packets enviados al conectarse al live (interesante)

lo copio de la web de http://www.blackcats-games.net .. la verdad k lo e encontrado interesante.

Hi all, As a regular member of BC i just wanted to through out an idea that i thought someone might want to look into regarding the recent XBL banhammer.

As clarification, this is not a topic about x360 ban stats. Mearly an idea i have and thought could prove useful.

We are all aware that the only way to recieve the banhammer from M$ is to be connected to the internet, and able to send/recieve data to the XBL servers. I am following the assumption that M$ does a remote check on all consoles to see if they meet requirements to be banned.

We Do know from posts here on BC and xbox-scene.com that they are banning console ID's and not accounts, for those that dont know: console ID's = your 360 serial #.

From previous packet capturing by myself, between my 360 + XBL servers this is some of the traffic that is passed back and forth,which can be capture using free software (Ethereal packet capture)


Host 1 Host 2 Protocol contents
Xbox -> nameserver DNS query AS.XBOXLIVE.COM
Xbox <- nameserver DNS AS.XBOXLIVE.COM is 207.46.247.6
Xbox -> 207.46.247.6 KRB5 Kerberos Request, containing the following

plaintext string in the "Pre-Authentication" part of the Kerberos packet:
"Xbox Version=1.00.4831.5 Title=0xFFFE0000 TitleVersion=268595456"

as well as

Request/Client Name = "SN.205516223205@xbox.com"
Request/Realm = "PASSPORT.NET"

Xbox <- 207.46.247.6 KRB5 Kerberos Reply, containing the following confirmation:
Client Name = "SN.205516223205@xbox.com"
Realm = "PASSPORT.NET"
as well as some cyphertext.


For those that do know a bit about networking + authentication this is very straight forward, for those that dont, i will point out a few important elements which bring the reason for my post.

First off, as you can see on the top 2 lines, When your 360 connects to XBL it first does a Domain name Query, which essentially changes a URL name to a specific IP address.

What is really interesting is the 3rd, 4th and 5th line. XBL requests an authentication from the xbox including information such as:

"Xbox Version=1.00.4831.5 <- im assuming the dashboard version
Title=0xFFFE0000 <- Game title in drive?
TitleVersion=268595456 <- Version of game in drive?

and one of the most important

Request/Client Name = "SN.205516223205@xbox.com"

So as you can see above, while signng into XBL, your console ID (serial) is attached to your authentication into XBL, this is where i stumbled across a few ideas that could prove useful to the community if properly approached and handled.


Idea 1. Using the very limited amount of unencrypted information in the packets, you could presume that, using a packet capture/injector, you could capture that packet going out containing your console id (serial). and either prevent it from going to the XBL servers or, replace the console id with another value.

Of course this raises the question, how much XBL account info is tied to the console ID?
A complete assumption on my part: But from what i read even if M$ bans the console, the account is still active... Does this mean that replacing or blocking the Kerberos authentication containing the Console ID will affect nothing? who knows..

Idea 2. Capture the Banhammer request/reply. this in my opinon would be the best method if properly constucted and implemented (until a more viable method is released).
After the banhammer packet has be captured, individuals could analyze the contents and persue in a varity of methods. One would be to block the banhammer request all together (although it is not known if XBL needs a reply to the BAN checking request) or Second, Modify the reply packet going to the XBL servers to contain a diffrent console ID, perhaps one already banned. The second option i think would be more viable, since the xbox serial number is displayed in Plain-text in the packet.

Well thats my thought on a circumvention of the banhammer, This is not tested or proved at all, this is mearly speculation.

If anyone has any thoughts or suggestions to circumventing or analyzing the banhammer, feel free to leave a post


creo k puede ayudar a encontrar una solucion o almenos prevenir...