Hacking Discussion Why FreeShop is still possible on the Switch, and what should have been done to prevent it.

[SimonMKWii]

Here's my (moderately detailed) analysis on why freeShop is still possible on Switch, and what I believe Nintendo should have done differently to prevent certain things.

First, lets recall how freeshop works on 3DS (heavily simplified):
Get the titlekey from a database
Generate the ticket for that title
Install the ticket
Get title contents from CDN
Install title contents
The title is now playable.

And this is how the Switch fails to prevent it (also heavily simplified):

Get the titlekey from a database:
That can't be stopped.

Generate the ticket for that title:
They would have solved that by generating RSA-wrapped personalized tickets server-side, but this is easily defeated by disabling signature checks and generating an unsigned common ticket.

Install the ticket:
With patched sysmodules, there's nothing stopping an attacker sending the ipc commands necessary for installing a common ticket.

Get title contents from CDN:
Nintendo really fucked this one up hard.

All requests to atum (within your certs environment) are accepted.

This is extremely poor design as both system modules/applets and eShop content share the Atum server.

What they should have done is segregate system and eShop content to different servers.

System content should require just your console-unique cert, similar to the current system put in place.

In the case of eShop content, it should require your ShopN bearer auth token, and check that your account has the rights to the requested title prior to returning any of its content (NCAs and patch CETKs).

Yes, Atum doesn't check whether you own a certain title before returning its content.

The dumbest part is, it was always possible, as Shogun, the eShop backend, already has a feature to list all of your owned titles that aren't currently installed on your device.

Sending an authed GET request to https://bugyo.hac.lp1.eshop.nintend...ned_titles?shop_id=4&lang=en&device_type_id=6 returns a JSON with all of the uninstalled titles you own.

And yet another colossal fuckup is sending an authed POST request to the "redownload" endpoint https://bugyo.hac.lp1.eshop.nintend...d_titles/download?device_type_id=6&title_ids= (title ID, uppercase) with the data "lang=en" will invoke nsBeginInstallApplication; downloading and installing the title, regardless of whether or not the requested title ID is present in your owned titles.

Yes, "owned_titles/download", unlike what the name would imply, doesn't actually check whether you're trying to download an owned title, and just downloads every title ID sent to the endpoint regardless.

Install title contents:
Same issue as ticket installation.

Assuming sigpatches are enabled and the ticket is installed, the Switch can load the titlekey from the ticket into the relevant keyslot, and the title is now playable.

 

[DuoForce]

Dude freeshop is awesome! I hope a switch version comes out soon.

 

[Souperman9]

Interesting! I assumed the security wouldn't have been this lax.

 

[fixingmytoys]

come on dude don't give them ideas to fix it or stop it lol

 

[ihaveahax]

If you still need the client cert though, it seems entirely pointless, since Nintendo can still detect and ban you for that.

 

[ZeGerman]

Didn´t @SciresM said something different?

 

[SimonMKWii]

If you still need the client cert though, it seems entirely pointless, since Nintendo can still detect and ban you for that.

A client cert ban only stops Dauth from working, you still have full access to the Atum server.

 

[ihaveahax]

A client cert ban only stops Dauth from working, you still have full access to the Atum server.

Which Nintendo could fix, and revoke misbehaving client certificates. It's still risky regardless.

 

[SimonMKWii]

Which Nintendo could fix, and revoke misbehaving client certificates. It's still risky regardless.

They could fix it, but seeing as Nintendo tries to make sure everyone's device is updated, they won't do it, as again, system apps and eShop apps share the same server.

 

[willhack]

We just need to port of CDNSP to the switch Homebrew launcher with devmenu

 

[syntaxyz]

Nice analysis, thank you.
Tho I must say that nothing about this is unfixable, but I don't think N is going to have any of this fixed. I don't know what company created the eshop backend, but if its the same one as the 3ds one we are sure they arent going to give a flying f... sadly...

 

[ihaveahax]

They could fix it, but seeing as Nintendo tries to make sure everyone's device is updated, they won't do it, as again, system apps and eShop apps share the same server.

It's not impossible to selectively allow certain titles, like system + anything your account owns. We already know that they know who exactly is downloading what exactly from their network.

 

[SimonMKWii]

It's not impossible to selectively allow certain titles, like system + anything your account owns. We already know that they know who exactly is downloading what exactly from their network.

That's true, but will they implement selective downloading?
As @syntaxyz quite rightly said, Nintendo have a history of not patching server exploits.

 

[lordelan]

And yet another colossal fuckup is sending an authed POST request to the "redownload" endpoint https://bugyo.hac.lp1.eshop.nintend...d_titles/download?device_type_id=6&title_ids= (title ID, uppercase) with the data "lang=en" will invoke nsBeginInstallApplication; downloading and installing the title, regardless of whether or not the requested title ID is present in your owned titles.

Yes, "owned_titles/download", unlike what the name would imply, doesn't actually check whether you're trying to download an owned title, and just downloads every title ID sent to the endpoint regardless.

This is just one little thing to fix in their backend. If I was working at Nintendo this would take me around 10 minutes to do.
Thanks for pointing Nintendo to it lol.

 

[Bedel]

This is just one little thing to fix in their backend. If I was working at Nintendo this would take me around 10 minutes to do.
Thanks for pointing Nintendo to it lol.

Yeah I thought the same. It's something preatty easy to fix, so I don't get how they messed this up (again)... But maybe in the next eshop mantenance we'll see it fixed.

 

[Arck]

Ok but if you play with a pirated installed nsp game online, ban

 

[fixingmytoys]

and again we giving out ideas on how to fix and stop things grrrrrr lol

 

[SimonMKWii]

Yeah I thought the same. It's something preatty easy to fix, so I don't get how they messed this up (again)... But maybe in the next eshop mantenance we'll see it fixed.

Yeah, once the next eShop maintenance takes place, I'll test downloading Mario Kart 8 Deluxe and cancel the download straight after (I own the cartridge version, so I don't feel too bad about using it as the test title).

Ok but if you play with a pirated installed nsp game online, ban

Yes, that's something Nintendo did extremely well, I'm very impressed with the Aauth implementation.

 

[hippy dave]

Sounds too easy to fix, but we're lucky so far.

What I want to know is how hard it would be to send an alternate console certificate (rather than the one built in to your console). People have been using already-banned certificates that have been shared online when downloading from computers, but if downloading directly on the Switch, would system patches let you swap in the chosen certificate into the existing process? Would you have to rewrite the whole download process down to the level of http protocol exchanges?

 

[Nincompoopdo]

Currently all NSP installed under SX OS works flawlessly. If TX built a CDN downloader into the CFW and auto installed the downloaded nsp (they are working on a installer) it should be similar to Freeshop.