Sony Officially Blames Anonymous For PSN Hack

H_Fisher writes "In a letter to Congress, Kazuo Hirai, chairman of Sony's board of directors, blames hacker group Anonymous for making possible the theft of gamers' personal information. 'What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes,' Hirai wrote. He also indicated that Sony waited two days before notifying the FBI of the theft."

Comments

shame game

[alphatel]

I officially blame Sony for being PSN hacked.

Re:shame game

[ouija147]

Anonymous my ASS

Convenient scape goat

Re:shame game

[_xeno_]

They probably deserve the blame, too - they were apparently hacked via a "known vulnerability" although I don't think they've ever stated which one.

Re:shame game

[tripleevenfall]

Same here.

I fail to see any kind of plausible explanation why "We were busy defending ourselves from Anonymous" affected the poor design of their security structure.

Re:shame game

[toastar]

I think they meant anonymous as in they don't know who did it, not Anonymous the group.

Kinda like the guy who broke into my car and stole my radio/mp3 player was anonymous.

Re:shame game

[Eggplant62]

I blame Sony for not having security sufficient to prevent such an attack in the first place. What, did we have a Win '08 server facing the 'net without a firewall??

Re:shame game

[Anonymous Coward]

Actually it was Anonymous Coward. My bad. I just wanted to play "global thermonuclear war" and suddenly I got all these credit card numbers.

Re:shame game

[Omnifarious]

The real mind bender is.. Is there a difference? I mean, Anonymous isn't exactly organized is it? It's just a convenient name people adopt sometimes.

Re:shame game

[Anonymous Coward]

Nope: Linux running Apache. They use PHP, and where either owned via a known vulnerability in PHP or Apache. They haven't made it clear which, just that it was a known vulnerability with their "web application software."

Which is Linux based.

Re:shame game

[shentino]

Who scapegoated them?

A professional cyber cracker may well opt to take advantage of anonymous's wrath by leaving a frame job behind.

Re:shame game

[LWATCDR]

You can blame a home owner for not putting a good lock on their door but the person that breaks in should still go to jail.
Blaming the victim is just lame.

Re:shame game

[characterZer0]

Sony is not the victim, the users are the victims.

Re:shame game

[zmollusc]

Yeah, but a home owner with huge amounts of other people's sensitive data should have better security, or contract it out to someone competent.

Re:shame game

[LoganDzwon]

no there is not difference. People whom think there is do not understand the meaning of the word.

Re:shame game

[Riceballsan]

Both facts are true. Yes if they can trace and find the owner, but it also depends on your sort of business. If it is your stuff being stolen then you are the victim. When you take a role of protecting other people's stuff that is when you are liable. If someone breaks into a bank and steals my safe deposit box, yes the thief deserves jail time if he's caught, but if he isn't the bank and its security should be liable for what was stolen from their vault, not me.

Re:shame game

[softWare3ngineer]

to that point how did they find an Anonymous spokes person. they don't have meetings nor a roster. to join Anonymous you just need to participate in a DOS attack or just say you are part of Anonymous

Re:shame game

[HungryHobo]

Anonymous?
bah!
Not a chance!

To me this looks like the work of the famous lone wolf known as "Somebody"!

Re:shame game

[WrongSizeGlass]

I blame Sony for not having security sufficient to prevent such an attack in the first place. What, did we have a Win '08 server facing the 'net without a firewall??

No, it was a PS3 that used to serve as a Linux firewall. Unfortunately they 'patched' it and now it doesn't run Linux anymore.

Re:shame game

[19thNervousBreakdown]

what

Re:shame game

[margeman2k3]

Agreed.

In Canada (not sure about the rest of the world), if you don't have enough security measures in place to prevent someone from stealing sensitive/confidential information in your possession (like say, credit card numbers), then you are held responsible as well.
Comes up all the time now that doctors have copies of their patients' medical records on their laptops. Different, but the idea is the same.

Re:shame game

[poetmatt]

Wha? Why would it have to go that far?

This is a single file that sony "magically" came up with after the fact. This is more than a week later, and there's nothing they're showing to substantiate their claim. If there was an actual anonymous attack plan stating "let's steal sony's credit card info" prior to this event, then we might have a finger to point at anonymous.

Instead, I'd bet my life savings that Sony planed this "anonymous framing document" themselves.

I really hope this puts sony out of business.

Re:shame game

[Sinning]

If you say you are part of Anonymous, you're not.

Re:shame game

[powerlord]

I blame Sony for not having security sufficient to prevent such an attack in the first place. What, did we have a Win '08 server facing the 'net without a firewall??

Nope: Linux running Apache. They use PHP, and where either owned via a known vulnerability in PHP or Apache. They haven't made it clear which, just that it was a known vulnerability with their "web application software."

Which is Linux based.

Just out of curiosity, can you point to any links saying it was a PHP/Apache vulnerability, or even that it was a vulnerability in their Web Stack? I'm not disproving (I didn't read the whole Congressional Letter, so it may be in there), but I haven't seen any sources as to HOW the systems were compromised (from anyone).

Re:shame game

[nip1024]

Sony was entrusted with something they needed to keep secure. They failed. If I give money to a bank and some guy is able to take that money by kicking in the back door, then yes, the robber should go to jail, but the bank deserves blame too for not sufficiently securing what they were entrusted with. nip

Re:shame game

[Tsingi]

to that point how did they find an Anonymous spokes person. they don't have meetings nor a roster. to join Anonymous you just need to participate in a DOS attack or just say you are part of Anonymous

They found him, then shot him in the head and dumped his body in the ocean. Honest!

Re:shame game

[hedwards]

I'm guessing that Sony is scapegoating them because it's easier than figuring out who did do it. And even when/if they do figure out who it was, it's basically impossible to prove that that individual isn't in some convoluted way anonymous.

Re:shame game

[0100010001010011]

The reason it took so long is because they were planning on using 'terrorists', but after the recent news they decided against it.

Add "Anonymous" to the list of things that frighten the lay person and get stupid laws passed.
Right after 'terrorists' and 'for the children'.

Re:shame game

[JTsyo]

Sounds like a class action suit against Sony in Canada.

Re:shame game

[Catnaps]

It was reported somewhere that they were running a version of Apache from 2009, so I'm guessing that's a large part of it.

Re:shame game

[bioster]

Of course there's a difference.

Just because party A and party B are both anonymous doesn't mean they're the same party. It just means you can't pick either of them out of a crowd.

The Anonymous group which has been anti-Sony recently is huge, amorphous organization with goals that change from day to day depending on what they feel like doing that day. Think of Anonymous as an online flash mob.

The anonymous group that hacked Sony? Who knows. They could be highly organized under a feudal system where failure is rewarded with the opportunity to commit seppuku. Although this group is anonymous, they may have none of the attributes that make Anonymous what it is.

I guess the problem you're having is that you're equating anonymous with Anonymous. One is a description and the other is the name of an organization which happens to be descriptive.

If (as we suspect) Anonymous had nothing to do with the hack, then all Sony is doing is trying to vilify an organization that opposes it. In other words they're putting the blame on someone they don't like in the hopes of lowering public opinion of them.

Re:shame game

[AliasMarlowe]

You can blame a home owner for not putting a good lock on their door but the person that breaks in should still go to jail. Blaming the victim is just lame.

You can blame a home owner for not having firearms under lock and key, and the law is likely to do so.
It is the burglar who breaks in and steals them who is completely guilty of the theft. And whoever subsequently uses the stolen firearms is also guilty of a crime. But the burgled gun owner owner is guilty of negligence in failing to adequately secure items which could harm others, and would face consequent punishment in many jurisdictions.

Re:shame game

[ceswiedler]

From what I've heard, the vulnerability was in a library which was used by a piece of middleware which Sony relied on.

Sony should have tracked vulnerabilities in indirect dependencies more carefully, but I'll bet that dozens of other companies which invest millions of dollars in security have similar issues. It takes a ridiculous amount of money and sacrificed features to harden a non-trivial setup against truly determined attackers. Sony had both a lot of valuable credit-card data and a lot of wrath from the tech world, and that's a dangerous combination.

Re:shame game

[93 Escort Wagon]

My name is Anonymous, for we are many.

That makes absolutely no sense.

Re:shame game

[Illy-chan]

Weird question anymore. Maybe? Wouldn't be amazed if the hacker who did it was one of them. They certainly helped to enable the attack. Doesn't mean Sony isn't stupid for not taking better care of their customers. So glad I never got that PS3 but some of my friend's aren't so lucky. They can't even find out what information was specifically on there and in danger.

Re:shame game

[cdrguru]

In a climate like that anyone that knowingly carries personal data of another person's is simply a fool.

You cannot possibly know about all of the ways that data can be compromised. Similarly, at my doctor's office the doctors themselves use wireless laptops to update patient information and send out prescriptions. This is of course stupid because there is utterly no security through something like this. I'm sure the connection is not through a VPN or SSL because wireless is encrypted, right? Except today most professionals know that wireless encryption is easily broken. Fortunately for the doctors, there is no assumption of risk like that in the US.

There is no such thing as "enough" security measures. Hardwired networks inside a secure facility is a beginning, but the first person that installs GoToMyPC or something like that has just opened the door to unlimited access. Fortunately, credit card numbers aren't worth all that much or we would be seeing physical break-ins to get them. But anyone that believes the state of computer security allows someone to say they have "enough security measures in place" is an idiot.

There simply is no such thing when you are faced with a determined person or group of people. The security is going to be defeated.

Re:shame game

[Jah-Wren Ryel]

You can blame a home owner for not putting a good lock on their door but the person that breaks in should still go to jail.
Blaming the victim is just lame.

Except that Sony is the one who started the misplaced blame game here.

What Sony did was roughly the same as blaming a home invasion on some kid who egged their house. At that point Sony forfeited the victim sympathy card.

Re:shame game

[_UnderTow_]

But look at how Sony was dressed. They were asking for it.

Re:shame game

[icebraining]

http://en.wikipedia.org/wiki/Legion_(demon)

Re:shame game

[cdrguru]

You almost certainly sign something at a bank that says they are making a "best effort" and are not liable beyond that.

You are going to see things like this on web sites if any action succeeds against Sony. Just like with software (don't use this for critical life support functions, we're not liable for anything other than the purchase price, etc.), you will see disclaimers and agreements that have to be acknowledged in order to place an order somewhere.

So far, I don't believe anyone has ever had any liability for information in their keeping. And as long as it stays that way everything is fine. But there is no such thing as "enough security" except an air gap, so if Sony (or anyone for that matter) ends up with a serious liability because of a security exposure you can bet there will be no further exposures. Ever.

That would put a serious dent in online retail if the first thing you had to do was check of an acknowledgement that the seller wasn't liable for anything.

The problem of course is that credit card fraud isn't really a crime anywhere. It isn't prosecuted in the US except in utterly outrageous cases. Someone might get nailed because of breaking into a computer system but not because of credit card fraud.

Re:shame game

[Pseudonym Authority]

What is usually called as "Anonymous" on the news for idealogical, morally ambiguous things are children on AnonOps, and they are total losers who suck in every way, though sometimes support good things. The "Anonymous" group that hunts down cat killers, harasses little girls, and belong to that " far left website distributing child pornography to pedophiles"* go to 4chan**.
Don't confuse the two. They both hate it.

* Bill O' Reilly.
**More likely the other imageboard though, I watched them try to DDoS the new version of Encyclopedia Dramatica, and the thread got 200+ replies before someone realized that the IP specified in the OP (209.84.4.105) was fbi.gov! They had been attacking that for over an hour!

Re:shame game

[WATist]

Sony is more like a bank with inadequate security and insurance that was robbed.

Re:shame game

[ildon]

What's the name of the other guy?

Re:shame game

[tacokill]

In the US, the very fact that they are "in the home" means they are secure enough. Having them under lock and key is not a requirement of the law, nor will it ever be. A victim of gun theft is not guilty of negligence if the gun is later used in a crime.

What you claim simply isn't true.

Re:shame game

[Dunbal]

In b4 "Sony was hacked by the Scientologists who wanted to frame Anonymous for it"...

Re:shame game

[geekmux]

I blame Sony for not having security sufficient to prevent such an attack in the first place.

You are aware that Mr. Hindsight has perfect vision, right?

My point here is one can ALWAYS make your statement after the fact. Reality shows us that we have such things as 0-day vulns. In my opinion, Sony's failure was not so much getting hacked in the first place(which they do have their faults here, don't get me wrong), but more for failing to properly plan for this scenario.

If we've said it once, we've said it 1,000 times...it's not a matter of "if", it's only a matter of "when". Proper planning for the "when" can be just as important as the planning to avoid it.

Re:shame game

[sabt-pestnu]

I had heard of the apache servers being out of date, with the implication that other parts of their servers were similarly out of date. I had not heard about the middleware. Could you provide a link?

Re:shame game

[DarkTempes]

This from this twitter makes me think it wasn't an apache or php vulnerability, though 'application server' is a broad enough term that it could mean almost anything.
Some random security researcher posited that because they had outdated apache server versions (with no known exploits) that it might have been an apache vulnerability. News sources elsewhere repeated that nonsense.

Re:shame game

[DriedClexler]

Well, perhaps members of Anonymous could be investigated. Perhaps an equally talented security firm could identify the best hackers in Anonymous and then inform them that their names will be exposed if they don't come forth and help find the hackers behind Sony's breach.

What could go wrong with such a plan? Oh, wait.

Re:shame game

[twistedsymphony]

You can blame a home owner for not putting a good lock on their door but the person that breaks in should still go to jail. Blaming the victim is just lame.

That's a BS analogy... This situation is more like the home owner blaming their bank for not putting a lock on the vault... In that situation the bank (Sony) has just as much responsibility to good protection as the thief had a responsibility to not steal it.

Re:shame game

[Dunbal]

That's the whole point - there IS no "Anonymous the group". All there is are a bunch of wannabe script kiddies who are dying to jump at the chance of being able to claim "credit" for something like this, but most of them don't even know what port 80 is for.

Re:shame game

[Svartalf]

Damn, for want of mod points... :-D

I think there's a few of us that would hold that position.

Re:shame game

[_Sprocket_]

In a climate like that anyone that knowingly carries personal data of another person's is simply a fool.

You cannot possibly know about all of the ways that data can be compromised. Similarly, at my doctor's office the doctors themselves use wireless laptops to update patient information and send out prescriptions. This is of course stupid because there is utterly no security through something like this. I'm sure the connection is not through a VPN or SSL because wireless is encrypted, right? Except today most professionals know that wireless encryption is easily broken. Fortunately for the doctors, there is no assumption of risk like that in the US.

Welcome to HIPPA. You have a lot of reading to catch up on.

There is no such thing as "enough" security measures. Hardwired networks inside a secure facility is a beginning, but the first person that installs GoToMyPC or something like that has just opened the door to unlimited access.

Right. And it is impossible, impossible I tell you, to compartmentalize systems and do egress filtering.

Fortunately, credit card numbers aren't worth all that much or we would be seeing physical break-ins to get them. But anyone that believes the state of computer security allows someone to say they have "enough security measures in place" is an idiot.

Physical trespassing involves a lot more risk and a lot more logistics - it's a lot less attractive for this kind of thing. But you're completely right on the concept of security being a definitive goal one matches. One can match requirements and meet compliance. But too often people think they are "secure" as if risk can be whisked away by being in a state of grace / arriving at security nirvana.

There simply is no such thing when you are faced with a determined person or group of people. The security is going to be defeated.

Not a given but the attackers tend to have the advantage.

Re:shame game

[sabt-pestnu]

Yes and no.

Yes, Zero-day attacks exist.
No, what they fell prey to did not need to be one. Servers that had been unpatched for some number of months, with the resulting window of known vulnerability available.

We can't even say "they didn't plan for this scenario". It's a known unknown. As you say: when, not if. Damage done is a variable unknown until it occurs, and must be assessed. And "run around screaming about the sky falling" is a conceivable, if ineffective, plan.

From the outside looking in, we don't really have a look at Sony's response plan, how well thought out it was or how well carried out it was. I'd say, though, that taking everything that they found compromised offline as soon as they could, and not bringing it back up until it had been patched would be a good one.

Re:shame game

[LWATCDR]

No you are wrong. If a back has a bad lock on the vault or a be alarm then there insurance will go up until they fix the issue. They will not face criminal charges. If they broke some federal security rule they may even get fined.
Bad security isn't a criminal act theft is. Sony is a victim. Sony's users are victims. Who ever stole the data is a criminal. So no nothing that you said is in fact true. No body or organization is ever under as much obligation to protect property as a thief is to not steal it. I mean really? Think about what you are say it is just so whacked out that it just doesn't make sense.I mean think about!

Re:shame game

[LWATCDR]

Sony and the users are.

Re:shame game

[LWATCDR]

But you will not go to jail for it and the criminal that stole your car still will go to jail. FAIL!

Re:shame game

[LWATCDR]

A. Not someone committing a crime.
B. The victim is a minor. Laws treat minors differently.
C. you will be sued not sent to jail. The owner didn't commit a crime unless there is a law requiring a fence.
FAIL,

Re:shame game

[LWATCDR]

Will this cost Sony money? Yes. Was Sony the target of a criminal act? Yes. Sony is also a victim as are Sony's users.

Re:shame game

[LWATCDR]

So? That doesn't make Sony not a victim. A back with that situation will face higher insurance rates. The criminal act was the breaking what Sony did wasn't a crime.

Re:shame game

[LWATCDR]

So do you think such a kid with a history of vandalism and making threats to the home owner wouldn't be the first person they would look at?
  At this point you are making Sony's case.
Here is a really important rule of life. If you threaten people and vandalize there stuff if anything bad happens to them you will be the first one they come looking for.
That is just common sense which just seems totally absent from Slashdot today.

Re:shame game

[LWATCDR]

That is what I said. You can be a victim and still have some responsibility. You should have a dead bolt on your door but that doesn't mean that you are a criminal if you get robbed. Why is this so hard for people to understand?

Re:shame game

[mcmonkey]

I really hope this puts sony out of business.

Seriously? How many Play Stations are up on eBay or Craigs List, or in the trash, because their owners were fed up with dealing with Sony?

I'm guessing 3. Ah, the impotent rage of the Internet Tough Guy.

If you're affected by this PSN thing and you're upset, fine. But don't pretend this will affect business going forward. What are you going to do? Buy a Wii?

Disclosure: I don't own a PS, but I do have 2 Sony receivers, a subwoofer, a CD carousel, and somewhere an old yellow walkman.

Re:shame game

[stealth_finger]

Technically they are right, it was done by an unknown person or persons who aren't claiming responsibility and are therefore anonymous.

Re:shame game

[froggymana]

I'm guessing that Sony is scapegoating them because it's easier than figuring out who did do it. And even when/if they do figure out who it was, it's basically impossible to prove that that individual isn't in some convoluted way anonymous.

Well wouldn't those "secret hackers" be anonymous until he/she's name is revealed?

Re:shame game

[LWATCDR]

I once had to work at a secure facility doing computer repair. You do not even want to know what it took even back in the 80s to have real security. I will tell you that a lot of humorless armed guards was involved.

Re:shame game

[goose-incarnated]

In the US, the very fact that they are "in the home" means they are secure enough. Having them under lock and key is not a requirement of the law, nor will it ever be. A victim of gun theft is not guilty of negligence if the gun is later used in a crime. What you claim simply isn't true.

GP didn't qualify his statement with a country name - it could still be true

(FWIW, in my country, the statement is fully true)

Re:shame game

[LWATCDR]

So did Sony break any laws? If not then so? Yes you have to follow laws but I am pretty sure that none apply in this case so??? Also I said Sony has some responsibility but that does not mean that they are not a victim and that the person that took the data isn't a criminal.
So using your analogy which doesn't fit at all.
The person robbed was the victim of robbery.
The person that broke in guilty of theft. They are also not guilty of armed robbery if they take the guns because they are in position of a fire arm while committing a felony.
The thief will then probably be charged with sell of stolen goods for selling a gun.
Then who ever commits the gun crime will be guilty of murder, attempted murder, depending on what crimes they do.
The home owner will not be charged with murder but might get a fine for not securing their firearms... Maybe..
So Sony will get sued for not securing peoples data well enough and have to pay higher insurgence premiums that still makes them a victim and the people that stole that data and possible sold the data criminals. I just don't understand how this is so hard for people to understand.

Re:shame game

[poetmatt]

Why am I an internet tough guy? That is quite a non sequitur. They have had abhorrent policies and generally treat the public like shit for years. I don't do business with sony in any way. I do not buy sony products.

In reality, companies who have total access cut off for more than 3 days are extremely likely to go out of business (>90%). This is a well studied economic issue, and in this case while it is not all business with the company, it is substantial. A week's worth of PSN revenue is not small by any stretch of imagination for a company that relies on it, and neither will the penalties from lawsuits and regulations that come out of this.

Re:shame game

[uniquename72]

I think gp's point was that "legion" works in the phrase because it means "many."

"Anonymous" doesn't mean "many", so "My name is Anonymous, for we are many" is nonsensical. ("My name is Anonymous, for I am behind 7 proxies" is perfectly fine, though.)

Re:shame game

[N0Man74]

Anonymous my ASS

Convenient scape goat

Indeed. I think that the following quote shows they don't really understand the nature of Anonymous.

'What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes,'

Re:shame game

[Aqualung812]

Similarly, at my doctor's office the doctors themselves use wireless laptops to update patient information and send out prescriptions. This is of course stupid because there is utterly no security through something like this. I'm sure the connection is not through a VPN or SSL because wireless is encrypted, right?

I'm pretty sure you don't know what you're talking about. If you assume WiFi is no more secure than the internet, then wireless or hardwired are just as secure.
Every doctor's office I've seen is too small for local servers, most are using some SaaS product that is over the Internet, so again, they use VPN or SSL to get there.

Re:shame game

[scot4875]

But if that bank says they're making a "best effort," and they leave the back door open for people to just walk into the vault, then they are in breach of contract for not actually making that "best effort" -- and would certainly assume some liability for their failure to do so.

--Jeremy

Re:shame game

[TheQuantumShift]

Maybe, but the official word is:

We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named "Anonymous" with the words "We are Legion."

Most likely whichever jackwagon actually perpetrated the act thought it sounded cool. Or they used some automated 1337_h4cK.vbs script that came from the "real" Anon (if there can be such a thing). Or something. Whatever. I'm more curious to see what other companies are quietly reviewing their own security practices...

Re:shame game

[Fluffeh]

Same here.

I fail to see any kind of plausible explanation why "We were busy defending ourselves from Anonymous" affected the poor design of their security structure.

No, of course not, but to the average "layman Kompooter User" that sounds just plausible enough to make it stick. Sort of like claiming "I hit the little old lady while swerving away from the child that ran onto the road..."

Re:shame game

[praxis]

It does make them negligent with confidential user information, if indeed they were storing it on unpatched servers with no encryption. Having them speculate on who the attacker was is also not winning them points in my book.

Re:shame game

[HermMunster]

Yes, they did hack Sony. But, they were not the ones responsible for stealing the data. Their attacks apparently were long ended by the time these other attacks occurred. On top of that, due to that, isn't it clear that Sony tripped on their own security, or lack thereof? Really, they'd been attacked and yet did nothing to correct the holes uncovered, and now they are blaming it on Anonymous?

Re:shame game

[blair1q]

Anonymous ate my homework!

Re:shame game

[Anonymous Coward]

It takes a ridiculous amount of money and sacrificed features to harden a non-trivial setup against truly determined attackers. Sony had both a lot of valuable credit-card data and a lot of wrath from the tech world, and that's a dangerous combination.

It's interesting that they spend ridiculous amounts of money and sacrifice features in order to DRM their games and console up the wazoo and yet they aren't willing to spend comparable amounts protecting their customers' personal information and credit-card details. And by "interesting", I mean "downright appalling".

Re:shame game

[anomaly256]

Wha? Why would it have to go that far?

This is a single file that sony "magically" came up with after the fact. This is more than a week later,

and AFTER they had said PUBLICLY several times that they had no reason to believe Anonymous had anything to do with it!

Re:shame game

[anomaly256]

Make that 4 actually.

Re:shame game

[iplayfast]

How about the home owner who thinks their door is locked, but is in actual fact broken from the manufacturer.
I blame the manufacturer for giving a false sense of security. If I buy something on the web, I expect it to go over a secure connection. I don't expect ebay to oops and start handing out passwords and credit card info.

Re:shame game

[tobiah]

they had to drop the terrorist theory when they found out bin Laden didn't have internet service.

Re:shame game

[mug funky]

this is not analogous to the "she shouldn't have dressed like that" argument though.

more like the "she shouldn't have left the door unlocked, windows down when she had all that gold sitting on the passenger seat".

Re:shame game

[theshibboleth]

Umm... personally I'd be in favor of a law that forced corporations to secure MY private data.

Re:shame game

[Kalriath]

If you actually read the letter (I know, slashdot) they raise the possibility that Anonymous was completely unaware that their actions were covering the thief's intrusion.

Re:shame game

[TheGratefulNet]

you're half right.

it wasn't 'somebody', it was 'anybody'. anybody is the one who is responsible.

(and yes, I-don't-know is on third.)

Re:shame game

[Culture20]

I know a few people at second hand game stores. They had to stop buying used ps3s. Apparently people were only selling them, not buying them.

Re:shame game

[dwarfsoft]

Would it have been accepted if they had said they were the victims of Anonymous blindly stumbling in and finding a hoard of credit card numbers? I think that would sound worse. They are trying to deceive those who known not of Anonymous' MO.

Re:shame game

[Jah-Wren Ryel]

So do you think such a kid with a history of vandalism and making threats to the home owner wouldn't be the first person they would look at?

The first person they would look at simply because he's standing right there with an egg in hand? Sure.

The first person they would blame publicly? No, not at all.

That is just common sense which just seems totally absent from Slashdot today.

Pot, kettle, bam.

Re:shame game

[LordLimecat]

Werent they ridiculing Anonymous' hacks as feeble a month ago?

Re:shame game

[tftp]

How many Play Stations are up on eBay or Craigs List, or in the trash, because their owners were fed up with dealing with Sony? I'm guessing 3.

I have a PS3, but I have no plans to sell it or anything like that. I think I have a PSN account, but there is nothing in it other than a random username and a random password. I don't even recall why I set it up - probably to see the news and to browse the store. There is no credit card associated, no address, no nothing. I don't play online games; I'm quite satisfied with offline ones, played from a BlueRay disk. I think a bunch of PS3 owners are in the same position; they just use it as an appliance, not as a service that needs to be paid for every month. PSN doesn't even exist for those people.

Re:shame game

[adamofgreyskull]

They are not mutually exclusive you ninny. Life isn't that black & white, but your pithy comment has been moderated "insightful" anyway. Ho-hum. Both Sony AND the users are the victims here. An analogy to aid understanding: If someone broke into my safety-deposit box at the bank, both I and the bank are victims. If the bank's security wasn't that great then I have every reason to be upset with them, but it doesn't change the fact that they were also victim.

Re:shame game

[drinkypoo]

Seriously? How many Play Stations are up on eBay or Craigs List, or in the trash, because their owners were fed up with dealing with Sony?

I'm guessing 3. Ah, the impotent rage of the Internet Tough Guy.

Actually in my area there's been a rash of them lately. And I live in bumfuck, nowhere. I suspect the number is significant though not enormous.

Re:shame game

[ScrewMaster]

"It takes a ridiculous amount of money and sacrificed features to harden a non-trivial setup against truly determined attackers."

Yep and the lawsuits will cost a ridiculous amount of money too. Even if they win a case it will cost a lot of money defending that case. We are talking about a lot of lawsuits!

Yes, but to a typical corporate purchasing type, security costs money now, whereas lawsuits will cost money then and aren't his department anyway.

Re:shame game

[Dr Dodgy]

Ah, the impotent rage of the Internet Tough Guy.

But.... I joined a facebook group too.

Re:shame game

[ScrewMaster]

If you say you are part of Anonymous, you're not.

Or maybe you are. But you're Anonymous, so who really knows for sure?

Re:shame game

[ScrewMaster]

No, that was us. Your radio wanted to be free.

The music wanted to be free. The radio was happy where it was.

Re:shame game

[ScrewMaster]

There is! For ONE BILLION DOLLARS http://www.thestar.com/news/article/984932--playstation-users-plan-class-action-suit-for-hacking?bn=1

Insane, I read the amount in the paper this morning and thought it was a typo.

Well. If lawyers in Canada work anything like the way they do here in the U.S., they make bombastic claims and ask for spectacular redress right up front. They know they'll never get that much (but hey, they might) but the hope is to vilify the organization they are suing in the court of public opinion.

Re:shame game

[ScrewMaster]

The criminal act was the breaking what Sony did wasn't a crime.

You can't say that. Sony is a multinational operation and it's entirely possible, even likely, that in many jurisdictions their negligence was, in fact, criminal. If so, they'll be seeing some court time in the coming months.

Re:shame game

[Vectormatic]

This might not lead to a mass-exodus from the PS3 or anything, but people considering buying a PS4 might reconsider because of this (and off course anyone considering a PS4 for the other-OS option will think twice), just like lots of people will think twice about buying an xbox 720 after the whole RROD debacle.

The last sony product in my house is my PSP, which i like, it is a very good handheld gaming device, and ever since nintendo went all gimmicky, it fits better as a succesor to my GBA, but the NGP doesnt appeal to me, and buying something from Sony is pretty rapidly becomming a no-no. I just wish microsoft would launch an x-boy already, i dont even care if it only as powerfull as the original xbox, just give it to me!

Re:shame game

[tehcyder]

Disclosure: I don't own a PS, but I do have 2 Sony receivers, a subwoofer, a CD carousel, and somewhere an old yellow walkman.

I think in slashdot terms that makes you a Sony shill.

Re:shame game

[tehcyder]

Maybe, but the official word is: We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named "Anonymous" with the words "We are Legion." Most likely whichever jackwagon actually perpetrated the act thought it sounded cool. Or they used some automated 1337_h4cK.vbs script that came from the "real" Anon (if there can be such a thing). Or something. Whatever. I'm more curious to see what other companies are quietly reviewing their own security practices...

Anonymous should sue for breach of copyright.

Re:shame game

[sincewhen]

Wait, are you saying that Anonymous is made up of anonymous people?
Man, I'm taking the blue pill.

Re:shame game

[AndroidCat]

I found a text file on my computer that says that Sony is a bunch of giant douche bags. It must be true!

Re:shame game

[AndroidCat]

It was probably a PHB vulnerability. Those are the worst to fix.

Re:shame game

[LWATCDR]

Interesting but I believe the server was in the US "I could be wrong" so then US laws are probably the ones that apply.

Re:shame game

[LWATCDR]

They would get Sony and this happens. Going back to that kid yes you would tell the police that the kid said he was out to get you and that he had egged your house the night before. The police would question of not take them in for questioning. If the kid hid from them they would probably ask for a warrant. Yes it is common sense that if you publicly threaten a company and then that company is attacked you will be publicly blamed. That is common sense.What I find so sad is that a bunch nothing but vindictive thugs is held is such high regard by some people on Slashdot. The thing is that Anon can not even honestly say "they did do it" because they claim that they are not a formal group but are just a random mob on 4chan. If that is true how can they say that somebody in that random mob didn't do it? If that is not true then they have lied about many things in the past and are criminal organisation.

Re:shame game

[LWATCDR]

Okay, "I blame x for being hacked"
One they where not hacked. They where attacked. You hack your computer when you make it do something cool. You can hack device to add a new function. You can even hack your PS3 to run homebrew.
Hacking == good activity that is both moral and ethical even if it say Sony doesn't like it.
What happened to PSN was not good, moral, or ethical. Good job confusing the two.
Second you blame the target of an unethical, illegal, and immoral act for the act?

That is double plus good newspeak citizen, you shall go far. In one sentence you are both connecting hacking with criminal acts that hurts consumers, blaming the target, and badly shifting the blame from the criminal to the target. In one sentence you have just given every big media lawyer a giant box of ammo to make the DMCA stronger, try to repeal that jail-breaking exception, and shutdown console modders. So how much is Sony paying you?

Re:shame game

[ScrewMaster]

Interesting but I believe the server was in the US "I could be wrong" so then US laws are probably the ones that apply.

Yes, but is that the only way that jurisdiction can be determined? If people outside the U.S. had their data stolen, other countries laws may apply. I've never used Sony's network, but I'm assuming that it was delivered to users outside the continental U.S. as well.

oh Shit!

[Anonymous Coward]

They're on to us!

Re:oh Shit!

[blair1q]

You say that about everything.

Yeah right

[festers]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

Re:Yeah right

[firex726]

That's the part that made me LOL.

And besides, couldn't much of the damage of the attack been mitigated with even minimal effort in internal security?

Re:Yeah right

[Bobfrankly1]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Sony.

Re:Yeah right

[cpu6502]

Sony is doing what all people in power do:
- find a scapegoat.

Reminds me of what my boss said, "I will not take the blame for the failure of this board. YOU will." Normally I would agree, but I told you that we should do additional testing to verify it works, but you said 'we don't have time'. LIKEWISE I suspect Sony's employees told them to add additional safety measures, but Sony's managers refused to spend the labor time/cost.

So instead the managers are deflecting blame from themselves to the users.

Bastards.

Re:Yeah right

[vuke69]

That's not really sticking it to Sony.

Wait until the PCI-DSS audit is complete. That's when the sticking begins.

Re:Yeah right

[countertrolling]

- find a scapegoat.

And kill him.. It's 'cleaner' that way

Re:Yeah right

[shentino]

Would it be sophisticated and professional to *frame* anonymous?

Re:Yeah right

[Idbar]

See, what baffles me is that they lock Blurays, Consoles, Google TVs, handsets to no point. They know they are not good at it because (except for the GoogleTVs) all of them have been hacked already.

Yet they go around collecting information they know they are not good at protecting.

Re:Yeah right

[10101001 10101001]

Off-topic, I know, but it reminds me of how US Senators are trying to scapegoat Pakistan over not finding and handing over bin Laden. Last I checked, bin Laden's organization attacked the US and it was the US who was actively pursuing bin Laden for over 9 years. That Pakistan might not have found him in 5 years seems a moot point. And that doesn't even begin to point out how quickly we blamed the Taliban when they couldn't (or wouldn't, since it might upset their delicate power balance with the war lords) find and hand over bin Laden in a few months.

Of course, these are politicians I'm talking about. Expecting some sort of responsibility or accountability out of them is like expecting responsibility or accountability out of a company. But, oh no, we should never regulate companies. That would interfere with the free market and then those companies wouldn't be quite as efficient!

Re:Yeah right

[AK Marc]

If you read their statements, they blame Anonymous for DDOSing Mastercard and Visa for the breach on PSN. They spread Faux News style "information" by saying something that works out to "Anonymous was attacking people because of us (and a smaller attack on PSN that wasn't active at the time of the intrusion) and then the attack happened. We aren't saying that Anonymous did it, we are saying it looks like there's a link - We report - You decide." Of course, for making fun of our favorite un-news group, I'm sure I'll get modded/flamed, but it's something people are getting used to seeing in the news. When deliberate lies are spread as "fair and balanced news" from formerly reputable news organizations, why should we expect any less from corporations?

It's possible the two were linked. Perhaps Sony deliberately reduced security to improve uptime with a DDOS. Perhaps the targeted attack was planned and ready for a while and they waited until Sony was busy with other security matters or wanted to deflect the blame. "Linked" doesn't mean "caused by" or even "influenced by" in that the attacks would likely have happened even if Anonymous didn't exist. But that the timing may have been adjusted, however slightly, by Anonymous's actions. But it's not like someone DDOSing Sony from Anonymous said "Wow, I just hacked the Gibson, let's see what's in this garbage file..."

Re:Yeah right

[ClickOnThis]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Sony.

"Is Sony Guts!"
- Sony (describing Anonymous)

Re:Yeah right

[Machtyn]

Really, then what about Anonymous taking credit for the HBGary deal? Perhaps not especially carefully planned, but it was planned. Certainly not very professional - but what is professional about cracking systems - even when the (Chinese, US, Russian, insert your own) government does it on enemy servers? It was highly sophisticated - if you consider social engineering and/or knowledge of vulnerabilities sophisticated - I happen to think it is.

Before Sony announced this, I always felt it was an Anonymous attack because there were those that claimed to be Anonymous had threatened to do so. I'm sure some of those "members" were also disheartened with the way things turned out between Sony and geohot. It is not that unreasonable to think they went ahead and attempted something.

The only way to prove or disprove the claim is to follow the data trail if the data gets out. If the data does not get out, at all, then I would be fairly certain that it was an Anonymous attack - because they did it for the LuLz.

Notice, I'm not taking Sony's side. They're completely stupid for a lot of things. But to say that statement cannot be associated with members of Anonymous is denying the possibilities of Anonymous and their past works.

Re:Yeah right

[Jonner]

Anyone who has read TFA will not find this the least bit insightful, though the Slashdot headline is extremely misleading as usual. Sony said they had been the "victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes," but did not blame Anonymous for that. They said they were under a DDOS attack from Anonymous at the same time as the security breach and the two events may or may not have been related.

Re:Yeah right

[mandelbr0t]

Eventually such people run out of scapegoats, and get to deal with the brunt of the backlash themselves. Sorta like Ed Stelmach here in Alberta. If he didn't have his billionaire lobbyists padding his wallet, he'd be out of there by June like everyone wants. People in high places melt down; it's only a matter of pressure. This is only another example of short-term thinking with long-term unintended consequences on Sony's part (and anyone else who thinks they can blame Anonymous for their network security troubles).

Re:Yeah right

[rmstar]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

Maybe it got lost in translation? "Those unnamables thoroughly, professionally, fscked us"?

Re:Yeah right

[Kamiza Ikioi]

I was thinking the exact same thing. There are some skilled people who are a part of what Anonymous does. But half are still Photoshop-ing 8-bit penis drawings on celebrity pics, and the other half is trying to create the next big meme over at the Parody Motivator Generator.

Re:Yeah right

[dkleinsc]

- find a scapegoat.

A good scapegoat isn't just someone who can take the blame, it's somebody who you're trying to attack or remove for reasons you can't actually state publicly. For instance, if The Boss has to pick between scapegoating Alice or Bob, they might pick on whoever's standing in the way of a plum promotion for their good friend Fred, regardless of whether Alice or Bob had more to do with the problem in the first place. Or if someone from country A attacked country B, if the leaders of country B wanted to attack country C but couldn't come up with a legitimate reason they might try to blame the whole thing on country C rather than country A.

So I'm guessing Sony has it in for Anonymous for reasons totally unrelated to this breach.

Re:Yeah right

[Maestro485]

nope, which is why it isn't hard to believe sony did just that.

Re:Yeah right

[0xG]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Sony.

This are not words I think of when reading slashdot...

Re:Yeah right

[izomiac]

Anonymous is not a group, it's a collective of individuals. Kinda like a Stand Alone Complex if you've seen that show. It's also similar to the Lone Wolf Terrorists that I've heard discussed on the news of late. Assuming homogeneity, cohesion, or group-type structure is folly.

IOW - while the majority of 'Anonymous' might be random /b/-tards, this is just an observation. No single individual is a /b/-tard in every aspect, many are quite professional in other contexts. And some obviously have very advance technical skills. IMHO, Sony learned the danger of stirring the waters when you don't know what lurks in the depths. (Obviously assuming this was someone doing this in the name of Anonymous rather than a thief who wants to misdirect the investigation.)

Re:Yeah right

[Wyatt Earp]

Pakistan entered into a counter terrorism relationship with the United States after 9/11, in part to keep the United States from invading Pakistan on the way to Afghanistan, and they had captured hundreds of Al Qadea members over the last 10 years. Before that, the US and Pakistan had closer relations during the 1960s and 1980s with alot of US military and intelligence assistance going to Pakistan.

Al Qadea had conducted operations against the Pakistani government after 9/11, however some factions of the Pakistani government, the intelligence service and some of the Army, favor the political and religious stance of Al Qadea over the more liberal leanings of the majority of urban Pakistanis.

Pakistan had a legal responsibility to find bin Laden and other Al Qadea members, the fact that his compound was a couple hundred meters from a major Pakistan military academy makes it hard to believe they didn't know where he was.

Re:Yeah right

[DragonWriter]

Sony is doing what all people in power do:
- find a scapegoat.

Correction: Sony is trying to do what all (or, well, a reasonably large fraction, at any rate) people in trouble try to do: find a scapegoat.

Being in power has very little to do with it. A strung out penniless drug addict caught by the cops with a needle full of heroin about to inject himself will try to spin a story of how it isn't his drugs.

Being in power does make it somewhat more likely that you'll have publicly identified enemies that you can pull out as a scapegoat, I suppose.

Re:Yeah right

[Anonymous Coward]

Words I do think of when discussing Anonymous, however, are "we did it for the lulz," or, more to the point, "we did it." If there's one thing they love more than pulling their more-than-pranks, it's the attention they get for doing them. Yet they've emphatically denied this one, and they didn't even start doing that until people started pointing fingers.

Given that, I'm inclined to believe them on this. Stealing private information isn't really their M.O. anyway; what they get, they get from public sources (and man, do they get a scary amount this way).

Re:Yeah right

[sznupi]

Their console was by far last to fall during this gen; kinda similar with Bluray (long enough vs. competition); handsets? At the least, it doesn't really seem they are worse than any random corp.. so, what, most should discard information they have or is this just the good old Sony bashing?

Re:Yeah right

[mr_lizard13]

The Slashdot headline isn't just misleading, it's a complete fabrication.

Re:Yeah right

[smelch]

Anonymous itself stated

...

if someone calls himself "Anonymous", he in that very moment, stops being Anonymous.

Don't say contradictory things like you know what the fuck you are talking about, then tell everybody else they're wrong because you set contradictory rules to membership of a club which is not a club then claimed to be members which is against being a member. Then you top it off with the cream of the creme, "EPIC FAIL". Your post is everything I hate about the internet going mainstream, cyber-douchism at its maximum.

Re:Yeah right

[10101001 10101001]

Pakistan entered into a counter terrorism relationship with the United States after 9/11, in part to keep the United States from invading Pakistan on the way to Afghanistan, and they had captured hundreds of Al Qadea members over the last 10 years. Before that, the US and Pakistan had closer relations during the 1960s and 1980s with alot of US military and intelligence assistance going to Pakistan.

So...Pakistan was bribed and coerced into helping the US find and capture bin Laden, which is precisely why the CIA failed for 9 years. Oh, right, none of that matters to the point that the CIA failed for 9 years.

Al Qadea had conducted operations against the Pakistani government after 9/11, however some factions of the Pakistani government, the intelligence service and some of the Army, favor the political and religious stance of Al Qadea over the more liberal leanings of the majority of urban Pakistanis.

Yes, while most of Afghanistan pre-9/11 was war lord wilderness, only a sliver of Pakistan was. To appease that group (and its followers in the government), very little work was done to directly attack Al Qadea in that sliver. But, Pakistan kept being pushed by the US and eventually started taking actual action, which resulted in Al Qadea finally responding with attacks in 2007 (Bhutto's assassination, possibly) and later. So, only after that point would I see Pakistan's government actually really caring about Al Qadea as a threat. Of course, none of that against explains why the US failed in finding and capturing bin Laden.

Pakistan had a legal responsibility to find bin Laden and other Al Qadea members, the fact that his compound was a couple hundred meters from a major Pakistan military academy makes it hard to believe they didn't know where he was.

And the US "knew" bin Laden was in Pakistan, yet it wasn't until after the raid on the compound that they were certain bin Laden was there. Leon Panetta even made it very clear in a recent interview that the belief that bin Laden was there was based entirely on circumstantial evidence. There was no direct proof. But, yea, I'm sure a few Pakistani military academy troops, from the virtue of being nearer, would intrinsically do a better job.

In short, no matter how much of a case you can make that Pakistan could and should have done a better job, it's still deflecting from the real point that US Intelligence took over 9 years to find bin Laden. The failure of Pakistan, taken in that perspective, seems a rather moot point. After all, Pakistan isn't exactly a super power, didn't until more recently even have a personal interest in finding bin Laden, and if Pakistan was as untrustworthy in relaying information as you imply then actually relying upon them in the hunt was mildly foolish at best if not outright fool hearty. The point isn't that Pakistan is excused because it did a piss-poor job. It's that Pakistan's piss-poor job doesn't excuse the US's piss-poor job, especially if you're seeking to find someone to blame. Personally, I'm not.

Re:Yeah right

[maxwell demon]

Reminds me of what my boss said, "I will not take the blame for the failure of this board. YOU will." Normally I would agree, but I told you that we should do additional testing to verify it works, but you said 'we don't have time'.

Of course when he told you that you should not do additional testing, you asked for a written confirmation, right?

Re:Yeah right

[sznupi]

Oh come on, we couldn't help but to make it into a PR farce from the start for some reason... How many people even realize the preparations were well under way by the time "the reasons" happened (and nvm slight continuity problems and how the ultimatum was a farce, also how getting in the way of some investigations possibly made those events easier)

Will remain so; despite the supposed "war of words" Pakistan (one of very few of our "allies" to quickly recognize Taliban gov; others being Kuwait and Saudis, IIRC) is safe I'm sure, ISI won't be labelled as a terrorist organisation... Pakistani ISI which fought alongside the Taliban (the largest support going towards the only mujahidin faction eager to fight not only against the Soviets) vs. the Northern Alliance, greatly contributing to them being unable to hold Afghanistan (nvm how, immediately after the "causes", "rumors" began that Iraq could have played a role; or how opium production skyrocketed after the intervention (is it already a pattern? BTW "free market"); how the compromised ISI was again, also, quick to helpfully point out their enemies, for us to deal with; how ideology is branded as an "organization", which can be obviously fought like any organization)

Admittedly such subtleties just confuse people (and the farce of October surprise in 2004 was hilarious, with OBL tape clearly designed to make reelection easier :) ...well, still not on the level of Reagan team hampering Iranian hostage release efforts), what we got is so much more palatable. Just social evolution, not the "best" approaches surviving but the fittest ones... as long as it works (how many people now realize that bomber gap and missile gap were a fiction comparable to mine shaft gap? How many even heard about Team B?)

But don't paint it so into "us" vs. "them" (locally) fashion. Systems of governance are ultimately basically a reflection of society; from where do people forming them come from? It's hard to find somebody who would actually abstain from taking a piece of the cake for themselves, given the chance (not the same as just declaring they wouldn't do it; then you have virtually whole families swearing for one military member amongst them - always somebody honourable and decent; or families of some engineer or blue-collar worker, normally bitching about gov waste, always praising the work of their family member - especially when it's publicly funded, when the product provided is obviously essential and the price fair)

Re:Yeah right

[Wyatt Earp]

A large chunk of Pakistan is "war lord wilderness", and OBL wasn't found there, he was found in a middle class neighborhood in a city known for military training establishments and academic institutions.

It's well known that the Pakistani intelligence community assists the Taliban and Al Qadea, hence the CIA and SOCOMs inability to find OBL.

Re:Yeah right

[demonbug]

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Anonymous. Give me a break.

"carefully planned, very professional, highly sophisticated"

These are not words I think of when discussing Sony.

No kidding. PSN only got marginally worse once they shut it off.
Maybe they are taking this opportunity to actually build a network that works and isn't embarrassingly slow.

Re:Yeah right

[sznupi]

It might be also what actual masses of Sony users pretty much want and expect (almost certainly not any of "the managers are deflecting blame from themselves to the users" crap). Look at forums, etc. of actual typical users, they largely wish Sony all the best throughout the affair, and they hate all by themselves whomever has done this.

And "Anonymous" pretty much designated "itself" as such convenient target by default anyway; that's the point of hiding behind this one label for many disconnected actions, make impression of grander movement (vs. just another Judean People's Front)

Re:Yeah right

[Em Adespoton]

It's also useful to find a scapegoat that has proven to be culpable in the past and who cannot defend themselves. Since anonymous has no centralized leadership, there's nobody that can honestly say "it wasn't us!"

Re:Yeah right

[bannable]

Not entirely. If you had RTFA, you'd have noticed the bit about files being found on the compromised servers named "Anonymous", containing "We Are Legion."

Re:Yeah right

[mr_lizard13]

Entirely. The Slashdot headline states "Sony Officially Blames Anonymous For PSN Hack". Sony has done no such thing.

Sony has made a link between the actions of a group it refers to as 'Anonymous' and the hack. It has not stated that Anonymous carried out the hack.

Slashdot have misrepresented what Sony has stated.

Re:Yeah right

[nwf]

So I'm guessing Sony has it in for Anonymous for reasons totally unrelated to this breach.

Indeed. Anonymous already demonstrated that PSN was designed poorly and made Sony look like fool. Now that someone else has done real damage (not the customers' information was stolen, but that people could get stuff without paying for it. This is the real reason they took it down--lost revenue) after everyone knows that PSN was poorly designed, it opens up Sony for more lawsuits. Because they knew they had issues, but did nothing. Then something serious happens and they look like complete morons. They can't blame anyone other than Anonymous for fear of looking negligent.

Re:Yeah right

[10101001 10101001]

Yeah except the U.S. has given Pakistan over $20 billion in aid over the past 10 years. Or was that just to show we like them? Also, the Taliban didn't just 'not look hard enough' for bin Laden, they sheltered him and allied with him. They refused to turn him over first to the Saudi's then later to the United States. I don't know what kind of false history world you are living in, but there is no connection between Pakistan and Afghanistan here.

Let's see how well of a false history world I'm living in. The Taliban were semi-rulers over a bunch of war lords in Afghanistan. Some of those war lords were sheltering bin Laden and his followers. If the Taliban had tried to simply went along, blindly, with the US's request, bin Laden would have likely been hidden by the war lords in much the same way he was hidden by the war lords when the US came in or how he was sheltered in Pakistan. However, the Taliban was an evil theocracy with views the US didn't like. The Taliban didn't exactly morn 9/11, either. So, we went into Afghanistan with anger in our hearts to destroy the Taliban, as a bin Laden ally, because we hated them and that action likely aided bin Laden in escaping--I say this because we could have, oh, gathered intelligence for months or years then sent in a strike team with say two black hawk helicopters resulting in a much quick capture time for bin Laden.

Meanwhile, recently bin Laden was possibly found--we had only circumstantial evidence of his position--and possibly sheltered by yet another country, this time Pakistan, who was been receiving financial aid for around a decade specifically to find and turn over bin Laden and his allies. Instead of making threats against Pakistan, ordering bin Laden handed over, etc, we sent in a strike team because we apparently didn't trust the Pakistani government enough.

There seems to be a connection there, and it seems to revolve around bin Laden, a lack of trust of governments in the region, and the choice of action in dealing with the capture of an individual. Of course, it's too simply to say that because bin Laden and al Qaeda aren't synonymous. Invading Afghanistan has certainly resulted in the death of many al Qaeda members. If that was the goal, well, even Pakistan's failing to hand over bin Laden isn't a big deal because he's more a figurehead then anything--his death meaning the need for a replacement figurehead, not a death or real harm to the organization.

In the end, it seems we went after al Qaeda not because they killed so many of our people but because they had the audacity to attempt such a thing and actually succeeded. And we didn't simply attack the Taliban because they were shelterers of our enemies but because they had the audacity to not bend to our will through either money or threat of force. A war or two do not seem the appropriate response except as a means to force other countries or organizations to respect the authority of the US in the world.

The more pragmatic response would seem to be more akin to what Mossad does. It's dirtier and eviler in many ways, but we're already there in many ways with the CIA. We've been there for decades.

So, I guess I really just don't understand things at all.

Re:Yeah right

[10101001 10101001]

A large chunk of Pakistan is "war lord wilderness", and OBL wasn't found there, he was found in a middle class neighborhood in a city known for military training establishments and academic institutions.

So, he was the last play the CIA bothered to look? And perhaps Pakistani intelligence as well, presumably they were trying?

It's well known that the Pakistani intelligence community assists the Taliban and Al Qadea, hence the CIA and SOCOMs inability to find OBL.

I didn't realize Pakistani intelligence was a suborganization of the CIA and hence the CIA was fully reliant upon them for intelligence gathering. Oh, right, they're not. Yes, Pakistani intelligence not helping or outright hindering CIA efforts certainly is something that could get in the CIA's way, but the CIA still managed to find OBL and it sounds like it finding or not finding OBL had really nothing to do with Pakistani intelligence except in so far as Pakistani intelligence might have known and not bothered to tell the CIA. So, great, we can fault Pakistani intelligence for being unhelpful. But, again, that doesn't explain why it took the CIA so long on its own to find OBL.

Re:Yeah right

[sabt-pestnu]

> but at least be original and don't ...

We live in the internet age. You present a high bar.

When I can google the term "Faux news" and the second link is the news network being lampooned, I don't find it so far off the mark.

Be irritated by the wordplay all you like. But see how apropos the rest of us find it, first.

Re:Yeah right

[david_thornley]

How long was it between the removal of OtherOS and the cracking of the PS3? OtherOS may have encouraged people to play with it rather than crack the console.

Re:Yeah right

[sjames]

Or perhaps they got attacked and their asses handed to them by a six year old in Japan (just before her bed time) but didn't want to own up to that, so they blame Anon instead.

Re:Yeah right

[Aardpig]

Are you a dick all the time, or is this a red-letter day?

Re:Yeah right

[Confusador]

Are you sure you posted this on the right story? It's hard to tell from the content.

Re:Yeah right

[AK Marc]

Faux news (without the quotes and caps) is what Sony is reporting. That Fox News has a similar moniker that it worked hard to obtain (suing for the right to lie in news stories, having more opinion content than news content and presenting the opinions as news, and other such practices). As such, it seemed quite appropriate. And I called it that those who don't like Fox News being made fun of would flame me.

And the complaints against Fox are unrelated to any political ideology they are linked with. Their news isn't bad. It's just that there's almost no news on the Fox "News" channel. The FCC should make them rename it to the Fox Opinion channel.

Re:Yeah right

[thetartanavenger]

FTFA:

Sony Corp (6758.T) blamed Internet vigilante group Anonymous for indirectly allowing a hacker to gain access to personal data of more than 100 million video game users.

That sounds to me like Sony blames them. They're saying it wasn't necessarily them that did it, but Sony are using them as an excuse for distracting them away from their security responsibilities. The title and summary are correct, although they are exaggerating some facts to make it sound more serious than it is. The accusation that is, not the breach itself.

On a side note, what kind of company has security set up such that because someone else is ddossing you, other people can get in. Pure bs and incompetence.

Re:Yeah right

[Vanderhoth]

The thing is Anonymous usually takes credit for their attacks. In this case I'm sure I've read they specifically said it wasn't them. Not that I don't take that with a grain of salt, but it seems more plausible to me that Sony is looking to blame someone else. Anonymous is a group of hackers, people are fearful of hackers, people (especially fan boys) are also more likely to side with Sony, ergo Anonymous is a perfect scape goat for Sony.

Re:Yeah right

[meglon]

exactly.

Re:Yeah right

[praxis]

Not entirely.

"Sony Corp (6758.T) blamed Internet vigilante group Anonymous for indirectly allowing a hacker to gain access to personal data of more than 100 million video game users."

Sony is not saying Anonymous carried out the attack. They are saying if Anonymous had not done what they had said they had done then the access of personal data would not have occurred. They most certainly are actually blaming Anonymous for being the cause to the effect of a successful attack.

Here's a car analogy. I am stopped at a red light and Alice is in the lane next to me. It's a summer day and we have our windows done. Not liking each other, we are bickering while waiting for the light to change. Bob comes from behind and rear-ends me lightly. I then go on record saying that had I not been bickering with Alice I may have noticed Bob in the rear-view mirror and been able to avoid the accident by rolling up a foot. Someone then publishes a headline that reads "praxis blames Alice for accident". Is that headline really 100% false?

Re:Yeah right

[praxis]

I don't mean to double-post, but perhaps this is a more succinct version of my point.

Does "Sony Officially Blames Anonymous For PSN Hack" have only one meaning and that meaning is that Anonymous carried out the attack? Or are there other meanings that are possible? If there is ambiguity, is it fair to say that the headline is a complete fabrication? Is it fair to say that the headline is a complete fabrication if one of the other possible meanings describes what Sony actually said accurately?

Re:Yeah right

[mr_lizard13]

Quite sure, thank you.

Re:Yeah right

[Nyder]

Sony is doing what all people in power do:
- find a scapegoat.

Reminds me of what my boss said, "I will not take the blame for the failure of this board. YOU will." Normally I would agree, but I told you that we should do additional testing to verify it works, but you said 'we don't have time'. LIKEWISE I suspect Sony's employees told them to add additional safety measures, but Sony's managers refused to spend the labor time/cost.

So instead the managers are deflecting blame from themselves to the users.

Bastards.

Easy to believe. Having play Everquest 2, I noticed about 3 years or so ago we lost a "Quality Checker". It really became apparent when, mythical weapons were introduced in the game, and it gave a server wide message that misspelled mythical. (every time someone earn it, it was funny. took them like 2 months to fix a spelling error. 2 fucking months!)

Still quest from 2 expansions ago that the words aren't in there. Crap like that. Stuff that shouldn't of made it out of beta/test server, but did.

Sony reaps what it sows in the name of it's quest for money.

Re:Yeah right

[mr_lizard13]

You've quoted the Reuters article, but not the Sony statement.

The PlayStation blog and Sony's statement to The US House of Representatives can be found via the following links:

http://blog.us.playstation.com/2011/05/04/sonys-response-to-the-u-s-house-of-representatives/
http://www.flickr.com/photos/playstationblog/sets/72157626521862165/

Both make clear reference to the file placed on the server which bears the hallmarks of Anonymous, but neither statement "officially blames Anonymous" for the PSN hack.

Re:Yeah right

[mr_lizard13]

The headline is, IMO, little more than link-bait. It could just as easily (and far more accurately) stated that Sony has implied a link between the activities of Anonymous and the recent PSN hack.

At no point has Sony said the PSN hack was the work of Anonymous, which is what the headline certainly states. Sony has yet to "officially blame" anyone.

Re:Yeah right

[staticneuron]

http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars It isn't true that "all" the people taking up the banner do not have methods more advanced than DDoS.

Re:Yeah right

[exomondo]

Anonymous is not a group, it's a collective of individuals. Kinda like a Stand Alone Complex if you've seen that show.

It isn't like a stand alone complex, attacks by Anonymous are always organised (look at the IRC channel), a DDOS with multiple participants would not work if it weren't organised.

(Obviously assuming this was someone doing this in the name of Anonymous rather than a thief who wants to misdirect the investigation.)

There wouldn't be any difference then since you've said Anonymous isn't a group and anyone acting in the name of Anonymous is Anonymous.

Re:Yeah right

[ukemike]

Unbeknownst to the loyal readers, Slashdot has been acquired by Rupert-Murdoc's News Corp. From now on misleading and false headlines will be the result of deliberate policy instead of laziness and poor editing. A renaming contest will be held. Pick your favorite from the following options

Foxdot
Slashfox
Flashdox
Slashdot Fair and Balanced News for Nerds

Re:Yeah right

[izomiac]

S: (n) collective (members of a cooperative enterprise)

S: (n) group, grouping (any number of entities (members) considered as a unit)

The two terms are not identical, although they may be synonymous in most contexts. I was referring to their specific discordance, albeit I was a bit laconic when I forwent the explanation of this concept, and instead relied on a pair of examples to illustrate it. Clearly I was insufficient in conveying that point.

Re:Yeah right

[izomiac]

While they have transient organization, there is nothing permanent or overarching like a traditional group. People will act based on their own motivations and initiative, sometimes forming into like-minded groups to do so.

There wouldn't be any difference then since you've said Anonymous isn't a group and anyone acting in the name of Anonymous is Anonymous.

You make a good point and may be right, depending on how you delineate Anonymous. I would liken this to someone who loots a store during a revolution. If they do so to further the revolution, then they're a revolutionary. If they're merely taking advantage of the chaos, they're just a thief, even if they try to credit their crime to the revolution.

Re:Yeah right

[exomondo]

While they have transient organization, there is nothing permanent or overarching like a traditional group.

If that were true no-one could ever deny that Anonymous was involved in anything, anyone involved in any action can attribute it to Anonymous and regardless of whether they are doing it to use the Anonymous name as a scapegoat it makes the action a valid Anonymous action. The message posted on anonnews denying the sony hacking is obviously representing someone, since Anonymous can be anyone no-one could ever deny Anonymous was involved.

People will act based on their own motivations and initiative, sometimes forming into like-minded groups to do so.

That's pretty much what every Anonymous 'operation' ends up being. The 'Anonymous' behind an individual operation is always a group though they may or may not be the same group participating in any other 'operation'.

There wouldn't be any difference then since you've said Anonymous isn't a group and anyone acting in the name of Anonymous is Anonymous.

You make a good point and may be right, depending on how you delineate Anonymous. I would liken this to someone who loots a store during a revolution. If they do so to further the revolution, then they're a revolutionary. If they're merely taking advantage of the chaos, they're just a thief, even if they try to credit their crime to the revolution.

Fair enough, i see your point but i would imagine not everyone involved in - say the DDOS attacks - was doing it for the same goal and chasing the same end. This contrasts with a stand alone complex where everyone is chasing the same ends via the same or different means.

Re:Yeah right

[ScrewMaster]

Unbeknownst to the loyal readers, Slashdot has been acquired by Rupert-Murdoc's News Corp. From now on misleading and false headlines will be the result of deliberate policy instead of laziness and poor editing. A renaming contest will be held. Pick your favorite from the following options Foxdot Slashfox Flashdox Slashdot Fair and Balanced News for Nerds

Murdot

Re:Yeah right

[izomiac]

A group is a unit, implying a unity that Anonymous lacks. A cooperative enterprise is essentially working towards a common objective, which is a bit more accurate (not completely, but the closest term that came to mind). The 'vastly different' quality is that a group is more intrinsically defined, whereas a collective is more extrinsically defined (a 'collection' of people with a common trait, i.e. their objective). Generally these are congruent and it's easy to conflate them. That is the aforementioned folly, as the conflation causes people to ascribe things to Anonymous that have no basis in reality.

Re:Yeah right

[mjwx]

See, what baffles me is that they lock Blurays, Consoles, Google TVs, handsets to no point. They know they are not good at it because (except for the GoogleTVs) all of them have been hacked already.

Yet they go around collecting information they know they are not good at protecting.

Acutally, they are just as good at securing personal information as they are at producing DRM.

Neither works very well.

Re:Yeah right

[JosKarith]

"Pakistan entered into a counter terrorism relationship with the United States after 9/11, in part to keep the United States from invading Pakistan on the way to Afghanistan"
You held a gun to their head, said "Work with us or die" and are then surprised when they didn't bring their A game to the table?

Re:Yeah right

[js_sebastian]

- find a scapegoat.

A good scapegoat isn't just someone who can take the blame, it's somebody who you're trying to attack or remove for reasons you can't actually state publicly. For instance, if The Boss has to pick between scapegoating Alice or Bob, they might pick on whoever's standing in the way of a plum promotion for their good friend Fred, regardless of whether Alice or Bob had more to do with the problem in the first place. Or if someone from country A attacked country B, if the leaders of country B wanted to attack country C but couldn't come up with a legitimate reason they might try to blame the whole thing on country C rather than country A.

But they had WMDs! Saddam's dandruff was a chemical weapon!....

Re:Yeah right

[Culture20]

When deliberate lies are spread as "fair and balanced news" from formerly reputable news organizations

I'm confused. Are you talking about Fox, CBS, CNN, or MSNBC?

Re:Yeah right

[AK Marc]

Are you talking about Fox, CBS, CNN, or MSNBC?

You left off the New York Times, Huffington Post, Onion (hey, they are no less reliable than the others and more enjoyable - I get all my news from the Onion), etc.

I wasn't singling out any one as the least reliable, it's just Fox is so blatant about it and, for some unknown reason, the neo-cons rush to its defense like moths to a flame. So for the sheer entertainment value of the responses, I'll always use Fox for my examples.

Re:Yeah right

[izomiac]

Definition 2a is the one I used, the context made that clear, and it's easily contrastable with Webster's definition of 'group' in the way I previously discussed. I had thought the fact that different words mean different things was self evident, and am sorry that this concept is offensive to you. 'Group' and 'collective' are not absolute synonyms, if such things even exist.

ROFLMFAO

[GrumpySteen]

They called Anonymous "very professional, highly sophisticated"

Re:ROFLMFAO

[zill]

Obviously Anonymous managed to perform a man-in-the-middle attack between Sony and Congress.

Re:ROFLMFAO

[Bobfrankly1]

They called Anonymous "very professional, highly sophisticated"

The old adage applies "It takes one to know one." Sony isn't professional or highly sophisticated, and they wouldn't know what that looked like if it hacked their network and stole all their data...

Re:ROFLMFAO

[RichMan]

> They called Anonymous "very professional, highly sophisticated"

Obviously they have never been to 4chan.

Re:ROFLMFAO

[ScrewMaster]

They called Anonymous "very professional, highly sophisticated"

The old adage applies "It takes one to know one." Sony isn't professional or highly sophisticated, and they wouldn't know what that looked like if it hacked their network and stole all their data...

Actually, if the attack truly had been so professional, so sophisticated, Sony would never have known about it.

Re:ROFLMFAO

[Bobfrankly1]

They called Anonymous "very professional, highly sophisticated"

The old adage applies "It takes one to know one." Sony isn't professional or highly sophisticated, and they wouldn't know what that looked like if it hacked their network and stole all their data...

Actually, if the attack truly had been so professional, so sophisticated, Sony would never have known about it.

Exactly.

Anony == Scrapegoats

[Anonymous Coward]

Dont have the competency or skill to run your network correctly?
Dont know who else to blame when your on the hook for a class action and liability in the billions?

Blame Anonymous.

Re:Anony == Scrapegoats

[Hatta]

The identity of the people behind this attack are unknown. In other words, they are anonymous. That's the downside of being anonymous.

Re:Anony == Scrapegoats

[smelch]

They are if they say they are, isn't that the whole point? This "Anonymous isn't a group but anonymous != Anonymous" shit makes no fucking sense. God damn it's like everybody is in Philosophy 101 all of a sudden with delusions of being deep.

Re:Anony == Scrapegoats

[Dutch Gun]

Capitalization makes a difference.

Re:Anony == Scrapegoats

[sabt-pestnu]

"Anonymous" is a label that some people have applied to themselves. Whether they are a group depends on your definition and expectations of a "group".

Typical expectations are cohesion, common goals and/or opinions, and organization. The group known as anonymous defies most or all of those expectations. Calling Anonymous a group is about as valid as calling the world population of Caucasian males a group. True for some values of "group", not for others.

Anonymous?

[Anonymous Coward]

hey!
I didn't do crap!

Re:Anonymous?

[Tsingi]

hey! I didn't do crap!

Coward

Re:Anonymous?

[Moryath]

Sony, go fuck yourselves.

We are not "Anonymous."

We are the customers whose data you exposed by being a bunch of idiot fucktards who wouldn't bother with the most basic of data encryption.

And WE ARE STILL LEGION.

Re:Anonymous?

[piripiri]

I think you forgot to tick "Post Anonymously".

Re:Anonymous?

[Noughmad]

You're constipated?

Re:Anonymous?

[Moryath]

That was rather the point.

I was not a part of any attack. However, due entirely to Sony's fuckwitted lack of security concerning sensitive data, I have had to take measures to protect my identity.

The number of customers whose data was exposed are legion. Being given a "free month of PSN Plus", when I do not play games online through the PS3, is bullshit.

I, like most Sony customers, know better than to patronize them in the future. Fool me once, shame on you: fool me twice...

Re:Anonymous?

[houstonbofh]

I have to agree. If so, it is the first time Anonymous has been called "very carefully planned, very professional, highly sophisticated" about anything. That alone should raise flags.

Re:Anonymous?

[jmac_the_man]

However, due entirely to Sony's fuckwitted lack of security concerning sensitive data, I have had to take measures to protect my identity.

Like the Post Anonymously button?

Re:Anonymous?

[dbc]

Why is this modded 'insightful'? I thought thought he was going for 'funny'....

Re:Anonymous?

[blair1q]

So you're personally accepting responsibility for the theft?

Or are you really just saying you're a pissed-off victim of the theft, moreso than Sony is?

Re:Anonymous?

[anomaly256]

We are not "Anonymous."...

anymore

Re:Anonymous?

[mug funky]

YAAAAAAAAAHHH!!!!!

Re:Anonymous?

[Moryath]

Learn to read, moron.

Sony had a legal responsibility to secure their customers' data.

They failed. In a way that cannot be seen as anything other than sheer negligence.

A month of a service I never signed up for, that I never intended to use, as "payment" for the crap I have to go through re-securing my identity? Please. That's complete bullshit.

Re:Anonymous?

[SETIGuy]

From the sounds of it, the attack didn't need to be highly sophisticated. Sounds like Sony left the door open but posted a "please don't break in" sign out front.

Re:Anonymous?

[Runaway1956]

Perhaps you didn't really read about the downfall of H B Gary Federal?

Planned - check.
Professional - check.
Sophisticated - check.

I'll admit that the professional and sophisticated parts might be subjective, but they pass muster with me. On the other hand, real sophisticated professionals should have figured out that they were vulnerable, and closed the doors against Anonymous. That goes for HB Gary and Sony.

Re:Anonymous?

[cheater512]

Erm HB Gary was some guy typing SQL queries in to urls and then sent a couple of emails.

Hardly planned, professional or sophisticated. They got screwed by the simplest of flaws and they gave their root password out just because a email asked for it.

Re:Anonymous?

[houstonbofh]

Actually, I figured it could go either way. The best jokes can. :)

Re:Anonymous?

[ScrewMaster]

Actually, I figured it could go either way. The best jokes can. :)

The best humor has a kernel of truth in it.

Re:Anonymous?

[interkin3tic]

That alone should raise flags.

Yes, but there should already be flags raised when an executive of a corporation say anything to congress. Some of those flags should say "Hey stupid elected official: be skeptical" others should say "citation needed," others should say "Caution: possible scapegoating ahead" and many should say "This corporation is not your constituency."

But of course, those flags don't get raised, so it's probably too much to hope that congress realizes he's full of BS when he's saying obviously untrue things about anonymous.

Re:Anonymous?

[thsths]

Indeed - clever and cunning would be a much better description - something you rarely hear being said about "professionals".

But I find it funny that SONY can blame an anonymous person just by capitalising. They should admit that they have no clue who it was.

Re:Anonymous?

[mcvos]

Sony's description of Anonymous is funny. Pointing out that they mean it and it should raise flags, is insightful.

Re:Anonymous?

[tehcyder]

From the sounds of it, the attack didn't need to be highly sophisticated. Sounds like Sony left the door open but posted a "please don't break in" sign out front.

So if you leave your door unlocked and someone comes in,and steals everything in your house, that's your fault? The intruders were just doing you a favour by exposing your poor security?

I really don't think you'd see it that way in real life.

Re:Anonymous?

[blair1q]

So you are accepting responsibility for the theft. And blaming Sony for leaving it exposed. Because that's what someone who can read what you wrote can parse from your two posts in this subthread.

Learn to write, dickhead.

Re:Anonymous?

[jahudabudy]

The best girlfriends can, too.

Re:Anonymous?

[mcgrew]

Fucktards, yes. Idiots, no. They just don't give a shit about your data. As long as companies don't suffer from losing data, they won't give a shit either. There needs to be laws that say if a company lets your data loose, they pay triple the costs of fixing the credit and all other expenses. If such a law were passed, the data breaches would stop.

Re:Anonymous?

[mcgrew]

If I forgot to lock my door and someone came in and stole my shit, I'd be pissed at the thief and would try to have him jailed, but I'd be kicking myself in the ass, too.

Re:Anonymous?

[SETIGuy]

I really don't think you'd see it that way in real life.

I'm not saying the intruders were doing anyone a favor. I'm saying that Sony is required by law to protect personal data, and they didn't even try to do so. Now they are saying they were subject to sophisticated attacks when any random script kiddie could have gotten through their security. They are trying to dodge liability for their lack of security by claiming they were attacked by unstoppable supercriminals.

Re:Anonymous?

[Sique]

Ask your insurance company if they will cover you if you left your front door unlocked. From their point of view, you are at fault. You can try to recover your damage from the actual thieves, but for everyone else (execpt law enforcement), it's solely your problem.

Not Quite

[rjstanford]

While a particular group may have been responsible for the data theft, Sony is still responsible for the irresponsible storage that they used to enable the theft. Good (industry standard) practices around credit card retention, such as gateway tokenization, would have drastically reduced the financial implications. There would still have been privacy implications, but by not storing card numbers they'd actually have made the information much less appealing to hackers as well.

Re:Not Quite

[g0bshiTe]

No to mention the 2 day lapse between the time the noticed the information was compromised and when they notified the FBI of the breach. I was under the impression that anyone that had credit card data on clients are liable for full quick disclosure of a breach as soon as it is noticed.

Re:Not Quite

[DarkOx]

Ok,

So how accountable should Sony ( a victim ) be for/to their end users also victims? I mean this seriously. In a world of tangibles its not even clear. Lets say you lent me your laptop and left it in my unlocked car at a the mall. When return to my car its gone. Now I was negligent about protecting your laptop. Clearly its the thief's fault its missing but I really should replace your computer if it can't be found after a day or two.

Now we are in the world of intangibles, Sony did a poor job of protecting users data. Its certainly whoever crack they systems fault the data is gone but that should not completely excuse Sony and more than I would be excused for the loss of that laptop. Trouble is what is the harm to the users? It could be none, the crackers stole the data just to embarrass Sony and have already deleted every bit of it, or someone could spend the next six months sorting our identity theft issues consuming hundreds of hours of their time; but that could happen anyway. We will never know. What is really fair here?

Re:Not Quite

[smelch]

Whoa whoa whoa! Your reasoning is getting in the way of our crucifixion!

"...steal..."

[betterunixthanunix]

The fact that the attack involve the theft of credit card data, as opposed to just shutting down the network, screams "not Anonymous" to me. You know, given how Anonymous tends to just shut things down with DDoS attacks, or occasionally overwrite a web page with one that spreads some message.

Re:"...steal..."

[billcopc]

Yep, most Anonymous attacks involve masses of non-technical users joining a LOIC DDOS. It's essentially a human "botnet", just as cheap and effective too!

Re:"...steal..."

[Jonner]

If you'd read TFA, you'd know that a DDOS is exactly what Sony accused Anonymous of. They accused an unknown entity of the "theft."

Re:"...steal..."

[jank1887]

FTFA:

"The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said.

Sony said it was not sure whether the organizers of the two attacks were working together."

I.e., it's anonymous's fault. We were busy dealing with their crap and didn't notice someone coming in and stealing stuff.

Re:"...steal..."

[TheCarp]

Agreed though "they" have done more than that. I was very curious about Anonymous recently and um.... I am unconvinced that they are a specific "group". Its very Omar Ravenhurst. You do whatever you want, declare yourself anonymous, and other people, who do the same, will either cheer or denounce you. Thats not a "group" by any traditional definition. Its a label whose meaning is entirely in what it really can't be... which is... an organized group. Organized groups may exist within the overall umbrella name, but to call such a thing an organized group? Not so much.

I would posit... this is not anonymous for two very specific reasons A) no statement has been put out bragging about it and claiming it as the work of anonymoyus. B) Related to A: since A has not happened, there have been no counter statements by other anonymous claiming solidarity with the action or claiming that it is not the work of Anonymous.

Without the statement by Anonymous, and community approval by those who also fly the anonymous flag, it is not the work of Anonymous.

Re:"...steal..."

[eepok]

So very this. I'd mod you up if I could.

The common and fashionable sentiment is "Anonymous is a scapegoat for the Sony Conspiracy" or "Sony just needs a scapegoat for their failure..." when the defense of Anonymous should be exactly as you stated: It's not their MO.

Anonymous, to date, has shown itself to be mischievous (sometimes malicious) and extremely precise in their targeting. They have never represented themselves to be a for-profit hacking crew and they're smart enough to know that such actions are hurting the innocent users more than the company. Thus, the copying of millions of accounts' financial information cannot rationally be tied to them on history alone.

I really don't think Anonymous did this and I think Sony just needs *a* target of blame ASAP. In my opinion, anonymous is a *scapegoat of convenience*, given their vocal opposition to the modding community.

Tinfoil Hat Time: Maybe a for-profit hacking crew executed this attack knowing Anonymous would be target #1, thus giving them sufficient smoke screen.
Hmmm...

Re:"...steal..."

[just_another_sean]

Yes but the information they "stole" was used more to embarrass them then anything else. I never heard anything about them accessing HBG's bank accounts or using their corp. credit cards; judging by the amount and sensitivity of data they copied it seems likely they could have used it to drain a few accounts.

As others have stated this just seems like a convenient scapegoat. If it was Anonymous then copying credit card data was most likely just part and parcel to further embarrassing Sony by pointing out how weakly they guarded this data.

Re:"...steal..."

[Xtravar]

>One notable detail is that Sony claims that the intruders had planted a file on the Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”

http://rpgamex.com/news/new-details-on-playstation-network-outage-and-anonymous/

Don't know if that link's better than TFA, but it seems a lot of people here were asking why Sony's blaming Anon.

Re:"...steal..."

[vuffi_raa]

Maybe actually using the credit cards isn't their MO, but they were behind the gawker intrusions which also stole passwords and account details. Anonymous being behind this makes sense because if you remember, right after doing the DOS attacks, they stopped and put out a public statement saying that they wanted to do something to directly affect Sony and not to bomb the servers because it only effected users. Ironically if they are behind it directly intruding on the servers actually affected users far more than the couple of days of DOS attacks as the network has been offline for weeks to shore up the security.

Re:"...steal..."

[repapetilto]

Its a nucleation point.

Re:"...steal..."

[just_another_sean]

You misunderstand my interpretation of the situation as approval. I do not condone the actions of Anonymous, I merely speculate on their reasoning and, most important to the discussion at hand, believe that Sony are a bunch of incompetent, greedy and evil bastards who don't have a clue who did this to them. I don't think it was Anonymous, I gave my reasons why. Feel free to keep trolling there bud but realize that you are just as much of an immature idiot hiding behind anonymous as Anonymous are.

Re:"...steal..."

[billcopc]

That's kind of the point though. Anonymous is not a specific group. You could say they draw upon some kind of meta-community, but it is really just a label like Alan Smithee is to movie credits.

I see them as two main entities. One is a still-faceless but perhaps consistent core group, who lead most events. The other is random nobodies who choose not to claim ownership of their actions, because the important thing is the action itself, not the person performing it. Both tend to act in a concerted effort favoring the individual over the corporation.

Of course, any troublemaker can claim they are "Anonymous", but then I can also go into a bar and tell people I'm the Queen of France. Does anyone really care ? No.

Anonymous != a group

[ItsJustAPseudonym]

Sony == desperate weasels

Nuff said.

!Anonymous

[agoliveira]

Anonymous already denied it and, AFAIK, they don't do sneaky attacks and do not steal personal info.

Re:!Anonymous

[harl]

Except for when they do.

http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars

http://tech.slashdot.org/story/11/02/07/1424213/HBGary-Federal-Hacked-By-Anonymous

Re:!Anonymous

[sqrt(2)]

There is no official "anonymous" and there is no leadership or command structure. It's a concept, an idea to describe an emergent system of hacktivism. Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.

Re:!Anonymous

[locallyunscene]

Except they didn't. They posted company emails to show the incompetence of the CEO and claimed credit for it. They didn't steal credit card, address, or other personally identifiable information and then denied it.

Re:!Anonymous

[harl]

Anonymous disagrees with you.

"The attackers went one better than this, however: they dumped the user database for rootkit.com, listing the e-mail addresses and password hashes for everyone who'd ever registered on the site."

There was also the little bit about posting personal info about spouses and children of HBGary employees.

Re:!Anonymous

[harl]

lol

Re:!Anonymous

[powerlord]

There is no official "anonymous" and there is no leadership or command structure. It's a concept, an idea to describe an emergent system of hacktivism. Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.

Yes, but when an organization runs around saying they are attacking targets, and when that organization has no real leadership (collective/mob), they also can't cry foul if someone co-opts their name, claims to be part of them (since they have no real membership requirement or leadership, whose to say), and decides to either:

1) Partake in the attack even though it has been officially "called off" (hey, just because most of Anonymous might be clueless, doesn't mean some of it can't hack/crack with the best of them.

2) Use your name as a convenient scape goat to pin their crime on (okay, we take as much data as we can, and point the finger at THOSE guys over there).

Either which way, saying "Anonymous Denied all Responsibility, It MUST BE SONY'S FAULT!" is the biggest LOL of them all.

Its the fault of the malicious idiot who attacked and broke into the network. Yeah, Sony should have done a better job securing the data, but that does not absolve the THIEF of responsibility (in spite of what most slashdotters seem to think).

Re:!Anonymous

[powerlord]

"but that does not absolve the THIEF of responsibility"

I haven't seen a single comment yet on any Sony article here that implies this.

Yet, every Sony article I've read here contains much vitriol that points to it being entirely Sony's fault. If its entirely Sony's fault, then the Thief bares no responsibility.

Re:!Anonymous

[amicusNYCL]

Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.

Are you equating the loosely-affiliated group Anonymous with a concept like democracy, or are you redefining the common definition of Anonymous as a loosely-affiliated group to now mean anyone involved in hacking or online attacks for an ideological reason other than financial gain? I've never heard proponents of democracy, or any other ethos, say something as cheesy as "We are [ethos]. We are Legion. Expect Us." The words "we" and "us" clearly identify people as a group. That is, even Anonymous thinks they're a group and not just an ethos. They are not an ethos, they are a group of people with some common world views, regardless of whether or not they have an official roster.

It's perfectly reasonable that a not-for-profit attacker would in fact steal valuable information just to steal it, not necessarily to release or sell it. It makes Sony look much worse, and costs them more, to have their customers' financial and personal data stolen, even if that information never actually gets used or released. In addition, it's not Sony's customers that Anonymous wants to attack, it is Sony itself. It doesn't serve their goals to release customer information, all they need to do is steal it. In other words, it would fit in with the idea of revenge against Sony to simply do as much damage to them as possible even if you don't plan on benefiting directly from the attack.

Re:!Anonymous

[Guerilla Antix]

It is entirely Sony's fault. Once a company has decided to protect my personal property and fails to do so, it's that company's fault. Completely. If I put valuables in a bank vault and the bank gets broken into I blame the bank, not the thief. Thievery like this isn't random, it's a statistical inevitability that Sony didn't prepare for. They were happy taking the money of the people using their service and didn't uphold their end of the bargain: secure their $#!+.

Re:!Anonymous

[Noughmad]

Joke or Fail?

Re:!Anonymous

[sabt-pestnu]

> It is entirely Sony's responsibility.

Fixed that for you.

> Thievery like this isn't random,
Quite right. They go where the money can be found.

> If I put valuables in a bank vault and the bank gets broken into I blame the bank, not the thief.

Hmm... By extension, you trusted the bank's security standards before putting your valuables into their vault. Why, then, is it not your fault that the valuables were stolen?

Similarly, you yourself say "it's a statistical inevitability". Again, you've put your valuables (credit card information) in the hands of another. In this case not even with trust in their security, but instead expectation that it would fall into the wrong hands.

> that Sony didn't prepare for...
Since it's a statistical inevitability that they'd get hacked, why are you conflating "defensive actions" with "remediation actions"? You say "secure their shit" - but that's a defensive action, not a remediation one. What are your specific complaints about their remediation?

Re:!Anonymous

[Guerilla Antix]

>> It is entirely Sony's responsibility.
> Fixed that for you.

You fixed nothing. It was a known security exploit that Sony chose to ignore. That's fault, not responsibility.

> Hmm... By extension, you trusted the bank's security standards before putting your valuables into their vault. Why, then, is it not your fault that the valuables were stolen?

Lol, my fault for trusting the bank vault? Must be my parents' fault. The genes they passed to me and my upbringing clearly brought me to the poorly drawn conclusion of trusting bank vaults. I'm sorry, but your argument ultimately slides into absurdity. Most reasonable people would expect their goods to be completely safe in a bank vault. That conclusion isn't flawed.

> Since it's a statistical inevitability that they'd get hacked, why are you conflating "defensive actions" with "remediation actions"? You say "secure their shit" - but that's a defensive action, not a remediation one. What are your specific complaints about their remediation?

Yes, statistical inevitability because they didn't close known security flaws. Now it's too late. It's like preventive vs reactive health care. Sony is reacting when they should have been preventing.

Re:!Anonymous

[sqrt(2)]

It's obvious you're the one who is confused. Re-read my post until it sinks in. Anonymous is just an idea that a lot of people share.

Re:!Anonymous

[MareLooke]

They don't do sneaky attacks. Anonymous breaks in to make a point, denying involvement and trying to hide the breakin as well as possible don't really fit the bill.

Most likely it was a bunch of criminals going after the user data and Sony is just pointing fingers because they have no fucking clue who is responsible and they need to blame someone (or rather, try to redirect all the public outrage) and Anonymous is the popular scapegoat given their history of hacktivism.

Re:!Anonymous

[sabt-pestnu]

> Lol, my fault for trusting the bank vault? ... the poorly drawn conclusion of trusting bank vaults. I'm sorry, but your argument ultimately slides into absurdity. Most reasonable people would expect their goods to be completely safe in a bank vault. That conclusion isn't flawed.

1) You trust your credit card data with Sony
2) You state that it is inevitable that Sony will suffer a data breach and your data will be exposed

And yet, you state "Once a company has decided to protect my personal property and fails to do so, it's that company's fault." To use your analogy again, if your bank has a history of having its vault robbed, and you decide to trust it anyway, whose fault is that? It doesn't negate their liability, but it doesn't relieve you of responsibility for having trusted foolishly.

I don't buy it

[rjmx]

Doesn't sound likely to me. Anonymous have done many things, but stealing user information hasn't been one of them until now.

I wonder if Sony did it themselves with the intention of pinning it on Anonymous?

Re:I don't buy it

[betterunixthanunix]

More likely, Anonymous has become a convenient name to throw around whenever someone cracks a security system. Poorly designed security system? Just blame Anonymous when someone pulls off a successful attack. The media makes Anonymous sound like some sort of invincible, unstoppable hacker/wizard/demigod army (or should I just say, "Hackers on steroids"), so nobody will blame you when you blame Anonymous.

If people only knew that Anonymous is just a bunch of teenage script kiddies...

Re:I don't buy it

[Amouth]

you know if Anonymous is actually responsible i want Sony to provide Proof of that - else it's just slander.

Re:I don't buy it

[powerlord]

FTFA:

We also informed the subcommittee of the following: ...

- We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named "Anonymous" with the words "We are Legion." ...

Well, it may be slander, but they claimed (Under Oath?), that they were informed that Anonymous was responsible for the break-ins on the SOE servers. I don't think they actually said "Anonymous is behind the attacks", they just listed the evidence they have found since then.

Sony itself freely admits that Anonymous may have not been involved in the attack itself, but states that the initial intrusion seems to have happened at the same point that the initial Anonymous DoS attack did, and that the initial attack, knowingly or not, helped provide concealment for the breach.

Specifically read the last 3-4 paragraphs on:
http://www.flickr.com/photos/playstationblog/5687533298/in/set-72157626521862165/lightbox/ and the first one on http://www.flickr.com/photos/playstationblog/5687532796/in/set-72157626521862165/lightbox/
(I'd copy and paste the relevant paragraphs, but its tough to do that with pictures, so if you really care, go read what they wrote).

If Anonymous ISN'T behind these attacks and just patsies/dupes (as Sony admits is possible), then they should probably use much of their world renowned internet ability to help track down who ACTUALLY broke into the servers, if for no other reason than to clear their name.

Re:I don't buy it

[DragonWriter]

If Anonymous ISN'T behind these attacks and just patsies/dupes (as Sony admits is possible), then they should probably use much of their world renowned internet ability to help track down who ACTUALLY broke into the servers, if for no other reason than to clear their name.

I think its more likely that instead of being patsies/dupes or directly responsible, they were a known presence that was used as convenient cover. Rather than Anon being duped or coopted by the intruders, the intruders took advantage of the distraction from Anon's DDoS to help conceal their heist, the same as someone wanting to rob a brick-and-mortar facility might take advantage of a known disaster to distract the focus of security.

Re:I don't buy it

[oliverthered]

I think this may possibly be the only time you can say:

a bunch of niggers.

and not be trolling, my nigger.

some quality psy-cops and counter propaganda if ever there was.

Sony did not forgive, it will not forget.

Re:I don't buy it

[freedumb2000]

Finally, a post worth reading and it is actually informative. Thank you. Mod parent up

More perspective....

[Samfer]

Some more perspective and info on this story available @ http://gaming.operationreality.org/2011/05/04/sony-to-congress-we-found-anonymous-file-on-server/ Summary: "This proves nothing" :P

So, how anal rape tastes, sony? Aha?

[roboverlord3]

They got what they deserve. Users were hit too, I admit, but at least that will teach them not to use sony again.

Re:So, how anal rape tastes, sony? Aha?

[Anonymous Coward]

Well, as long as the ends justify the means. Who cares about collateral damage anyway? In the end, all that really matters is whether people come around to your point of view.

Re:So, how anal rape tastes, sony? Aha?

[ae1294]

Well, as long as the ends justify the means. Who cares about collateral damage anyway? In the end, all that really matters is whether people come around to your point of view.

Quoted from "The U.S. Governments Guide To Foreign Affairs", page 2

Carefuly Planned and Profesional?

[Bo'Bob'O]

Some how none of that seems to point to Anonymous in any way.

Re:Carefuly Planned and Profesional?

[Dhalka226]

Well, what else are they going to say?

"The theft of our customer data was a completely amateur, wholly preventable action whereby somebody stumbled on our unprotected psn.playstation.com/customer-data.xml data dump?"

Of course they're going to claim it was carefully planned, professional and sophisticated (what the fuck is a sophisticated hack, anyway?), because the implication otherwise is that they didn't take the proper precautions to secure that data. With such a "sophisticated" attack, gosh, how could they be expected to prevent it? And more importantly, how can they be sued for being as incompetent as pretty much everybody who does not work for Sony assumes that they are?

Maybe it's true, maybe it's not, but I wouldn't read anything into the fact that they said it. They're trying to get Congress off their back.

Re:Carefuly Planned and Profesional?

[tomstockmail]

Except for that file that said: We are Anonymous. We are legion. http://blog.us.playstation.com/2011/05/04/sonys-response-to-the-u-s-house-of-representatives/

translation

[Anonymous Coward]

we don't have a clue

Wait, what...

[Jugalator]

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

  The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said.

  Sony said it was not sure whether the organizers of the two attacks were working together.

So they know Anonymous DDOS'ed them, and Anonymous have admitted this too.

They also were attacked separately where the theft took place. They don't know if these groups were working together. They blame the latter on Anonymous too. How did they draw that final conclusion??

Re:Wait, what...

[betterunixthanunix]

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

This quote is more disturbing as far as I am concerned. Sony was not defending itself against Geohot, since Geohot never attacked Sony nor did Geohot sue Sony. Geohot was defending himself in a lawsuit filed by Sony.

Talk about slanting things...

Re:Wait, what...

[dasdrewid]

They also were attacked separately where the theft took place. They don't know if these groups were working together. They blame the latter on Anonymous too. How did they draw that final conclusion??

If A=B, and B=C, then C="Anonymous fucking did it!" That's basic logic right there.

Re:Wait, what...

[chemicaldave]

Sony defending itself against a hacker in federal court in San Francisco.

Did they really claim to be defending themselves against a "hacker" in court? Don't they mean "suing"? And isn't it unfair to lump the hackers who stole the information with completely different hacker, Geohot? Who the fuck wrote this article?

Re:Wait, what...

[Rob Kaper]

They being Reuters, Sony - as you quoted - didn't draw that conclusion. They mentioned the ongoing attack and of course it would seem relevant, but they carefully denied knowing of any relation between the two.

Re:Wait, what...

[_xeno_]

If you read the letter (which is made needlessly annoying by the fact that it's scanned in and the raw text isn't made available, fuck you very much Sony), you'll see that on page 2 they explain:

When Sony Online Entertainment discovered this past Sunday afternoon that data from its servers had been stolen, it also discovered that the intruders had placed a file on one of those servers named "Anonymous" with the words "We are Legion."

So that's how they come to that conclusion. Which I guess means we can blame Anonymous, in so much as anyone calling themselves Anonymous is Anonymous.

Not that I really believe that the attacker really is "Anonymous," but they do make a good scape goat. And who knows, maybe the attacker did decide that this attack might as well be carried out under the "anonymous" banner.

Re:Wait, what...

[powerlord]

They also were attacked separately where the theft took place. They don't know if these groups were working together. They blame the latter on Anonymous too. How did they draw that final conclusion??

If A=B, and B=C, then C="Anonymous fucking did it!" That's basic logic right there.

Not to mention the file Sony says they found claiming "Anonymous" breached their systems.

I'm starting to wonder if some technically proficient hacker/cracker in Anonymous actually did crack Sony's servers, maybe just to plant the file saying Anonymous did it (for LOLs or to show they could), and inadvertently left the systems more vulnerable for an unrelated third-party to waltz in and get access to the data.

Either that or an unrelated third part decided this was a good time to try cracking Sony's systems since they would be dealing with all the extra load from Anonymous' attack.

Re:Wait, what...

[Machtyn]

Legalese. They defended their IP against Geohot's hacking. Whether we see it like that is a different story. Most of us see it as Geohot had to defend his ownership of hardware from Sony. IANAL, but I think the law sees both as correct until a judgment is made.

Re:Wait, what...

[chemicaldave]

Not to mention the article's author just used two completely different definitions of "hacker" interchangeably. The hackers who stole the data and hacker Geohot are two completely different types of people. It's a shame they lumped the two together.

Re:Wait, what...

[Cl1mh4224rd]

So they know Anonymous DDOS'ed them, and Anonymous have admitted this too.

They also were attacked separately where the theft took place. They don't know if these groups were working together. They blame the latter on Anonymous too. How did they draw that final conclusion??

Sony’s Response to the U.S. House of Representatives:

We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”

Re:Wait, what...

[staticneuron]

Well, the amount of spin and FUD being outputted here makes that understandable. You can read the full response here http://www.flickr.com/photos/playstationblog/sets/72157626521862165/ While they mention finding a file on their servers that references Anonymous and noting that the intrusion takes place around the same time. They letter enver blames Anonymous. What I find worse is the mob mentality that has gone along with this circus show. 1. People are assuming that Anonymous is a formal group and has one particular set of behavior. 2. People are assuming that "everyone" that took up the Anonymous title, are altruistic and/or have a very limited set of skills. This behavior reminds me of basic conformation bias. It is sort of how people in the US are quick to point out violent/negative behaviors done by certain people who identify themselves as muslim to paint the entire islam community despite any denouncements yet when violence/negative behaviors of that nature are done by people who claim they are christians are relatively ignored or brushed over stateside (like the murder of Dr. Tiller). No I am not a guy who "hates" any of the big three companies. I am an avid gamer who reads these sites all the time, and I can't help but notice the amount of BS people love to have aimed against sony. Sony is in the wrong for going after someone who exposed proprietary keys? Sony is at fault for being a victim of data theft? You seriously believe that keeping abreast of all activity on a network while defending against a DDoS attack is easy? Is there such thing as an unhackable network? For such a tech saavy site with supposedly mature tech minded people, the vast majority of these upmodded comments are seeming ownright immature and ill informed.

Re:Wait, what...

[Algae_94]

This is the problem with a group calling themselves Anonymous and having no membership requirements. Any random person in the world could do an attack like this one against Sony then say "I'm Anonymous" and they then ARE Anonymous.

Regardless of what Anon has done in the past, because they are a loose-knit organization, small groups of haxxors can split off under the same name and start doing much more nefarious activities. And at the same time, this splinter group has the authorities looking for the founding/more influential members of Anonymous and can escape the heat.

I'm not saying this is what happened, but if I were to do some sort of system breech like this, I'd be damn certain to leave some sort of "evidence" saying that I was Anonymous.

It's the girl's fault!

[JackSpratts]

Whilst I was admiring the gentle sway of her shapely derriere somebody stole my laptop!

What's next?

[ItsJustAPseudonym]

They add Slashdot to their complaint, for this poll? Sheesh!

Right...

[Spykk]

The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said.

Because we all know that keeping your network secure involves someone personally inspecting each packet as it comes in. With all of Sony's packet inspectors distracted by the DDOS the hackers were able to sneak their packets through undetected.

Old, but gets funnier after every hack

[zill]

Fox was right! Anonymous is a bunch of hackers on steroids!

Re:Old, but gets funnier after every hack

[Algae_94]

I gotta love the "demonstration" of a van exploding in a street.

You have to admit....

[ProppaT]

You have to admit...blaming Anonymous for the attack sounds a lot better and less embarrassing as stating "Yeah, some 17 year old kid in Toledo managed to hack us and pull all your private information because we don't have our s&*t together." I don't blame them for pointing at Anonymous. After all, Anonymous pointed their finger at Sony not but a month prior.

Re:You have to admit....

[CCarrot]

You have to admit...blaming Anonymous for the attack sounds a lot better and less embarrassing as stating "Yeah, some 17 year old kid in Toledo managed to hack us and pull all your private information because we don't have our s&*t together."

Sure. It's like blaming all rain everywhere for the flooding in your basement.

Some of the local rainwater may have gotten in and started wrecking things and generally behaving badly, but the bottom line is that the water got in because you have a hole in your basement...

Fix and maintain your basement, Sony, and don't blame it on the rain...yeah, yeah...

Re:You have to admit....

[Macthorpe]

Bad analogy, because rain isn't a human being capable of critical thought that can decide not to be an asshole and flood a basement.

Re:You have to admit....

[CCarrot]

Bad analogy, because rain isn't a human being capable of critical thought that can decide not to be an asshole and flood a basement.

Sorry, and you mean to imply that 'Anonymous' is?

Certain elements of Anon may be capable of planning and directing attacks (i.e., that '17 yo kid in Toledo'), but as far as I can tell, the average Anon member mostly just follows the crowd, like a flash mob or an excited terrier. Their strength is in numbers, which amplifies relatively piddling DOS attacks into something that can actually bring major content servers to their knees...for a while, anyway.

Okay, here's a better analogy for you: it's like blaming the rain for the flooding when it was actually your neighbor who set up dikes and dug channels and redirected his eaves-troughs to make sure your property got as much water as it could during the recent downpour. Still wouldn't have made a difference if you'd kept your basement maintained...

Indeed!

[Cable]

Sony once had rootkits in audio CDs, now someone gained control of the psn. Not sure who, so blame the obvious and occaRAM's razor needs sharpening. :)

            But in all seriousness my hopes and prayers go to Sony and Japan for the damage done by tsunamis and other things. This is nationwide and needs to stop these break-ins to web sites.

            Is it anonymous? I am not sure. I am not sure who or what it could be. As zombie botnets dominate the Internet it could be anyone. Even viruses we haven't detected yet or hide from scanners by infecting them. Whomever is doing this, please stop, this is not the way, the truth, and the light.

            Yes I know Slashdot, maybe some disagree maybe some agree. But whomever did it, they will be caught as evil always brags.

Sony's 9/11 moment

[countertrolling]

I, for one, will wait for the tape of anonymous's 'confession', which I'm sure will surface at any moment, then we can send in the navy to raid the compound

IT'S THE CUSTOMERS FAULT!

[cpu6502]

That's the translation of Sony's Japanese doublespeak. (Notice it resembles Toyko Power's doublespeak of why the nuclear meltdown is not a danger to nearby customers.)

Fundamental rhetoric error on Sony's part

[EQ]

Logical Fallacy on Sony's part. Post hoc ergo propter hoc . Or as many on /. like to say "Correlation is not causation".

Re:Fundamental rhetoric error on Sony's part

[EQ]

augh hit submit instead of continue editing ...

This isn't to say Anon's members are blameless, and legally off the hook. A case can be made they were unknowingly but maliciously contributing factors. Its the malice part that will push law enforcement and prosecutor's buttons - they knew what they were doing was wrong/criminal and did so anyway. Without malice, its simple negligence; with malice, you may have a contributory criminal violation. The law is kinda funny like that - along for a minor prank, someone does a felony act (prior unknown to you) and all of a sudden you are looking at accomplice charges. So watch out for law enforcement to answer Sony's call.

Re:Fundamental rhetoric error on Sony's part

[DragonWriter]

Logical Fallacy on Sony's part. Post hoc ergo propter hoc [fallacyfiles.org] .

Except that Sony doesn't make that connection. They say "X happened", "Y happened", "A admits to doing X", "X made it more difficult for us to protect against Y", "We don't know if A did Y or was in any way knowingly cooperating with those who did."

Other people reinterpreted that into Sony saying "A did Y".

Conclusive evidence

[rvr777]

An article on gamespot http://www.gamespot.com/news/6312141.html says that the evidence they have is a file named "Anonymous" with the content "We are Legion". What a conclusive evidence.

Re:Conclusive evidence

[rvr777]

I agree, but using this as evidence is not enough. Anyone could have created that file. It could have been Anonymous, another hacker group and even Sony could have made it up! For me, the important part of the article is:

When asked if Sony had indentified the individuals behind the attack, Hirai answered with a flat, "No."

Re:I told you, I didn't do it!

[OECD]

There is no 'Anonymous.' It's just a term that's been widely co-opted. Sort of like 'Al Qaeda.'

Cuts Both Ways

[Anonymous Coward]

I think Anonymous is going to find out that their prized anonymity is a double edged sword. If no one can speak for anonymous, how can this ever be denied?

Re:Cuts Both Ways

[19thNervousBreakdown]

It doesn't have to be, because there is no organization to belong to. The double-edged part really starts to cut when the ones doing the accusing realize that they can put someone else into Anonymous as easily as they can join it.

"He's obviously an unrepentant criminal; he's a hacker from Anonymous!"
"No I'm not!"
"Prove it."

Re:Cuts Both Ways

[ThatMegathronDude]

That's the nice thing about innocence until there is proven guilt.

Re:Cuts Both Ways

[19thNervousBreakdown]

It sure would be.

The attackers left no trace

[broknstrngz]

That's Anonymous' trademark!

ich bin Anonymous !

[Thud457]

oh, wait, no I'm not...
I'm a jelly doughnut.

Re:ich bin Anonymous !

[JustinRLynn]

You look more like a meat popsicle to me.

Sony didn't explicitly blame Anonymous.

[Renaissance 2K]

Sony may have blamed Anonymous for the attack, but they're not accusing Anonymous of executing the attack itself. They said the following:

• They found a file named "Anonymous" on their servers that contained the text "We are Legion."
• They were too distracted by Anonymous' DDOS freakshow to notice the real intrusion that was taking place.

Granted, Sony can say anything to cover their butts, but Hell... The hackers could have just as easily left an "Osama wuz here" file. Would that mean Al Qaida definitely did it? Could they abandon any further investigation and blog posting because the dude is shark food now?

Summary should contain more:

[Sentry23]

In the letter there is a part which says:
"We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”"

It's not much of an evidence in my eyes, but at least it's more then 'because we say so'.

Got my letter...don't know why

[hilldog]

I got a letter in the mail yesterday May 3rd advising me my info may have been hacked. Weird since I don't have a play station and have not played an online Sony game in over a decade (12 years maybe more) and then I canceled my subscription. Which brings me to a question why is information that old still being kept where it can be cracked?

Re:Got my letter...don't know why

[SheeEttin]

Because they can't charge you for anything if they don't have your credit card number.
(And having to give it to them again is just another step between them and your money, so they do what they can to eliminate it.)

Re:Got my letter...don't know why

[Em Adespoton]

I got a letter in the mail yesterday May 3rd advising me my info may have been hacked. Weird since I don't have a play station and have not played an online Sony game in over a decade (12 years maybe more) and then I canceled my subscription. Which brings me to a question why is information that old still being kept where it can be cracked?

Because they can :)

Honestly, it'd cost them more to purge it than it does for them to store it, and they have absolutely no incentive to throw out potentially useful information.

Re:Got my letter...don't know why

[StormReaver]

That reminded me of why I'm not worried about the break-in. I have two PSN accounts, but all the information I submitted was 100% fictitious. I did that as passive resistance, but now I'm even more happy that I faked it all.

Who?

[b4upoo]

Why point blame at Anonymous. The Russians love this kind of hack and apparently China also wishes to have such an illegal industry as well. Before anyone spouts off about blame they need some serious proof.

To turn a phrase...

[Bobfrankly1]

FTFA:

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

Meanwhile in reality:

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony attacking a hacker in a hopeless attempt to control information that had already slipped far out of it's control in federal court in San Francisco.

Re:To turn a phrase...

[Nyder]

FTFA:

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

Meanwhile in reality:

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony attacking a hacker in a hopeless attempt to control information that had already slipped far out of it's control in federal court in San Francisco.

Well, ya, the info slipped out of their control, information wants to be free!!!!

Bastards. Maybe the info did the hacking job.

Re:To turn a phrase...

[tobiah]

ya, that line jumped out at me too.

Agreed - Scapegoat for organized crime

[Anonymous Coward]

Looking for credit card info? Anonymous tends to do things for idealogical reasons, AFAIK. There may be some overlap, but this sounds like organized crime. And yes, known vulnerabilities are things you should not be vulnerable to if you have credit card info for even two million people.

Re:Agreed - Scapegoat for organized crime

[negRo_slim]

It's highly unlikely that anyone that would self identify as Anon was involved with this. Perhaps Sony's recent troubles have caused people, who might not otherwise have bothered, to take a closer look at Sony and their related infrastructures and there they found opportunities they had previously overlooked.

Then again there might just be one really bad ass anon who decided to get down with his bad self.

Re:Agreed - Scapegoat for organized crime

[SuricouRaven]

Or it could be that Sony, fearing Anonymous attacks, had their engineers start running systematic security audits - and then discovered that PSN had been hacked months ago, but do well that it hadn't been noticed.

Re:Agreed - Scapegoat for organized crime

[Agent0013]

To me it sounded like they had the PSN network brought down by anonymous. Then when Sony was looking into the security breach they discovered that there was a much more serious problem than just a DDOS going on. They were probably infiltrated by a crime group a long while ago without ever knowing about it. The anonymous attack gave them reason to look and they happen to discover the other issue and can blame that on anonymous as well. Sony admitted it took a couple of days before they told the FBI, that doesn't sound like a security aware company to me.

Re:Agreed - Scapegoat for organized crime

[Toam]

But will anonymous now respond to the accusation that they were behind this by attacking Sony? Personally, I kind of hope so.

Re:Agreed - Scapegoat for organized crime

[tobiah]

a reasonable hypothesis...

Re:Agreed - Scapegoat for organized crime

[radioteeth]

haha nice

Re:Agreed - Scapegoat for organized crime

[RivenAleem]

If it was Anonymous, then the data would be up on Piratebay already.

Interesting timing...

[LordStormes]

They hired professional investigators, what, last night to track down who did this, and then this morning, ta-da, it's Anonymous!

Anon is becoming the al-Qaeda of the Internet - the generic name used for "anybody who does this sort of thing." Hackers ARE Anonymous, in the same way Curads ARE "Band-Aids" and Puffs Plus ARE "Kleenex" and Sharp copiers ARE "Xerox machines".

Re:Interesting timing...

[andrea.sartori]

Well, whoever is behind the PSN facts, it looks like they weren't dumb enough to leave their names around, so technically they are anonymous :P
We have to admit this trend of giving things general labels is really relaxing. Somebody blows something up, it's Al Qaeda. Somebody "hacks" something, it's Anon. If it wasn't like this, imagine the amount of time journalists (or professional investigators!) should spend doing, OMG, research and even investigation to find the actual causes of things. The stress. The fatigue. (The chance of being laid off if your work doesn't bring results.) So much easier like that: something happens, you have somebody to blame in a matter of minutes.
And this way, it is much easier to hide your own responsibility as well, at least to the general public... only a few will know (or care) about the "hack" being bad password policies and/or overconfidence (I'm looking at you HBGary), poor security, and you know, the usual reasons for "Anonymous's" "hacks".
Side Note: not talking about terrorist attacks here... but the Al Qaeda reference is really appropriate.

Not an ideal strategy

[Oxford_Comma_Lover]

Getting anonymous mad at them might not be the best strategy for beefing up the image of their security, though.

Re:Not an ideal strategy

[equex]

/me grabs popcorn

Re:Not an ideal strategy

[Sinning]

Well, it could be a good way to quickly discover any other security holes.

Re:Not an ideal strategy

[DragonWriter]

Getting anonymous mad at them might not be the best strategy for beefing up the image of their security, though.

Anonymous wouldn't be even a superficially credible scapegoat if they hadn't already been publicly mad at Sony anyway, even if they deny calling for the particular attack that Sony is trying to blame them for.

Re:Not an ideal strategy

[hypergreatthing]

Getting anonymous mad at them might not be the best strategy for beefing up the image of their security, though.

I can see it now.
Pizza... everywhere.

Re:Not an ideal strategy

[sabt-pestnu]

And Pizza Hut stock takes off!

Re:Not an ideal strategy

[HiThere]

If I understand things correctly, Anonymous isn't a coherent group. There's no centralized decision maker. There's no list of members. I'm not sure what makes one a member of Anonymous, except that you claim to be one (anonymously).

So saying that Anonymous was mad at Sony is merely saying that some anonymous person said that he was mad at Sony and called for an attack. Perhaps many people joined in, but, again, if I understand correctly, there's no particular reason to believe that someone who was a member of one Anonymous attack was a member in any other Anonymous attack.

Basically, my understanding is that Anonymous is like a mob. Saying that you were attacked by a mob doesn't convey much information. And saying that a mob conducted an expert and sophisticated attack is clearly silly. Some members of a mob may have done that, but this isn't evidence that other members of the mob would have condoned it if they had known. And one should expect the motives of the members of the mob who conducted the "expert and sophisticated attack" to be disjoint from, if not antithetical to, the motives of the ordinary members of the mob.

re: credit card theft

[King_TJ]

Ever since I first created my PSN account, I remember the site asking me if I'd like to have them save my credit card info for future use and I always said "no". (Really, how often do you actually buy something through PSN? I guess I'm not as hard-core of a gamer as some people, but I only bought a few games from it in the 3 years or so I've had my PS3. It's not that big a deal to re-enter my info with each purchase.)

Now, this hack just reinforces my belief in not giving info like that to companies to store for me. The extra bit of hassle getting out your credit card and entering the digits and expiration info is a lot less than the hassle of dealing with card fraud.

Hell hath no fury like Anonymous Scorned...

[JBHarris]

I'd say that trying to blame Anonymous for a "carefully planned, very professional, highly sophisticated" attack is at best a stretch with no evidence, and at worst a purposeful misdirection for shoddy security mechanisms.

If I was a betting man, I'd say that this spin will result in more of Anonymous' attention being directed at Sony.

Sony, if you wanna feel what its like when 3,400,000 anonymous users really want to hurt you at the same time.....just keep poking the bear.

Canada will stand up to Sony

[future assassin]

I hate linking to this POS paper but here's the story http://www.theprovince.com/life/Privacy+czar+scolds+Sony+calls+power+levy+heavy+fines/4725743/story.html

Re:Canada will stand up to Sony

[snowraver1]

Your link does not support your position. The link says that the Privacy Commissioner has no power in Canada. It says that SONY doesn't have to tell her about the brech, and she has no power to impose fines on SONY. She WANTS to bitch-slap SONY. But then so do I

What a bunch of knuckle heads...

[Desmoden]

Even if they didn't explicitly blame Anonymous for the attack to even talk of them just shows ignorance.

The loosely formed group sometimes known as "anonymous" are not a for profit organization.

If the goal was $$, this was probably done for bid, or by groups looking to make a profit off the results.

Not a political or statement based event.

Lame.

Flamebait summary

[robmv]

Sony did not blamed Anonymous, they published that they found a file named Anonymous on their website and that we may never know if Anonymous member were duped to provide cover with their denial of service attacks to the person/group that exploited the vulnerability

Re:Not Anon

[Fallen Kell]

Yep. They are lucky to even be able to plan a target for an attack, let alone a day/time.

WSJ Article

[xkalikox]

not sure if there's a paywall up, but WSJ has an article entitled 'Sony Says Hacker Left Taunting Message' in it, it says Sony is claiming the hackers left a file on the server entitled Anonymous, with contents saying 'We are Legion'.

Re:WSJ Article

[xkalikox]

now with link! http://online.wsj.com/article/SB10001424052748703849204576302970153688918.html

Re:Boogeyman

[Pieroxy]

This story kind of gives me a chill. I mean, I do manage servers and for sure a "carefully planned, very professional, highly sophisticated criminal cyber attack" would come into my systems. I mean, security is relative. If someone wants to get in, they'll get in eventually. If Stuxnet did anything, it was to point that out.

Now, I'm not saying that this was sophisticated attack. I don't know. But the fact remains that any network/server can fall to this kind of stuff.

Reuters neutrality

[Kuukai]

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.

Since when does taking a hardhacker to court constitute "defending yourself"? They might be defending their DRM or EULA or something but the article makes it sound objectively unreasonable for anyone to be upset with them...

Re:Reuters neutrality

[Kuukai]

In contrast, Sony called it "enforcing."

Correlation = causation, only on SlashDot

[Mad Leper]

Can anyone provide a link to ANYTHING that shows that Sony lays direct blame for the attack on Anonymous?? Anywhere at all?

The only time I've seen a claim that Anonymous was directly responsible for the Sony hack was from the Tech blogs & forums. Sony itself has never claimed anywhere that they lay the blame for the attack on Anonymous. In fact, Sony has gone on record stating that they do not know who is responsible. SlashDot again takes an implied link and twists it into a fact, par for course.

Sony claims to also have found a file planted on their servers named "Anonymous" containing the text "We are legion". So either it was planted by an Anon or by a sympathizer. Aside from that Anonymous is never directly implicated by them.

Geez, next people will be claiming Anonymous has been targeting Sony's employees and family members, or organizing protests at Sony stores, or launching DDos attacks against PSN. Ridiculous to think they might be responsible for this attack right??

Slightly deceptive headline

[__aavqan3009]

Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco. The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said. Sony said it was not sure whether the organizers of the two attacks were working together.

Re: Theft, Privacy and Hackers

[QuasiSteve]

While a particular group may have been responsible for the data theft

[Joe Downloader] it's not theft. It's copyright infringement.

There would still have been privacy implication

[Joe NoSuchThingAsPrivacyOnTheNet] people shouldn't complain that when they put information on a third party network that said information can become public.

less appealing to hackers

[Joe HackerVsCracker] ... ffs not this again.

Slightly more on-topic: SONY may be in no small part culpable, but they're not responsible for the breach and dissemination of the data. Whoever made their way into their systems, is.

SONY is also handling this much better than I had expected. Paying for people to replace their CCs? Head honchos publicly showing humility with a deep bow? Offering a free time of premium content + free days for every day that the network is down?

Usually you're lucky if you catch a small ad in a major newspaper where the company says 'my bad' and recommends you contact your credit card issuer.

BitTorrent

[GFLPraxis]

If Anonymous had stolen the data, it would be on TPB/Bittorrent right now. Remember HBGary?

Something doesn't add up

[Drakkenmensch]

How does a hacker steal several gigs of data in a few minutes in the midst of a DDoS attack, when the server are too overwhelmed to answer outside requests? Whatever ISP this guy has that can give a download speed of above 1 gig per minute, I want in on their service!!!

Apparently

[microbee]

Sony would have blamed Bin Laden had he not been killed by the US earlier this week. They had to find some other scapegoat so that's why it took so long for their official blaming.

Hint to Sony

[MemoryDragon]

It was not Anyonmous, it was John Doe...

Really?

[HalAtWork]

Good luck proving it was Anonymous. Also, Sony must share some of the blame for not preventing/dealing with security breaches effectively.

Re:Stupid

[ae1294]

Hacker group?
Oh please, give me a break, there are two people, at best, who can be called a hacker on 4chan.

Better include moot in that or you're gonna get perm-banned!

Irony

[DarthVain]

Doesn't anyone find it the least bit ironic that a company like Sony that spent so much time and money on DRM and effecting security to limit and put security over its paying customers, then does such a crappy job at overall network security that some jerks hack their entire network and make off with personal information, credit card numbers, etc... but ohhhh no, you better not pirate that 1$ disk of Madden Football 14.

Maybe if they spent as much time securing their stupid network as trying to enforce DRM on paying customers they might not be in the mess they are in.

I mean how is it, that the game is encrypted, on an encrypted system, using keys etc... and then online verification of that encryption, but your bloody VISA number is in a GD text file on one of their servers or something...

Hahahahaa - incompetence ? blame anonymous.

[unity100]

i wonder if sony can sink lower. default, problem-free blaming - screwed up ? blame anonymous. nuclear accident ? blame anonymous. martian invasion ? blame anonymous. i can see unlimited use for this 'blame anonymous' thing.

Re:Hahahahaa - incompetence ? blame anonymous.

[Cant use a slash wtf]

Just blame Al Qaeda, it works equally as well.

The real killer

[ae1294]

I just the FBI an anonymous tip about Anonymous!

Re:Boogeyman

[DrXym]

Now, I'm not saying that this was sophisticated attack. I don't know. But the fact remains that any network/server can fall to this kind of stuff.

Most security admins acknowledge it too which is why logging is enabled, roles are separated out, teams perform penetration testing an so forth.

I have no idea how sophisticated the attack against Sony was but the way they're talking of moving their data centers and that they had defence at the perimeter suggests to me that someone broke in through their intranet or wifi (e.g. sitting in their carpark) to gain access rather than through a public facing interface to the service.

Blame the victim?

[PerlHun]

I never could understand the attitude of blaming the victim a la "It's Sony's fault they got hacked...". Or even saying Sony was asking to be hacked due to their trial against geohotz. I don't blame rape victims for being raped or suggesting they were asking for it. Sony is trying to run a business and it is clear that criminals broke the law in a big way to access their servers. I can only imagine that with the FBIs involvement, Sony will be going after a lot of individuals who were ever involved with anything Anonymous related.

Re:Blame the victim?

[future assassin]

>I never could understand the attitude of blaming the victim a la "It's Sony's fault they got hacked...".

Thats because Sony has abused you so much that you now feel for them.

Re:Blame the victim?

[PRMan]

Because there are different ways to approach the problem and heavy-handed lawyer-inflicted abuse makes you look like a total jerk.

Marcon hacks Wii and adds the "Homebrew Channel", which has never enabled piracy (although some others have built upon it to do so). Nintendo releases a firmware update. Marcon re-opens Homebrew Channel. Ninetendo releases another firmware update, which bricks a few Wiis on accident. Marcon re-opens Homebrew Channel and finds a way to un-brick some of the bricked Wiis. Nintendo pretty much just leaves the issue alone, not wanting to harm their customer base even more.

Note, at no time did Nintendo sue Marcon, remove features that were advertised with the product, etc. And when they realized their strategy was doing more harm than good, they backed off a little. Nintendo is still making a fortune off of Wii, BTW.

Contrast Sony. They said you could install Linux on your Playstation, but not use about half the hardware. GeoHot figures out how to use ALL the hardware. Instead of realizing what's best for everyone involved, in a control-freak driven rage they remove OtherOS. GeoHot casually puts it back. Sony removes it again, makes it so future firmware updates are forward-only, and requires all their game and BluRay partners to do a firmware check on all new releases. And they drag GeoHot into court on what should be freedom of speech. Then, they subpoena all visitors to GeoHot's website, everyone who ever gave him money, etc., etc., really making enemies of millions of unrelated people. All this in addition to their track record of installing a rootkit on customers' PCs when listening to music (a 5-10-year felony if you or I did it) and taking back purchases from thousands of customers and refusing to lift a finger to give them back.

Sony is NOT the victim here. And they are being punished for legitimate crimes (hacking, theft) by vigilante justice because the courts and governments haven't done their job.

Re:I told you, I didn't do it!

[St.Creed]

Are you saying Anonymous is Al Qaeda? :)

Re:Anon...

[ae1294]

*** Tachyon Transmission from the future ***

4CHAIN Domains seized by ICE after Seal Team 6 RAID, moot is DEAD!"

Shame?!?

[sgtrock]

The hackers who stole the data and hacker Geohot are two completely different types of people. It's a shame they lumped the two together.

No, no shame at all. That was very deliberate!

Re: credit card theft

[zzsmirkzz]

I chose not to have it remember it because I allow others to use my PS3 and not my CC.

Re: credit card theft

[david_thornley]

Now you're relying on Sony not to save information on you just because you told them not to save it. It might work, but I wouldn't bet the house payment on it.

Re: Theft, Privacy and Hackers

[Chaonici]

> [Joe Downloader] it's not theft. It's copyright infringement.

Actually, I would call this an instance of data theft. I, too, believe that calling copyright infringement "theft" or "stealing" is ridiculous rhetoric, but there's a difference between music/movies/software available on BitTorrent and personal information kept on Sony's servers. Copyrighted material is meant to be available to the public, even if it's not supposed to be distributed over file sharing networks. In theory, anyone can legally obtain a copy and be able to view it to their heart's content. Sony customer data, on the other hand, is (supposed to be) carefully guarded and kept safe from unauthorized viewers (which I imagine would be just about everyone except certain Sony employees). The unauthorized copying of the latter is, in my opinion, much closer to actual theft, although I nonetheless feel a small chill using the word theft to describe the copying of data.

Furthermore, there is no copyright protection for personal information, so that rules out infringement as well.

I doubt it

[JustAnotherIdiot]

"very carefully planned, very professional, highly sophisticated criminal cyber attack"

I'm sorry, this doesn't exactly scream anon. When I think of anon I think of idiots who spam memes.
I find it sad that Sony still doesn't have a clue who broke into their systems.

Ted Danson?

[pak9rabid]

So they're saying it was Ted Danson?

May I have your attention please?

[CyberDragon777]

Will the real Anonymous please stand up?
I repeat, will the real Anonymous please stand up?
We're gonna have a problem here...

Re:I told you, I didn't do it!

[Squiddie]

So they are terrorists! I knew it!

Re:Boogeyman

[_Sprocket_]

This story kind of gives me a chill. I mean, I do manage servers and for sure a "carefully planned, very professional, highly sophisticated criminal cyber attack" would come into my systems.

If this is your wake-up call, you've been sleeping pretty hard for the past few decades.

Or

[koan]

SONY is just making more bad decisions regarding security like they did with the SONY rootkit.
http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal

Re:Boogeyman

[Bahamut_Omega]

Normally this is a case of not to feed the trolls. Unfortunately the trolls didn't listen and went straight to the buffet tables to start loading up on the first plate.

Re:I told you, I didn't do it!

[Noughmad]

There's more of you?

We don't blame them anymore

[gosand]

Except now you don't even have to blame Al Qaeda. The US government got away with lying to the world about Iraq, so there's no need to blame anyone anymore. It's just assumed they can do whatever they're doing it to protect us. Say you're protecting people's freedom and you can get away with anything. It doesn't matter what the facts show.

Sony: It was Anonymous, honest guv

[David Gerard]

GUTEN TAG, Wii Gehts, Wednesday (NTN) — Sony has revealed that the Playstation Network security breach, which compromised 24.6 million credit cards, was entirely the work of evil hackers from Anonymous, and nothing to do with their own incompetence, honest.

"We discovered a file making a clear reference to 'Username unknown,'" the company said in a letter to the US Congress on Wednesday, "and a blank user icon which therefore was anonymous. D'you see what that means? It means George Hotz and his hacker friends are loathsome criminal masterminds! So obviously we can't be held liable for negligence in the face of forces like these. In conclusion, give us money."

The letter details the company’s actions over the past two weeks. It says Sony acted with "care and caution" in deciding how to act and how long it thought it could get away without telling anyone. "We did not want to cause confusion and cause customers to take unnecessary actions, such as stopping their credit card payments to us."

"We have suffered a very carefully planned, very professional, highly sophisticated criminal cyberattack, which has led to people committing the heinous hate crime of jailbreaking their PS3s. In accordance with our campaign contributions, we ask that you impose the death penalty for such offenses."

The letter concluded that the breakin was quite definitely the work of Anonymous. "We were going to blame Al-Qaeda, but we figured after Monday that you probably wouldn't buy that."

Inside job more likely

[warp_kez]

Probably has already been said, but the more one reads the news bursts on the whole affair, it reads more like an inside job or someone had inside help.

I am Spartacus!

[tekrat]

There's a great scene in the Kirk Douglas film "Spartacus", where, after the defeat of the slave army led by Spartacus, the Roman general, who still doesn't know him by sight, wants the man or the body identified by the remaining prisoners, or all will be executed.

Spartcus (played by Kirk Douglas) is about to stand up, give himself up and save his men. But two men next to him stand up and shout in unison "I am Spartacus!" And then wave after wave of prisoners stand up and also shout the same. It's a powerful, moving scene because it's no longer about one man, it's about the dream of freedom to everyone there.

It's clear that Sony has no F'ing clue who or what "Anonymous" is, they are just going after a convenient scapegoat so they can sue some random people they might have the IP address of, at the time of the attack.

It's up to all of us to stand up and shout "I am anonymous" (or "Blank is beautiful" to those of us who remember Max Headroom), and join our voices in unison, because it's no longer about one person, it's about freedom for us all.

Uhh...

[czehp]

...very professional, highly sophisticated criminal...
Obviously no one from Sony has ever met a /b/tard...

Re:Boogeyman

[Pieroxy]

Not my wake up call. Just another reminder.

Re:Boogeyman

[_Sprocket_]

Fair enough. Me - I'm collecting links for my next "scare the horses" briefing where I have to explain why we go through all the hassle.

Re:bah, its Sony

[Ash-Fox]

the FBI and the legal system did nothing

http://www.theinquirer.net/inquirer/news/1027960/sony-bmg-sued-over-rootkit-again-sony-sued-over-playstation-psp

You can stop the bullshit of legal system doing nothing now, you lying prick.

I hope I'm not the only one who sees the problem.

[icannotthinkofaname]

very carefully planned, very professional, highly sophisticated

Is this supposed to be the same "Anonymous" that's supposed to have its home on 4chan's Random board? 'Cause none of these qualities bring those users to mind.

I suggest Sony look elsewhere. I'm pretty sure "very carefully planned, very professional, highly sophisticated" and "Anonymous" are mutually exclusive possibilities.

Ohh, this is going to sting....

[TiggertheMad]

due entirely to Sony's fuckwitted lack of security concerning sensitive data, I have had to take measures to protect my identity

Fuckwitted, indeed. By making this (dubious sounding) claim, they have just poked anon with a stick after it has just been demonstrated that they have a major security problem. There is a fair chance that anon has a sizable population of already irritated PSN users. In light of the whole HBGary fiasco, does this REALLY seem like a wise thing to do?

GG Sony, you are proving to be more entertaining by the day...

Re:Ohh, this is going to sting....

[ScrewMaster]

'What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes,' Hirai wrote.

Besides, does that really sound like Anonymous? Sounds more like something somebody on the Russian Business Network would do. Sony just wants us to believe that they were hit by some group so technically competent that Sony can't be blamed for losing their customers' data. The reality is that a. this isn't the kind of thing for which Anonymous is known and b. if anyone here is technically competent it isn't Sony. And yeah, I agree with both of you: if they weren't in Anonymous' crosshairs before ... they are now.

Stick to rootkits, Sony. Running a global gaming network obviously isn't your cup of tea.

Re:I hope I'm not the only one who sees the proble

[microbee]

Yeah, SONY really dropped the ball here. I would have chosen China for this.

Any connection to the movie?

[professorflipwig]

There is a new movie coming out about William Shakespeare, called "Anonymous." As soon as I heard about this, I figured that there would be some sort of backlash by Anonymous. Then I saw that it was made by Sony Pictures. http://www.anonymous-movie.com/

Just about as accurate

[Torodung]

I choose to blame this guy. It's about as accurate as targeting an umbrella group alias over a text file that provides no real identifying intelligence, and he's far more entertaining. IMHO, I would place this sort of thing under the heading of "fiddling while Rome burns." Sony needs to be reacquainted with the term FAIL, then they need to demonstrate that they know why they're a fail whale, and that they will fix whatever the hell went so desperately wrong with their information security.

Accept no substitutes.

WRONG.

[laxguy]

This is such bullshit. Sony never "blamed" Anonymous.. they merely stated that they found a file titled "Anonymous" with the contents "We are Legion". NO WHERE DID THEY SAY THEY BLAMED THEM. In fact they point out that they still don't know who did it. More likely the file was placed by the person(s) who did hack to the network to distract the people looking for them. Come on guys, at least read the shit you post.

Re:Boogeyman

[Anne Thwacks]

And Sony owned Sony data centres are more secure than AT&T owned Sony data centres?

Surely the word in common is "Sony"?

DIAF

[ZeRu]

Sony should die in a fire.

Amused

[sd4f]

I find this amusing, because that michael crichton story "rising sun" has sean connery say about the japanese, that they don't scapegoat when they have problems, they just sort them out and then don't worry about it. Sucks to be sony, it's quite dishonouring that they stoop to this level. Whilst the bowing was somewhat a mea culpa, this in a way takes it all back, back to evil empire sony. In any case, i don't think anonymous as a collective did it, i think it's one of two options, either someone from anonymous seized the opportunity and decided to keep on going after anon officially broke off, or other hackers, which is very highly likely, since it was a fairly public ddos, kept an eye out, and saw the potential, when members started pointing out details of the problems with sony's network.

Re:bah, its Sony

[AdmV0rl0n]

The FBI and legal system did nothing against Sony.

If your claim that people had to get together to go fight a corp equates to the FBI kicking Sony in the balls, you are more stupid than you seem.
No, Sony rootkitted people's machines and got away with it. If I rootkit a Sony device *I* own, apparently you think its kudos that they should have a big stick to beat me or anyone else with.

No, you sony bitchboy, take a hike.

Just another excuse

[ThatsNotPudding]

to make privacy and anonymity a federal crime. Going on-line? "Papers, please".

Re:bah, its Sony

[Ash-Fox]

The FBI and legal system did nothing against Sony.

The legal system did. People sued the company and won in numerous class actions suits and the legal system made it possible.

No, you sony bitchboy, take a hike.

I don't have any Sony hardware, nor do I want any.

Same old, same old

[Cant use a slash wtf]

Anonymous is like the Al Qaeda of the internet. You can blame pretty much everything on them, whether they did it or not. I mean, it benefits both sides in these cases. Sony can just yell "he did it!", while Anonymous take credit, whether they did it or not. It's a win-win situation for both sides. Much like how terror attacks are dealt with. Except replace Anonymous with Al Qaeda and Sony with the US Government.

Gaping holes

[Platinum Dragon]

So who is Sony blaming for the SOE hack? /b/?

of course sony is innocent

[mcescalante]

I doubt this was Anon, and if it was, they will never admit to it - they'll just blame ebaumsworld. Sounds like Sony trying to cover up their massive failures and continuing ignorance to what is going on and/or what customers want.

Blame game

[zer01ife]

Sony is blamed because they didn't have proper precautions for such attacks on their servers. We all know that if they kept their systems up to date, then things would be hardly possible to hack into their server systems. At the same time, we can't be sure about blaming Anonymous for this incident because many can be involved in this issue. The ones pointing the fingers on Anonymous are Sony and some other groups framing them by placing a file with their group name on it, but no one can be exactly sure about that because Anonymous, eventually, are a group of hackers so it's possible that they've done it and lied about it.

Who's lying here?

[netflusher]

Anon said on multiple occasions it's not them though. Who's lying here?