asie, 1 month ago

@GossiTheDog The wild part is that this exploit was introduced in a firmware update in 2021, with seemingly no actual usecase other than to be exploited?

https://github.com/PretendoNetwork/SSSL/

"As of 5.5.5, CA's crafted in a specific way may take a newly introduced alternate path for verification. This allows for a CA's signature to not be verified correctly. Instead, the Wii U simply checks if the CA matches one already known by the system, but not the signature or contents of the CA. We have no idea why this change was made, as it does not benefit Nintendo at all. It almost feels intentional."

tomw, 1 month ago

@GossiTheDog This is interesting because I bet Nintendo would still want to patch this, but also just turned off its capability to do so

Edit: this is a little speculative though as we can't be sure that the online services and OS update mechanism was so tied together as that

phi1997, 1 month ago

@tomw
Considering that they left Pokémon Bank on so you can transfer your Pokémon to Switch, I'm going to assume they still left patching on too.
@GossiTheDog