration so I guess I'll have to sign up on the PC to get my login information that way and manually enter it. It's not exactly ready for prime-time.
Kris
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re: (Score:2)
A Little more info (Score:4)
I was running the web browser CD on the Dreamcast and I was dialed to my ISP, my university. I ran the port scan from my computer. I obtained the IP of the Dreamcast from a website which gives you your IP. It's possible this is wrong, but this is the only way I can think of to get my IP. As far as I know there is no direct way to get the IP, the Dreamcast doesn't tell you your IP.
I would like to try and find a l/p for it, although it'll be kinda hard since I don't even have a username. If anyone knows of a good brute force program for telnet let me know. My email is aminidab@mailcity.com.
Re:modem (Score:2)
Kris
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:Whoa (Score:2)
For what probably won't be the last freakin time, NO, the Dreamcast does not run WinCE. It CAN run WinCE.
cluelessness :P (Score:4)
rep:can i please have your name and phone number?
aaron:doody doody doo!
r: thanks, how can i help you?
a: well.. i was using my dreamcast, and i tried to telnet into it. it asked me for a username and password.
r: huh?
a: i tried telnetting into my dreamcast from another computer.
r: is telnet ppp?
a: huh?
r: do you know what ppp is?
a: yes. both computers are connected via ppp. the dreamcast is connected over modem and my computer is connected via dsl.
r: uhhhh...
a: anyway, could you give me the username and password?
r: you shouldn't need one.
a: everything works fine - thats not the problem. i just want to see what it does.
r: do you use at & t worldnet?
a: no.
r: well just go to "other" when you reboot, and that will tell you how to sign up. did i answer all your questions today?
a: well, no. that's not the problem, everythign works fine. there's no other number i could call?
r: you mean your isp?
a: no. for dreamcast.
r: that's me!
a: okay. do you know a login and password for the dreamcast?
r: you need a login and password when you start the dreamcast?
a: *chuckle* i think we're misunderstanding each other. i'll start over. my dreamcast is connected via modem, via my isp. my computer is connected via dsl, via another isp.
r: okay...is your isp worldnet?
a: no. i tried scanning for open ports on my dreamcast, i saw telnet was open, and i tried using telnet to access it. i did this from my dsl-connected computer. i got the login and password prompt in the telnet window. the dreamcast works fine, even when i'm using telnet.
r: whoa, man. i dunno.
a: alright..
r: i couldn't give you any dns or anything
a: yeah?
r: that'd be ILLEGAL!
a: *chuckle*
r: alright, sorry i couldn't help. have a good day.
a: you too!
hmm..and i don't even own a dreamcast
Nope, it's OpenBSD/SH4 (Score:3)
http://www.softrare.com/openbsd-sh4/
Kris
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
have it dial to a *NiX box where you have root (Score:3)
Moron (Score:2)