Major Playstation Network Hack.

DurkaDurka
Avatar
#1
So, the Playstation Network (onling gaming, game store, messaging etc) has been down for approx a week now which is rather unusual considering it had an uptime of approx 90% in the past. Over the past couple days I heard that it had been hacked, with various rumors as to what had been compromised. Today, I received this e-mail from Sony..... seems there whole system was compromised along with subscriber info for millions of people.

If you have a Playstation 3 you might want to keep an eye out for on any suspicious credit card transactions.


"Valued PlayStation Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a
full and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly
and efficiently as practicable.

Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state/province,
zip or postal code), country, email address, birthdate, PlayStation
Network/Qriocity password, login, password security answers, and handle/PSN
online ID. It is also possible that your profile data may have been obtained,
including purchase history and billing address (city, state/province, zip
or postal code). If you have authorized a sub-account for your dependent,
the same data with respect to your dependent may have been obtained.
While there is no evidence that credit card data was taken at this time,
we cannot rule out the possibility. If you have provided your credit card
data through PlayStation Network or Qriocity, out of an abundance of caution
we are advising that your credit card number (excluding security code) and
expiration date may also have been obtained.


For your security, we encourage you to be especially aware of email,
telephone, and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security, tax identification
or similar number or other personally identifiable information. If you
are asked for this information, you can be confident Sony is not the
entity asking. When the PlayStation Network and Qriocity services are
fully restored, we strongly recommend that you log on and change your
password. Additionally, if you use your PlayStation Network or Qriocity
user name or password for other unrelated services or accounts, we
strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss,
we encourage you to remain vigilant, to review your account statements
and to monitor your credit or similar types of reports.

We thank you for your patience as we complete our investigation of
this incident, and we regret any inconvenience. Our teams are working
around the clock on this, and services will be restored as soon as
possible. Sony takes information protection very seriously and will
continue to work to ensure that additional measures are taken to
protect personally identifiable information. Providing quality and
secure entertainment services to our customers is our utmost priority.
Please contact us at 1-800-345-7669 should you have any additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment"
Last edited by DurkaDurka; Apr 27th, 2011 at 03:26 PM..
 
mentalfloss
#2
Yea, apparently Sony could be out $24 Billion because of this.
 
EagleSmack
Avatar
+1
#3
Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.
 
DurkaDurka
#4
Quote: Originally Posted by mentalflossView Post

Yea, apparently Sony could be out $24 Billion because of this.

No doubt, there will be some serious repercussions to this.
 
mentalfloss
Avatar
+1
#5
Quote: Originally Posted by EagleSmackView Post

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

Not to side with the hackers on this one, but the company should also bear some of the blame for their security measures.
 
DurkaDurka
Avatar
#6
Quote: Originally Posted by EagleSmackView Post

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

They should be hung out to dry but at the same time Sony has some serious explaining as to why some of this data is not encrypted. Leaving subscriber info in plaintext is retarded.

I'm pretty sure the hackers who did this were looking for a financial kickback, many of these sophisticated hacks are backed by mafia these days, so I have read anyways.
 
EagleSmack
Avatar
#7
Quote: Originally Posted by mentalflossView Post

Not to side with the hackers on this one, but the company should also bear some of the blame for their security measures.

They will in the tune of their losses. But guys are always going to hack and find ways around defenses. If a great security team gets beat by a brilliant hacker... wtf?!
 
Unforgiven
#8
Quote: Originally Posted by DurkaDurkaView Post

They should be hung out to dry but at the same time Sony has some serious explaining as to why some of this data is not encrypted. Leaving subscriber info in plaintext is retarded.

I'm pretty sure the hackers who did this were looking for a financial kickback, many of these sophisticated hacks are backed by mafia these days, so I have read anyways.

Not as new a phenomenon as one might think. Brand destruction came along in the 80s.
 
DurkaDurka
#9
Quote: Originally Posted by UnforgivenView Post

Not as new a phenomenon as one might think. Brand destruction came along in the 80s.

From a company's own fault or via outside sources?
 
mentalfloss
Avatar
#10
Quote: Originally Posted by EagleSmackView Post

They will in the tune of their losses. But guys are always going to hack and find ways around defenses. If a great security team gets beat by a brilliant hacker... wtf?!

There's a backstory to this as well.

Apparently Sony tried to get some hackers arrested earlier this year for hacking their PS3s. This had nothing to do with the network infrastructure. There was a feature that Sony removed from the PS3 in their latest firmware update - called "OtherOS" - which they believed was causing rampant piracy and therefore it needed to go.

Well a lot of people weren't too happy about this, and there is still an ongoing court dispute about this wherein many claim that the removal of the feature is like some sort of misleading advertising. Anyway, one hacker in particular has been targeted by the company in this dispute, and a hacker group called Anonymous has also made some statements about the removal of this feature - claiming it is unwarranted.

It could be that this intrusion into their network infrastructure was in part due to the backlash from this earlier feature removal.

The Anonymous group has come out and said that they had nothing to do with this latest attempt, so if Sony can find these guys only time will tell. But if they can't, then this will be one of the most successful disturbances of business we've ever seen.

I'm pretty sure from here on in, Sony will make damn sure they have a good anti-piracy schema in place from the beginning of their system's hardware cycle. People have proven time and again that they will go to great lengths to cause civil unrest or corporate disruption if they feel they've been treated unjustly.
 
DurkaDurka
Avatar
#11
Quote: Originally Posted by mentalflossView Post


I'm pretty sure from here on in, Sony will make damn sure they have a good anti-piracy schema in place from the beginning of their system's hardware cycle. People have proven time and again that they will go to great lengths to cause civil unrest or corporate disruption if they feel they've been treated unjustly.

Mental, Sony had the most sophisticated DRM on any of the consoles, the fact that it took over 5 years to crack it looks pretty good in their regard. The lawsuit against geohot for cracking the system was a farce though, by the time the court ruled, the source code was all over the net.

The problem with Sony or Microsoft for that matter is that they assume the majority of people who "crack" their systems do it in order to run pirated games... false. these systems have so much potential to do things these companies could never dream of or dream of but dont because they cater to the lowest common denominator. I have ran various cracked system in the past (PS3, Iphone, Android, 360) and it was solely to get the machine to do what I want.

They'll learn one of these days
 
mentalfloss
+1
#12

YouTube - PS3 - It Only Does Identity Theft

 
Avro
#13
Who cares? It's spring.
 
Kreskin
#14
Quote: Originally Posted by EagleSmackView Post

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

I'm with you on this.
 
Andem
Avatar
+1
#15
Quote: Originally Posted by EagleSmackView Post

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

It's not the fault of all 'hackers'. I myself run a custom firmware on my PlayStationa and for all intents, it should also be considered hacked. The reason why I do is because Sony removed the "OtherOS" feature which was an advertised feature included when purchased which allows you to run a second operation system on the PS like Linux. They even got tax breaks across the EU and I believe Canada and the US because they were selling the system as a "Personal Computer".

Sony opened this can of worms themselves. If they would have left the "OtherOS" feature, hackers, especially the one that cracked it open "Geohot", would not have had a real reason to even start tinkering with the system. Sony is also to blame because they built such a flimsy, insecure network and made hacking their servers a cakewalk. For the whole time, making a few changes to system files and it gave any user the ability to access the development servers!

This is all the fault of Sony for being so careless and trying to be so controlling of what people do with their own hardware.
 
DurkaDurka
Avatar
#16
Quote: Originally Posted by AndemView Post

It's not the fault of all 'hackers'. I myself run a custom firmware on my PlayStationa and for all intents, it should also be considered hacked. The reason why I do is because Sony removed the "OtherOS" feature which was an advertised feature included when purchased which allows you to run a second operation system on the PS like Linux. They even got tax breaks across the EU and I believe Canada and the US because they were selling the system as a "Personal Computer".

Sony opened this can of worms themselves. If they would have left the "OtherOS" feature, hackers, especially the one that cracked it open "Geohot", would not have had a real reason to even start tinkering with the system. Sony is also to blame because they built such a flimsy, insecure network and made hacking their servers a cakewalk. For the whole time, making a few changes to system files and it gave any user the ability to access the development servers!

This is all the fault of Sony for being so careless and trying to be so controlling of what people do with their own hardware.

While I agree that Sony shares a lot of responsibility for this, there is not an ethical hacker in the world that would stoop to stealing the identities of millions of PSN members, this is identity theft on a massive scale for which I'm fairly certain Anonymous had nothing to do with.
 
Andem
Avatar
#17
I agree. Anonymous isn't exactly capable of doing this in their current setup. When I read that they were targetting PS servers a few weeks ago, I visited their chat room and the large majority of the people in there were script kiddies. I'm not say that Anonymous is all script kiddies, obviously not, but I think they have ethical goals in their own minds and I certainly agree that stealing passwords and credit card numbers wouldn't be one of their goals.
 
DurkaDurka
Avatar
#18
Quote: Originally Posted by AndemView Post

I agree. Anonymous isn't exactly capable of doing this in their current setup. When I read that they were targetting PS servers a few weeks ago, I visited their chat room and the large majority of the people in there were script kiddies. I'm not say that Anonymous is all script kiddies, obviously not, but I think they have ethical goals in their own minds and I certainly agree that stealing passwords and credit card numbers wouldn't be one of their goals.

Yeah, anonymous is pretty simple in their methods (DDOS etc), for something this scale, I wouldn't rule out organized crime either. I was reading on Arstechnica earlier, that inside involvement at Sony is suspected as for this hack to work the way it did requires physical access to the hardware.

It would be great if there was a 'shadows' PSN where you could avoid the Sony BS.
 
mentalfloss
Avatar
#19
I can guarantee that if there was more than one hacker involved in this, Sony will find them. A job this big is something you go in alone for. Any attention you draw to yourself as part of the community and it's over.

We're looking at possibly up to $24 Billion in repercussions if all the accounts involved were tampered with.
 
DurkaDurka
Avatar
#20
Quote: Originally Posted by mentalflossView Post

I can guarantee that if there was more than one hacker involved in this, Sony will find them. A job this big is something you go in alone for. Any attention you draw to yourself as part of the community and it's over.

We're looking at possibly up to $24 Billion in repercussions if all the accounts involved were tampered with.

Sony is currently in the process of physically moving all the servers, routers, switches etc to a different location as they suspect inside involvement in the hack, so going with what I have read, I'm guessing someone on the inside to open up some ports on the firewalls, a who knows how many people on the outside to perform the hack. It will be interesting anyways
 
Dexter Sinister
Avatar
#21
I'd like to know why any business is allowed to keep customers' credit card numbers on file. After a transaction's completed and verified they have no need of it, all it does is allow the business to bill your credit card without your explicit consent, and leave that information open to hackers. A lot of businesses with online sales do that. Buy any of their product licenses online, and they'll automatically bill you for a resubscription a year later, then tell you afterwards. You can usually stop that, but you have to drill down through their website to find the place to turn off automatic renewals, and I've no doubt they still keep your credit card number. I don't think that's a legitimate business practice, I will decide in every instance what gets billed to my credit cards and when. That's why I abandoned McAfee's security products a few years ago, quite apart from it turning into bloated hogware.
 
mentalfloss
Avatar
#22
Consumers complain when they have to always re-enter their credit information. I used to be in that camp, but after this fiasco, I think I'll be limiting card access to Ebay and Amazon.
 
Dexter Sinister
Avatar
#23
Quote: Originally Posted by mentalflossView Post

Consumers complain....

Yeah they do, which only suggests to me that consumers don't know what's good for them. I spent a large part of my working life in IT and my considered opinion is that the only safe attitude to computer security is paranoia.
 
DurkaDurka
#24
Quote: Originally Posted by Dexter SinisterView Post

I'd like to know why any business is allowed to keep customers' credit card numbers on file. After a transaction's completed and verified they have no need of it, all it does is allow the business to bill your credit card without your explicit consent, and leave that information open to hackers. A lot of businesses with online sales do that. Buy any of their product licenses online, and they'll automatically bill you for a resubscription a year later, then tell you afterwards. You can usually stop that, but you have to drill down through their website to find the place to turn off automatic renewals, and I've no doubt they still keep your credit card number. I don't think that's a legitimate business practice, I will decide in every instance what gets billed to my credit cards and when. That's why I abandoned McAfee's security products a few years ago, quite apart from it turning into bloated hogware.

Sony claims the password table is encrypted, not really sure I believe them though
 
Tekknowlogy
#25
actually at first i was pissed, about the hacks and possible llosing credit card information, but then i see how sony acted and neglected to say anything, annd all they offer is 30 to 60 day play station plus, when i already have it..now i think GOOOD 24 billion good for you and your buildaburg bull****... i hope this whole monetary system falters and it will, thanks for nothing, i pay for you to have a swimming pool, while i rot in hopes my finaces are stolen, annd alll i get in return is a sorry.. and given something i already have, you guys are ****in tyrants...
 
Angstrom
Avatar
+2
#26  Top Rated Post
In the Geohot case. Sony asked court's to force Google to give out user information about who got a copy of the jail break code crack from geohots web page. Google is not really supposed to give that kind of information to anyone so it was not a smart move.

I don't think hackers liked that idea.

So some hackers attacked PSN to steal, Sony User account information in retaliation.
this is really just a bad judgment on the part of the U.S court in my opinion.
The jail break is out its no use violating peoples user information to know who has it.

Sony has stuck its penis into the hornets nest
 

Similar Threads

34
Paul the hack Martin
by Hank C Cheyenne | Oct 3rd, 2005
no new posts