Major Playstation Network Hack.

[DurkaDurka]

So, the Playstation Network (onling gaming, game store, messaging etc) has been down for approx a week now which is rather unusual considering it had an uptime of approx 90% in the past. Over the past couple days I heard that it had been hacked, with various rumors as to what had been compromised. Today, I received this e-mail from Sony..... seems there whole system was compromised along with subscriber info for millions of people.

If you have a Playstation 3 you might want to keep an eye out for on any suspicious credit card transactions.


"Valued PlayStation Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a
full and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly
and efficiently as practicable.

Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state/province,
zip or postal code), country, email address, birthdate, PlayStation
Network/Qriocity password, login, password security answers, and handle/PSN
online ID. It is also possible that your profile data may have been obtained,
including purchase history and billing address (city, state/province, zip
or postal code). If you have authorized a sub-account for your dependent,
the same data with respect to your dependent may have been obtained.
While there is no evidence that credit card data was taken at this time,
we cannot rule out the possibility. If you have provided your credit card
data through PlayStation Network or Qriocity, out of an abundance of caution
we are advising that your credit card number (excluding security code) and
expiration date may also have been obtained.

For your security, we encourage you to be especially aware of email,
telephone, and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security, tax identification
or similar number or other personally identifiable information. If you
are asked for this information, you can be confident Sony is not the
entity asking. When the PlayStation Network and Qriocity services are
fully restored, we strongly recommend that you log on and change your
password. Additionally, if you use your PlayStation Network or Qriocity
user name or password for other unrelated services or accounts, we
strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss,
we encourage you to remain vigilant, to review your account statements
and to monitor your credit or similar types of reports.

We thank you for your patience as we complete our investigation of
this incident, and we regret any inconvenience. Our teams are working
around the clock on this, and services will be restored as soon as
possible. Sony takes information protection very seriously and will
continue to work to ensure that additional measures are taken to
protect personally identifiable information. Providing quality and
secure entertainment services to our customers is our utmost priority.
Please contact us at 1-800-345-7669 should you have any additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment"

 

[mentalfloss]

Yea, apparently Sony could be out $24 Billion because of this.

 

[EagleSmack]

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

 

[DurkaDurka]

Yea, apparently Sony could be out $24 Billion because of this.

No doubt, there will be some serious repercussions to this.

 

[mentalfloss]

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

Not to side with the hackers on this one, but the company should also bear some of the blame for their security measures.

 

[DurkaDurka]

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

They should be hung out to dry but at the same time Sony has some serious explaining as to why some of this data is not encrypted. Leaving subscriber info in plaintext is retarded.

I'm pretty sure the hackers who did this were looking for a financial kickback, many of these sophisticated hacks are backed by mafia these days, so I have read anyways.

 

[EagleSmack]

Not to side with the hackers on this one, but the company should also bear some of the blame for their security measures.

They will in the tune of their losses. But guys are always going to hack and find ways around defenses. If a great security team gets beat by a brilliant hacker... wtf?!

 

[Unforgiven]

They should be hung out to dry but at the same time Sony has some serious explaining as to why some of this data is not encrypted. Leaving subscriber info in plaintext is retarded.

I'm pretty sure the hackers who did this were looking for a financial kickback, many of these sophisticated hacks are backed by mafia these days, so I have read anyways.

Not as new a phenomenon as one might think. Brand destruction came along in the 80s.

 

[DurkaDurka]

Not as new a phenomenon as one might think. Brand destruction came along in the 80s.

From a company's own fault or via outside sources?

 

[mentalfloss]

They will in the tune of their losses. But guys are always going to hack and find ways around defenses. If a great security team gets beat by a brilliant hacker... wtf?!

There's a backstory to this as well.

Apparently Sony tried to get some hackers arrested earlier this year for hacking their PS3s. This had nothing to do with the network infrastructure. There was a feature that Sony removed from the PS3 in their latest firmware update - called "OtherOS" - which they believed was causing rampant piracy and therefore it needed to go.

Well a lot of people weren't too happy about this, and there is still an ongoing court dispute about this wherein many claim that the removal of the feature is like some sort of misleading advertising. Anyway, one hacker in particular has been targeted by the company in this dispute, and a hacker group called Anonymous has also made some statements about the removal of this feature - claiming it is unwarranted.

It could be that this intrusion into their network infrastructure was in part due to the backlash from this earlier feature removal.

The Anonymous group has come out and said that they had nothing to do with this latest attempt, so if Sony can find these guys only time will tell. But if they can't, then this will be one of the most successful disturbances of business we've ever seen.

I'm pretty sure from here on in, Sony will make damn sure they have a good anti-piracy schema in place from the beginning of their system's hardware cycle. People have proven time and again that they will go to great lengths to cause civil unrest or corporate disruption if they feel they've been treated unjustly.

 

[DurkaDurka]

I'm pretty sure from here on in, Sony will make damn sure they have a good anti-piracy schema in place from the beginning of their system's hardware cycle. People have proven time and again that they will go to great lengths to cause civil unrest or corporate disruption if they feel they've been treated unjustly.

Mental, Sony had the most sophisticated DRM on any of the consoles, the fact that it took over 5 years to crack it looks pretty good in their regard. The lawsuit against geohot for cracking the system was a farce though, by the time the court ruled, the source code was all over the net.

The problem with Sony or Microsoft for that matter is that they assume the majority of people who "crack" their systems do it in order to run pirated games... false. these systems have so much potential to do things these companies could never dream of or dream of but dont because they cater to the lowest common denominator. I have ran various cracked system in the past (PS3, Iphone, Android, 360) and it was solely to get the machine to do what I want.

They'll learn one of these days

 

[mentalfloss]

YouTube - PS3 - It Only Does Identity Theft

 

[Avro]

Who cares? It's spring.

 

[Kreskin]

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

I'm with you on this.

 

[Andem]

Wow. What a bummer. Hacks should really be penalized severly. They think nobody gets hurt but they cause so much financial damage.

There should be a new law just for hackers.

It's not the fault of all 'hackers'. I myself run a custom firmware on my PlayStationa and for all intents, it should also be considered hacked. The reason why I do is because Sony removed the "OtherOS" feature which was an advertised feature included when purchased which allows you to run a second operation system on the PS like Linux. They even got tax breaks across the EU and I believe Canada and the US because they were selling the system as a "Personal Computer".

Sony opened this can of worms themselves. If they would have left the "OtherOS" feature, hackers, especially the one that cracked it open "Geohot", would not have had a real reason to even start tinkering with the system. Sony is also to blame because they built such a flimsy, insecure network and made hacking their servers a cakewalk. For the whole time, making a few changes to system files and it gave any user the ability to access the development servers!

This is all the fault of Sony for being so careless and trying to be so controlling of what people do with their own hardware.

 

[DurkaDurka]

It's not the fault of all 'hackers'. I myself run a custom firmware on my PlayStationa and for all intents, it should also be considered hacked. The reason why I do is because Sony removed the "OtherOS" feature which was an advertised feature included when purchased which allows you to run a second operation system on the PS like Linux. They even got tax breaks across the EU and I believe Canada and the US because they were selling the system as a "Personal Computer".

Sony opened this can of worms themselves. If they would have left the "OtherOS" feature, hackers, especially the one that cracked it open "Geohot", would not have had a real reason to even start tinkering with the system. Sony is also to blame because they built such a flimsy, insecure network and made hacking their servers a cakewalk. For the whole time, making a few changes to system files and it gave any user the ability to access the development servers!

This is all the fault of Sony for being so careless and trying to be so controlling of what people do with their own hardware.

While I agree that Sony shares a lot of responsibility for this, there is not an ethical hacker in the world that would stoop to stealing the identities of millions of PSN members, this is identity theft on a massive scale for which I'm fairly certain Anonymous had nothing to do with.

 

[Andem]

I agree. Anonymous isn't exactly capable of doing this in their current setup. When I read that they were targetting PS servers a few weeks ago, I visited their chat room and the large majority of the people in there were script kiddies. I'm not say that Anonymous is all script kiddies, obviously not, but I think they have ethical goals in their own minds and I certainly agree that stealing passwords and credit card numbers wouldn't be one of their goals.

 

[DurkaDurka]

I agree. Anonymous isn't exactly capable of doing this in their current setup. When I read that they were targetting PS servers a few weeks ago, I visited their chat room and the large majority of the people in there were script kiddies. I'm not say that Anonymous is all script kiddies, obviously not, but I think they have ethical goals in their own minds and I certainly agree that stealing passwords and credit card numbers wouldn't be one of their goals.

Yeah, anonymous is pretty simple in their methods (DDOS etc), for something this scale, I wouldn't rule out organized crime either. I was reading on Arstechnica earlier, that inside involvement at Sony is suspected as for this hack to work the way it did requires physical access to the hardware.

It would be great if there was a 'shadows' PSN where you could avoid the Sony BS.

 

[mentalfloss]

I can guarantee that if there was more than one hacker involved in this, Sony will find them. A job this big is something you go in alone for. Any attention you draw to yourself as part of the community and it's over.

We're looking at possibly up to $24 Billion in repercussions if all the accounts involved were tampered with.

 

[DurkaDurka]

I can guarantee that if there was more than one hacker involved in this, Sony will find them. A job this big is something you go in alone for. Any attention you draw to yourself as part of the community and it's over.

We're looking at possibly up to $24 Billion in repercussions if all the accounts involved were tampered with.

Sony is currently in the process of physically moving all the servers, routers, switches etc to a different location as they suspect inside involvement in the hack, so going with what I have read, I'm guessing someone on the inside to open up some ports on the firewalls, a who knows how many people on the outside to perform the hack. It will be interesting anyways