Slashdot Mirror
'Why I Bid $700 For a Stolen PSN Account' (vice.com)
Patrick Klepek tells the story of a PlayStation Network user who had their 13-year-old account stolen via what appears to be a social engineering scheme against Sony. Klepek managed to track it down and start negotiating for its release. An anonymous Slashdot reader shares an excerpt from the report: 1,200. That's how much someone is asking for a PlayStation Network account I've been investigating for the past few weeks. "Secure," the person calls it, claiming the account will "never be touched" by the original owner again. "He won't be getting it back," they claim. More than a thousand dollars? That's a little rich for my blood, and so I counteroffer: $700. "Btc?" they respond, accepting my bid. (BTC refers to bitcoin. The majority of transactions like this take place using cryptocurrency; it's generally harder, but not impossible, to trace.) I didn't purchase the account, of course. But I could -- anyone could, if they only knew where to look. This account wasn't on a shady market because someone was clumsy with their digital security. They had a strong password and two-factor authentication. When they were notified about problems with their account, they called Sony and asked for help. Despite all this, despite proving their identity over and over, they lost access to their PSN account, including any trophies earned or any games purchased. It was gone...well, sort of. The original owner no longer had access, but this person -- the individual asking for $1,200 but who quickly and without hesitation dropped to $700 -- did.
[...]
More than likely, Sony itself is a victim of a clever social engineering scheme, in which a user, or series of users, repeatedly spammed their representatives, until it found someone willing to accept the limited information they did have, and calculated the system would eventually lock the account in their favor. Even a "failed" social engineering attempt can be a success, if the person calling comes away with new information about the account. Every company in the world can fall victim to social engineering, as there are no true fail safes. But Sony's setup seems especially ripe for it. Why didn't the system get flagged as "sensitive" sooner? Why can a user flip off two-factor authentication over the phone? How can an account get abandoned, when it's still active? There are ways Sony could have prevented this from happening. In the end, the original account owner was magically handed the account. "Sony promised that they were going to set it up so no reps could make any changes," the account owner said, "but they are still investigating how this happened."
[...]
More than likely, Sony itself is a victim of a clever social engineering scheme, in which a user, or series of users, repeatedly spammed their representatives, until it found someone willing to accept the limited information they did have, and calculated the system would eventually lock the account in their favor. Even a "failed" social engineering attempt can be a success, if the person calling comes away with new information about the account. Every company in the world can fall victim to social engineering, as there are no true fail safes. But Sony's setup seems especially ripe for it. Why didn't the system get flagged as "sensitive" sooner? Why can a user flip off two-factor authentication over the phone? How can an account get abandoned, when it's still active? There are ways Sony could have prevented this from happening. In the end, the original account owner was magically handed the account. "Sony promised that they were going to set it up so no reps could make any changes," the account owner said, "but they are still investigating how this happened."
Don't you have to make credit card payments to PSN? And by having credit card statement, can't they just use your credit card number to confirm who owns the account? The fact that the hacker guarantees the original owner cannot get it back leads me to believe that Sony hasn't done a good enough job.
Usually any extra security you add is going to hurt legitimate people who forgot their password/login. These people out number the crooks and a large army of them will be very upset if they can't reset their account with minimal effort. It's a balancing act for customer support but better to lose one account and restore 100 users who have are having trouble. Those support calls cost a lot and there is limited profit potential from them. Don't expect this problem to be fixed or even improve anytime soon.
Marking individual accounts as 'likely to be attempted to be hijacked' doesn't fix the broader problem, which is hardly exclusive to Sony. Surely security doesn't need to fly out the window when you call a helpdesk? Attackers being able to obtain bits of info about an account could be stopped by these interactions being handled by a chatbot, and programmed to not give up that info.
So long as 'I forgot my password' or 'my 2FA got lost/broken' can work on administrators, then those security features can be bypassed. As phone scams have proven, people are really bad at detecting scams when talking over the phone. Sending notifications to the account and to all the on-file contact methods for the account e.g. "click here if you don't want your password reset, you have 24 hours" is imperfect, if you happen to not log in or check messages, such as if you're out of town or you just don't use the account often. Not sure what the solution to this is, aside from some perfect unduplicatable identity verification.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Sony have deprived him of goods (ie games) that he has paid for. Sony was scammed, but that is not the user's problem, he seems able to demonstrate that the scam was not caused by something that he did wrong. In the UK he could take them to the small claims court - which is quick and easy. Yes: Sony's lawyers would get involved but they would need to convince a judge that they are not liable.
She's been investigated by corrupt republicans for over 35 years trying to force fake charges to stick without so much as a single charge being filed against her.
He's been fined 3x for money laundering for the Russian Mafia since 2005. He was also fined in 2006 for money laundering for the bank of Iran, who used that money to fund ISIS.
Doesn't quite seem on the same level.
3# They've been contributing for over a decade anonymously. I've been here for 16 years and never created an account. I've had AC posts rated up to +5 for Insightful, Informative and Funny. It's not cowardice, I just want my posts to be interpreted free of assumptions about me caused by reading my posting history.
Reading between the lines and guessing from writing style, there's a lot of people doing similar.
Also, ACs don't get bot spam replying to every post they create, unlike people who piss off APK, the GNAA guy or the Russian troll that hates C Reimer.
It took way too long to get it back, but suffice it to say, for a service whose TOS claims you can't trade or sell accounts, they seemed happy to ignore the fact that the password, e-mail and language changed, and the users IP moved to Russia. I'd think a simple check on that would be enough to say "You are right, here's your account back, set it up for 2-factor and never screw up again"
Instead, we had to go back and forth, feeding them product keys used in the account in a back-and-forth that had a 24 hour+ turnaround time (their side) and took a couple of weeks. Meanwhile, some punk in Russia had bought my son's account (worth well over $3000 at the time), and probably was out a couple hundred bucks when we got it back.