6 ms·

PlayStation Network being rebuilt

42 points by eswat 16y ago

jrockway 16y ago
Is this related to the geohotz thing?
- younata 16y ago
  It could be. Anonymous is stating that they have nothing to do with it, though it could be a more radical offshoot of them.[1] It could be some massive hardware problem, and they are taking advantage of the ill-will related to geohot to say that it's not their fault, even though it could be. [1] http://www.anonnews.org/?p=press&a=item&i=848 http://www.anonnews.org/?p=press&a=item&i=848
- geoffw8 16y ago
  Yes and no. Yes because they believe it was "Anonymous" who hacked the system, as a retaliation to "the geohotz thing" and no because it could very well be something entirely separate. All we know is they had an intruder, have switched off the network and are now rebuilding.
  - marshray 16y ago
    From the amount of money they certainly lose while the service is down we can infer that the intrusion looks pretty deep from their perspective.
- Natsu 16y ago
  It doesn't look like planned downtime to me, so I don't see how it could be directly related. But that doesn't mean that someone hasn't blown PSN's security wide open after figuring something out on a hacked PS3, or something like that. I get the feeling that Sony doesn't plan to tell us, either. Once again, I'm glad that I haven't bought any Sony products for ages.
- sp332 16y ago
  I've heard - though nothing more substantial than rumor, it seems like it could be true - that some pirates had modified their PS3s to sign in to PSN dev channels, and then hacked the dev channels to pirate games via direct download from PSN. Although not directly related, some of that would have been facilitated by GeoHot's publishing of the signing keys for PS3 binaries.
  - ewams 16y ago
    Source?
    - fjarlq 16y ago
      This isn't a source, but I did hear the same sort of thing mentioned here: http://news.ycombinator.com/item?id=2476931 http://news.ycombinator.com/item?id=2476931
  - 1880 16y ago
    I have seen tutorials about that method in several forums. People were adding funds to their account for free and downloading tons of paid content. That's plain stealing, and I'm happy that Sony may be fixing that.
    - JoachimSchipper 16y ago
      Would Sony really take down the whole network just to stop some pirates? Maybe the dev network has access to more juicy stuff (e.g. CC data)?
      - count 16y ago
        Given the use of a static 'random' variable, who knows what other kinds of trusts were hidden behind simple obfuscation?
- pstack 16y ago
  You mean, is Sony insinuating that it is related to geohotz? Clearly. Is it really? Who knows? It seems awfully convenient. What better way to entirely discredit an entire group of people (not just Anonymous, but anyone out there looking to jailbreak their products for their own use) and derive sympathy for yourself than to take advantage of a moment like this and claim a failure is due to nefarious people? It'd be kind of like a country bombing itself and blaming another country for doing it. Of course, this is just random unsubstantiated speculation with a heavy dose of conspiracy thrown in for the fun of it, but . . . honestly . . . it really does seem almost too perfectly convenient. :P That said, I was finally going to open my Killzone 3 and Portal 2 today, damn it. Guess I'll continue to wait . . . indefinitely. Oh, there was also a fair amount of "it's because they hosted part of PSN on AWS/EC2" going around. The timing would (almost) fit. I'm pretty sure that seems to have been discredited by now, though.
marshray 16y ago
The big concern that they didn't mention is the manner in which all the PS3s in the field seem to trust their back end. In addition, the PS3's hardware root signing keys have been leaked. Consider that 50 million PS3s sit in perfect position (behind the firewall) to execute a local-LAN man-in-the-middle attack on millions of home PC users. What would happen if Sony's compromised backend were to push down a malicious software update? Perhaps they already have. This attacker could instantly have the biggest botnet ever, by a factor of 10x. What's their next move?
- watty 16y ago
  This is a huge stretch. So all a hacker has to do is break into Sony's update servers, create a signed hacked boot loader that automatically starts a MiTM attack on home users? Wouldn't it be easier to break into Google servers and install a malicious Chrome update?
  - jsnell 16y ago
    I doubt it. Google takes security seriously and has a superb security team. Sony... doesn't exactly have a great track record when it comes to this.
  - sp332 16y ago
    There are lots of tools to make MITM easy. And it's not exactly rocket science, if you want to write one yourself. And the signing keys have already been published, right? So the only difficult part is breaking into PSN dev channel. You wouldn't necessarily have to hack the server that distributes bootloaders, maybe you could just impersonate another dev and submit a few changes to their existing app. When users are playing the "new version" of that game, your code goes to town.
  - GrandMasterBirt 16y ago
    The difference is that if a ps3 gets hacked, the hack can prevent you from removing it thus causing the need for new hardware. Opse.
  - marshray 16y ago
alecco 16y ago
Good luck finding competent security developers, Sony.
randrews 16y ago
I wrote a comment about this on Reddit and got downvoted to oblivion, don't know why, but here it is: I have a PS3. Last night I unplugged it to move it from one room to another. Most of the games I have are downloaded from PSN, and I found out today that I can't play them, even single-player. See, it apparently checks the system clock before it runs things, unplugging it reset the clock, it only trusts the clock if it was able to set it from the network, and with PSN down... So is anyone else having this problem?
ScottWhigham 16y ago
We use the PS3 for Netflix streaming and so we haven't been able to watch Netflix for a week. It always pissed me off that I had to create a Playstation Network account then log in to it just to watch Netflix.
- nuclear_eclipse 16y ago
  I've thankfully had my TiVo to use for Netflix as a backup, but the TiVo interface for it is extremely limited by comparison. No searching, recommendations, captions, or anything other than the instant queue; anything else has to be done from a PC. Oh, and the normally slow input for TiVo is even worse when using the Netflix interface... I'm tempted to buy a Roku or Apple TV just to use until PSN is back...
- vaksel 16y ago
  Netflix works for me...all you have to do is attempt to signin...then when it fails, you can watch netflix

42 points by eswat 16y ago

jrockway 16y ago

Is this related to the geohotz thing?

younata 16y ago
It could be. Anonymous is stating that they have nothing to do with it, though it could be a more radical offshoot of them.[1] It could be some massive hardware problem, and they are taking advantage of the ill-will related to geohot to say that it's not their fault, even though it could be. [1] http://www.anonnews.org/?p=press&a=item&i=848 http://www.anonnews.org/?p=press&a=item&i=848
geoffw8 16y ago
Yes and no. Yes because they believe it was "Anonymous" who hacked the system, as a retaliation to "the geohotz thing" and no because it could very well be something entirely separate. All we know is they had an intruder, have switched off the network and are now rebuilding.
- marshray 16y ago
  From the amount of money they certainly lose while the service is down we can infer that the intrusion looks pretty deep from their perspective.
Natsu 16y ago
It doesn't look like planned downtime to me, so I don't see how it could be directly related. But that doesn't mean that someone hasn't blown PSN's security wide open after figuring something out on a hacked PS3, or something like that. I get the feeling that Sony doesn't plan to tell us, either. Once again, I'm glad that I haven't bought any Sony products for ages.
sp332 16y ago
I've heard - though nothing more substantial than rumor, it seems like it could be true - that some pirates had modified their PS3s to sign in to PSN dev channels, and then hacked the dev channels to pirate games via direct download from PSN. Although not directly related, some of that would have been facilitated by GeoHot's publishing of the signing keys for PS3 binaries.
- ewams 16y ago
  Source?
  - fjarlq 16y ago
    This isn't a source, but I did hear the same sort of thing mentioned here: http://news.ycombinator.com/item?id=2476931 http://news.ycombinator.com/item?id=2476931
- 1880 16y ago
  I have seen tutorials about that method in several forums. People were adding funds to their account for free and downloading tons of paid content. That's plain stealing, and I'm happy that Sony may be fixing that.
  - JoachimSchipper 16y ago
    Would Sony really take down the whole network just to stop some pirates? Maybe the dev network has access to more juicy stuff (e.g. CC data)?
    - count 16y ago
      Given the use of a static 'random' variable, who knows what other kinds of trusts were hidden behind simple obfuscation?
pstack 16y ago
You mean, is Sony insinuating that it is related to geohotz? Clearly. Is it really? Who knows? It seems awfully convenient. What better way to entirely discredit an entire group of people (not just Anonymous, but anyone out there looking to jailbreak their products for their own use) and derive sympathy for yourself than to take advantage of a moment like this and claim a failure is due to nefarious people? It'd be kind of like a country bombing itself and blaming another country for doing it. Of course, this is just random unsubstantiated speculation with a heavy dose of conspiracy thrown in for the fun of it, but . . . honestly . . . it really does seem almost too perfectly convenient. :P That said, I was finally going to open my Killzone 3 and Portal 2 today, damn it. Guess I'll continue to wait . . . indefinitely. Oh, there was also a fair amount of "it's because they hosted part of PSN on AWS/EC2" going around. The timing would (almost) fit. I'm pretty sure that seems to have been discredited by now, though.

marshray 16y ago

The big concern that they didn't mention is the manner in which all the PS3s in the field seem to trust their back end. In addition, the PS3's hardware root signing keys have been leaked. Consider that 50 million PS3s sit in perfect position (behind the firewall) to execute a local-LAN man-in-the-middle attack on millions of home PC users. What would happen if Sony's compromised backend were to push down a malicious software update? Perhaps they already have. This attacker could instantly have the biggest botnet ever, by a factor of 10x. What's their next move?

watty 16y ago
This is a huge stretch. So all a hacker has to do is break into Sony's update servers, create a signed hacked boot loader that automatically starts a MiTM attack on home users? Wouldn't it be easier to break into Google servers and install a malicious Chrome update?
- jsnell 16y ago
  I doubt it. Google takes security seriously and has a superb security team. Sony... doesn't exactly have a great track record when it comes to this.
- sp332 16y ago
  There are lots of tools to make MITM easy. And it's not exactly rocket science, if you want to write one yourself. And the signing keys have already been published, right? So the only difficult part is breaking into PSN dev channel. You wouldn't necessarily have to hack the server that distributes bootloaders, maybe you could just impersonate another dev and submit a few changes to their existing app. When users are playing the "new version" of that game, your code goes to town.
- GrandMasterBirt 16y ago
  The difference is that if a ps3 gets hacked, the hack can prevent you from removing it thus causing the need for new hardware. Opse.
- marshray 16y ago

alecco 16y ago

Good luck finding competent security developers, Sony.

randrews 16y ago

I wrote a comment about this on Reddit and got downvoted to oblivion, don't know why, but here it is: I have a PS3. Last night I unplugged it to move it from one room to another. Most of the games I have are downloaded from PSN, and I found out today that I can't play them, even single-player. See, it apparently checks the system clock before it runs things, unplugging it reset the clock, it only trusts the clock if it was able to set it from the network, and with PSN down... So is anyone else having this problem?

ScottWhigham 16y ago

We use the PS3 for Netflix streaming and so we haven't been able to watch Netflix for a week. It always pissed me off that I had to create a Playstation Network account then log in to it just to watch Netflix.

nuclear_eclipse 16y ago
I've thankfully had my TiVo to use for Netflix as a backup, but the TiVo interface for it is extremely limited by comparison. No searching, recommendations, captions, or anything other than the instant queue; anything else has to be done from a PC. Oh, and the normally slow input for TiVo is even worse when using the Netflix interface... I'm tempted to buy a Roku or Apple TV just to use until PSN is back...
vaksel 16y ago
Netflix works for me...all you have to do is attempt to signin...then when it fails, you can watch netflix