Slashdot Mirror
Sony Targeted Yet Again; Thwarts Attackers This Time
alphadogg writes with an excerpt from a Network World article: "Sony suspended 93,000 user accounts on several of its gaming and entertainment networks after unauthorized login attempts on those accounts. The attempts occurred on the PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment, and the company says that login information likely acquired from other sources was tested en masse on the networks. Only a 'small number' of the attempts were successful, and no credit card information was leaked. ... Sony Chief Information Security Officer Philip Reitinger said that 'less than one tenth of one percent' of the networks' users may have been affected."
"Sony suspended 93,000 user accounts
'less than one tenth of one percent' of the networks' users
Sony has over 93 million accounts? ... ?
As far as I know only about 50 million PS3s have been sold, some to upgraders / replacers / theft or fire insurance claims, so there's probably less than 50 million PS3 user accounts.
The other 50 million or so accounts are
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
'less than one tenth of one percent'
Which means ... how many accounts?
Are you contacting the compromised account owners for assistance?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
"login information likely acquired from other sources was tested en masse on the networks."
Acquired from other sources? Maybe from wine hq?
The Tao of math: The numbers you can count are not the real numbers.
.. would be Security Officer - Sony.
(For headscratchers - think TLA).
Could be worse. Google hired a former TV psychic as head of their Apps security.
And, no, I'm not joking.
SJW: Someone who has run out of real oppression, and has to fake it.
...news at 4:11
"Now back to you, Bob"
No, last time they kept quiet about the scale, nature, and results of the attack, while this time they've announced the scale (90,000+ users), nature (user/password attempts), and results (some accounts are compromised) of the attack. It would appear that they have learned at least a little.
No kidding!!! What do you say at this point?
Well at least he could foresee what hacks were coming and when!
Couldn't he...? Whaddyamean no?
Sounds like the attack was successful to me.
Having to work for a living is the root of all evil.
So then he's "SCISO" right? (Schizo... )
I noticed that I couldn't log in to EQ2 last night, but there was a post in the forums about SOE taking things offline for maintenance at 8PM PST (normally they do it at 7am PST). Then, I got this email in the morning:
Too bad that was anonymous.
You don't have to have "the best security and tracking team on the planet" to notice that someone's trying tens of thousands of usernames and passwords and failing. And it doesn't exactly scream competence when it turns out that user details your company failed to protect are now being actively used by fraudsters. It just compounds the original failure.
No kidding!!! What do you say at this point?
The summary states that there 93,000 login attempts and that a small number of the attempts were successful. This is false. There was an undisclosed number of attempts, and 93,000 accounts were successfully compromised. From Sony's own statement:
You don't have to have "the best security and tracking team on the planet" to notice that someone's trying tens of thousands of usernames and passwords and failing.
I didn't say that they ARE the best team. I said "PR stunt" which is targeted at the unknowing, not the most knowledgeable receiver.
And it doesn't exactly scream competence when it turns out that user details your company failed to protect are now being actively used by fraudsters. It just compounds the original failure.
I also mentioned the possibility that these users don't exist. "PR STUNT" - italicized and capped. I don't know how to make what I said more clear.
If you're one of the users of a company that releases that kind of information, and you aren't one of the "affected" people, it increases your feeling of safety and security. Simple logic, simple stunt. While they're at it, they may as well have people out on the 'net putting forth information that maintains the feelings of gravity and reality toward this situation that supposedly occurred (again, making others feel they "[weren't] the ones affected"). In fact, there was an anonymous comment in reply to mine where an anonymous commenter posted the notification they got from Sony. If it weren't an anonymous commenter, it would bear some weight. Anonymous = could be as false as the earth being the center of the universe.
I'm not saying that this IS what happened; I'm saying that it's odd that they are so publicly releasing information about it when, in fact, companies try to keep it as quiet as possible. And I'll balance your counterargument in advance - they also didn't say "we are dedicated to making people aware of the situation, and are striving to be more open than [competitors]."
If you're going to really play the game, play it through at the beginning to avoid losing customers' positive feelings.
Maybe. Except this wasn't really a hacking attempt... not even a brute-force password cracking attempt... more like an automated login script more or less. Wake me up when they catch an actual intrusion, through SQL injection or some perimeter vulnerability they may have. This here is a positive publicity stunt.
Bow before me, for I am root.
One for each parent, one for each kid. That way the trophies and such stay separate.
93,000 compromised accounts. If they can tell that an account was compromised vs. a legitimate use, that means there was something unique to these logins. For the sake of argument, let's just say it was a browser-agent. Let's also make some baseline assumptions:
- Let's say that the 93,000 accounts only make up 10% of the total scope of the attack. 930,000 accounts hit, or 1% of the account-base (according to Sony).
- Let's say that only 1 attempt was ever made per account (the most difficult scenario to detect).
- Let's assume that across all the accounts on these systems, 1% of the logins are fat-fingered, and 50% of the user-base logs in per day: 2% average user error.
* These assumptions are very biased in Sony's favor.
If suddenly 930,000 of your accounts (2% of daily logins) had a 90% login failure rate across the board, that would be a terrifying moment for a sysadmin.
If suddenly 930,000 of your accounts started seeing logins from a uniquely distinguishable user-agent, that's a blatant attack.
If, with a dedicated security team, it takes you 3 days to notice that this is going on, there is undeniable incompetence.
Thwarted? No. It was probably some lone sysadmin scanning through the logs that said 'hey, this user-agent sure is showing up a lot...'.
But clearly you have something better to say...