4 ms·

I don't understand the whole botnet fluff. Hackers would first have to create a custom signed image that runs a MiTM attack. Next, they would need to magicall

by watty 16y ago

I don't understand the whole botnet fluff. Hackers would first have to create a custom signed image that runs a MiTM attack. Next, they would need to magically break into the Sony update servers and pull a switcheroo without anyone noticing. Wouldn't it be easier to "simply" break into the Microsoft/Google/Apple/etc. update servers and slip in a fake update?

Unseelie 16y ago
Arguably, there's utility in the fact that the ps3s are all the same hardware, and need only one patch. Of course, the Xbox is also, but the point made in the article was that the PS3 botnet would be quite a lot stronger than a 360 botnet. Hacking microsoft/google/apple/etc would lead to having to use software on a botnet comprised of a wide range of hardware... So on what applications does that tradeoff of utility against the difficulty of hacking Sony make sense?
- Retric 16y ago
  The PS3 may be slightly more powerful than the Xbox 360, but what is important is the number of them connected to the internet which seems to be much higher in the Xbox camp.
- watty 16y ago
  Maybe a PS3 botnet would be more powerful, but does it matter? The article itself pointed out two problems (MiTM and DDOS) which would be equally efficient on PS3 or 360. Forget Xbox 360 altogether, if we can break into an update server wouldn't Windows Update be the better target? 350M Windows 7 licenses alone, talk about a botnet. Having different hardware doesn't make a difference. Edit: I realize none of this this easy, I'm just trying to play devils advocate regarding the glossed over "If they then compromised the PSN update servers...".
  - Unseelie 16y ago
    Try a reply to both watty and retric, which is, if someone wanted a botnet, the case is that they went after Sony, which indicates that Sony had a vulnerability. Of course, everyone has vulnerabilities, but the coincidence is likely that this is one that both existed, and the hackers knew about. Sorry that my best answer to the inherent question is 'coincidence'. That's supposing that someone wanted a botnet..and we're all supposing they had a great deal of planning. I'd expect such an event to hinge on a great deal of chance..
bradleyland 16y ago
In my mind, there are a couple of distinguishing factors that would make the PSN target a good choice above others. Although I'm not convinced the purpose of the attack is to execute MiTM, DDoS, or spamnet attacks. * The recent publication of the PS3 private key and shitstorm surrounding Geoh0t debate gives good cover. * Sony appears to be a weaker than average target, or is at least receiving a lot of attention from the cracking community, resulting in a lot of usable information for orchestrating an attack. * The PS3 is known for its ability to act as a distributed computing power house, making it attractive to anyone whose purposes require a large amount of processing power. Given the recent increase in sophistication of malware and the attacks against Comodo, I'm not sure it's wise to write off this attack as such a simplistic plot as a MiTM attack or simple spam network. In a crypto cracking role, the PS3 is a very powerful tool. This could be a single step toward a greater goal involving the breakage of another target.

by watty 16y ago

Unseelie 16y ago

Arguably, there's utility in the fact that the ps3s are all the same hardware, and need only one patch. Of course, the Xbox is also, but the point made in the article was that the PS3 botnet would be quite a lot stronger than a 360 botnet. Hacking microsoft/google/apple/etc would lead to having to use software on a botnet comprised of a wide range of hardware... So on what applications does that tradeoff of utility against the difficulty of hacking Sony make sense?

Retric 16y ago
The PS3 may be slightly more powerful than the Xbox 360, but what is important is the number of them connected to the internet which seems to be much higher in the Xbox camp.
watty 16y ago
Maybe a PS3 botnet would be more powerful, but does it matter? The article itself pointed out two problems (MiTM and DDOS) which would be equally efficient on PS3 or 360. Forget Xbox 360 altogether, if we can break into an update server wouldn't Windows Update be the better target? 350M Windows 7 licenses alone, talk about a botnet. Having different hardware doesn't make a difference. Edit: I realize none of this this easy, I'm just trying to play devils advocate regarding the glossed over "If they then compromised the PSN update servers...".
- Unseelie 16y ago
  Try a reply to both watty and retric, which is, if someone wanted a botnet, the case is that they went after Sony, which indicates that Sony had a vulnerability. Of course, everyone has vulnerabilities, but the coincidence is likely that this is one that both existed, and the hackers knew about. Sorry that my best answer to the inherent question is 'coincidence'. That's supposing that someone wanted a botnet..and we're all supposing they had a great deal of planning. I'd expect such an event to hinge on a great deal of chance..

bradleyland 16y ago

In my mind, there are a couple of distinguishing factors that would make the PSN target a good choice above others. Although I'm not convinced the purpose of the attack is to execute MiTM, DDoS, or spamnet attacks. * The recent publication of the PS3 private key and shitstorm surrounding Geoh0t debate gives good cover. * Sony appears to be a weaker than average target, or is at least receiving a lot of attention from the cracking community, resulting in a lot of usable information for orchestrating an attack. * The PS3 is known for its ability to act as a distributed computing power house, making it attractive to anyone whose purposes require a large amount of processing power. Given the recent increase in sophistication of malware and the attacks against Comodo, I'm not sure it's wise to write off this attack as such a simplistic plot as a MiTM attack or simple spam network. In a crypto cracking role, the PS3 is a very powerful tool. This could be a single step toward a greater goal involving the breakage of another target.