SSL-Communication between Wii and Nintendo

Leseratte · 5. März 2014, 17:06

Blitzur schrieb:

lol u mean it's almost like the trucha bug?

Maybe.

I've researched a little bit more - in a few GameSpy games this "Bug" works, and in few it doesn't work. So we have to try if it works in MKWii.

But it's not Nintendos fault - this "feature" is in the GameSpy SDK. Maybe this was in an early version of the SDK so a few games have this bug and a few don't?

eN-t schrieb:

Would it be useful or atleast of advantage to use a second network adapter for Dolphin so that only Dolphin data gets dumped by Wireshark? Or is it easy for you and/or other people to simply remove garbage data from the Wireshark dumps, e.g. network browsing data that may be included in these dumps?
Also, I want to mention this because of privacy reasons. People might upload their Wireshark dumps containing more info than only the required Dolphin data, maybe even sensitive or personal data.

Rubbish data doesn't disturb the analysis. if anyone has privacy concerns, he might use the Microsoft Network Monitor 3.4 (save-nintendo-wifi.com/dolphin.html) which is able to dump only network data from one specific Application.

Chadderz · 7. März 2014, 18:55

I've just waded through all the auth code and I've got a horrible feeling the first part is from the SSLed communication. From what I can tell, it seems to be the value from the logging message at 800EE6E0 (wiki.tockdom.com/wiki/DWC_Log), which is "(%d) token=%s\n". If you look at nearby logging messages, the firelds seem to correspond to the ones from the SSL. A dump of both the SSL and the login packets should confirm or deny this.

Leseratte · 8. März 2014, 14:12

So you need a Wireshark-Dump and an SSL dump of the same login?

Network

ssl_read.bin

ssl_write.bin

Wiimm · 9. März 2014, 14:45

Have you ever tried a man-in-the-middle attack?

Leseratte · 9. März 2014, 14:48

For the normal authentication or the SSL-part?

Why is a MITM needed here?
We can dump normal data via Hub and SSL-data via dolphin.

Wiimm · 9. März 2014, 14:55

If man-in-the-middle works, replacing the server using the same certificates will work too.

Toad King · 9. März 2014, 19:25

I tried MITM attacks on MKW and some DS games: It doesn't work. The game verifies the server certificate and if it isn't Nintendo signed it won't accept it. So unless you have Nintendo's CA private key lying around...

However, on the DS side I found out that if you simply force the game to use HTTP instead of HTTPS, it works for DS games since nas.nintendowifi.net accepts unencrypted HTTP requests. This won't work on Wii games though, since naswii.nintendowifi.net only listens for TLS-encrypted requests.

Leseratte · 9. März 2014, 19:28

But if we have our own server, we could make it to listen on http/80, or not?
Then we only have to change "https" to "http" in the game.

Toad King · 9. März 2014, 19:33

Leseratte schrieb:

But if we have our own server, we could make it to listen on http/80, or not?
Then we only have to change "https" to "http" in the game.

Yes, this absolutely work on DS games and should work in theory on Wii games.

Leseratte · 11. März 2014, 08:16

If I understand that correct, somebody has found a vulnerability in Nintendos SSL-implementation and was able to create a certificate that is accepted by the Wii...

sufami.org/thread.php?board=8&thema=23&page=1

Chadderz · 11. März 2014, 08:20

As far as I can see, all he's done is create his own CA and add that to the game (which I was intending to do for MKWii anyway). Not sure what he means about the easier bruteforcing though.

Toad King · 11. März 2014, 08:29

Me neither. He mentions them all using a fixed serial number but as far as I can tell a cert's serial number has no cryptographic significance and is just used by the CA to help identify the cert. It might be worth asking him what me means by the cracking part.

Leseratte · 11. März 2014, 08:55

He means that one part in the decrypted SSL data is always the same. I found that out, too, but I thought it was a fault of dolphin.

Wiimm · 11. März 2014, 23:00

Chadderz schrieb:

As far as I can see, all he's done is create his own CA and add that to the game (which I was intending to do for MKWii anyway). Not sure what he means about the easier bruteforcing though.

Why not simply change to http and throw away all SSL+CA related problems. This makes also debugging of our own server much easier.

Chadderz · 12. März 2014, 07:28

Wiimm schrieb:

Why not simply change to http and throw away all SSL+CA related problems. This makes also debugging of our own server much easier.

True; depends how easy that is. Attacking the CA is very obvious, whereas changing to http will involve changing many method calls in the connection setup, which obviously means more work finding those calls. I suppose we'll cross that bridge when we come to it.

gskw · 12. März 2014, 07:44

What method are we going to run the server? Where would we get one?
I mean, most of the services are just webhotels...
Are we going to use multiple domains or just all-in-one?

Chadderz · 12. März 2014, 07:47

I think we'll decide that closer to the time. Bean and I have a server at home we can use and Wiimm and Tock have servers. All in one (as seperate applications) probably makes most sense, unless we find the strain is too great. We can have them all as subdomains pointing to the same host.

Wiimm · 12. März 2014, 09:21

My plans:
1.) Deep analyses of all data base connections.
2.) Define a database schema.
3.) Write servers listing to specific ports.

I will start with 3.) at April 14. (2 weeks vacation at home).

gskw · 12. März 2014, 14:31

We are that far? That is amazing!
I think I can use my server (gskartwii.arkku.net), it supports HTTP, probaly also HTTPS, but it is a web server, can MKW connect to that?

Leseratte · 12. März 2014, 14:40

When it supports HTTPS this server should be able to replace "naswii.nintendowifi.net.". The other servers will need a TCP / UDP connection on different ports so they can't be run on a simple web server.

gskw · 12. März 2014, 16:41

It doesn't support HTTPS...

Wiimm · 12. März 2014, 16:48

Chadderz schrieb:

Attacking the CA is very obvious, whereas changing to http will involve changing many method calls in the connection setup, which obviously means more work finding those calls.

Next weekend I will looking for a reverse proxy, that allows also http to https connections. If working, it can be used for testing the "calls" stuff.

Chadderz schrieb:

We can have them all as subdomains pointing to the same host.

That was my investigation of the last weekend: All domains/server use different ports, so that they can run at 1 machine.

AwesomeMarioFan · 12. März 2014, 21:29

Nice to see progress!
I got a 1GBPS web server if you guys wanted to use that for the new Mario Kart Wii server. (As a central main one.)

m4xiking · 12. März 2014, 21:53

What? I can't believe it you've gone so far that your searching for servers already? Awesome. Is there something wich can still ruin everything or are we on the save side now?

Leseratte · 12. März 2014, 21:57

Sure, there might always be something that screws everything up. We are only on the safe side when we've a running server. Not earlier.

We don't need just a web server (port 80/443), we need a few other ports (TCP and UDP).

SSL-Communication between Wii and Nintendo

Blitzur schrieb:

eN-t schrieb:

Quellcode

Quellcode

Quellcode

Leseratte schrieb:

Chadderz schrieb:

Wiimm schrieb:

Chadderz schrieb:

Chadderz schrieb:

Teilen