Slashdot Mirror
PSN Outage Continues, Console Hack Claimed To Be Responsible
Over the weekend, we discussed news that the PlayStation Network had been down for days, with Sony saying little other than that it was caused by an "external intrusion" and that they were "rebuilding their network." Many of you have written to point out that the outage continues, with Sony saying they "don't have an update or timeframe to share at this point." One theory about the cause behind the network's downtime was recently espoused on Reddit by 'chesh,' a moderator at PlayStation-modding enthusiast site PSX-Scene.com. According to him, recently released custom firmware called Rebug allowed people to essentially turn their PS3s into dev consoles, though some features were missing. A different group supposedly used this firmware to get on PSN through the developer networks, and also found that fake credit card numbers were not being validated for game purchases, leading to what chesh called "extreme piracy." He acknowledges that this theory is speculation. Sony's handling of this outage is starting to draw attention from the government. Update: 04/26 20:47 GMT by S : Sony just posted more details, saying that a massive data breach occurred: An "unauthorized person" has PSN users' "name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID." Billing address, password questions, and credit card info may also have been taken.
I've got a friend who is a PS3 fanatic, and hates all things Nintendo and MS as a consequence (never understood the partisanship myself, and I've owned all three consoles at one time or another and they all have their respective merits). A couple of weeks ago when he found out I was buying Portal 2 for the Xbox (I sold my PS3 a while back), I was treated to a rant about how superior the PS3 version was because it allows cooperative play between PSN and Steam PC users (a nice feature, for sure). I thought I was going to have to give him a sedative to get him to shut up about how stupid I was to even consider the Xbox version, how great PSN is, how much Xbox Live sucks, etc., etc.
I'm tempted to rub this in his face, but it would probably only make him worse.
SJW: Someone who has run out of real oppression, and has to fake it.
I understand that the slashdot community might be anxious to see the PSN come back up, but do we seriously have to start publishing nothing more substantial than speculation?
Also, I've met Dick Blumenthal. He's a very nice man. However, he is, by no means, "the government", nor does a single letter from a freshman senator constitute "attention from the government".
My postings are informational and does not constitute legal advice. Act on it at your risk.
Is there anything that isn't government business anymore?
why is the PSN outage any of the (US?) government's business?
Because Senators are suppose to represent their constituents and the issues they care about (lets leave the vote pandering cynicism discussion as off-topic for now) and his constituents are worried their personal/financial details were compromised in the attack so it makes sense that he would ask Sony whether or not this is the case as he has a better chance of being responded to because he wields more power.
It would be nice to be able to activate the PC version included with my PS3 copy of Portal 2. You're in a somewhat unique position to improve matters, given that you were planning to make the PC version available to us anyway.
Insert self-referential sig here.
One theory about the cause behind the network's downtime was recently espoused on Reddit by 'chesh,' a moderator at PlayStation-modding enthusiast site PSX-Scene.com. According to him, ... [snip]
He acknowledges that this theory is speculation.
Slashdot should to change its moniker to "Jerry Springer for Nerds". All that's missing is a video feed of some grimy sweat pants wearing nerds furiously typing away virtual beatdowns over who got who's virtual girlfriend knocked up.
This whole "new media" thing is unconvincing.
You seemed to have missed the part where dev consoles can get unlimited funds to buy content from the PSN store.
At least Amazon were up front about the failure and remedy for its service... Sony should be learning that lesson - fast! http://www.cmswire.com/cms/enterprise-20/the-aftermath-amazon-ec2-sony-playstation-network-recover-from-cloud-crashes-010954.php
If he's the Walrus then can I be a penguin please?
"We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network.
Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.
"
http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/
Yeah, that whole 17th ammendment ship already sailed, AC. Let it go.
If the rumor is indeed true that a custom firmware has been used to get some people free stuff, take note how Sony has handled the situation -- A small, small portion of people (the few that run custom firmware, and the fewer that run this particular custom firmware) are getting a few free (virtual) goods, and they shut down the entire network, screwing 100% of their customers.
What if banks operated this way? They find a ring of fraudsters using bank accounts to commit fraud, and the bank responds by freezing everyone's accounts for weeks? It would be totally unacceptable.
When you find a small group of fraudsters, you take targeted action against them alone, even if it means you hemorrhage a little money compared to the more totalitarian approach. Its part of the cost of doing business. In the retail world they call it "spillage" -- the fact that some of your goods might get damaged beyond saleability or that a few things will go missing from the floor (or the stock room) is unavoidable -- you simply do your best to detect and take action against those responsible, but you don't go around treating every other customer as a criminal.
Of course, that assumes the rumored reason is the cause of this action -- I suspect its either speculation or a (possibly intentionally-leaked) cover story for other measures taken in response to the Anonymous attack and whatever information they got out of GeoHot in the settlement. I anticipate a new official firmware will be required after the network comes back up and it will be necessary to access the "new" PSN, and possibly even already-owned downloadable content. This long of a downtime indicates pretty drastic changes behind the scenes, methinks.
aren't there other goddamned things they should be working on?
As a member of the Subcommittee on Privacy, Technology and the Law, this is exactly what Richard Blumenthal should, and is doing.
why is the PSN outage any of the (US?) government's business?
Why would you even question that? Preventing citizens from being harmed or abused by others, whether they be foreign armies, domestic criminals, or large corporations skirting or possibly even breaking the law, is precisely the most fundamental function of any government. There are regulations dictating how a corporation must handle user's information precisely because of this, and there's good reason to believe Sony ain't following them at the moment. Are you suggesting governments should just ignore their job and not enforce laws or address threats to their citizens merely because it's a corporation that did them rather than an individual or a foreign power, and therefore somehow above the law?
"Convictions are more dangerous enemies of truth than lies."
To tell the truth, I do not believe a think Sony says. Sony credibility has fallen to zero, or negative even. So if Sony says their system was brought to its knees by a "console hack" I naturally tend to assume that the real cause was an inside job. And then I go on to speculate about what kind of employee abuse goes on inside Sony that might trigger such a thing, not that I condone it.
Have you got your LWN subscription yet?
I'd written a blog post speculating about a worst-case scenario involving attackers using the leaked firmware signing keys to push a malicious firmware update from Sony's compromised backend servers. Personally, I've disconnected my PS3 from the network until the all-clear sounds from Sony.
Or we are seeing what happens when a company become so arrogant that they don't bother actually locking down this info despite the fact that it would be inevitable that someone would come along and find a backdoor.
Seriously, a 'hacked PS3' being able to do this is pretty much the definition of "Security Design Failure".
Bought the two big titles that came out a week ago. Can't play Mortal Kombat on my PS3 because PSN is down. Can't play Portal 2 on my Xbox360 because it red ringed on me. Isn't the latest technology grand?
Lets look at two problems with a Japanese company. PSN down and TEPCO's reactor. Both had similar reactions.
Silence, followed by small admissions, followed by admissions its much worse that it appears, followed by more silence, followed by admissions that some members of the public may have been harmed, repeat. No timetables, no estimates.
Is this possibly a Japanese cultural thing?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
If Sony had never removed "other OS" feature, they would never have encountered the focused rage of the entire enthusiast community.
Now, it's possible that the Playstation Network, and possibly the entire PS3 platform, is finished.
You reap what you sow, Sony....
If telephones are outlawed, then only outlaws will have telephones.
It seems we're going more and more toward this centrally connected system for gaming and software in general. Used to be if you wanted to use software you bought for a computer or game system, as long as you weren't in multiplayer or otherwise using network resources you were able to play without worrying about connection problems. Now when something like this happens a lot of things that have no apparent NEED for a connection stop working completely. It just shows that while being connected is nice, it certainly has drawbacks when some games or services are unusable. I can't watch Netflix now because it requires a PSN connection - even though the Netflix service is working perfectly fine. This reminds me a lot of Steam - another platform that is very convenient when it works, but extremely frustrating when it doesn't. These vendors need to come up with a better way to handle authentication in a way that doesn't leave you high and dry for something that would otherwise work if it wasn't for their failed network. Maybe some kind of token that only needs occasionally updated. Sometimes I miss those days when you just clicked the icon and it ran no questions asked!
The anime film "Summer Wars" predicted this EXACT scenario, except a little more extreme and with more dire consequences, but pretty darn close.
http://www.anime.com/Summer_Wars/
If telephones are outlawed, then only outlaws will have telephones.
Yeah, can't you wait until your Blu-Ray player stops working too, every time you want to watch a movie? This is why you can't have "server" verification. Because there's no guarantee the server will be there.
Tell your friend to return the game. It's broken. Get his money back. It's designed to fail.
If telephones are outlawed, then only outlaws will have telephones.
They almost certainly had that info on separate systems. Why else the "Billing address, password questions, and credit card info may also have been taken." disclaimer. If the information had been on the same system they would have been sure. However rather than assume that the information is safe just because it was on a separate server, they're saying that "at the moment we don't know. Please be vigilant until we can give a definite answer".
Two things.
a. I thought slashdot didn't edit articles. I'm obviously wrong.
b. This smells of anonymous....
That guy always was a coward...
Does this mean PSN stored passwords in cleartext?
If the password was hashed I'm not that concerned. You won't find my password in a rainbow-table.
But if it was unhashed, a looooot of people should change their passwords.
This XKCD comes to mind
Harald
Everyone.
I feel a disturbance in the financial industry, as if millions of gamer's credit cards were stolen, and then suddenly canceled.
:(){