2

So, we have this article:

http://www.engadget.com/2014/04/04/xbox-live-five-year-old-hacker/

Apparently, using nothing but spaces the local account (with an obviously saved password... I hope) was compromised. I am guessing that the password was TRIMMED before comparison and the dad had a password of merely spaces to begin with. Although, for a dad who is a "security researcher" this is seems awfully naive.

So, what does Security.SE think? Is there an affirmative source that confirms how this exploit works?

1

The consensus seems to be that the Xbone trims terminal whitespace from entered passwords. When the kid enters a password of just spaces, trimming whitespace results in a blank password.

So, the kid has both entered a blank password and entered a non-blank password. The empty password error handling routine chokes on this strange state of affairs and hijinks ensue.

  • Note that this bug is exploitable whatever the local password is, so the dad could have had a very strong password. – Graham Hill Apr 7 '14 at 15:36
  • So the password passes a !empty test, and errors out on the password comparison because it's handled as a null value? – Mondrianaire Apr 7 '14 at 21:52
  • Yes, it seems likely that they test for !empty first, then trim the spaces. – Graham Hill Apr 8 '14 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.