Legal team hack Xbox memory for defence evidence

LEAVING a software vulnerability unpatched can give hackers a way to seize control of your computer. Such vulnerabilities can also be useful if you're in the digital forensics business.

So say Chris Hargreaves and Joe Rabaiotti at Cranfield University in Shrivenham, UK. They have found a way to use vulnerabilities to tease forensic evidence out of games consoles, smartphones and e-books, where access to the inner workings is restricted by the manufacturer.

In 2009, they were hired as investigators by a legal team appealing against the conviction of a vendor of so-called "modchips" for the Microsoft Xbox. Because these chips enable the console to run pirated games, the vendor was ruled to have broken copyright laws. The defence team thought that analysis of a "modded" console's random access memory (RAM) might reveal whether copyright laws had been breached.

But the Xbox is a "closed ecosystem", says Rabaiotti, so you cannot run the analytical tools used for forensic investigations into, say, desktop PCs. So how could they get a peek at its RAM? Microsoft could not help because, as the maker of Xbox, it was working with the prosecution.
Then inspiration struck. The pair knew the Xbox could be modified to run the Linux operating system, and also that the first edition of an Xbox game called MechAssault has a vulnerability called a buffer overflow, which allows new sets of instructions to be run when inserted into the game's code.