Slashdot Mirror
PSN Up, And Then Down Again
RdeCourtney writes "The PlayStation Network is down again. Sony had originally enabled passwords to be reset onscreen simply by entering an email address and date of birth. Whoever has the data from Sony, could, in theory, then reset any of the captured users accounts simply by entering the details they stole."
I've never been a particularly big fan of Sony, mind you. But even I am shocked by the level of security incompetence they've shown over this whole thing. This is a major corporation, for fuck's sake! Do they even *have* a full-time security staff in there online division? Their press releases make it sound like they only stumbled on the whole PSN hack by accident and had to run out and contract for a bunch of security people. Surely to god they had SOMEONE monitoring security, right?
As one of the effected users, I'm just glad I never gave them my credit card number (fortunately, I never bought anything on PSN). Now, I wouldn't give them a credit card number on a *dare*. Hell, I won't even give them my real *name* ever again. No online system is secure, but theirs looks like a complete joke.
Meanwhile, you have the CEO of the company dismissing this whole thing as a "hiccup," which pretty aptly demonstrates just how seriously Sony apparently takes its security. No way I want my CC number or private info involved in their next "hiccup."
SJW: Someone who has run out of real oppression, and has to fake it.
Did Sony's security team even THINK about testing and verifying they were doing was indeed secure when they brought the system back up again?
Sounds like the corporate culture over at Sony is horrible. First the DRM scandal, then the PSN hack and now this.
He who knows best knows how little he knows. - Thomas Jefferson
they are the company who shut down japanese swg servers suddenly one morning to the face of at least 4000 players without warning. they decided the servers were not profitable, and they decided to shut them off to their customers' faces without a word. if you played a char for 2-3 years and had memories etc, you couldnt even take a screenshot.
that is TOTALLY leaving aside how they screwed their customers en large in star wars galaxies, at the cost of screwing up the game. they had the habit of routinely changing skill properties in order to force people to drop entire skill trees and level others so that they would keep paying - spent 2 months of your play time building up a character ? well - come next patch, you had to ditch on average 30% of your character and level another tree to remain viable. as long as you kept paying, it was all ok by soe.
sony deserves whatever is shoved up their ass.
Read radical news here
Are they really that dumb?
Yes. I'd stake $599US on it.
Maybe they can use my SSN, or hmmm my old password, or how many fingers I'm holding up. Sony can't reset my password with data they never had and if the hackers stole all the data Sony had on me; Sony doesn't have much recourse than to use that data. The question now is balancing the pain of the process with the security of the process.
Hackers stole everything Sony knows about their users, so it's no surprise that re-verifying accounts is going to be a painful process.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
I just want to say this
Ubuntu is an African word meaning 'I can't configure Debian'
Are they really that dumb?
Was there ever any doubt?? I heard the Japanese PSN wasn't even up.. They were saying, it will be up only after they are confirmed its security is safe.. So that was one good thing that came out of this debaccle.. The Japan wing of Sony's PSN is good.. The rest, as they say, is history..
Nothing here... So... SHOOO!!!
One way to verify who you are is to either require you reset your password from the console you last connected to the PSN with or just send an email to the email address they have stored... Because, theoretically neither of those items are accessible to the hackers.
"One can not truly appreciate Shakespeare until you have heard it in it's original Klingon" -Star Trek
That is the whole point isn't it? The bad guys stole all the info Sony knew about you so there is no reasonable way of Sony differentiating the correct user 'X' from the bad guys. What are you people really expecting? magic security fairy dust?
Its the same as people complaining about the lack of encryption on Apple's iPhone location cache, come on now, the phone needs to read and write that data, guess what that means? Even if it were encrypted the keys would need to be on the device too and the 'attack' already relies on access to the device so any 'encryption' added would be DRM style obfuscation not secure encryption. The same type of encryption the same people complain about when it is used.
I thought they were only going to allow resets from the user's own console. Since the attackers stole everything sony knows about the user, the authentication has to rely on something the users have instead.
After all the publicity, the best they come up with is to use a system that still lets you use your old credentials to get new ones? What exactly were they doing when they pulled the system down to fix the hack? If hackers really took everything Sony knows about its users, validating users accounts is going to be tough ... but will it be impossible?
Julie
It usually works for me ...
The market value for PS3s will plummet and we can pick them up cheap and install OtherOS.
Oh, sorry about that.
Have gnu, will travel.
It seems to me that the 13-yr olds that run FARK have a far better security system in place than Sony does. Their people have no plan, no concept, no big picture at all, of what to do.
They are grasping at straws, throwing stuff at the wall to see what sticks, or whatever tired car analogy you wish to entertain. Point is: I think it's time they gave up and went home.
If they are lucky, they will shut down for 8 months and rebuild from scratch. If they are stupid (most likely scenario), they will continue to prop up a house of cards with a few pieces of sticky tape, and it will come down again and again, until no one is left and they've wasted a great deal of money only to arrive at the conclusion that they should have done the rebuild from scratch in the first place.
Of course by then, management will look at the numbers and get out of the game business entirely, leaving MS and Nintendo.
If telephones are outlawed, then only outlaws will have telephones.
But I've heard reports that the e-mail reset page is down.
The e-mail included a key to keep this from happening, but someone must have broken that key generation scheme.
=================
Unix is very user friendly, it's just picky about who its friends are.
The bad guys stole all the info Sony knew about you so there is no reasonable way of Sony differentiating the correct user 'X' from the bad guys.
Send me a letter (yes, snail-mail) that contains a one-time-use code that I can use to reset my password online. If you have my credit card info, you have my billing address...
Problem solved. But oh wait, that costs MONEY to do!
With the first link, the chain is forged.
At the time I type this, the PSN is actually up and running. Or at least, it's online gaming components are. The Store and other features that require payments are still offline, as they have been since the initial shutdown several weeks ago. But you can, should you feel so inclined, log in and play games online at present. Whether this may change over the next few hours is open to question - while it wouldn't completely surprise me, I suspect that Sony will try to keep the network itself up this time..
What's just been taken offline is web-interface for changing passwords. Now, that's still pretty bad - in fact, given how stupid the mistake in this case is, it's verging on the awful - but I dare say that a lot of PSN users may not actually notice until Sony tells them. Furthermore, just to add a little perspective, stupid though Sony's mistake here is (and it is very stupid indeed and then some), no additional personal information or credit card details beyond what has already been leaked will have been compromised as a result of this - not least because you can't, so far as I know, actually input new credit card details into the PSN yet.
So it's a further embarrassment for Sony and will further undermine confidence in them (do you really, really want to trust them with your credit card details ever again). But unless I'm reading things wrong - and if I am then happy to be corrected- there's not been any actual additional harm done to users this time.
I'm sorry for all those who I've inconvenienced. This time it was my fault. I created a new username for security purposes. Apparently, PSN didn't take too kindly to the username "; drop table Users; --"
Similes are like metaphors
Give Microsoft credit - xbox live is setup/run extremely well. They had to compete with xbconnect, Xlink Kai, and other freebies back in the day; they stepped up and created a better alternative. Everyone was willing to pay for a service - as long as it was worth it. It was and still is.
The revenue has allowed them to build a better network and keep it up. I'm not claiming they too couldn't be hacked, just highly doubt it would be to this level.
... it's not just for a day.
-- B. D.
Well, apparently, you only have to fool the majority of people for a little while.
Wii (repeat ii many times, because of the slashdot filter...)
I don't even miss PSN. Haven't logged in for MONTHS after I jailbroke it, so thankfully I wasn't affected by the initial hacking.
I don't even use XBox Live so it's not a fanboy thing. The only reason I even still have a XBL account is because I got charged for a year back in Nov 09, and I use it for Netflix.
PSN up, up again, then down, down. Then Left, right, left, right, B, A, start.
If the geiger counter does not click, the coffee, she is not thick.
They get sued into oblivion by the mother of all class action lawsuits. Not even Sony could successfully defend against that.
Good-bye
If they have an email address, they can mail a password reset to it, but simply allowing users to enter it as if it were a password is a bit much.
Of course, the problem is that if they have an email address and a password for their own system, for a large number of accounts, that password will be the password for the email system as well.
When I was a senior in HS, the price of the TI-99/4a dropped to 50 bucks. This happened just before the coupon for 50 bucks off was issued.
Free computers for everyone!
--
BMO
They could start by sending the token that lets me change my password to my email account instead of simply throwing it up to whoever happens to hit the website with the data that was already stolen. They don't even need my old password to do this FFS.
Bothering to have people change their passwords at all with security that week is just theatre.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Clearly the solution here is to give Sony more personal information than you already have. How about your SSN, relative's contact info, 3rd grade report card, or facebook login (hoping you don't use the same login there). If Sony doesn't get their act together though, this will just turn into a cycle. There really is no way to identify someone on the internet other than using one issued by some other body such as a SSN or CCN who has hopefully done their legwork to verify your applications for ID are legitimate.
But if you put in your postal address into the PSN then the person will know where to steal your activation code!
Any system can be explained away. Snail mail theft is a bit extreme, but so is sending everyone a snail mail code to re-activate. An email validation code should be good enough and if you're dumb enough to use the same password for PSN as your email and you haven't changed it yet, you deserve the long boring hold time while trying to get your password reset over the phone.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
In addition to the email suggestions above, shouldn't they be able to use some sort of hardware ID? I don't think PSN accounts are tied to your machine, but they should have records of which machines you have used with PSN recently. Just require that you reactive your account from a machine which you regularly used prior to the intrusion. If they can't even verify that, then what good is their DRM at all?
The Japanese PSN isn't up because the Japanese government isn't letting them put it back up until they can demonstrate they've properly secured it.
Speaking of police work, Slashdot editors should try actually verifying their stories. PSN isn't down. It's up right now I type this. Apparently, what's down is the email reset page.
As for your credit card number, there is no evidence credit card data was obtained in the PSN breach. Credit card companies would have noticed an increase in fraud and alerted their customers. The alarmism on forums is ridiculous, and most of it is driven from Sony hatred rather than facts. This is the website on which a commenter to a story on the Japan earthquake delaying the Sony NGP justified the lethal disaster by saying, "Anything that hurts Sony is good for the consumer." It got +3 Funny.
Anyone can make an omelet with eggs. The trick is to make one with none. Sony has learned this trick.
I've heard that shame is a powerful motivator in the East.
Apparently Sony has no shame.
I'm about 99% certain that Sony required you to reactivate your account from the PS3 it was activated on.
This is an absolute non-issue /multiple PS3 owner
---Up Up Down Down Left Right Left Right B A START
Sony would INITIATE it to defend themselves. They can't be sued twice, anyone who doesn't opt-out can't sue or participate in a new CALS, and they don't have to even notify you of your ability to opt-out. Settle for $100 million, and you're good.
Support my political activism on Patreon.
The next day a cure for cancer will be found.
From a guy that sorely misses his online Vegas Texas hold-em.
WARNING: Smartphones have side effects--most of them undocumented.
and the shocking bad security for their actual paying Customers. Tells me all I need to know about who they are worried about taking care of. I will never buy a sony product again.
PSN isn't down. What Sony shut down is several website login pages that used PSN accounts, due to an email reset exploit.
Howard Stringer has the gall to say that they acted quickly.
link
What fucking planet is he on?
In the context where hackers/criminals have access to all the information Sony knows about its clients, there is no information that Sony can use to validate the identity of its clients. I wonder how this comes as a surprise now.
The only safe way to check is through physical verification. For example, through PS or other registered device serial numbers. If you log in with the PS3 that has the same serial number has the one that was used to create the account (assuming they have that info), you can relatively safely assume that it is the right person. There are other way. If your postal address is in your PSN account, they could send a letter with a unique validation code. Similar could also be done with SMS to registered cell phone or automated callback on landlines. I can see a lot of possible solutions... none that are cheap or easy to implement.
What do you do If you know the following data has been compromised: email-address and possibly the password used for that email address as well (if it's the same). You fecking change the password as soon as you are aware of the fact! I'm sorry but if you didn't do that yet you deserve to be locked out of psn for ever and preferably locked out of a reproduction opportunity as well.
You're trolling really hard right now, how can you expect to not be modded down?
There's even a classification for it.
http://lkml.org/lkml/2005/8/20/95
The Hotz guy smiles... thanks karma!
Chuck Norris is using it. :)
Abd they're apparently demonstrating this to the Japanese government by saying 'Look we'll switch the rest of the world back on and use them as guinea pigs'. Typical modern day Sony i'm afraid. What a wasy for a company to go from the top of the pile to the foul smelling underbelly
there's not been any actual additional harm done to users this time
You say that all that's lost is the ability to change one's password.
Didn't Sony's user database just get stolen? Wouldn't people thus want to change their password, so attackers can't vandalize their game info/account?
I honestly don't know how PSN works, so maybe I'm missing a piece of the puzzle, but that's the first thing that occurs to me.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I was working at KMart back then, and I believe it was a mail-in rebate which dropped the price effectively to -$5. When the store doors opened that Sunday morning, there was a stampeded to the back of the store. I think we only had 5 or 6 in stock at that point. I wasn't too impressed with the machines, so didn't bother getting one for myself - I was an Atari 800 snob in those days.
The password reset issue is not intentional. Normally Sony would email you a URL with a security token in it, this is required to reset your password. As it happens that security token can be gotten from another form if you have a user's username, email address, and date of birth. Kotaku has a list of steps used for this exploit: http://kotaku.com/5803070/sony-playstation-network-password-reset-page-exploited-customer-accounts-potentially-compromised
fuck with anonymous.
I for one welcome our new decentralized anarchist overlords. Maybe now we can find out who shot JFK?
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
There is absolutely no reason why PSN can't be free and secure at the same time. Every game bought through the PSN justifies it's infrastructure and if Sony wants to do online transactions like that, then they had better make sure their system has the appropriate security.
Besides, Xbox Live is a con job. Free works perfectly fine. If you've used the vastly superior Steam then you know what I'm talking about. How MS managed to convince people to pay for multiplayer and trivial things like themes and avatar accessories is beyond me and saddening to say the least.
So are you saying that Apple has catastrophically bad failure rates, and has dismal software security, or the opposite?
Then, I finally buy a Wii.
May the Maths Be with you!
Yep. A lot of people don't realize that class actions suits are more often than not initiated (secretly) by the companies themselves. They get blanket lawsuit immunity for the relatively low cost of paying off some lawyers and sending out some worthless coupons to consumers.
SJW: Someone who has run out of real oppression, and has to fake it.
Out of curiosity, which OS are they running PSN on ?
"I get knocked down
But I get up again
You're never going to keep me down"
Sony don't need help from anyone to do that.
This is a major corporation, for fuck's sake! Do they even *have* a full-time security staff in there online division?
And Japanese at that. Where are the razorgirls? There were supposed to be razorgirls!
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
Its the same as people complaining about the lack of encryption on Apple's iPhone location cache, come on now, the phone needs to read and write that data, guess what that means? Even if it were encrypted the keys would need to be on the device too and the 'attack' already relies on access to the device so any 'encryption' added would be DRM style obfuscation not secure encryption. The same type of encryption the same people complain about when it is used.
That's not entirely true. The location file was backed up with ITunes so the data was stored on locations other than the iPhone. Probably easily accessible by family members who might want to see where you've been at the very least.
War doesn't show who is right - just who is left.
Yes, but that requires physical effort. You'd have to send an army of thousands of scammers to mailboxes all over the country/world.
Not perfect, but 99.99% better than "enter your birthday and email address, both of which scammers have in their files"
With the first link, the chain is forged.
Why can't they just use something unique to mix it with an email address like, oh I don't know, The console ID directly pulled from the hardware.
One assumes an attacker can't steal those in bulk easily. (artificially created replay attack possibly?)
They seem to be pretty good at finding it to use against George Hotz (yes I know it turned out to be the previous owner but it shows they know the mappings).
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
For years to come this will be THE computer security textbook case covered in universities describing how not to operate. Every aspect has been mishandled. And this is a major global brand name. Sony failed to follow elementary security BKMs and allowed the breakin to happen. They behaved arrogantly toward the security researcher community (guys, no matter what you may think of them, this is never a good approach! Smarter companies work with the researchers that find vulnerabilities and test exploits to mitigate them quietly. Sony invited this by taking the opposite approach. And this is the result!). Sony did not protect their customers' data. They failed to disclose the breakin for a week. Their CEO drew an analogy with having your house burglarized then checking to see if anything was taken to see if it was necessary to call the police. Huh? Helloooooo.... Hello, hello? Is anyone home? If your house is burglarized call the police (and your neighbors!) immediately. You don't need to wait around while the crooks are running free nearby. Worry about other potential victims! Duh! And of course, Sony took a week to figure out that, yes, stuff was stolen. Not exactly rapid response. Now they literally can't get it up. Nor can they determine exactly what all was stolen precisely. Let's see... anything else that they could have done wrong? Oh, yes... the followed all of this up by skillfully pulling a PR disaster when that CEO used that stupid burglary analogy then tried to somewhat cover himself with a general statement that nobody can protect customer data anymore. Whether there is truth in that or not is irrelevant. The point is that this is their public relations position to make everyone feel somewhat more confident in Sony?! "We're lousy, but no one else is any good either... as far as we know... and we know a whole lot about security...". Somebody's head will probably roll (wonder whose?). But this will still go down as THE classic example of how to mishandle computer security at every possible juncture. A friend of mine in computer security told me this morning that Sony PS3 used to be great. He bought his in college because you could use it as a computer/MFD and install your own OS on it along with playing games, etc. But over time Sony took away those nice capabilities. Now he wishes he never bought one. Overall it looks like Sony is managing to snatch defeat out of the jaws of victory in the most moronic ways imagineable. I'm not a Sony or PS3 hater. I just bought one. I want them to suceed. But for crying out loud don't you guys ever learn anything??? Sad!!!
Marc.PDX