Slashdot Mirror
77 Million Accounts Stolen From Playstation Network
Runaway1956 was one of many users to continue to update us about the intrusion we've been following this week.
"Sony is warning its millions of PlayStation Network users to watch out for identity-theft scams after hackers breached its security and plundered the user names, passwords, addresses, birth dates, and other information used to register accounts. Sony's stunning admission came six days after the PlayStation Network was taken down following what the company described as an 'external intrusion'. The stolen information may also include payment-card data, purchase history, billing addresses, and security answers used to change passwords, Sony said on Tuesday. The company plans to keep the hacked system offline for the time being, and to restore services gradually. The advisory also applies to users of Sony's related Qriocity network."
steals everything.
Seriously? They were storing passwords in a way that could be unencrypted?
Hows that online requirement DRM working out for you guys?
~UC
They're calling it an "unexpected mass friendship opportunity."
SJW: Someone who has run out of real oppression, and has to fake it.
Gee, Sony just catch a break lately. I'm wondering if they are going to be asked to appear before the US Senate to explain their actions, just like Apple and Google? I think this is a little more serious than just tracking my phone location.
The real Sig captains the Northwestern. This one captains
It amazes me that a company as large and established as Sony would make such a boneheaded move as storing sensitive information in plaintext. Passwords and answers to secret questions should always be hashed. Credit card information and other sensitive information should be encrypted (preferably AES-256 or stronger).
I posted this in the last thread, but PSN users are already seeing their credit cards being fraudulently used!
So if you're affected, CANCEL YOUR CARD!
It's not a possibility anymore, it's a certainty.
You did not lost your identity, you gained additional account holders!
Massively Unexpected Online Identity Theft.
The only way to win...
I think the fact Sony has left the PSN in a completely disabled state for the past week could hint at some internal problems with disaster recovery. Their servers have been compromised and can no longer be trusted. In my world, that's a perfect time to re-build your systems from a pristine backup. So why doesn't Sony patch the vulnerability and deploy new servers? Perhaps it's because they don't have any good backups to restore from..
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
More interesting to me than how the intrusion occurred or how lax Sony's security practices are will be what the public backlash level is like. IT security departments tend to whip up a frenzy with the potential for "end of the company" concerns for data breaches on a regular basis. However, reality is that data loss doesn't always seem to have a particularly negative effect for the company that loses the information. Point in example would be the TJX data loss - http://it.slashdot.org/story/07/03/29/1618239/TJX-Is-Biggest-Data-Breach-Ever. Somehow this hardly seems to have put a dent in corporate profits. TJX's stock is up 100% since 2006 when the breach occurred. http://www.google.com/finance?q=tjx Point being is, if nothing seriously negative happens to Sony then it's no wonder that firms continue to have poor security practices. After all, why bother spending the effort and money to secure data when there is no return on the investment?
I wonder if Sony regrets waving the red flag. http://news.cnet.com/8301-13506_3-20050310-17.html. Anybody heard from geohotz in the last few days?
There are two schools of thought here...
If the passsword is stored as a hash on the server, then it is more resistant to attacks against the storage of the server. However, this does require the password be transmitted over the wire in one way or another on every connection. A man-in-the-middle attack with ip spoofing or dns cache poisioning has a non-trivial shot at compromising the password.
If the password is stored 'in the clear' on the server side and treat the password as a shared secret, then *if* you design the authentication right, you render man in the middle infeasible with the tradeoff of storage attack being a large exposure. A common scheme is to have client have a packet, concatenate with the password, calculate hash, then strip password before transmit. Server then repeats calculation and only accepts payload if secret matches. Usually, server responses are protected the same way, meaning only the server you *meant* to talk to can meaningfully respond because it needs your password to calculate correct hash responses.
All that said, it's also entirely likely that Sony has crypted hash passwords, but it's safer to say 'your password is compromised', because of how many users have passwords like 'yourmom65' rendering the hashing pointless.
XML is like violence. If it doesn't solve the problem, use more.
Never. Trust. The. Client.
If their online systems' security depends on all clients playing by a specific set of rules, it is Broken.(even barring custom firmware, PS3s communicate over the internet via reasonably normal protocols, so it isn't as though the public-facing infrastructure was ever invisible to PCs running whatever people wanted them to run).
Especially for something as large and potentially valuable as 77 million accounts, many with cards on file, there would just be no way that you could make the client secure enough to serve as a trusted part of your security system: your pirate will give up if you can't flash a firmware in software or do a relatively simple mod-chip install. A more serious hacker might be willing do dump some ROMs, if possible, maybe snoop bus traces if they can get to them, install mod chips that require SMT skills, etc. For 77 million accounts, though, you have to consider the possibility that somebody would commission a serious forensic teardown of your system, decapping, microscopes, and the lot.
So what are the ramifications for Sony if they violated PCI standards?
"- If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not."
Completely wrong. I have a PSN account and never, ever gave them credit card info.
In a world with plenty of well understood crypto schemes like public-private key systems where you can prove yourself without a shared secret... why the hell do we trust so much of our wealth with a trivial to see/copy account number being tossed around like crazy?
XML is like violence. If it doesn't solve the problem, use more.
The mp3 has been around since the mid 90s and plenty of other simpler formats were around before that. Macs were doing 8 bit PCM music back in the late 80s and if you want to be pedantic about it synthesized music on a personal computer has been around since the 8 bits days in the early 80s.
Seriously, I mean why give me a game that allows me to steal cars and shoot people when it's doesn't even emulate the experience properly?!! I go out and try these techniques on the street and they don't work at all the way they do in the game. It's morally negligent I say! I could be killed because of the bad info I'm getting from my video games!
Sony hasn't warned me of anything, and I know they have my correct email address attached to my PSN account. I am getting all of my information from 3rd parties. That irritates me more than their getting hacked in the first place. And yes, I canceled the credit card attached to my PSN account yesterday.
You have sued hotz, harassed those who modded/jailbroke your devices, suppressed hotz, and .....
'some' people basically handed your ass over to you in a different fashion ?
in the end, it seems you have annoyed far more dangerous circles in the internet hacker underground than the jailbreakers/mod hackers.
enjoy. and next time, remember that it is not good to treat people like cattle, and suppress/repress them.
Read radical news here
You don't really sound like you've played the game, the way you talk about it makes it sound very serious. You don't actually have to kill innocent bystanders unless you want to, just the same as real life. Many missions call for you killing people, but what do you expect in a game about gangsters? Actually, you don't even have to do the killing missions if you don't want to.. you could just be a taxi driver, paramedic, or firefighter if you really wanted to just be super-good all the time.
which is totally what she said
The last time I checked, my identity couldn't be stolen with a copied MP3.
The problem with the whole credit card system for online payments is that you will need to give your secrets out to anyone who you want to pay, and trust that they handle those secrets properly. It just doesn't work.
If someone steals your identity, do you no longer have it? Who are you then?
I've been robbed, and I'm not even sure what they have stolen. I've had my PS3 for years, it collects dust most of the time lately - But I'm sure I setup a PSN account back in the day. So, I know they have some data. I have a pretty good idea what that data is - But I can't be sure. And since their site is down, I can't go in and check. Wonderful. And I'm getting this info from the media - Where's my letter saying "Hey, we got robbed, they took this and it was yours." Or some sort of note. Anything. Sony...Hello?
A company that sues it's own customers is a company that does not care about protecting your information.
So, you peek into PS3 internals, you get slapped with lawsuits, police raids your home and they send army of lawyers after everyone.
Someone steals 77m accounts from Sony, all they have to say is basically...
Sorry?
Fuck you Sony.
I was playing MP2s on my computer almost ten years before that.
And MOD files five years before that.
And (okay, going to stop before I age myself here ...)
Kind of. A personal identity is singular and is assumed to only exist for one person. If one person uses an identity it is assumed another is not.
Also using another's identity most certainly can and does bring harm to the creator/originator of that identity.
Sort of, via my credit score. They use my identity to use my credit, not a copy of it. Anything they do to damage my credit becomes my burden to bear, not reflected on a copy of it. Credit isn't something that can be copied like a file.