I can confirm that only enabling restrictions 'Xbox LIVE Access' and 'Xbox Live Membership Creation' in 'Console Control' (in Family Settings) is NOT adequate protection for your Jtag flashed console.

I sniffed outgoing connections whilst running an Xbox1 game (this is in FSD if anyone is interested) because I was curious as to why I was greeted with 'you need to update' despite not being logged in to any profile, let alone on xbox live. This message would disappear if I removed the Ethernet cable (used to update FSD + FTP on LAN).

The console successfully connects to 65.55.42.183 using the kerbose service (handshake?), then connecting again afterward on 65.55.42.180 on UDP port 3074. The IP range 65.55.42.* is owned by Microsoft Corp, and is located in Bellevue in the US.

Evidently, despite the suggested precautions, our consoles are still capable of connecting online beknown to us. Microsoft could quite easily pull one off again and 'surprise us', as they did with the Ixtreme banning, with a forced update or such.

I highly suggest you either block all outgoing/incoming WAN traffic on your console's MAC address, or remove the ethernet cable entirely, particular if your console's R3T6 resistor has not been removed/shorted.

Finally, exercise extreme caution in all future updates, 9199 onwards. Microsoft could quite easily not only impose a ban on your Xbox LIVE account and console, but could remove your console's exploitabilty therefore rendering your jtag useless.

I thought I aught to share my findings with the community - please share your thoughts, I hope someone can prove me wrong.

Good job sniffing that out mate.

Interesting. If people still wanted to download certain things from their xbox (FSD updates, game art etc) cutting off all outgoing access is kind of overkill. I went ahead and added a custom rule to block port 3074 on my Linksys router for my JTAG 360. Wouldn't that accomplish the same thing?

is 3074 the port the xbox 360 uses? Id it possible it tries an alternate?


I am testing this out with my router

I am blocking 3074 and 88 tcp and udp

ok I tested and it failed to connect to live, what got me nervous is that there was a status bar moving

but it failed, now Im going to try some ftp, and test FSD2 update


ok third edit, I tested again and it connected to live!!!

I googled port forwarding xbox 360 and was brought here

http://support.xbox.com/support/en/us/nxe/...4&lcid=1033

it shows the 360 uses 53, 80, 88, and 3074 I blocked all these and it still connected to live

I too tried blocking certain ports, but this is still not safe as Microsoft could easily just chose to use a different port. Not all Microsoft connections are on the 3074 Xbox LIVE port either, as Maximize said port 80 is also one of the used ports and blocking this would disable FSD updates too. This is unconfirmed by me but Maximize also pointed out that despite blocking all these ports, it still connects anyway.

So I came to this conclusion - the best way to be 100% safe, is to block all servers but those that the teamfsd updates come from. So I sniffed out their update server, realized it was on the same server their homepage is hosted on, and came up with the idea of using these commands in my linux based router (dd-wrt) for my firewall.



This will 'drop' (block) all outgoing and incoming connections from/to your console's MAC address (much safter than using only LAN IP, this could for some reason change at any time whereas the MAC address will not) unless the server is teamfsd.com. It will also add the dropped/accepted results to your log so you can see just what is going on. This is although quite advance and you need an iptables compatible router (you'll need to ssh in). Bear in mind that FSD could start using a different server for its updates, but if this were to happen, I will re-sniff the new server and update you all here. Change your MAC accordingly.

I hope people understand the gravity of this issue.

K

Thank you very much for taking the time to sniff all this stuff for us.

As per your last post, how would one go about applying such code to a router running Tomato?

Ok I did some more to try to disable my connection to live, and I got the ban notice from being connected to live less than 15 seconds yesterday.

does anybody know the implications for this on freebo 9199, I think nothing since f\/ck live, and 9199 has no hdd corruption. Is there anything I am not aware of?

Does this only happen if you launch the game from FSD? My guess is since FSD is connecting to the internet, it's disabling (or bypassing) the XBL blockage in the console settings.

I thought this was the case. Had an unbanned jtag with xbox live connection blocked and I commonly signed in with a Live profile. Turns out the KV got banned even though the sign-in process was never fully completed. I always just unplug the ethernet cable now unless I'm ftping something and if that is the case I don't sign in.

I think the consoles are still exchanging information with the M$ servers reguardless of family settings. Think about it, family settings blocks you from signing in to Xbox Live, that does not mean it severs all communication with M$.

Thats exactly what I feared and stupidly removed the block on my router to update FSD. Even though Live has always been blocked it shows as if its communicating with M$ and thats without signing in.

Anyways, whats the worst scenario if were banned? It's not like were ever gonna be able to use the service on a Jtag console.

Edit: I'm meaning for someone who never uses Live at all and would only want it for some desperate download.

yeah I pretty sure they have consoles search for a connection trying any port, because it only failed to connect once, second attempt connected quick. I assume the dd-wrt code is the only way for kai xlink and fsd to connect without MicroDick connection

If the above mentioned resistor is removed, it would only ruin your flash, probably E79/E74, and you'd have to link the console up and reflash your NAND. If not, it could remove your jtagged console's exploitability entirely.

Microsoft might also be able to come up with some other way to ruin/patch the jtag hack too in the future and push that update, but who knows - this is all speculation.



I'm not sure. You'd have to browse the Tomato forums/wiki, or ask for help perhaps on their forums. You may be able to add the commands to the 'firewall' settings if you can find anything like that on your firmware, I don't know I'm afraid, I've never used Tomato.



The HDD corruption is indeed still present on 9199 - I can confirm this from my other console being banned (non jtag). I doubt there will be any problems for you now, unless you update (or microsoft find a way to force an update).



No, this is not the case I'm afraid. It's a direct handshake with the Microsoft servers, it's nothing to do with FSD. Plus FSD connects to its own servers and I believe (unconfirmed) microsoft's to fetch artwork - although I'm yet to sniff this. I'm away this weekend, I will when I'm back.

ok I can still copy games to hdd, can still play games from hdd god's and not god's, and my saves for borderlands and alan wake are still good, so I am going to say the ban did nothing to my console, and maybe that is because I have the bridged ut61 (or whatever its designation) so I wonder if you could get your hands on a banned xbox and see how the traffic compares

I've run FSD on my JTAG'ed Jasper, and XBL is blocked in the family settings. This console is connected to my home network 100% of the time - I can still install to NXE the regular way, my profile and HDD work fine on other consoles. I'm pretty sure it's just the dashboard saying, "Hey Xbox Live, are you awake?" and Xbox Live replying "Yep!" I don't think your console is sending any specific information to the service, especially if you don't have any XBL accounts on the HDD at all (I don't), since you have not agreed to the XBL TOS if you don't have a Live account.

This should be stickied.

Either way we need to build up a clear picture of what has happened and could happen.

@ Maximize: You say u got banned in 15 seconds. Do u know the entire history of your jtag? Did u mod it yourself/never used it online? ...It's strange that your ban doesn't corrupt saves/achievement's between consoles, a 'normal' ban would corrupt data/not sign off trusted content.

...Have you redumped your NAND and checked the secdata to compare before and after?


What brandogg said makes sense, i.e. the 'yes I'm alive' handshake, but without any h/w or user specific console data going out/in.

I really hope you guys are right !!! But are'nt we being a bit naive thinking that no console specific info is being transfered?

Does anyone know how we could check/interpret the traffic while in this idle state?

Agree it should be stickied.
AFAIK when a JTAG gets banned the secdata etc isn't written to in the same way that a non-modded kernel is - ie there's no command to 'cripple' the 360, just a ban of the KV. I'm uncertain whether this is due to the way FreeBoot is structured, or if it's Live-side that dictates this.
I think what brandogg says is correct - it's a handshake thing with Live. And it's a fair thing to do to not be signed in on a Live/MS created profile whilst the network cables is in, you really don't want your GT associated with a JTAG as this may lead to problems with GT banning later down the line.

the console wasnt modded or jtagged when I bought it, I jtagged it and my gamertag had never been on live with a modded console before, the only times my gamertag signed on live prior, was prior to modding and to download divx support only.

the other day I was attempting to block ports and my mac addresses using those ports I blocked all the ports previously posted as well as 10 ports above and below them. Did a connection test it failed, did another and it connected to live. was connected for about 15 seconds. disconnected tried to further block connection and tried to connect again this is now the next day, and I got the ban notice.

it is my understanding that installing 9199 on a banned console restores hdd function, so a ban while on 9199, shouldnt affect hdd function or save data

some thread here recently stated that consoles on 9199 and maybe 8955 save a file on the nand that is believed to be created when a drive or nand is "modded" (I can t remember the thread or the file) but if this is the case it would stand to reason that this data is sent almost immediately when connected to live

9199 just restores the 360's ability to save to the HD - the console (I believe) still can't create trusted content - ie saves and GT will appear as corrupted on other 360s.
The file thats created/altered is the secdata - also now makes more sense you got the ban message the next day - you'll get 6 hours tops on a JTAG online (that's from when you first connect to Live) before your KV's a gonner.

Yes, the first connection is indeed a handshake as I said in the OP, on the Kerberos authentication protocol (google it). My worries are the subsequent connection(s) on the alternate port, and although Microsoft at present don't have anything in place to limit/blow/patch/etc. freeboot and the jtag hack, as others have said above I think it'd be naive to completely ignore the possibility of it in the future - they might just 'pull a fast one'. I for one don't like my console connecting back to Microsoft for any reason at all - even if it's just a darn ping.

At the moment, with the iptables previously mentioned set up, I have peace of mind that my console isn't connecting to anyone but teamfsd for diddly squit. Although at present I haven't had time to figure out where the NTP sync, covers, info, etc. are fetched from, but this doesn't bother me much for now. I need to get onto teamFSD and ask personally, but I can't find anyway to contact them but the bugtracker.

Try #FreeStyleDash on EFNet

I'll get at them tomorrow afternoon - it's a bit late now. Cheers.

We're on the forums too
NTP goes to pool.ntp.org, FSD updates to teamfsd.com
but all covers and such are downloaded from microsoft. we use the same url's NXE use.
In time we'll probably release a pc-indexer again, so if you're worried about connecting
to microsoft, you can wait for that for all your covers and such (won't be too soon though).

hope this helps

Brilliant - cheers Mattie!

I know of consoles that haven't ever connected to LIVE (original Xbox games or otherwise) and were never banned, so I have a question: Does this network communication occur only when an original Xbox game is run? or can it happen at any time?

I am no lawyer, nor do I claim to know anything about the law, but I am pretty sure that MS can't send you an update that will brick your JTAG 360, or make it unusable. Especially if you do not accept the update. The reasons people get banned (as I understand it) are for violating the ToS of Xbox Live, i.e., you willing connect to XBL with a modified Xbox 360. If you make all attempts to block a connection to XBL via the options on the Xbox 360, they should not be able to do anything to you because you are not violating any sort of terms. By blocking the connection to Xbox Live, I believe you would be refusing the ToS of Xbox Live, therefore you are not bannable. I have been connected via ethernet since I JTAGed months ago, and I have not been banned as of yet. I block the connection with the settings on the Xbox 360. However, if I were banned, I would contact a lawyer. (LOL)

from what i can gather... u own the hardware... u dont own the software...

I doubt anyone one get banned for connecting to live if their family settings were set to not connect to it.

Didn't google this week in the UK get found guilty of sniffing inappropriate data with their google cars (security details of customers wifi accounts) they should have been fined though.

But i believe this is connecting to live even if all options are set not connect will be used by microsoft to determine how many jags and such are out there.

It's a dodgy area indeed but the authorities would'nt do anything until there is a complaint that stirs up an investigation that finds out if microsoft are or aren't spying on folks by collecting data

Are you saying that you are using the original NXE with U6T1 or U6T2 shorted??? I tried that and received error E80!!!

The new TOS allows for silent updates! If the JTAG (with a banned KV) hassles the live servers enough it is concievable that they will put the console ID on the untrusted list (Meaning u have to patch for every game- From memory) Or maybe they'll just log-it

Having banned KV on JTAG means nothing as others have commented previously. I'm worried about the day when they decide to take it further(I'm glad I always remove R6T3)

I agree about the handshake prolly being for updating the 'Xbox Live is Up and Running' on network panel on the dash- to give/recieve QOS packets - But you never really know 4sure ....


BTW I would bet that Xval would prolly be in the layer 5/6 part of the handshake anyway (Same as above QOS)

i think this is the best solution so far. but how to make it permanent in the router and how to edit like if i want to play kai xlink, how to add it up.

sorry to gravedig here, but is there a list of domains that the xbox tries to connect to?
The reason i would like to know is so that I can plug in the domain names to opendns and have them automatically blocked.

Sorry if this is a stupid question but, is the newest version of Dashlaunch able to block any of this?

im sure dashlaunch doesn't block live in the least bit.
as long as you don't use your live profile on your hacked console
it's not gonna connect to live. besides even if you do connect chances are you
console is already banned.

That is what I fear, but Dash_launch_v2.21 has this to say in it's read-me, among other things:



My question is, does anyone know if this "fixes" the issue exposed in this thread?

For what it's worth...I am another poor sucker reading this post too LATE!!!

I am not kidding when I say this was the first time I ever had the ethernet cable in my JTAG. I wanted to dapple with PS3 Media Server which I hear works pretty well with Xbox and streams just about anything out there. I was having some connection problems so stupidly went to dashboard connection test page.

I think I clicked Xbox Live Connection test instead of Network Connection test option. Before I knew it Ban - I swear it was less than 10 seconds! Yet I had used Family Settings to BLock Xbox live creation, Access to XBL, made sure no User Profile had a Live Account and all that jazz.

Not a biggee losing XBL on a JTAG just was surprised an annoyed the feckers ignored all my settings and went ahead with connection. Talk about covert M$ actions or what and they hammer us for not playing the game!!!! Fecking hypocrites.

im unsure why you guys arent just blocking the ports xbl uses. they have always used the same ports since xb1 days.

Remove or bypass R6T3! Castrate the bitch. Make sure you have a good backup copy of your NAND.


http://forums.xbox-scene.com/index.php?showtopic=706121
http://forums.xbox-scene.com/index.php?showtopic=495800

One time my friend tried to update my JTAG, gave me an E80. Lucky for him (and me) I just reflashed the nand and it worked. Only time I ever purposely blow an EFuse is to update to 7371 to JTAG. Updating to 7371 will not change the CB, these are only patched if you sent your console back to M$, or bought one after 6/1/09 I think, as long as you use the right update!

Download here: http://www.mediafire.com/?zrugemuynvn
MD5: 8F8F8374C2C05028CD9F452A0E4D2757

$System_Update\su20076000_00000000
MD5: 703C32EB867A47F692C11FF0735E31B2

Download MD5 Checker here: http://download.cnet.com/MD5-SHA-1-Checksu...23107&idl=n

I ALWAYS check the MD5, before I even think of updating my console before JTAG. One guy on this form downloaded a link someone made look like 7371, and updated it to 8955. What a dick? Also, in regards to the E-Fuses, bypassing R6T3 is always a good idea on JTAG/RGH because of a story I heard. Apparantely, someone made a virus for the XDK (Developer Console), that blew all the EFuses (including the CPU key) of this $1700 machine. I can't believe people would get joy out of doing such a thing, what assholes!

I still don't know what to bypass on slims, saw an R6T3 but for all I know it goes somewhere else. Any ideas?