Slashdot Mirror
PSN Up, And Then Down Again
RdeCourtney writes "The PlayStation Network is down again. Sony had originally enabled passwords to be reset onscreen simply by entering an email address and date of birth. Whoever has the data from Sony, could, in theory, then reset any of the captured users accounts simply by entering the details they stole."
I've never been a particularly big fan of Sony, mind you. But even I am shocked by the level of security incompetence they've shown over this whole thing. This is a major corporation, for fuck's sake! Do they even *have* a full-time security staff in there online division? Their press releases make it sound like they only stumbled on the whole PSN hack by accident and had to run out and contract for a bunch of security people. Surely to god they had SOMEONE monitoring security, right?
As one of the effected users, I'm just glad I never gave them my credit card number (fortunately, I never bought anything on PSN). Now, I wouldn't give them a credit card number on a *dare*. Hell, I won't even give them my real *name* ever again. No online system is secure, but theirs looks like a complete joke.
Meanwhile, you have the CEO of the company dismissing this whole thing as a "hiccup," which pretty aptly demonstrates just how seriously Sony apparently takes its security. No way I want my CC number or private info involved in their next "hiccup."
SJW: Someone who has run out of real oppression, and has to fake it.
Are they really that dumb?
Did Sony's security team even THINK about testing and verifying they were doing was indeed secure when they brought the system back up again?
Sounds like the corporate culture over at Sony is horrible. First the DRM scandal, then the PSN hack and now this.
He who knows best knows how little he knows. - Thomas Jefferson
they are the company who shut down japanese swg servers suddenly one morning to the face of at least 4000 players without warning. they decided the servers were not profitable, and they decided to shut them off to their customers' faces without a word. if you played a char for 2-3 years and had memories etc, you couldnt even take a screenshot.
that is TOTALLY leaving aside how they screwed their customers en large in star wars galaxies, at the cost of screwing up the game. they had the habit of routinely changing skill properties in order to force people to drop entire skill trees and level others so that they would keep paying - spent 2 months of your play time building up a character ? well - come next patch, you had to ditch on average 30% of your character and level another tree to remain viable. as long as you kept paying, it was all ok by soe.
sony deserves whatever is shoved up their ass.
Read radical news here
Maybe they can use my SSN, or hmmm my old password, or how many fingers I'm holding up. Sony can't reset my password with data they never had and if the hackers stole all the data Sony had on me; Sony doesn't have much recourse than to use that data. The question now is balancing the pain of the process with the security of the process.
This Sony ordeal is getting ridiculous... Seriously, even this? C'mon! What's wrong with you, Sony?
Hackers stole everything Sony knows about their users, so it's no surprise that re-verifying accounts is going to be a painful process.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
What happens if sony decides that maintaining PSN is not worth the effort and just decides to shut down the entire PS3 online ecosystem?
I just want to say this
Ubuntu is an African word meaning 'I can't configure Debian'
And Sony appears to think that doing system operations the Kamikaze way is in place.
But it's fucking stupid. My best guess is that their security chief got modded down by the Tsunami.
One way to verify who you are is to either require you reset your password from the console you last connected to the PSN with or just send an email to the email address they have stored... Because, theoretically neither of those items are accessible to the hackers.
"One can not truly appreciate Shakespeare until you have heard it in it's original Klingon" -Star Trek
That is the whole point isn't it? The bad guys stole all the info Sony knew about you so there is no reasonable way of Sony differentiating the correct user 'X' from the bad guys. What are you people really expecting? magic security fairy dust?
Its the same as people complaining about the lack of encryption on Apple's iPhone location cache, come on now, the phone needs to read and write that data, guess what that means? Even if it were encrypted the keys would need to be on the device too and the 'attack' already relies on access to the device so any 'encryption' added would be DRM style obfuscation not secure encryption. The same type of encryption the same people complain about when it is used.
I thought they were only going to allow resets from the user's own console. Since the attackers stole everything sony knows about the user, the authentication has to rely on something the users have instead.
Up down up down left right left right B A.
After all the publicity, the best they come up with is to use a system that still lets you use your old credentials to get new ones? What exactly were they doing when they pulled the system down to fix the hack? If hackers really took everything Sony knows about its users, validating users accounts is going to be tough ... but will it be impossible?
Julie
It usually works for me ...
It seems to me that the 13-yr olds that run FARK have a far better security system in place than Sony does. Their people have no plan, no concept, no big picture at all, of what to do.
They are grasping at straws, throwing stuff at the wall to see what sticks, or whatever tired car analogy you wish to entertain. Point is: I think it's time they gave up and went home.
If they are lucky, they will shut down for 8 months and rebuild from scratch. If they are stupid (most likely scenario), they will continue to prop up a house of cards with a few pieces of sticky tape, and it will come down again and again, until no one is left and they've wasted a great deal of money only to arrive at the conclusion that they should have done the rebuild from scratch in the first place.
Of course by then, management will look at the numbers and get out of the game business entirely, leaving MS and Nintendo.
If telephones are outlawed, then only outlaws will have telephones.
But I've heard reports that the e-mail reset page is down.
The e-mail included a key to keep this from happening, but someone must have broken that key generation scheme.
=================
Unix is very user friendly, it's just picky about who its friends are.
The bad guys stole all the info Sony knew about you so there is no reasonable way of Sony differentiating the correct user 'X' from the bad guys.
Send me a letter (yes, snail-mail) that contains a one-time-use code that I can use to reset my password online. If you have my credit card info, you have my billing address...
Problem solved. But oh wait, that costs MONEY to do!
With the first link, the chain is forged.
At the time I type this, the PSN is actually up and running. Or at least, it's online gaming components are. The Store and other features that require payments are still offline, as they have been since the initial shutdown several weeks ago. But you can, should you feel so inclined, log in and play games online at present. Whether this may change over the next few hours is open to question - while it wouldn't completely surprise me, I suspect that Sony will try to keep the network itself up this time..
What's just been taken offline is web-interface for changing passwords. Now, that's still pretty bad - in fact, given how stupid the mistake in this case is, it's verging on the awful - but I dare say that a lot of PSN users may not actually notice until Sony tells them. Furthermore, just to add a little perspective, stupid though Sony's mistake here is (and it is very stupid indeed and then some), no additional personal information or credit card details beyond what has already been leaked will have been compromised as a result of this - not least because you can't, so far as I know, actually input new credit card details into the PSN yet.
So it's a further embarrassment for Sony and will further undermine confidence in them (do you really, really want to trust them with your credit card details ever again). But unless I'm reading things wrong - and if I am then happy to be corrected- there's not been any actual additional harm done to users this time.
Well unless I misunderstand, could they not email you the new password instead of resetting it from the page? This way nothing is compromised to anyone. It's a simple two factor authentication as opposed to one-factor. The only way you would be vulnerable here is if the attacker then also knows your email password. And if it's the same as any of your other passwords, well, you're probably not reading this website.
I'm sorry for all those who I've inconvenienced. This time it was my fault. I created a new username for security purposes. Apparently, PSN didn't take too kindly to the username "; drop table Users; --"
Similes are like metaphors
Give Microsoft credit - xbox live is setup/run extremely well. They had to compete with xbconnect, Xlink Kai, and other freebies back in the day; they stepped up and created a better alternative. Everyone was willing to pay for a service - as long as it was worth it. It was and still is.
The revenue has allowed them to build a better network and keep it up. I'm not claiming they too couldn't be hacked, just highly doubt it would be to this level.
... it's not just for a day.
-- B. D.
Well, apparently, you only have to fool the majority of people for a little while.
I don't even miss PSN. Haven't logged in for MONTHS after I jailbroke it, so thankfully I wasn't affected by the initial hacking.
I don't even use XBox Live so it's not a fanboy thing. The only reason I even still have a XBL account is because I got charged for a year back in Nov 09, and I use it for Netflix.
PSN up, up again, then down, down. Then Left, right, left, right, B, A, start.
If the geiger counter does not click, the coffee, she is not thick.
If they have an email address, they can mail a password reset to it, but simply allowing users to enter it as if it were a password is a bit much.
Of course, the problem is that if they have an email address and a password for their own system, for a large number of accounts, that password will be the password for the email system as well.
So what happens if you are one of the 85% of users who didn't enter CC information or use your home address (or in my case - that CC and address are so outdated that nothing is forwarded from that address anymore)?
As for Sony sending emails to the user's email account - if the hackers had malicious intent, then all those email addresses are also potentially compromised. In fact, outside of CC info, you email would be the next thing attacked:
1. because it's fairly easy to hack, especially when you have the amount of information that was stolen
2. because then the hacker potentially has access to account information from other websites, such as ebay or amazon.
I had my PS3 totally freeze up when I was trying to put in my new password. The only way I could get it unstuck was to unplug it.
Sony = Clowns
Microsoft should license Tubthumping and use it for the soundtrack for a fake PSN commercial...
This is why I like Japan.
They could start by sending the token that lets me change my password to my email account instead of simply throwing it up to whoever happens to hit the website with the data that was already stolen. They don't even need my old password to do this FFS.
Bothering to have people change their passwords at all with security that week is just theatre.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Clearly the solution here is to give Sony more personal information than you already have. How about your SSN, relative's contact info, 3rd grade report card, or facebook login (hoping you don't use the same login there). If Sony doesn't get their act together though, this will just turn into a cycle. There really is no way to identify someone on the internet other than using one issued by some other body such as a SSN or CCN who has hopefully done their legwork to verify your applications for ID are legitimate.
But if you put in your postal address into the PSN then the person will know where to steal your activation code!
Any system can be explained away. Snail mail theft is a bit extreme, but so is sending everyone a snail mail code to re-activate. An email validation code should be good enough and if you're dumb enough to use the same password for PSN as your email and you haven't changed it yet, you deserve the long boring hold time while trying to get your password reset over the phone.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
In addition to the email suggestions above, shouldn't they be able to use some sort of hardware ID? I don't think PSN accounts are tied to your machine, but they should have records of which machines you have used with PSN recently. Just require that you reactive your account from a machine which you regularly used prior to the intrusion. If they can't even verify that, then what good is their DRM at all?
Speaking of police work, Slashdot editors should try actually verifying their stories. PSN isn't down. It's up right now I type this. Apparently, what's down is the email reset page.
As for your credit card number, there is no evidence credit card data was obtained in the PSN breach. Credit card companies would have noticed an increase in fraud and alerted their customers. The alarmism on forums is ridiculous, and most of it is driven from Sony hatred rather than facts. This is the website on which a commenter to a story on the Japan earthquake delaying the Sony NGP justified the lethal disaster by saying, "Anything that hurts Sony is good for the consumer." It got +3 Funny.
Anyone can make an omelet with eggs. The trick is to make one with none. Sony has learned this trick.
I've heard that shame is a powerful motivator in the East.
Apparently Sony has no shame.
I'm about 99% certain that Sony required you to reactivate your account from the PS3 it was activated on.
This is an absolute non-issue /multiple PS3 owner
---Up Up Down Down Left Right Left Right B A START
Sony PSN has other inconsistencies as well in their password reset scheme currently in effect: the stated password policy is different on the web compared to that presented using your PS3 upon password reset. Password history doesn't seem to be properly implemented (compared to what the policy says). I've taken screenshots and made a blog post to describe the differences at securitynirvana.blogspot.com.
Of even more interest: Sony has said in official blog posts that they have used several respected security companies to aid them in restoring PSN with proper security. Anyone got any names of those companies?
and the shocking bad security for their actual paying Customers. Tells me all I need to know about who they are worried about taking care of. I will never buy a sony product again.
PSN isn't down. What Sony shut down is several website login pages that used PSN accounts, due to an email reset exploit.
Howard Stringer has the gall to say that they acted quickly.
link
What fucking planet is he on?
Here you go:
http://wiki.whysonysucks.com/main_page.pl
In the context where hackers/criminals have access to all the information Sony knows about its clients, there is no information that Sony can use to validate the identity of its clients. I wonder how this comes as a surprise now.
The only safe way to check is through physical verification. For example, through PS or other registered device serial numbers. If you log in with the PS3 that has the same serial number has the one that was used to create the account (assuming they have that info), you can relatively safely assume that it is the right person. There are other way. If your postal address is in your PSN account, they could send a letter with a unique validation code. Similar could also be done with SMS to registered cell phone or automated callback on landlines. I can see a lot of possible solutions... none that are cheap or easy to implement.
What do you do If you know the following data has been compromised: email-address and possibly the password used for that email address as well (if it's the same). You fecking change the password as soon as you are aware of the fact! I'm sorry but if you didn't do that yet you deserve to be locked out of psn for ever and preferably locked out of a reproduction opportunity as well.
so being overly paranoid about things like this (identity theft victim), I went to PSN online to change my password as soon as the site was back up.
after entering my username, PSN online emailed me a unique token link in order to change my password before it would let me login.
as the PS3 has a web browser, why not do the exact same thing when trying login to PSN from the first time through the PS3?
You're trolling really hard right now, how can you expect to not be modded down?
There's even a classification for it.
http://lkml.org/lkml/2005/8/20/95
The Hotz guy smiles... thanks karma!
Chuck Norris is using it. :)
Abd they're apparently demonstrating this to the Japanese government by saying 'Look we'll switch the rest of the world back on and use them as guinea pigs'. Typical modern day Sony i'm afraid. What a wasy for a company to go from the top of the pile to the foul smelling underbelly
I can give them the number of a lawyer to help them with the liquidation.
After that the name needs to die, like WorldCom, Enron & March 1st.
Of course the board of directors, Chief Xs, and Division managers/officers in charge of their cluster fucks also all need to be sued by the other stock holders for fraud since they claimed to be competent, and they obviously weren't.
there's not been any actual additional harm done to users this time
You say that all that's lost is the ability to change one's password.
Didn't Sony's user database just get stolen? Wouldn't people thus want to change their password, so attackers can't vandalize their game info/account?
I honestly don't know how PSN works, so maybe I'm missing a piece of the puzzle, but that's the first thing that occurs to me.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
The password reset issue is not intentional. Normally Sony would email you a URL with a security token in it, this is required to reset your password. As it happens that security token can be gotten from another form if you have a user's username, email address, and date of birth. Kotaku has a list of steps used for this exploit: http://kotaku.com/5803070/sony-playstation-network-password-reset-page-exploited-customer-accounts-potentially-compromised
umm, still seems to be up to me... or else I didn't just play black ops...
fuck with anonymous.
I for one welcome our new decentralized anarchist overlords. Maybe now we can find out who shot JFK?
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
Hbgary a cyber security and forensic specialy company specializing in this type of thing got majorily hacked and humilliated by this same group.
Mastercard got hacked by this same group.
Paypal got hacked by this same group.
Square/enix got hacked by this group.
Foriegn government agencies were hacked by this group.
And a whole lot of other firms, companies and so on got hacked by this group.
But you morons blame sony for lack of security despite the vast amounts of other companies they have hacked numerous times? You folks just want to complain about sony is all because your on the trendy internet bandwagon of the month to bash some company for no reason. Sony drew the ire of many hackers that are continually hacking them because its been such big news. Its not sonys fault and they dont have lax security they have just become a popular target is all.
Anyone who is living in the real world and has a functional brain knows that nothing is secure, nothing is fool proof and nothing is guarnteed. If one person can build a security system there will be a million who can break in it because security of any kind is fundamentally flawed by the fact it was created by a human being.
All of you idiots run around the net talking like you think a multi billion dollar, worldwide, major corporation like sony hired the geek squad to setup their security or something. Your crazy, but most of all your cynical retards just looking for a excuse to complain instead of using your brains. All you guys do is repeat the same things enmass constantly, you just repeat eachother with no real sound argument or insight.
Sony is down and all you want to do is kick them because you think it makes you suave, savy and informed infront of millions of others online who dont care what you think. When in reality you just want to sound like a modern hippie and lash out against the big evil corporations because you have huge egos and no self esteem.
There is absolutely no reason why PSN can't be free and secure at the same time. Every game bought through the PSN justifies it's infrastructure and if Sony wants to do online transactions like that, then they had better make sure their system has the appropriate security.
Besides, Xbox Live is a con job. Free works perfectly fine. If you've used the vastly superior Steam then you know what I'm talking about. How MS managed to convince people to pay for multiplayer and trivial things like themes and avatar accessories is beyond me and saddening to say the least.
So are you saying that Apple has catastrophically bad failure rates, and has dismal software security, or the opposite?
And you base all this on the fact that the x-box network has not YET been hacked. As far as you know...
PSN wasn't hacked either, till a while back. Before that happened, no-one would have believed you if you had claimed PSN was insecure as hell.
Obligatory ocean liner analogy. You standing on the docks, remarking how this mighty new ocean liner Titanic is unsinkable...
Xbox live setup well? Only time will tell. In security there is no finish line, you security record is at best always "not broken, yet".
Out of curiosity, which OS are they running PSN on ?
Its also why it is important to fully check your account the moment you logged on again and to make sure your e-mail address is still the same. Because even if they attempt to change your password; guess where the new information is being sent to ?
This is a non-issue and IMO only showing how ignorant some people actually are.
But since its modern to "Sony bash" these days I guess it was to be expected.
Next up: PSN Accounts hacked, Sony fails miserable again!. As it turns out several people use the same password they used on gmail, hotmail and even some tech website called slashdot. We have reports that a lot of these accounts got hijacked and are now being used to spread spam and highly sensitive information about the acounts in question. Once again Sony's security staff fails miserably because they should have known up front that people's e-mail accounts were going to be abused!
And after a few months I guess we'll finally reach the stage of "Sony ate my hamster!" and then - hopefully - we'll be back to normal. Unless of course some people actually believe that as well, and the whole mindless bashing starts up all over.
The real question is this.
Can PS3 firmware updates be trusted?
Who is to say that since the PS3 was hacked, then PSN hacked, that sonys firmware servers were not hacked to contain nasty rootkits.
Sony should take a hint from Nintendo.
You can go online with a wii and buy from the wii store. You can do all of this without setting up an account or personal information.
All you do is go to a retailer and get wii points, enter those points into your wii. The only personal data exchange is between you and the retailer.
For basic PSN access you should not need to setup an account, period.
"I get knocked down
But I get up again
You're never going to keep me down"
This is a major corporation, for fuck's sake! Do they even *have* a full-time security staff in there online division?
And Japanese at that. Where are the razorgirls? There were supposed to be razorgirls!
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
Its the same as people complaining about the lack of encryption on Apple's iPhone location cache, come on now, the phone needs to read and write that data, guess what that means? Even if it were encrypted the keys would need to be on the device too and the 'attack' already relies on access to the device so any 'encryption' added would be DRM style obfuscation not secure encryption. The same type of encryption the same people complain about when it is used.
That's not entirely true. The location file was backed up with ITunes so the data was stored on locations other than the iPhone. Probably easily accessible by family members who might want to see where you've been at the very least.
War doesn't show who is right - just who is left.
Yes, but that requires physical effort. You'd have to send an army of thousands of scammers to mailboxes all over the country/world.
Not perfect, but 99.99% better than "enter your birthday and email address, both of which scammers have in their files"
With the first link, the chain is forged.
first of all the psn is completly down, i can play online games as much as i want at this moment....
second off all of you people saying sony's security wasnt good? do you even know the real details to the attack on there network? a major Denial of service attack had been wrecking havoc on there servers for more than 3 days which had been consuming all of sony's security staff which in turn made this hacker a lot harder to find...
i would really like for the people out here criticizing sony for there security think about this a bit it is one hell of a hard job to keep everything secure all the time, well actually its almost impossible, hackers these days can perform extremely harsh attacks on servers and with almost everyone owning a computer anybody can jump in the bandwagon and help out these hackers without even knowing it.
glad i hoped off the burning train before it crashed.
Why can't they just use something unique to mix it with an email address like, oh I don't know, The console ID directly pulled from the hardware.
One assumes an attacker can't steal those in bulk easily. (artificially created replay attack possibly?)
They seem to be pretty good at finding it to use against George Hotz (yes I know it turned out to be the previous owner but it shows they know the mappings).
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
Slashdot still exists? Wow. Haven't been here for years.
Paying for Live is so much better because it has never been down for 2 weeks before. Oh wait:
http://www.examiner.com/video-game-in-boston/xbox-live-down-how-quickly-we-forget
It was also down the holiday weekend that Halo 3 came out.
But our user accounts are safe. (Accounts hacked 2007)
http://www.zdnet.com/blog/security/xbox-live-hacked-accounts-stolen/131
(Accounts hacked 2008)
http://playsquad.commongate.com/post/Xbox_Live_hacked_accounts_stolen/
Also at least once the whole customer database was downloaded. (Sorry can't find a good link)
Though I must admit, Microsoft did accomplish something Sony hasn't yet, people were able to steal other people's Microsoft points.
For years to come this will be THE computer security textbook case covered in universities describing how not to operate. Every aspect has been mishandled. And this is a major global brand name. Sony failed to follow elementary security BKMs and allowed the breakin to happen. They behaved arrogantly toward the security researcher community (guys, no matter what you may think of them, this is never a good approach! Smarter companies work with the researchers that find vulnerabilities and test exploits to mitigate them quietly. Sony invited this by taking the opposite approach. And this is the result!). Sony did not protect their customers' data. They failed to disclose the breakin for a week. Their CEO drew an analogy with having your house burglarized then checking to see if anything was taken to see if it was necessary to call the police. Huh? Helloooooo.... Hello, hello? Is anyone home? If your house is burglarized call the police (and your neighbors!) immediately. You don't need to wait around while the crooks are running free nearby. Worry about other potential victims! Duh! And of course, Sony took a week to figure out that, yes, stuff was stolen. Not exactly rapid response. Now they literally can't get it up. Nor can they determine exactly what all was stolen precisely. Let's see... anything else that they could have done wrong? Oh, yes... the followed all of this up by skillfully pulling a PR disaster when that CEO used that stupid burglary analogy then tried to somewhat cover himself with a general statement that nobody can protect customer data anymore. Whether there is truth in that or not is irrelevant. The point is that this is their public relations position to make everyone feel somewhat more confident in Sony?! "We're lousy, but no one else is any good either... as far as we know... and we know a whole lot about security...". Somebody's head will probably roll (wonder whose?). But this will still go down as THE classic example of how to mishandle computer security at every possible juncture. A friend of mine in computer security told me this morning that Sony PS3 used to be great. He bought his in college because you could use it as a computer/MFD and install your own OS on it along with playing games, etc. But over time Sony took away those nice capabilities. Now he wishes he never bought one. Overall it looks like Sony is managing to snatch defeat out of the jaws of victory in the most moronic ways imagineable. I'm not a Sony or PS3 hater. I just bought one. I want them to suceed. But for crying out loud don't you guys ever learn anything??? Sad!!!
Marc.PDX