15 ms·
Why I Bid $700 for a Stolen PSN Account
- s73v3r_ 8y ago"When Justin finally heard back from Sony, they didn’t apologize and promise to protect the account. Instead, they said it—an account Justin has had for more than 13 years, with a history of trophies and purchases—was gone. There was nothing he could do, no process to appeal, no way to get any of his games back." That, should be considered completely unacceptable, especially from a company that has had huge data breaches in the past. Sony should be bending over backwards to make this guy whole, not giving up.
- HarryHirsch 8y agoWithout incentives, why would Sony do anything for anyone?
- platinumrad 8y agoSony's reputation should be incentive enough.
- northwest65 8y agoThey are a disgusting gutter company who cares naught for their reputation. I haven't knowingly purchased any Sony products (music, movies, games, hardware) since their behavior around 2005.
- Shaddox 8y agoThat was around the infamous rootkit scandal, right? They also have some very annoying practices for their hardware. I borrowed a Sony digital camera from a relative for a roadtrip and the memory card broke down. To my dismay I realized I can't just put any old memory card in it, I have to put in a Sony one which costs 10x as much for 0 benefit. Since then I also stopped buying any Sony products. I think they're just too big and too diversified to fail at this point. They don't have to care about their reputation at this point, the money just won't stop coming since they're so pervasive.
- azernik 8y agoWhich it apparently was - once they realized a reporter was writing a story on it, they fixed the issue right quick.
- jonny_eh 8y agoCompetition?
- rm_-rf_slash 8y agoI’m surprised he didn’t sue. ONE WEIRD TRICK - dirtbag companies HATE this - my mom (former lawyer) taught me to get any company dragging its heels or otherwise being scummy about giving you what you paid for is to basically state what you want followed by “...and if I do not get the product/service that I paid your company for, my next call will be to the State Attorneys General of the state of (where we’re from) and the state where you are incorporated, and we will be filing a claim of fraudulent business practices.” 9 times out of 10 that’ll be enough to get the gears moving. Legal compliance is almost always more expensive than fighting a customer on an issue, so they tend to give in rather quickly.
- giancarlostoro 8y agoI've also heard equally worthwhile efforts when contacting a company through BBB (Better Business Bureau) has gone as far as getting people's accounts unbanned where the account was meant to stay permanently banned from an MMO. Get legal through the right channels and you will see results. You want to get a hold of BBB directly basically, I havent had the pleasure of doing it but have heard from many that it works.
- rashkov 8y agoWhile this may work, as far as I know, BBB is a private company with no enforcement muscle, providing a service similar to Yelp, but less respected.
- duxup 8y agoBBB is it's own pay to play scam. People who join magicly have poor scores removed.
- lotsofpulp 8y agoOnly clueless business owners care about BBB. Not only is BBB a scam itself, but no one cares what they think anyway.
- rustcharm 8y agoThis is not good advice. Once you threaten to sue, most Big Companies will stop talking to you via customer support channels and make you do everything in writing to their legal department. Don't do this.
- deleted 8y ago[deleted]
- mxfh 8y agoThe obvious solution would be to transfer the account to a different username, that has no attraction for the scammers, but even that is still virtually impossible. If you ever thought Microsoft is an incoherent mess, Sony is even more so, just without any clue when it comes to modern software, UX or security concepts. The PSN experience it pretty much the state of ten years ago with security features tacked on to fix the hacks, but little more.
- jonny_eh 8y agoPSN notoriously doesn't support changing usernames, at all. It's been their #1 most requested feature for over a decade.
- cyberpunk0 8y agoGood.
- rococode 8y agoRumors are that they've asked game devs to prepare for name changes, so it should be possible in the nearish future! https://kotaku.com/game-developers-say-theyre-preparing-for-psn-name-chang-1829521254 https://kotaku.com/game-developers-say-theyre-preparing-for-...
- Aissen 8y agoIt's coming https://blog.us.playstation.com/2018/10/10/psn-online-id-change-feature-entering-playstation-preview-program-soon/ https://blog.us.playstation.com/2018/10/10/psn-online-id-cha... Edit : it might also be a great way to "hide" an account once it's been acquired. Just pay $5 to rename it once you've removed all the friends.
- jonny_eh 8y ago> please note not all games and applications for PS4, PS3 and PS Vita systems are guaranteed to support the online ID change, and users may occasionally encounter issues or errors in certain games. I can't say I'm not surprised. What a mess.
- gmjoe 8y agoOnline accounts (even free ones) increasingly seem like they should be viewed as property, that stealing an account like this should be considered theft, and that a company administering accounts (Sony in this case) should be held to a standard of due process. I wonder if this is something there's been any pressure on legislation for, and I also wonder if it's something tech companies would fight against.
- WorldMaker 8y agoI think digital asset law is a hugely under-explored issue. I think one of the biggest fights that currently is hugely emblematic of the overall problem and going to surprise a lot of people in the near-ish future: inheritance. Can you inherit your parents accounts if they pass? Could you play their PSN games and watch their Movies Anywhere movies? Right now there's no protection for that. None of the major digital services directly support transferal of licenses and most of them directly forbid it in their terms of services. GDPR got some pressure from some of the EU members to explore the issue and GDPR itself wound up punting the ball back to individual countries for now rather than wade into digital asset protections/inheritance.
- CobrastanJorji 8y agoIt'd be lovely to see a return of the first sale doctrine, as well. We gave up the right to own a movie when we went to streaming. I want to be able to sell my stuff again. More importantly, I want Netflix to be able to offer streaming of everything they have the DVDs for.
- tobyhinloopen 8y agoThis is why I buy disks
- jonny_eh 8y agoA lot of games are download only, not to mention DLC (Downloadable Content, aka expansions).
- NegativeLatency 8y agoIf you have enough patience you can usually just wait for an edition to come out with all the dlc bundled. (if the game is suitably popular)
- sodosopa 8y agoDo they come with a time machine?
- PascLeRasc 8y agoNot to be that guy, but it's disc when you're referring to optical media [1]. Unless you're trying to say that you're fed up with an awful digital ecosystem and you just buy physical disks like Frisbees and vinyl ;) [1] https://en.wikipedia.org/wiki/Spelling_of_disc https://en.wikipedia.org/wiki/Spelling_of_disc
- diffeomorphism 8y agoBuying discs is fine, but you still need a license/key. That license then often needs to be activated online or tied to an account and... no benefit to having discs at all.
- ade2 8y agoConsole game discs do not require a license key, the disc itself is the key. Apart from not having to fear losing your account and thus the game, you also get the added benefit of being able to sell or trade the game.
- wtracy 8y ago
- hiei 8y agoBeyond a library of games and maybe credit car details are there other incentives to sellers/buyers for stealing these accounts?
- bballlova99 8y agoI'm assuming the PSN name was something short or of value. Something like "Justin" would get a lot of bidders.
- ObsoleteNerd 8y agoIt's mostly about the library. Many long-term Playstation users have large libraries of expensive games tied to it, so people buy stolen accounts so they can play all the games on them without buying all the games themselves. Game-hackers also buy the accounts so they can get around being banned from online games, but considering the price mentioned this sounds more like a big game library account.
- brian_herman__ 8y agoSo he did it only to write an article about it?
- deleted 8y ago[deleted]
- alexkavon 8y agoHe wrote the article to validate his decisions, he sought validation to ease his bidding convictions, he uneasily bid on a psn account to gain what he’d lost, he lost what he had gained because he swallowed a fly. I don’t know why he swallowed a fly, perhaps he’ll die.
- daveFNbuck 8y agoHe did it as part of the effort that resulted in Justin getting his account back.
- Izmaki 8y agoI got about half way through when I realised I had read the same piece of information twice already. A shame, because I lost interest somewhere around that point. Too bad for Justin. I hope he gets it resolved.
- haser_au 8y ago[Spoiler] He got his account back, and a specific phone number he can call if he has problems again.
- deleted 8y ago[deleted]
- SmellyGeekBoy 8y agoShame everyone doesn't get this benefit. It's strange how being covered on all of the big gaming news sites suddenly makes "technically impossible" things (like reinstating access to an account) possible again.
- tjbrennan 8y agoI recently lost access to my two factor authenticator. I had saved most but not all of my recovery codes. I was surprised that a couple of websites I didn't have recovery codes for allowed me to disable 2FA after login but before authentication. It saved me from having to contact support, but it seemed to defeat the purpose of 2FA.
- Thriptic 8y agoThis happened to me as well with Uber. They use SMS 2FA and didn't provide any backups. I left my phone in an Uber and I couldn't log into my account to notify the driver because 2FA was in place. I also couldn't contact Uber about the issue because they try as hard as possible not to provide customer service mechanisms for people to leverage. At the end of the day I had to use another friend's Uber account to contact Uber and explain the situation. They disabled 2FA and let me back into my account. I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :(
- reymus 8y ago>I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :( For that, I assume they would need to have tools built for that specific purpose, with security/audit in place. I doubt any support guy could just randomly query for GPS data for drivers/users.
- SmellyGeekBoy 8y ago> I doubt any support guy could just randomly query for GPS data for drivers/users. There was a very widely publicised case a few years back when their support people were doing just this to stalk celebrities and exes. How quickly the world moves on, I guess.
- achompas 8y agoThis was not my recent experience with Uber's 2FA at all. I had purchased a new phone, but lost cellular service and couldn't authenticate into Uber. I found contact info and they asked me to verify my recent ride history (including fares, times, and destinations) before disabling 2FA for me.
- dahdum 8y agoCould he sue Sony in small claims court for the value of all the games he had in his account? Seems like they are unlikely to show up.
- wtracy 8y agoI'm curious too. There may be a binding arbitration clause in the EULA that allows them to overturn any decision made by the court.
- albertgoeswoof 8y agoThat wouldn’t be enforceable, the user won’t have even read it.
- hawkesnest 8y agoHe got his account back, with a few purchases from the attacker.
- deleted 8y ago[deleted]
- ojosilva 8y agoWhy switching an account to Japanese make it harder for the owner to get it back?
- azernik 8y agoMy guess? It moves the responsibility for the account to a different bureaucracy (international vs. domestic).
- tyingq 8y agoI found the forum that the article was talking about, and the how-to article. Using the Google cache, since they've altered the forum to make you register to see content: https://webcache.googleusercontent.com/search?q=cache:nVHhLB6UJykJ:https://ogusers.com/Thread-How-To-Secure-a-PSN+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:nVHhLB... Sounds like the suggestion is to first change the email from the original owner's to yours. Then, sign up the original owner's email as a Japanese account.
- callahad 8y agoI had similar happen with my XBox Live account seven years ago: the attacker bought $125 in Microsoft Points using the associated credit card and then immediately transferred the account to Russia under a new email address. At the time, Microsoft's customer service told me it was impossible for them to return accounts that had been moved internationally. They claimed that they literally didn't have the technical ability to do so, but that they'd file a ticket with engineering. I figured the account was gone. To my great surprise, three months later I got CC'd on an email from an engineer closing the ticket, followed by an email from Microsoft customer support with temporary account credentials to reclaim the username. And... that was that. No further follow-up, just "we fixed the system, and now we can transfer your account back to you."
- Kaveren 8y agoGreat article. This problem goes far beyond PSN though. The sheer amount of account recovery processes companies offer that are poorly designed is astounding. In particular, SMS has been a notoriously strong attack vector for _years_, and companies played catch-up very slowly. Maybe it's still offered because phones in the developing world don't have much space for Google Authenticator or something, but that's a stretch.
- inopinatus 8y agoSpeaking as a company that deals with frequent account resets I’ll add that account holders routinely confuse the issue with poorly/inaccurately specified identities, duplicate accounts, and obsolete contact details. We do our best to apply strict and fair rules, but some cases still get evaluated on a balance of merits and history. I can also safely say that customers who struggle to enter their date of birth consistently see 2FA schemes as an insurmountable barrier. These are 1% issues but the volume grows linearly with user base, unlike other support issues which we can automate away or use the ecosystem to assist. I haven’t yet found a way to deal with these cases that scales any better, and I just know it’s going to be a marginal cost issue later. (I don’t think any of this applies to the case in this article, no sympathy for Sony’s dismal support)
- RIMR 8y agoJust an FYI: The enterprise MSP password management service "Passportal" allows you to disable MFA over the phone with zero authentication.
- hkmurakami 8y agoReminds me of the time my friend lost his single character Twitter account due to Godaddy social engineering. https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- jlawson 8y agoWow. That sounds like something he could sue PayPal for. $50,000...
- rand_r 8y agoLooks like he got the @n handle back! Do you know what happened?
- hkmurakami 8y agoIirc he contacted friends at TWTR.
- danso 8y agoA surprisingly convoluted story, but no much the fault of the author as the lack of transparency by Sony. Most stories of account compromise have an obvious cause, such as SIM cloning. This story makes it sound like Sony’s system has many possible attack vectors via social engineering. And given Sony’s history of catastrophic breaches, it’s really hard to imagine the fault is on the user here.
- Rotdhizon 8y agoAs someone with intimate knowledge of console account buying and selling, I can elaborate some. The main site used for buying stolen/jacked accounts is called ogusers. The screenshots in that article are of ogusers, I recognize the layout. Most of the people who buy and sell accounts do it for profit and fame. Something among teens these days really drives them to want to be internet famous. Having a 1, 2, or 3 character account name garners attention to these people. 1 letter xbox accounts go for 10-20k. 1 letter social media accounts (twitter and IG mostly) go for anywhere from 10k upwards to 75k. A good amount of the 1 letter accounts on these platforms are bought or stolen, very few original creators own the accounts. The problem is that people aren't content with getting an account by being the creator of the name. They want accounts by any means necessary. Some of these people do this for a living, they've devised their own secret techniques for gaming the system to get account information so they can game password resets and account retrievals. I know for PSN there is a tightly guarded way to pull the email account and name information from any account. For the most sought after accounts, attackers play the customer support reps like a fiddle. Say the right words and they will happily hand over sensitive information. Even if you buy an account, there's no telling if you get to keep it. Microsoft has been really trying to crack down on this, and has banned hundreds of original accounts over this. I'm not how PSN handles it. IG has been trying to crack down as well. It is a sad state of affairs. Owning an original account isn't about creating it anymore, it's about how much you will spend to buy that name or who you know that can jack the account. Unfortunately, all these platforms are not setup to handle theft, fraud, and selling. If you lose an account, it is next to impossible in most cases to get it back. In some cases you can get the account back by providing sensitive account info that only the original owner would know. However, the modern process of 'locking down' a stolen account includes flooding it with fake information to push back the original information past the point of being able to be used.
- ivm 8y agoIt's not a "teens these days" thing though, short ICQ numbers were constantly hacked and resold fifteen years ago.
- TheGrumpyBrit 8y ago
- wtracy 8y agoI find it strange what services attract hacking attempts. If anyone has attempted to break into my bank accounts or my Google account, I never noticed. (My Gmail account is used for TFA for most of my other accounts, so I would expect it to be a target.) You know what accounts I have had attacked? There have been dozens and dozens of attempts to access my Steam account by someone who figured out my password, but didn't have access to my email to receive a confirmation code. (Mostly, but not always, from Chinese IP addresses.) Someone else successfully compromised my OkCupid account and apparently used it to advertise escort services. Apparently someone else got into my Snapchat account and sent spam to all my contacts. Go figure.
- bspammer 8y agoIt may be that hacking those kind of services is very unlikely to cause any sort of legal response. As soon as you start going after bank accounts, you risk the government kicking down your door.
- venantius 8y agoSomeone tries to take over my Google account at least once a quarter. They haven't succeeded yet, but woof - it would really, really suck if they did.
- nstart 8y agoOff topic, but hot dang. That was some excellent story telling. Didn't feel the urge to skim a single word.
- askmike 8y ago> it took far too long for Sony to add two-factor authentication to PSN, despite the service’s massive hack in 2011. Microsoft added two-factor to Xbox Live in 2013. It didn’t hit PSN until 2016, five years after the personal details of 77 million users were potentially exposed to hackers. Enabling 2FA isn't go to stop hackers from accessing user data if the hackers hack Sony (what happened before). I fail to see the connection between 2FA and Sony being breached.
- fragmede 8y agoIt's rather simplistic to think there's only one level of access inside Sony. At least in, or especially because of, the hacking of PSN, any sane company isn't going to give the account reps the same access as even random engineers, who, at a company the size of Sony, should get sanitized databases to develop against.
- Illniyar 8y agoOnce there is a massive hack, usernames, emails and passwords that were used before become compromised. That means that 2FA becomes more vital - as it not only provides a new factor for authentication, it provides the only one that isn't compromised.
- askmike 8y agoThat's a good point, though after a hack they would ask everyone to reset their password anyway - but these people are probably using the same e-mail/password on other services.
- _mrmnmly 8y agoThe first question I had while reading this - can't Sony check the localization or something like console ID that the account is logging into? I can't believe stealing these accounts is so un-revertable! :|
- StavrosK 8y agoIn my previous job, which was security-related, we had to deal with people forgetting their 2FA credentials (and many, many people forgot their credentials, even staff members). The way we did it was thus: If you had enabled 2FA, it could be disabled/reset by calling support and adequately proving you were the owner of the account. This had to be this way, because, as I said, everyone forgot their 2FA credentials ("my phone fell in the sea and the backup codes were on it"). We also had another checkbox that said "Never, under any circumstances, reset my account. I have stored my backup codes somewhere secure that is not my phone. I understand that, if I lose access, I lose the account." If the user checked that, then the password/2FA reset system for the admins got disabled for their account. If they lost their 2FA, nobody short of DBAs could reset their account (and DBAs knew not to). Additionally, we had a screen where you could print a long, random, one-use key that would reset your account. It would come with a nice QR code so you could physically print it on a piece of paper and store it somewhere, and scan it if you ever forgot your 2FA/password, and it would let you access your account. I should probably write an article about this...
- giancarlostoro 8y agoYeah I hate when sites force one approach or the other, having the option to permanently lock yourself out seems the best, if I don't want to be permanently locked out, let me fallback to a SMS text.
- ClassyJacket 8y agoSMS is an absolutely unacceptable system to require for authentication. I just went overseas and got locked out of half the apps on my phone. Some of them permanently. Tinder now bans your account for life if you ever change phone numbers. I suppose if it's just one option then it's okay.
- giancarlostoro 8y agoI think if you arent willing to fully lock yourself out if you lose your backup code, it should be a fallback that you can get a text, otherwise rely on a 2-factor app. Key would be that nobody in support should have any access to change your 2 factor number or disable 2 factor. Now if you lock down your account to just your backup code, no SMS, no take backsies.
- Illniyar 8y agoLots of comments here detail how many people lose their phones and never kept recovery codes or lost some of their recovery codes. 2FA sms don't have that problem. If you lose your phone, you can usually get a sim card with the same phone number again. I think people who insist that 2FA sms is insecure because the telecom networks can be hacked/intercepted are ignoring the convenience of it for the vast majority of people especially considering the effort and skill required to hack the telecom network compared to just socially engineering a company.
- venantius 8y agoGiven the diligence with which the attacker worked on Sony via social engineering to gain access to the account, what on earth makes you think the same technique wouldn't work just as well for a telecom company? You don't need to "hack" the network, just the customer service rep. Just say you lost your phone :)
- Illniyar 8y agoThe telecom company has identifying information about you that hackers are unlikely to be able to fake - such as an home address to where they send your new sim card, or physical locations where it's much harder to work these kind of social engineering. The telecom company also have more regulation and the stakes are higher for letting someone basically steal your number - it usually means they have a much stricter protocol to giving someone a new sim card - they'll require a physical presence, they can actually call your phone to verify you aren't a fake, they'll require confirmation of card ownership or an ID for states/countries that have them.
- venantius 8y agoI am going to refer to this thread, which shows exactly how easy it is and how difficult it is to defend yourself against: https://news.ycombinator.com/item?id=18194701 https://news.ycombinator.com/item?id=18194701
- 8y ago
- mdni007 8y agoThere is no hacker. Justin's been doing it to himself. He has dissociative identity disorder
- mschuster91 8y agoI wonder whether it would make sense to force companies by law to provide proper support, given how much actual money (I know quite a number of people with four-digit-worth Steam accounts) is bound in such accounts, or how central these accounts can be for our modern lives (imagine all the identities tied to your gmail or fb or twitter accounts - and permanently losing them due to trolls "reporting" your accounts). As for bypassing 2FA: there is, at least in Germany, a way for any online company to have the real identity of the user proven. It's called "PostIdent" and works by having you go with your ID card to a post office where it is checked. It's acceptable enough even for the strict regulatory frameworks for banks. So the process could work like "okay, you are John Doe, and you want to re-establish control over your account with the ID 123456 by changing the primary email to john.doe@provider.com? Print out this voucher, pass PostIdent and we will modify your account".