Nintendo issues 3DS exploit bounty for enterprising hackers

By Danny Cowan December 6, 2016

nintendo offers hackers a bug bounty for 3ds exploits — Image used with permission by copyright holder

Nintendo has reached out to the hacking community with cash rewards for users who report vulnerabilities in Nintendo 3DS system security, revealing that it now plans to address software exploits before they become public knowledge.

Hackers who successfully identify vulnerabilities within the Nintendo 3DS system software will receive a bounty of between $100 and $20,000, depending on each exploit’s severity and its potential impact on the handheld gaming market.

Recommended Videos

The Nintendo 3DS has been a favorite target for hackers in recent months, leading to the release of multiple vulnerability-targeting applications and workarounds. Users who bypass the Nintendo 3DS’s security features are able to run unsigned code, ranging from home-brew applications to pirated versions of retail-released 3DS games.

While Nintendo frequently releases 3DS firmware updates to address security bugs as they’re found, hackers continue to devise exploits stemming from code vulnerabilities in new games, making it fairly easy to execute unsigned code on retail 3DS units. Previous hacking methods relied on exploits present in titles like Cubic Ninja and The Legend of Zelda: Ocarina of Time 3D, while other workarounds targeted vulnerabilities in the platform’s YouTube application and built-in web browser.

Rather than patching out exploits after they’re released and the damage has already been done, Nintendo aims to fix future 3DS vulnerabilities before they reach the general public. As part of its new vulnerability tipster program, Nintendo encourages hackers to develop “functional exploit code” in order to demonstrate the severity of discovered bugs.

“The reward amount depends on the importance of the information and the quality of the report,” Nintendo explained. “A report is evaluated to be high quality if you show that the vulnerability is exploitable by providing a proof of concept (functional exploit code is even better).”

Experienced hackers shouldn’t plan on making a living off of Nintendo’s new initiative, however, as the company’s terms don’t guarantee a payout for discovered glitches.

“Nintendo will determine at its discretion whether the vulnerability information qualifies for a reward as well as the amount of any such reward,” Nintendo’s statement reads.

Topics

Former Digital Trends Contributor

Danny’s passion for video games was ignited upon his first encounter with Nintendo’s Duck Hunt, and years later, he still…

Gaming

The Nintendo 3DS’ best (and weirdest) cult hit is coming to Apple Arcade

Horses race in Pocket Card Jockey.

Apple Arcade is kicking off 2023 by adding three new titles in January. Most notable among them is Pocket Card Jockey: Ride On!, a mobile port of one of the Nintendo 3DS cult hits set to launch on January 20.

The original Pocket Card Jockey, released in 2013 in Japan and 2016 in North America, is one of the 3DS' oddest titles. Developed by Pokémon studio Game Freak, it's a horse-racing RPG that revolves around solitaire. Players raise and breed horses and then race them by playing fast-paced rounds of solitaire. It's an extremely bizarre concept, but an incredibly fun one that made it one of the handheld's most charming hidden gems.

Gaming

Nintendo’s Wii Shop Channel and DSi shops are back online

Nintendo 3DS close-up.

After months of service outages, Nintendo's Wii Shop Channel and DSi Shop are back online.

Nintendo's two virtual marketplace services went down in March of this year. In a statement to Kotaku on the outage, Nintendo acknowledged the downtime but had nothing to report other than that the shops were undergoing maintenance and that it would provide updates on them at a later date. It seems it completely skipped the update and simply put both back online instead.

Gaming

Nintendo’s eShop closures are a necessary, but messy move

A Nintendo Wii U gamepad flat on a table.

Nintendo last week announced its intentions to shut down the Wii U and 3DS eShops, the systems' digital storefronts, in March 2023. This decision was disappointing for hardcore fans who stuck with Nintendo during that rocky era and extremely worrying as many of the games available on the platforms won't be preserved.
More significant Wii U games and a handful of 3DS titles were ported to Switch, but many titles are still stuck on those systems and can’t be ported. Once the digital storefront shutdowns, digital-only titles will be gone forever, and physical copies of these titles will get more expensive and harder to experience. Fans and game preservationists have not been pleased by this decision, with the Video Game History Foundation giving the most candid response.
https://twitter.com/GameHistoryOrg/status/1494398068346654720
Following this announcement, Digital Trends spoke to an industry analyst and game preservationists to get a better idea of what exactly caused Nintendo to shut down these stores and to learn how it could do a better job at preserving its legacy.
Why is Nintendo shutting down the 3DS and Wii eShops?
Officially, Nintendo’s FAQ on the eShop closures says “this is part of the natural life cycle for any product line as it becomes less used by consumers over time." The answer doesn’t get into specifics and might confuse those still playing games on the system or fans of games only available on Wii U or 3DS. Omdia Principal Analyst Matthew Bailey explains Nintendo’s user base argument in more detail, highlighting the massive gap between the number of people playing the Switch as opposed to the Wii U.
“While Omdia expects the number of Switch consoles in active use to exceed 90 million on a global basis this year, the Wii U’s global active installed base will drop under one million in 2022,” he explains. “Even when you include the more enduring 3DS family of consoles into the equation, the Switch still comfortably accounts for over 90% of Nintendo’s total active console install base.”
If one is going off just the numbers, it’s sensible that Nintendo would want to focus on the majority of its players. Bailey admits that “Switch users are already reaping the benefits of Nintendo’s singular first-party development focus on one platform.” Still, one might argue that Nintendo should just let the eShops remain up even if it isn’t actively updating or maintaining them.

Unfortunately, Nintendo doesn’t see that as possible due to cost and security issues. Game Over Thrity, a Twitter user with over 20 years of experience working on IT projects and infrastructure, shed some light on what might have influenced Nintendo’s decision-making in a thread.
“As these systems age, they require patches, security, special contracts, updates, and personnel that know how they were built (and maintained),” his Twitter thread explains. “As time goes on, there are security holes, servers, code, infrastructure, etc., that can’t be brought up to modern standards. It becomes a constant struggle between maintaining legacy systems, paying people to do so, and trying to keep up with global regulations. It’s not cheap by any means. They can’t just ‘leave the lights on’ and stop supporting them. What if someone hacked the payment processor?”
With every passing year, the Wii U and 3DS eShops likely became more expensive to maintain and an increased security risk for the video game publisher. Instead of investing the time and resources into pleasing a smaller amount of players, the easier option is to turn everything off entirely. While he isn’t affiliated with Nintendo, Game Over Thirty’s assessment aligns with what we’ve heard from Nintendo and Omdia.
"The Wii U’s global active installed base will drop under one million in 2022."