Slashdot Mirror
Sony Targeted Yet Again; Thwarts Attackers This Time
alphadogg writes with an excerpt from a Network World article: "Sony suspended 93,000 user accounts on several of its gaming and entertainment networks after unauthorized login attempts on those accounts. The attempts occurred on the PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment, and the company says that login information likely acquired from other sources was tested en masse on the networks. Only a 'small number' of the attempts were successful, and no credit card information was leaked. ... Sony Chief Information Security Officer Philip Reitinger said that 'less than one tenth of one percent' of the networks' users may have been affected."
"Sony suspended 93,000 user accounts
'less than one tenth of one percent' of the networks' users
Sony has over 93 million accounts? ... ?
As far as I know only about 50 million PS3s have been sold, some to upgraders / replacers / theft or fire insurance claims, so there's probably less than 50 million PS3 user accounts.
The other 50 million or so accounts are
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Ouch. That's not a particularly nice title to have these times...
'less than one tenth of one percent'
Which means ... how many accounts?
Are you contacting the compromised account owners for assistance?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
"login information likely acquired from other sources was tested en masse on the networks."
Acquired from other sources? Maybe from wine hq?
The Tao of math: The numbers you can count are not the real numbers.
.. would be Security Officer - Sony.
(For headscratchers - think TLA).
Well, at least Sony made a decent catch. Perhaps for the first time in ten years.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
IIRC, Sony denied anything had been compromised *last time* too. It was only days later that they admitted the scale of the attack and how successful it had been.
SJW: Someone who has run out of real oppression, and has to fake it.
...news at 4:11
"Now back to you, Bob"
You hit the Anonymous Coward.
The Anonymous Coward turns to flee!
You see here a -1 cursed Slashdot post.
You pick up x - a -1 cursed Slashdot post.
What do you want to read? (slx*?)
You feel that your are wasting your time.
The Tao of math: The numbers you can count are not the real numbers.
Yeah, hacked, again... ok SONY. Yeah sure, I believe you. Oh and you bravely fought them off and stopped them in their tracks.. oh yeah, sure SONY. I believe you. So, to instill confidence back into the blubbering idiots that were/are SONY Security, they come up with this ruse, and use it to make you think they are actually competent.
"Computers are a lot like Air Conditioners" "They both work great until you start opening Windows"
...It could be another PR stunt to make it look like they have the best security and tracking team on the planet.
I'd like to hear from one of the 93,000 people whose accounts were suspended. I'd like to know that these are actual accounts with real people.
Sounds like the attack was successful to me.
Having to work for a living is the root of all evil.
The summary states that there 93,000 login attempts and that a small number of the attempts were successful. This is false. There was an undisclosed number of attempts, and 93,000 accounts were successfully compromised. From Sony's own statement:
One for each parent, one for each kid. That way the trophies and such stay separate.
93,000 compromised accounts. If they can tell that an account was compromised vs. a legitimate use, that means there was something unique to these logins. For the sake of argument, let's just say it was a browser-agent. Let's also make some baseline assumptions:
- Let's say that the 93,000 accounts only make up 10% of the total scope of the attack. 930,000 accounts hit, or 1% of the account-base (according to Sony).
- Let's say that only 1 attempt was ever made per account (the most difficult scenario to detect).
- Let's assume that across all the accounts on these systems, 1% of the logins are fat-fingered, and 50% of the user-base logs in per day: 2% average user error.
* These assumptions are very biased in Sony's favor.
If suddenly 930,000 of your accounts (2% of daily logins) had a 90% login failure rate across the board, that would be a terrifying moment for a sysadmin.
If suddenly 930,000 of your accounts started seeing logins from a uniquely distinguishable user-agent, that's a blatant attack.
If, with a dedicated security team, it takes you 3 days to notice that this is going on, there is undeniable incompetence.
Thwarted? No. It was probably some lone sysadmin scanning through the logs that said 'hey, this user-agent sure is showing up a lot...'.
But clearly you have something better to say...