Slashdot Mirror
'Why I Bid $700 For a Stolen PSN Account' (vice.com)
Patrick Klepek tells the story of a PlayStation Network user who had their 13-year-old account stolen via what appears to be a social engineering scheme against Sony. Klepek managed to track it down and start negotiating for its release. An anonymous Slashdot reader shares an excerpt from the report: 1,200. That's how much someone is asking for a PlayStation Network account I've been investigating for the past few weeks. "Secure," the person calls it, claiming the account will "never be touched" by the original owner again. "He won't be getting it back," they claim. More than a thousand dollars? That's a little rich for my blood, and so I counteroffer: $700. "Btc?" they respond, accepting my bid. (BTC refers to bitcoin. The majority of transactions like this take place using cryptocurrency; it's generally harder, but not impossible, to trace.) I didn't purchase the account, of course. But I could -- anyone could, if they only knew where to look. This account wasn't on a shady market because someone was clumsy with their digital security. They had a strong password and two-factor authentication. When they were notified about problems with their account, they called Sony and asked for help. Despite all this, despite proving their identity over and over, they lost access to their PSN account, including any trophies earned or any games purchased. It was gone...well, sort of. The original owner no longer had access, but this person -- the individual asking for $1,200 but who quickly and without hesitation dropped to $700 -- did.
[...]
More than likely, Sony itself is a victim of a clever social engineering scheme, in which a user, or series of users, repeatedly spammed their representatives, until it found someone willing to accept the limited information they did have, and calculated the system would eventually lock the account in their favor. Even a "failed" social engineering attempt can be a success, if the person calling comes away with new information about the account. Every company in the world can fall victim to social engineering, as there are no true fail safes. But Sony's setup seems especially ripe for it. Why didn't the system get flagged as "sensitive" sooner? Why can a user flip off two-factor authentication over the phone? How can an account get abandoned, when it's still active? There are ways Sony could have prevented this from happening. In the end, the original account owner was magically handed the account. "Sony promised that they were going to set it up so no reps could make any changes," the account owner said, "but they are still investigating how this happened."
[...]
More than likely, Sony itself is a victim of a clever social engineering scheme, in which a user, or series of users, repeatedly spammed their representatives, until it found someone willing to accept the limited information they did have, and calculated the system would eventually lock the account in their favor. Even a "failed" social engineering attempt can be a success, if the person calling comes away with new information about the account. Every company in the world can fall victim to social engineering, as there are no true fail safes. But Sony's setup seems especially ripe for it. Why didn't the system get flagged as "sensitive" sooner? Why can a user flip off two-factor authentication over the phone? How can an account get abandoned, when it's still active? There are ways Sony could have prevented this from happening. In the end, the original account owner was magically handed the account. "Sony promised that they were going to set it up so no reps could make any changes," the account owner said, "but they are still investigating how this happened."
Dear article OP, the scammer wasn't accepting your bid... he was asking if you're a moron. (He was looking for idiots to pay him in untraceable currency.)
I'm guessing the scammer "sold" the account a few dozen times.
They were hoping for an RTX 2080 Ti card but settled for less?
Don't you have to make credit card payments to PSN? And by having credit card statement, can't they just use your credit card number to confirm who owns the account? The fact that the hacker guarantees the original owner cannot get it back leads me to believe that Sony hasn't done a good enough job.
I know lots of people hate the President and it's their right... but did you have to bring him into this subject? No wonder you have to post as an anonymous COWARD.
Who are these few dozen morons? I would like to sell them shares in a bridge.
Lesson to every company with phone/chat/email support:
PAY REPS MORE, AND QUIT PUSHING FOR PERFECT PRODUCTIVITY.
If you don't pay reps enough, they will simply not care, and when you push for higher productivity, you will get better productivity, at the cost of less attention paid to what is actually going on.
I shit you not, the one time I let a social engineering thing go, it was only caught by the fraud team because of the rapid succession in which the fraudster tried to do things with it. What would have made me notice what was going on? Well not having to compete with a dozen other people at cheating KPI's by cherry picking easy support requests before others get them. Email support reps often throw back support requests that they think are too hard.
The people who do chat support, are frequently talking to 8 other customers, and thus paying attention is very hard, this is why fraud queues are often phone-only because the CSR can only deal with one at a time. But they are still under pressure to keep the call short, and thus many verification steps, and notes on accounts are ignored because that is the first time they deal with the customer. If each representative was responsible for the same customers, then this would stop happening, because reps would recognize their own notes, and thus are responsible for their own fuckups.
Usually any extra security you add is going to hurt legitimate people who forgot their password/login. These people out number the crooks and a large army of them will be very upset if they can't reset their account with minimal effort. It's a balancing act for customer support but better to lose one account and restore 100 users who have are having trouble. Those support calls cost a lot and there is limited profit potential from them. Don't expect this problem to be fixed or even improve anytime soon.
How the hell is thIs news for slashdot front page??? Whatâ(TM)s next ??? Tips to catch more Pokémon go ???
BTC leaves an unbreakable cryptographic record of every transaction that has ever been made. There are some ways to make it more difficult to trace, but they require a fair amount of work unless you never want to convert it back to fiat.
Inside job.
https://www.newyorker.com/magazine/2018/10/15/was-there-a-connection-between-a-russian-bank-and-the-trump-campaign
Why would someone want another persons PSN account?
I shit on Sony. I throw flaming bags of human excrement at their headquarters. I give their CEO a yellow shower. DRM on audio CDs?
How would you feel if someone stole your childhood?
Anonymous Cowards are merely to prove why unregulated speech is a completely bad idea, you should ignore everything they say.
No right minded person would pay 1200$ for an account, that is eqvivally dumb to paying 150k$ for a cryptokitty.
I don't like stories about evil haxors like this because they are lies. The guy probably wanted 12$ for that account but only dumb people would buy a stolen account, it s against the TOS, even if the owner does not get it back it can be blocked then you throw your money into the dumpster, why bother instead of getting a legit one and leveling your characters up on your own.
So he did not pay 1200USD and he then also did not pay 700USD for an account that might or might nit be his. Why not lower the price to10 cents?
I once did not oay for stolen goods
This is loke running after a bus to save money, which is stupid. Better run after a taxi and save more.
Oh and I once offered 50 fEUR or a new car radio. All I had to do was pay upfront and they would get it.
Don't fight for your country, if your country does not fight for you.
Marking individual accounts as 'likely to be attempted to be hijacked' doesn't fix the broader problem, which is hardly exclusive to Sony. Surely security doesn't need to fly out the window when you call a helpdesk? Attackers being able to obtain bits of info about an account could be stopped by these interactions being handled by a chatbot, and programmed to not give up that info.
So long as 'I forgot my password' or 'my 2FA got lost/broken' can work on administrators, then those security features can be bypassed. As phone scams have proven, people are really bad at detecting scams when talking over the phone. Sending notifications to the account and to all the on-file contact methods for the account e.g. "click here if you don't want your password reset, you have 24 hours" is imperfect, if you happen to not log in or check messages, such as if you're out of town or you just don't use the account often. Not sure what the solution to this is, aside from some perfect unduplicatable identity verification.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Sony have deprived him of goods (ie games) that he has paid for. Sony was scammed, but that is not the user's problem, he seems able to demonstrate that the scam was not caused by something that he did wrong. In the UK he could take them to the small claims court - which is quick and easy. Yes: Sony's lawyers would get involved but they would need to convince a judge that they are not liable.
To be doing decent reporting on something interesting again, instead of "101 ways I can self-flagellate for being a toxic white male" and other such extreme social justice bullshit that Vice.com (and other Waypoint staff) will routinely harp on about.
He's a smart kid and now and then produces some great stuff, but man oh man can be he a total knob in regards to the endless virtue signal bullshit, instead of focusing on games. Gotta think of dem politics!
Imagine what prison can do for your laughing asshole, Trump Jr.
They often ask the potential buyer for their sony account info and use that to steal another account.
Patrick Klepek tells the story of a PlayStation Network user who had their 13-year-old account stolen
HIS, not their. Too much social justice, not enough grammar
She's been investigated by corrupt republicans for over 35 years trying to force fake charges to stick without so much as a single charge being filed against her.
He's been fined 3x for money laundering for the Russian Mafia since 2005. He was also fined in 2006 for money laundering for the bank of Iran, who used that money to fund ISIS.
Doesn't quite seem on the same level.
As true as that may be, I still fear a world where all speach is censored much more. We just need a /. Option to make AC posts not visible, and make it the default setting.
They post AC for basically 1 of 2 reasons.
1) they are using a mobile device and hate logging in practically every time they click a link from a response notification
2) they lack the spine to stand by whatever hatefull, moronic, outlandish, or downright retarded bullshit they drivel.
#1 is a technological issue and could be fixed with development of better tools.
#2 just needs to be fixed with some chlorine dispersed in their gene pool.
3# They've been contributing for over a decade anonymously. I've been here for 16 years and never created an account. I've had AC posts rated up to +5 for Insightful, Informative and Funny. It's not cowardice, I just want my posts to be interpreted free of assumptions about me caused by reading my posting history.
Reading between the lines and guessing from writing style, there's a lot of people doing similar.
Also, ACs don't get bot spam replying to every post they create, unlike people who piss off APK, the GNAA guy or the Russian troll that hates C Reimer.
It'll be interesting to see what happens as a bridge is built between PSN and Xbox Live and Switch's online services
It took way too long to get it back, but suffice it to say, for a service whose TOS claims you can't trade or sell accounts, they seemed happy to ignore the fact that the password, e-mail and language changed, and the users IP moved to Russia. I'd think a simple check on that would be enough to say "You are right, here's your account back, set it up for 2-factor and never screw up again"
Instead, we had to go back and forth, feeding them product keys used in the account in a back-and-forth that had a 24 hour+ turnaround time (their side) and took a couple of weeks. Meanwhile, some punk in Russia had bought my son's account (worth well over $3000 at the time), and probably was out a couple hundred bucks when we got it back.
We already are "delt with". Started a few months ago when Slashdot added member posts start at +1, that wasn't enough though so they added +2 for some (maybe based on UID?).
AND you still don't see 99% of the content on Slashdot unless you
1) set BOTH sliders to the _right_ of 0 (missleading since it appears to be -1 when infact it's setting 0)
2) Click "Check for new commennts"
You won't see most posts otherwise and even that is assuming the content wasn't removed entirely / shadowbanned. It's not just "APK" who get banned / comments removed either. SystemD, SSL, pro Trump/Republican, etc all targeted depending on the time of day. Like anon #57455180, I only post AC and for the same reasons. People make mistakes, you either take what I say at face value or not. I'm not in it for karma though it would be nice if Slashdot had some kind of tripcode at least.
She has never been charged, true. But many of her business associates have been, and convicted. Her husband gave them pardons as well. She surrounds herself with criminals, pardons them, but no, no, no. She herself has never done anything. /sarcasm
Each PS has a unique serial number. Require that for any account changes; and ty the account to the serial number to keep it working. They could also add a second number to the box to allow for getting a replacement PS if the original one dies. If it gets stolen, send a copy of the police report. Not perfect, but it adds a layer of complexity to stealing an account while keeping the information needed to legitimately do so available.
I'm a consultant - I convert gibberish into cash-flow.
What does the thief gain from this? I get it if the article mentioned the PSN account was unique, like a two letter username, or a year, or something someone else wanted. But he stole it and used it?
A friend of mine completely illiterate in tech had a godaddy website. She lost the password. They asked her all the secret questions, she got them wrong. Then they asked her what the CC was on the account. She did not know. They still gave her a new password. I'd like to see a "too bad" response when you can't prove yourself, but it is not going to happen. There are too many like my friend. I use encryption on my disks and I know if I forget the password, then the disk data is just gone. No hail Marys.
We already are "delt with". Started a few months ago when Slashdot added member posts start at +1
It's been that way for as long as I remember, and I've been here well over 10 years.
that wasn't enough though so they added +2 for some (maybe based on UID?).
It's based on "karma", which is having a large number of posts moderated up. In other words, once you've shown that you can make a positive contribution to discussions, you get an extra +1 bonus.
Based on Karma you fucking moron.
Fuck off and die.
I can think of nothing sadder and more pathetic than someone so wrapped up in their gaming that they are willing to pay money to get an account back.
Turn off the computer or console, and fucking go outside.
#3 Some opinions may trigger some extremely thin-skinned people and people don't want to run the unnecessary risk of getting doxxed, SWATed, or stalked.
Any every single person who worked on trumps campaign has been investigated with several putting in plea deals, and over 80% being charged.
Also, trump was still the only one out of the two to be fined for laundering money for criminals (a criminal act in and of itself)
Trump was also the only president in US history to commit treason.
Whew. Glad he got his digital trophy thing-a-ma-jigs back. Don't know what I do if I lost mine. Wait. Yes, I do. I have no idea what that fucking is. Money well spent.
A PS4 came out like 4 years ago.
Pay, no, but.. it would cost several thousand pounds to re-acquire the games in my Steam library. You can bet there'll be action if I lose access to it.
> But Sony's setup seems especially ripe for it.
Rife. Rife means abundant. Ripe means fully mature.
Yeah, hiding anonymous cowards from general view has been one of the best decisions /. ever made. If you have someone to say, but can't or won't show your face, it better be so fucking good that it gets modded up a bunch.
ZIP
P.S. => I'll be modding most of this thread down for being totally off-topic. You dipshit