13 ms·

Sony: All personal data stolen from PSN

1074 points by estel 16y ago

cryptoz 16y ago
I wonder how many times a company can install trojans on your computer, destroy your OS's security, secretly watch all your actions, then proceed to not properly protect your data when you voluntarily give it to them...before going out of business. Sony's size and momentum must be pretty crazy. Or maybe it's our society. I just can't imagine a small record store in the 1960s, after being caught spying through the bedroom windows of its customers, ever staying in business. I feel terrible for anyone caught in this. But maybe, just maybe, Sony isn't the company to do business with anymore?
- city41 16y ago
  People want to play God of War, Little Big Planet and Gran Turismo. I think Sony could do just about anything and stay in business. As sad as that is, it's probably true.
  - nathanb 16y ago
    I know, right? Reading through the comments on that post, the "you should have told us this last week" comments are just about balanced out by the "why are you wasting time with this instead of getting the PSN back online" comments.
    - dman 16y ago
      Different folks seem to value privacy very differently.
      - radicaldreamer 16y ago
        I'm willing to bet a lot of those commenting on that post have their parent's credit cards on file with Sony.
    - GrandMasterBirt 16y ago
      The problem is audience: Kids don't give a shit. Privacy is crap, they got their penis pictures on facebook. They want their fucking video games. People playing games all day don't give a shit. They want their fucking games, stfu privacy and get moar kof33 and fucking get this shit online. People with money to lose care. They care that their information is stolen because that could lead to their money being stolen. People who know the value of information care. Thats few people though, since facebook exists. In the end of the day people are willing to talk shit, when it comes to action that is a different story. How many people were so against EA's rootkits, but how many actually boycotted? Same with Apple? And now its same with Sony. Nobody will do anything. Nobody will boycott, the company will just shrug this off as an "opse".
      - ovi256 16y ago
        Oh noes, some people value different things than me how dare they. Let's be all elitist and imply "kids" don't know the value of information, whatever that may be. More like they know the information PSN had on them didn't matter (some nickname and email). And yeah, they want they games online, that's why they paid for a PS3 and multiplayer videogames after all. And Sony promised online multiplay. That's a badly made chain of arguments.
        quanticle 16y ago
        Even if PSN didn't collect any financial information a breach of usernames and passwords is a big deal. As the Gawker hack has shown us, people tend to use the same usernames and passwords across many different websites. You can argue that this is the user's fault, but it doesn't matter. They'll still blame you when their bank account gets hacked. In this case, though, there are indications that financial data was disclosed. PSN (just like Steam and XBox Live) collects financial data to allow for online game purchases. Disclosure of that information is quite a serious matter. Yeah, the "kids" playing might not care about their PSN account, but the parents who enter credit card information to buy their kids games sure will. A poorly made argument does not automatically render the conclusion false.
      - touchstone 16y ago
  - blocke 16y ago
    Why oh why did they buy Media Molecule. It sucks I have to chose between playing such awesome games and keeping my privacy and financial information safe. PS3 is the last Sony product I'll ever buy.
    - ja2ke 16y ago
      Mm was nearly fully Sony-funded pre buyout. Sony put a lot in to start that studio and also published LBP1, so it's not horribly surprising that they acquired them once it was revealed that Mm would be more than an indie fluke of a business.
- Groxx 16y ago
  Momentum and hydra-esque qualities. Sony manufactures parts for a lot of tech companies, who would suffer if Sony ceased to exist. So it's in their best interest to keep them alive, especially in the short-term as it would be crippling to have to change suppliers suddenly.
  - perlgeek 16y ago
    Large companies like Sony don't just go out of business - they are bought out, maybe broken up in the progress. This "cease to exist" idea is really removed from reality.
- jbellis 16y ago
  Outstanding use of sarcasm to make fun of the "EBS outage means we should all go back to building our own datacenters" overreaction. /applauds
- yid 16y ago
  > I just can't imagine a small record store in the 1960s, after being caught spying through the bedroom windows of its customers, ever staying in business. Sony isn't a small record store.
- mortenjorck 16y ago
  Don't read this as a defense of the company, but there hasn't really been a single, monolithic Sony for decades. Sony Music Entertainment, perpetrators of 2005's rootkit debacle, is pretty far removed from Sony Computer Entertainment, the division responsible for Playstation. Sony Electronics, makers of TVs, home theater systems, and Walkmans, is another silo, as is Sony Pictures. Of course, every act of incompetence under the Sony name tarnishes that name, and in the marketplace, that's ultimately all that matters.
  - wmf 16y ago
    There have been rumors that Sony Music/Pictures has "oh no, piracy!" veto power over the rest of Sony, though. Either that or every division of Sony happens to be really DRM-happy.
    - watchandwait 16y ago
      Sony Music's meddling is the reason Sony failed to make a successful Mp3 player, all the more remarkable because Sony created the individual portable music market and dominated it with the Walkman.
      - regularfry 16y ago
        Not only that, but they're responsible for the Minidisc's failure. That could have been a really nice format, but they had to slap a bunch of restrictions on it.
        wipt 16y ago
        Not only the DRM restrictions, but that they limited manufacturing licenses to other companies. MinkDiscs are the perfect size and a little more durable (scratch resistent) imo. It's a shame CD's won out.
    - fabjan 16y ago
      I'm pretty sure Sony Computer Entertainment has some pressure from other game publishers to have DRM on the PlayStation Store.
- Stormbringer 16y ago
  I think it's been proven that you can do just about anything in the US and get away with it because the consumers/populace are too placid to do anything about it ... except a BJ from a jewish girl that will get you in serious trouble.
- sbochins 16y ago
  This is one of the reasons its a shame you need to buy a console to play exclusive titles. I was going to buy a ps3, but am hesitant now. A security breach like this is really unacceptable from anyone, under any circumstance. I'll need to be careful about disclosing any of my data if I do get a ps3.
- nikcub 16y ago
  I would expect Sony to be bought out and split up and sold off in the next few years. They have been in trouble for a while now. A number of PE firms have been looking at doing this deal with Apple mentioned as a potential purchaser of the fabs, chips and personal computing divisions
- rmc 16y ago
  Happens to lots of organisations. Look at the Catholic Church. They are pretty big, still popular and have had their share of 'incidents' (to put it very mildly) recently.
unwantedLetters 16y ago
If someone has had their data stolen, are there any steps that they can take to ensure that they are not fleeced or does this mean that it's only a matter of time (or perhaps luck)?
- wmf 16y ago
  Change your credit card number and password; everything else is information that is already known.
dman 16y ago
Funnily enough the stock doesnt seem to have moved at all as a result of this news - http://www.google.com/finance?q=sne http://www.google.com/finance?q=sne
- krschultz 16y ago
  They're down about 10% relative to the rest of the market since the PSN outage, and pretty significantly in after hours trading (stock market closed about 25 minutes ago, news broke a few minutes ago).
- radicaldreamer 16y ago
  The market seems to have taken this into account over the past few days: http://finance.yahoo.com/echarts?s=SNE#chart5:symbol=sne;range=3m;compare=^dji+^ixic;indicator=volume;charttype=line;crosshair=on;ohlcvalues=0;logscale=off;source=undefined http://finance.yahoo.com/echarts?s=SNE#chart5:symbol=sne;ran...
- Mrdev4 16y ago
  Funny, Jim Cramer's thestreet.com upgraded it from hold to buy on the 25th. http://www.thestreet.com/story/11093134/1/sony-corporation-stock-upgraded-sne.html http://www.thestreet.com/story/11093134/1/sony-corporation-s...
  - Mrdev4 16y ago
    I suspect Sony's stock is getting hammered tomorrow, and the lack official email to PSN users,makes me think it's gonna be more bad news.
ares2012 16y ago
So it is as bad as we feared. The only silver lining I can see is that Sony made the difficult business decision to turn off the network until they were sure it was secure. While that doesn't make me feel better as a PSN user I do respect their honesty and commitment to fixing it. Time to get a new identity! =)
- Groxx 16y ago
  I doubt turning off the PSN was a "difficult business decision". More like their lawyers said "KILL IT NOW" and pointed out the ramifications of not actively preventing such wholesale personal information theft. There will already be a lawsuit of some sort. Imagine how bad it would be for them if they hadn't shut it down.
- Timothee 16y ago
  Time to get a new identity! =) That's what I was thinking: in most cases of user accounts being compromised, the solution is "change your passwords on this and other sites". Here you need to change your birthday, cancel your credit card, move out, change your name… kind of a hassle.
  - there 16y ago
    no problem! http://www.fakenamegenerator.com/ http://www.fakenamegenerator.com/
    - nitrogen 16y ago
      How do they claim to own the MX for example.com? Aren't the example.* domains supposed to be reserved?
      - xp84 16y ago
        From the "click here to use it" page: "Fake Mail Generator changes the domain frequently in order to prevent the address from being banned, a problem which plagues other disposable email services." Sounds like they added "example.com" into the list by mistake... It has no MX from what I can tell.
OmarIsmail 16y ago
This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards. This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death. I don't think this will kill PSN or the PS3, but it's going to significantly dent things. I'm curious to see how much media attention this gets and if we'll see a macro shift towards the Xbox 360 and Wii. If I was Nintendo and particularly evil I would leverage this opportunity to tout the new system and emphasize the cutting-edge online modes with rock solid security. And MS can also talk about their great track record in the online world.
- dman 16y ago
  You can diss your competitor for poor security practices only if you have some confidence in your own.
  - deleted 16y ago
    [deleted]
    - esrauch 16y ago
      He's not saying that the grandparent comment was "dissing the competitor". The grandparent comment suggested that Nintendo and Microsoft could use this opportunity to flaunt their own systems as superior, and the person you replied to was simply stating that Nintendo can't do that without having a lot of confidence in their own networks.
    - deleted 16y ago
      [deleted]
  - cooldeal 16y ago
    >You can diss your competitor for poor security practices only if you have some confidence in your own. Nope, companies usually don't leave any chance to point to the competition's faults and laugh, even if they themselves are worse in that regard.
wilschroter 16y ago
I can't even begin to fathom the magnitude of this considering how many people likely use the same login credentials for all of their sites. The problem you run into is that communicating both the nature of the breach and convincing people to respond accordingly is incredibly hard. This will continue to happen across many sites. I think after enough of these breaches, though, people will start to think about the protection of their online identities a lot differently, which is good, albeit at a painful cost.
- Florin_Andrei 16y ago
  This is a good time to purchase a password-vault app - AND USE IT!
  - reginaldo 16y ago
    No need to purchase. Just put the "Password Gorilla"[1] binaries for Windows, Linux and Mac on your Dropbox be done with it. [1] https://github.com/zdia/gorilla/wiki/ https://github.com/zdia/gorilla/wiki/
  - brown9-2 16y ago
    Keepass is great, easy, and free.
    - notJim 16y ago
      <3 <3 <3 keepass. It has clients for Linux, Windows and OS X, not to mention many smartphones (stick to the 1.x version for this.) This, along with dropbox makes for an awesome way to keep track of passwords securely.
  - technoweenie 16y ago
    Have you ever entered one of those passwords with a playstation controller?
    - Florin_Andrei 16y ago
norova 16y ago
FTA: we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login... I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.
- rhizome 16y ago
  Frankly I'm more concerned with their words about changing credit cards if you've made a purchase through PSN. This seems to be an admission that they were storing CC#'s in plain text.
  - ak217 16y ago
    How do you use stored credit card info if the cc# is not stored? Unlike passwords, the encryption for the cc#s has to be reversible. That's part of the reason why they introduced CVCs, right?
    - jimktrains2 16y ago
      You could at least have them encrypted on disk with a key only stored in memory, i.e.: when the system is turned on. Alternatively a dedicated crypo device where you feed it cipher text and it gives you plain text would also help as the attack wouldn't be able to get the key (even if they have the physical box (for good crypto devices)) While only marginally better depending on the type of attack and permissions gained by the attacker, if all they got was static data on disk, then it would be secure.
      - cookiecaper 16y ago
        And what if that server needs to be rebooted some day? What if there's a hardware failure and it has to be powered off? Something as big as PSN has multiple servers reading the same DB and must be able to tolerate failures without forcing everyone to re-enter their CC #. The keys must be stored persistently somewhere.
rkon 16y ago
Payback for GeoHot or what? Haven't heard anything about the source of the attack since the DDoS that Anonymous took credit for...
- retroafroman 16y ago
  Anon actually didn't do the DDoS attack. From the press release-"For once we didn't do it" http://anonnews.org/?p=press&a=item&i=848 http://anonnews.org/?p=press&a=item&i=848
  - rkon 16y ago
    I thought Anonymous apologized to PSN users for the collateral damage? Makes me wonder if they're just trying to save face after realizing the users were turning against them too... "We realize that targeting the PSN is not a good idea. We have therefore temporarily suspended our action, until a method is found that will not severely impact Sony customers." -- Anonymous Then they went on to say something about how Anonymous is a diverse group and they can't control everyone, blah blah blah.
    - originalgeek 16y ago
      Maybe it's all about the lulz until the lulz are about them.
  - elliottcarlson 16y ago
    Quoting Anonymous on their involvement is a moot point. The lack of hierarchy and completely radical differing opinions of members within the "group" allows for confusion and varying ideologies. Since a press release, in the mindset of Anon, is released by an individual or a group of individuals, they may not be aware that a separate member did perform the hack. In the end no one really knows until someone pretty much steps forward.
    - xp84 16y ago
      Quoting Anonymous on their involvement is a moot point. a moot point? moot? really? i like your choice of words. Heh.
lotusleaf1987 16y ago
Thanks for waiting a week to tell me my credit card info has been stolen Sony. I am not a big fan of MSFT usually, but the next time I am buying a console I'm not buying a PS4.
- ansy 16y ago
  The article says there is no evidence credit card information was accessed.
  - mrcharles 16y ago
    And it also says "we cannot rule out the possibility."
    - joezydeco 16y ago
      Sounds like lawyer-speak for "yeah, they got it".
      - estel 16y ago
        To me it sounds like lawyer-speak for "We don't think they do but we're covering our arses"
        contextfree 16y ago
        Why can't it just mean "we don't have a clue whether they do or not?"
        sukuriant 16y ago
        Because then there wouldn't be a conspiracy theory, of course! (I'm not taking any chances, either way)
  - lotusleaf1987 16y ago
    I absolutely do not trust them at this point. Why would I?
dman 16y ago
Holy Cow! This has to be one of the most serious breaches I remember in recent times. While I dont work in security and my security foo is weak it appears that they did not have a strong layered security apparatus in place? Is it just a coincidence that this breach and geohotz exploit happened around the same time?
- orangecat 16y ago
  It really looks like the PSN architecture assumed that the clients were trustworthy. If so, that's an epic Security 101 fail.
  - marshray 16y ago
    And they used the same servers for development as for production. Isn't that non-PCI-compliant?
    - brown9-2 16y ago
      What is the source for the claim in your first question? I don't see this mentioned in the linked post.
      - marshray 16y ago
        I got this link from Slashdot: http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_... But don't hold that against me. :-) I clicked around a bit in the linked psx-scene forums and it looked like there was a decent basis for it.
      - deleted 16y ago
        [deleted]
  - rbanffy 16y ago
    That would explain why they were so nervous about PS3 jailbreaking.
jasonneal 16y ago
How could they have gained access to passwords? Do they mean, rather, gained access to your secure password hash, or did they simply store passwords in an unencrypted format? Being a member of PSN, this has me concerned. I'm making it a point to change all of my security questions and passwords all throughout all websites I use.
- marshray 16y ago
  Not as easy as it sounds. You wouldn't believe the reaction I got from Mom when I asked her to change her maiden name.
  - joeyh 16y ago
    Makes me wonder how many people just punch in "Maiden". Of course those security questions are nearly useless anyway.
hebejebelus 16y ago
There were sixty million[0] PSN accounts. This is impressive, and amounts to (judging by a quick search) the largest-scale ID (and possibly credit-card) theft ever [Not so, see child comment]. Not even factoring in credit card details, the usernames, emails, addresses, ages, passwords, mother's maiden names, favourite pets, of sixty million people is worth a hell of a lot. I have to wonder how much data that is, in terms of storage. How could you even take that without someone noticing? Hats off to whoever it was. Now, I'm off to change my passwords. Thank Christ I had the sense not to use a credit card to buy from PSN. [0] http://www.derangedshaman.com/2011/01/06/sonys-60-million-psn-users-means-zero-zilch-nada/ http://www.derangedshaman.com/2011/01/06/sonys-60-million-ps... [edit] On a related note, paypal refuses to let my change my password to something longer than 20 characters - or have spaces in my password. Why is this the case? Surely the only thing that an upper limit on the length of a password does is help the attacker.
- samlevine 16y ago
  fwiw the Heartland incident involved 130,000,000 records: http://datalossdb.org/ http://datalossdb.org/ Not to lessen the extent of this, but it's not nearly the biggest dataloss incident ever.
- c2 16y ago
  TJ Maxx data theft involved 45 million confirmed credit card/debit card numbers stolen, which I believe was more serious then this: http://www.msnbc.msn.com/id/17853440/ http://www.msnbc.msn.com/id/17853440/ Fact is people put most of that other information on Facebook anyway, so for 500 million people, you can quite easily find someone's age, birthday, pets, and much more just from their FB account.
- joeyh 16y ago
  Overestimating 100k per user, it would only be 6 terabytes. And all those low-entropy passwords etc should compress quite well.
  - fragsworth 16y ago
    They would only compress well if you stored them in plaintext...
Hominem 16y ago
I haven't really been following this but there have been rumblings all week that a hacked firmware was released that allowed anyone who installed it, and twiddled with some other things, access to the PSN development and testing network. Anyone know more?
- milkshakes 16y ago
  you might be looking for rebug: http://rebug.me/ http://rebug.me/
- bxr 16y ago
  I personally don't know any more, but this might be a good starting point if you're interested: http://news.ycombinator.com/item?id=2482679 http://news.ycombinator.com/item?id=2482679 is a link to a post on reddit from a moderator of a forum that deals in ps3 modding. He outlines the situation, and his forum probably has some more information.
- kmfrk 16y ago
  There was a reddit thread on this that explains the gist of it: http://news.ycombinator.com/item?id=2482679 http://news.ycombinator.com/item?id=2482679.
parfe 16y ago
What the hell Sony? I just tried logging into http://us.playstation.com/psn/playstation-home/ http://us.playstation.com/psn/playstation-home/ the SSL connection to https://store.playstation.com https://store.playstation.com gave Error code: sec_error_unknown_issuer. It's like you're actively trying to make me never trust you again.
- marshray 16y ago
  Looks OK in my Firefox, says it's signed by Comodo UTN-USERFirst-Hardware. I am not making this up.
  - gedaxiang 16y ago
    Isn't Comodo the CA that was compromised recently?
    - marshray 16y ago
      Yep, through the usertrust sub-CA even. https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho...
mrcharles 16y ago
This seems like a really big argument for never allowing your data to be stored by a 3rd party. Does anyone see any reason why these companies should do anything other than store the data locally on your system, encrypted/obfuscated, and then only ever send once, via encrypted connection, and then immediately delete the info remotely? I mean, if someone breaks in to my house and steals my PS3, they already have access to all of that information.
- brudgers 16y ago
  >"This seems like a really big argument for never allowing your data to be stored by a 3rd party." iTunes comes to mind: http://isc.sans.edu/diary.html?storyid=9136 http://isc.sans.edu/diary.html?storyid=9136 http://news.ycombinator.com/item?id=1488956 http://news.ycombinator.com/item?id=1488956 http://news.ycombinator.com/item?id=948757 http://news.ycombinator.com/item?id=948757
- falcolas 16y ago
  Much of ecommerce would go down the drain, if they got rid of remote storage of your details. No recurring billing, no "One-Click", no address books, etc...
  - _delirium 16y ago
    It should at least be an option for me not to store it, if I prefer not to use "one-click" and similar features. I understand why stores prefer to save the information without giving me a choice (reduces friction for future purchases), but I'm not sure that's a good enough reason given the prevailing security track records. Either that, or perhaps there could be statutory penalties for data breaches. For example, if there was mandatory compensation of, say, $100/person for a data breach, companies might be incentivized to better think about whether they really need to store this data, and whether they're storing it safely.
    - dedward 16y ago
      Online retailers who handle their own CC processing tend to keep credit card information around if only for fraud/chargeback tracking in the future - being online opens you up to massive abuse if you don't keep it in check. A big player like sony should have been complying with PCI standards - but from what I've seen, that's not so difficult to pass and then forget about - people take shortcuts - and how many companies out there have ever had their processing revoked for NOT complying with PCI? That would be an interesting statistic.
vipivip 16y ago
Sad day, what's next for playstation owners Sony?
- marshray 16y ago
  Ordinarily I'd just say reformat it and install Linux, but....
  - vipivip 16y ago
    Linux installation is easy piece of cake to HN audience, but nightmare to normal people.
    - deleted 16y ago
      [deleted]
    - ilconsigliere 16y ago
      Sony yanked linux support from PS3s after thousands of users had already paid for it. Tally that in the "Reasons to no longer support Sony" column.
      - chrischen 16y ago
        Somewhat untrue. You could still use linux, but just not in combination with continued (free) PSN access.
        marshray 16y ago
        That was the theory anyway. Now we don't have PSN access either. We kept the family PS3 patched-up in good faith. Is there now a reasonable way for me to install Linux? Seriously, the kids are probably moving to Xbox and I have some supercomputing I'd like to do.
        ra 16y ago
        I'd like to know this too... I assume that now the keys have been discovered, PS3 should be fully retaskable?
maximilianburke 16y ago
I'm disappointed but not surprised. When I had to change my password a few months ago on the Sony developer's network site I was told that my new password was too similar to the last ones. I was wondering how they knew that, aside from storing the passwords in plain-text, something I'd assume they'd be too smart to do. I guess I gave them too much credit.
- phaylon 16y ago
  Genuine Question: They let you change your password without having you supply the old one?
  - jimktrains2 16y ago
    Password reset link?
    - phaylon 16y ago
      That might explain it.
- caf 16y ago
  Well, they could try permuting your new password in a few different ways and seeing if any of those permutations match the old hash.
  - JoachimSchipper 16y ago
    That's not practical. Password hashes should be slow, to stop dictionary attacks; and it's easy to imagine a couple thousand "similar" passwords (flip case of some characters? 256 possibilities for an 8-character password. Add year of birth? 20-50 possibilities. And so on.)
    - caf 16y ago
      Presumably the ratio between the rate of normal logins (each of which requires a single execution of the password hash) and the rate of password changes is at least a few thousand.
sdkmvx 16y ago
They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database. How many times does this have to happen before people realize that passwords are never to be stored in plaintext? The only exception is a client-side program that needs to log you in and in an ideal world that would be handled by a Kerberos-like ticket system.
- marshray 16y ago
  They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database. It could also mean that the attacker was in a position to observe the plaintext supplied by the user after it was decrypted (from SSL) but before it was authenticated (with a password hash algorithm). Or it could be that they're just not being too particular about the details, on the side of being overly conservative.
Splines 16y ago
It's too bad we don't know what's going on inside the sausage factory. It'd make for a very interesting post-mortem.
blhack 16y ago
Wow this sounds really really bad. As much as I dislike sony's actions in the Geohot case, and as much as "this is what you get for failing at security", I feel pretty bad for them right now (and even worse for all of their customers) >To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports. >We have also provided names and contact information for the three major U.S. credit bureaus below. At no charge, U.S. residents can have these credit bureaus place a “fraud alert” on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name.
- r00fus 16y ago
  I fail to see why Sony should be pitied, unless the details of the attack are laid out, and Sony shows that it was following good security practice. I see neither disclosure happening any time soon.
  - blhack 16y ago
    It's probably too much of my mother and not enough of my father, but I can't stand watching people fail, no matter how much I hate them. I hate sony, but I still feel bad for them.
deleted 16y ago
[deleted]
unexpected 16y ago
This is unreal. What bothers me the most, is that when this happened to me one time before, that particular company paid for a year of credit monitoring services. In this case, Sony is too cheap to do even that, pointing you towards where you could download your credit report online. Ridiculous.
- marshray 16y ago
  It's too soon. I don't think anyone knows what Sony's going to end up paying here (Sony included).
- lancepantz 16y ago
  I believe they are obligated to by US law.
- lawnchair_larry 16y ago
  Lifelock is a scam that you are better off without anyway, but yeah, they definitely should provide some compensation. Unlikely though. They would rather sue people that want to run linux.
alexknight 16y ago
While I don't know the details of how this happened, it's a sure fire bet that they were not doing something right when it came to securing their infrastructure. How many times have we heard of big name companies running un-patched operating systems and SQL databases or even weak passwords? From the consumer end, this really sucks. Especially if their personal data was compromised.
aeontech 16y ago
Does anyone else find it odd that they "strongly recommend that you log on and change your password" instead of just force-resetting everyone's password and sending them an email with an activation link? Out of 60M subscribers, I'm certain that a large proportion will never see this message.
- amackera 16y ago
  Methinks that 99% of PSN users can't remember their own passwords.
- deleted 16y ago
  [deleted]
- thenduks 16y ago
  Agreed, not only that but you can't even login right now, so in another week all 60M users are supposed to remember to go and futz around with the PS3's clunky account UI to change their password? Personally, I have a couple passwords in use for low-risk services (like PSN) and just went and changed all my other passwords :)
michaelchisari 16y ago
So how do we sign up for the class action lawsuit?
- rorrr 16y ago
  You can do it right here. All you need is what, 30 people to get the class action status.
estel 16y ago
Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: http://www.giantbomb.com/news/good-news-psn-back-maybe-within-a-week-bad-news-everything-else-updated/3084/ http://www.giantbomb.com/news/good-news-psn-back-maybe-withi...
- seiji 16y ago
  Salt is bad for you: http://news.ycombinator.com/item?id=1209254 http://news.ycombinator.com/item?id=1209254
  - cookiecaper 16y ago
    Salted hashes are better than unsalted hashes.
    - seiji 16y ago
      Against a GPU that can calculate five million hashes per second your salt isn't worth the paper it's printed on.
      - jbri 16y ago
        I don't know about you, but personally I think "crack one person's password in one day" is a much better situation than "crack everyone's password in one day".
      - ceejayoz 16y ago
        That's why you use a different salt per user.
      - perlgeek 16y ago
        Who prints out password salts anyway?
      - phsr 16y ago
        So we should just store the password in plain text then!! Or we could use the honor system, with no password!!
GrandMasterBirt 16y ago
Wait, "Password" was stolen? WTF they store unencrypted passwords?!?!?!!?! I sure hope they meant password hashes otherwise upset many people should be.
- nuclear_eclipse 16y ago
  Even if hashes are stolen, you should consider the original password stolen as well, because it's only a matter of time and effort to brute force the original password from the hash. Even if you use a really good password with a really good hash (like bcrypt), it still doesn't mean that they can't find the password, just that it will take more time to do so.
  - derobert 16y ago
    A really good password with a really good hash takes more time for values of time exceeding far exceeding any human's lifespan. Assuming a 10-character random alphanumeric, that'd be 62¹⁰ possibilities (26 uppercase + 26 lowercase + 10 numbers = 62). Even given an insanely fast brcypt of 1µs, that's over thirteen thousand years to get to a 50% chance. Now, if your hash is a bad one, say MD5, then you're in trouble. GPUs could brute force that ten-character password within a year.
dirtbox 16y ago
Interesting fact for the day: 75 million accounts is a new world record for information theft.
guelo 16y ago
We've seen several examples recently of Japanese corporate culture's secrecy and lack of candor. Toyota, TEPCO nuclear plant and now Sony same pattern of not wanting to admit to the problem. I wouldn't bet on their long term competitiveness.
- wmf 16y ago
  I think corporate ass-covering is pretty pan-cultural. See RSA's recent "we're answering every question other than the one that everyone is asking" PR about the SecurID thing.
  - yuhong 16y ago
    I know, there was a previous article on the cover-up culture that once made it to the top at HN.
    - alecco 16y ago
      For the lazy http://news.ycombinator.com/item?id=2088469 http://news.ycombinator.com/item?id=2088469
- alecco 16y ago
  Let's hold the asian bashing for a moment. Howard Stringer is Sony emperor... I mean Chairman, President and CEO. And he comes from Sony Entertainment (US) . He was the one pushing stuff like the Audio CD rootkit, DRM everything and BluRay in all PS3 consoles to force a format war. Some people consider this last trick as the move that got the previous admin gutted, I mean restructured, back in 2005. And he got the top job. Amazing guy. http://en.wikipedia.org/wiki/Howard_Stringer http://en.wikipedia.org/wiki/Howard_Stringer
moondowner 16y ago
Notice how they never apologize? The closest thing to apology, but it's not an apology, is: > "We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience." Sony apologizes only to Chuck Norris.
- pero 16y ago
  That is very standard legal. If they did so, the impending class action would already be over. I wouldn't be surprised if that blog post cost them well into 6 figures for legal fees. And that it took the full week to draft and approve--it is probably the reason this announcement took so long to emerge.
  - moondowner 16y ago
    True. Big incidents like this require for companies, in this case Sony, to carefully choose their words. They are obliged to inform their customers.
- jswanson 16y ago
  The Japanese announcement is full of apology: "2011年4月21日よりPlayStation®NetworkおよびQriocity™の障害が継続しており、お客様および関係各位に多大なるご迷惑をおかけしておりますことを深くお詫び申しあげます。" Which is a polite and flowery way of apologizing for the ongoing interruption of service. http://cdn.jp.playstation.com/msg/sp_20110427_psn.html http://cdn.jp.playstation.com/msg/sp_20110427_psn.html
  - moondowner 16y ago
    True, they are different probably because this (the Japanese announcement) is from Sony Corporation, and the link in English is probably from Sony Corporation of America.
    - ramchip 16y ago
      In Japan lawsuits are less common, and an apology is expected even if it's not your fault, so it shouldn't hurt their legal defense if they apologize. I think it won't be interpreted as an admission of guilt like it could be in America.
chrischen 16y ago
Any idea who's behind the data theft? I'm much more interested in that...
- romland 16y ago
  The REAL anonymous.
  - Raphael 16y ago
    Well any criminal would not want to be identified.
famousactress 16y ago
These malicious actions have also had an impact on your ability to enjoy... Interesting. Is it not fair to also say the negligent actions that made these malicious ones possible had an impact? I'm completely sick of the way these press releases sound.
- keithburgun 16y ago
  Reminds me of 9/11 and no one in government taking any responsibility. Except Richard Clarke.
idheitmann 16y ago
For many folk who may not use PSN much or recently, the first concern I imagine would be to recall whether they ever provided Sony with the most sensitive things on that list. A quick gmail search tells me that they had my mailing address and full name, but I have no idea if I ever gave them my CC or DOB or SSN or Gitmo prisoner bar code or whatever else. I'm glad I use lastpass because I have a nice list of sites to update password info, but I imagine this process is going to take quite a while. Too bad I repeated that password so many times.
nwatson 16y ago
This is case-in-point for centralized log-archival-and-analysis tools like SenSage. No matter how secure you make your infrastructure, in situations like this you want evidence of all activity on your networks, computers, DB's, app servers, apps, etc. Storing log data related to this activity can consume petabytes over a multi-year span. I don't know what kind of forensic tools Sony's using, hopefully they have something like SenSage.
redthrowaway 16y ago
"Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: ... PlayStation Network/Qriocity password and login," Seriously? Even Sony is keeping passwords in plaintext? There wasn't a single competent person involved in the design of PSN who might have mentioned that was a terrible idea?
- AndyKelley 16y ago
  It could be that they simply obtained a hash and salt, from which it is still possible to obtain plaintext.
- eneveu 16y ago
  Sometimes, you explain why storing a password in plaintext is a terrible idea, but the business executives simply do not care, or think it's better to keep them available, in case somebody forgets it...
rickdale 16y ago
Thats ridiculous. Sony should feel in debt to their customers for such a security breach. I hope they catch the people responsible and give them jobs!
neilalbrock 16y ago
Frankly I'm in shock. That a company as large and experienced as Sony would allow this to happen, well it beggars belief. The contempt shown to customers, not just by Sony but by other large tech companies (I'm looking at you Apple) is disgusting. I choose not to be part of Facebook because I'd rather they didn't know every detail of my life. Now I have to consider if I want to use products from Sony because of concerns that they can't even protect my private data, which they force me to give them in order to use their services. Unbafuckinglievable.
pdenya 16y ago
"We greatly appreciate your patience, understanding and goodwill" - I'm all out of good will for Sony. I already canceled the credit card I had on file with them, hopefully nothing happens with my personal info.
dfischer 16y ago
http://psx-scene.com/forums/f177/sony-has-been-bad-boy-ridiculous-levels-spying-81093/ http://psx-scene.com/forums/f177/sony-has-been-bad-boy-ridic... "A well known hacker i don’t want to reveal here had all the Sony PlayStation Network functions 100% decrypted as well as providing some nice info about how Sony dealing with PSN members privacy in their online servers. Apparently, Sony server gathered everything they can from the PSN connected PS3 console. When i said everything, i meant it. Here, i make all the list of what they squeezed from the IRC chat logs conversation between the hackers. Sony monitors all messages over PSN. All connected devices return values sent to Sony server returns TV, Firmware version, Firmware type, Console model They also collects data in your USB attached device. Credit card sent as plain text, example: creditCard.paymentMethodId=VISA&creditCard.holderN ame=Max&creditCard.cardNumber=4558254723658741&cre ditCard.expireYear=2012&creditCard.expireMonth=2&c reditCard.securityCode=214&creditCard.address.addr ess1=example street%2024%20&creditCard.address.city=city1%20&cr editCard.address.province=abc%20&creditCard.addres s.postalCode=12345%20 *The best part of all, the list is stored online and updated when u login PSN and random. But, that’s not all, with the PSN functions fully decrypted, this hacker can use the function to get all games, DLC, you name it, from PSN store without paying anything."
- swaits 16y ago
  > Credit card sent as plain text This was debunked. It's encrypted on the wire.
  - Natsu 16y ago
    What's your source on that?
    - swaits 16y ago
      It's talked about right in these very comments: http://news.ycombinator.com/item?id=2487412 http://news.ycombinator.com/item?id=2487412 The data is POSTed over SSL. C'mon, do you really think Sony sends credit card data across the wire in plaintext? If so, it would have been discovered the day the PS3 launched, like five years ago. And, its discovery wouldn't have required any system hacking, as described above. Is it amateur hour here?
edtechre 16y ago
"Wait, ENCRYPT credit numbers? I thought you said decrypt!"
ams6110 16y ago
I think that what we're seeing here is evidence that there's just too many ways to screw up handling personal information on line. The sane stance is to now assume that any profile you provide to any website will eventually become public, and proceed accordingly.
allending 16y ago
"+ OreoPoptart on April 26th, 2011 at 12:58 pm said: JUST STOP! FIX THE GOD DAMN PSN FIRST THEN POST THIS CRAP UP GEEZ" Heh.
deleted 16y ago
[deleted]
Osiris 16y ago
I'm just glad I got my Steam PC code from my Portal 2 disc activated just before PSN went offline.
rhdoenges 16y ago
This brings back memories of the Gawker breach, but Sony seemed so much more legitimate. It can happen to the best of companies, I guess. This is the worst security hack I've ever witnessed. This spells for Sony, yes, but even worse for the uncountable people whose credit card numbers just got nabbed. One hacker on the loose... The worst part is that this public breach is only a single event. All the companies that have our information could be hacked and Sony is only a visible example. It's similar to the BP oil spill: what other oil companies weren't running tight rigs? The disasters happened to BP and Sony, yes, but it is a reflection on their industries.
touchstone 16y ago
I think a lot of us are missing the big picture; thankfully not Tgebbs (see comment 22).
kristopher 16y ago
This appears to also have affected Sony in Japan, as well. It is interesting how this announcement differs from the Japanese announcement[0]. Japanese people are so paranoid about their identity that this cannot go well for Sony in Japan. It does not seem like Sony is preparing people for any sort of identity theft in Japan other than calling the card companies. They apologized and remarked at how they are gearing-up to better protect their users when the service reopens. [0] http://cdn.jp.playstation.com/msg/sp_20110427_psn.html http://cdn.jp.playstation.com/msg/sp_20110427_psn.html
touchstone 16y ago
an interesting update: http://torrentfreak.com/playstation-network-shut-down-to-end-piracy-free-for-all-110426/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Torrentfreak+%28Torrentfreak%29 http://torrentfreak.com/playstation-network-shut-down-to-end...
gildur 16y ago
Well, seeing it from a positive perspective, I did (finally) get the password changed on some sites =)
rbanffy 16y ago
While it's a big deal, let's be reasonable with our expectations of privacy. I know my street addresses, home and work, my e-mail addresses, significant URLs, credit cards, expired credit cards, buying habits, posts, messages, family relationships (mother, wife, ex-wife, kids, ex-girlfriends) etc are stored in a lot (probably more than a hundred) places. I have no expectation all that data will be kept secret for any length of time. I seriously doubt much of that data could be kept form a dedicated googler with lots of free time, much less from a determined criminal who wanted that data.
deleted 16y ago
[deleted]
D3lt4 16y ago
Damn it, Sony.
millerc 16y ago
I haven't seen this point mentioned anywhere yet, but... How many of you are willing to bet Sony will use the intrusion as an argument for material damages in court against GeoHot, somehow linking his exploit with the mode of intrusion? This is pure speculation of course. But I'm willing to bet serious money that Sony's "outside, recognized security firm" has been "requested (hint-hint, wink-wink)" to be on special lookout for any sign the exploit was a vector for the intrusion.
gorm 16y ago
> For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Am I the only one reacting on this? It's like they make it sound like YOU need to take care when it's they are the one to blame. Same with Skype on Android when they sent you an messaging telling you that YOU should be careful to install software because they have made a security hole for that software.
- danparsonson 16y ago
  I think what they mean is that the information harvested may now be used to perpetrate such scams - imagine receiving an email specifically addressed to you, containing information that you thought only Sony knew about. Would be pretty convincing (and people fall for less convincing emails all the time). Or a phone call? "Hi it's Bob from PSN here, we need to update your account with new card details following the recent security breach" etc.
tibbon 16y ago
Any idea if they properly Salted/Hashed the passwords, or if they just stored everything in the plain?
benhebert 16y ago
Poor Sony.
igorgue 16y ago
I like the first comment on the post: "Hope it come back quickly" And ultimately that's what people care about, that information most of them already share it via Facebook for FREE, funny thing, is that we already get spam deliver to our homes in shape of publicity. About the credit cards, these days most credit card issuers have pretty good security so they'll let you know and block your credit card if people used it in a weird way and believe me, I was a "victim" a couple of times already and it works very well. I join the 1st commenter. I wont be changing my credit cards because of this and I just care about playing my online games again... really I already got bored of Gran Turismo, Final Fantasy offline ;-).
shareme 16y ago
Japan Nuke Apology Two..same delayed response, same non-statement, same lack of transparency.. Where is Godzilla to stomp Sony's ass when we need him?

1074 points by estel 16y ago

I wonder how many times a company can install trojans on your computer, destroy your OS's security, secretly watch all your actions, then proceed to not properly protect your data when you voluntarily give it to them...before going out of business. Sony's size and momentum must be pretty crazy. Or maybe it's our society. I just can't imagine a small record store in the 1960s, after being caught spying through the bedroom windows of its customers, ever staying in business. I feel terrible for anyone caught in this. But maybe, just maybe, Sony isn't the company to do business with anymore?

city41 16y ago
People want to play God of War, Little Big Planet and Gran Turismo. I think Sony could do just about anything and stay in business. As sad as that is, it's probably true.
- nathanb 16y ago
  I know, right? Reading through the comments on that post, the "you should have told us this last week" comments are just about balanced out by the "why are you wasting time with this instead of getting the PSN back online" comments.
  - dman 16y ago
    Different folks seem to value privacy very differently.
    - radicaldreamer 16y ago
      I'm willing to bet a lot of those commenting on that post have their parent's credit cards on file with Sony.
  - GrandMasterBirt 16y ago
    The problem is audience: Kids don't give a shit. Privacy is crap, they got their penis pictures on facebook. They want their fucking video games. People playing games all day don't give a shit. They want their fucking games, stfu privacy and get moar kof33 and fucking get this shit online. People with money to lose care. They care that their information is stolen because that could lead to their money being stolen. People who know the value of information care. Thats few people though, since facebook exists. In the end of the day people are willing to talk shit, when it comes to action that is a different story. How many people were so against EA's rootkits, but how many actually boycotted? Same with Apple? And now its same with Sony. Nobody will do anything. Nobody will boycott, the company will just shrug this off as an "opse".
    - ovi256 16y ago
      Oh noes, some people value different things than me how dare they. Let's be all elitist and imply "kids" don't know the value of information, whatever that may be. More like they know the information PSN had on them didn't matter (some nickname and email). And yeah, they want they games online, that's why they paid for a PS3 and multiplayer videogames after all. And Sony promised online multiplay. That's a badly made chain of arguments.
      - quanticle 16y ago
        Even if PSN didn't collect any financial information a breach of usernames and passwords is a big deal. As the Gawker hack has shown us, people tend to use the same usernames and passwords across many different websites. You can argue that this is the user's fault, but it doesn't matter. They'll still blame you when their bank account gets hacked. In this case, though, there are indications that financial data was disclosed. PSN (just like Steam and XBox Live) collects financial data to allow for online game purchases. Disclosure of that information is quite a serious matter. Yeah, the "kids" playing might not care about their PSN account, but the parents who enter credit card information to buy their kids games sure will. A poorly made argument does not automatically render the conclusion false.
    - touchstone 16y ago
- blocke 16y ago
  Why oh why did they buy Media Molecule. It sucks I have to chose between playing such awesome games and keeping my privacy and financial information safe. PS3 is the last Sony product I'll ever buy.
  - ja2ke 16y ago
    Mm was nearly fully Sony-funded pre buyout. Sony put a lot in to start that studio and also published LBP1, so it's not horribly surprising that they acquired them once it was revealed that Mm would be more than an indie fluke of a business.
Groxx 16y ago
Momentum and hydra-esque qualities. Sony manufactures parts for a lot of tech companies, who would suffer if Sony ceased to exist. So it's in their best interest to keep them alive, especially in the short-term as it would be crippling to have to change suppliers suddenly.
- perlgeek 16y ago
  Large companies like Sony don't just go out of business - they are bought out, maybe broken up in the progress. This "cease to exist" idea is really removed from reality.
jbellis 16y ago
Outstanding use of sarcasm to make fun of the "EBS outage means we should all go back to building our own datacenters" overreaction. /applauds
yid 16y ago
> I just can't imagine a small record store in the 1960s, after being caught spying through the bedroom windows of its customers, ever staying in business. Sony isn't a small record store.
mortenjorck 16y ago
Don't read this as a defense of the company, but there hasn't really been a single, monolithic Sony for decades. Sony Music Entertainment, perpetrators of 2005's rootkit debacle, is pretty far removed from Sony Computer Entertainment, the division responsible for Playstation. Sony Electronics, makers of TVs, home theater systems, and Walkmans, is another silo, as is Sony Pictures. Of course, every act of incompetence under the Sony name tarnishes that name, and in the marketplace, that's ultimately all that matters.
- wmf 16y ago
  There have been rumors that Sony Music/Pictures has "oh no, piracy!" veto power over the rest of Sony, though. Either that or every division of Sony happens to be really DRM-happy.
  - watchandwait 16y ago
    Sony Music's meddling is the reason Sony failed to make a successful Mp3 player, all the more remarkable because Sony created the individual portable music market and dominated it with the Walkman.
    - regularfry 16y ago
      Not only that, but they're responsible for the Minidisc's failure. That could have been a really nice format, but they had to slap a bunch of restrictions on it.
      - wipt 16y ago
        Not only the DRM restrictions, but that they limited manufacturing licenses to other companies. MinkDiscs are the perfect size and a little more durable (scratch resistent) imo. It's a shame CD's won out.
  - fabjan 16y ago
    I'm pretty sure Sony Computer Entertainment has some pressure from other game publishers to have DRM on the PlayStation Store.
Stormbringer 16y ago
I think it's been proven that you can do just about anything in the US and get away with it because the consumers/populace are too placid to do anything about it ... except a BJ from a jewish girl that will get you in serious trouble.
sbochins 16y ago
This is one of the reasons its a shame you need to buy a console to play exclusive titles. I was going to buy a ps3, but am hesitant now. A security breach like this is really unacceptable from anyone, under any circumstance. I'll need to be careful about disclosing any of my data if I do get a ps3.
nikcub 16y ago
I would expect Sony to be bought out and split up and sold off in the next few years. They have been in trouble for a while now. A number of PE firms have been looking at doing this deal with Apple mentioned as a potential purchaser of the fabs, chips and personal computing divisions
rmc 16y ago
Happens to lots of organisations. Look at the Catholic Church. They are pretty big, still popular and have had their share of 'incidents' (to put it very mildly) recently.

unwantedLetters 16y ago

If someone has had their data stolen, are there any steps that they can take to ensure that they are not fleeced or does this mean that it's only a matter of time (or perhaps luck)?

wmf 16y ago
Change your credit card number and password; everything else is information that is already known.

dman 16y ago

Funnily enough the stock doesnt seem to have moved at all as a result of this news - http://www.google.com/finance?q=sne http://www.google.com/finance?q=sne

krschultz 16y ago
They're down about 10% relative to the rest of the market since the PSN outage, and pretty significantly in after hours trading (stock market closed about 25 minutes ago, news broke a few minutes ago).
radicaldreamer 16y ago
The market seems to have taken this into account over the past few days: http://finance.yahoo.com/echarts?s=SNE#chart5:symbol=sne;range=3m;compare=^dji+^ixic;indicator=volume;charttype=line;crosshair=on;ohlcvalues=0;logscale=off;source=undefined http://finance.yahoo.com/echarts?s=SNE#chart5:symbol=sne;ran...
Mrdev4 16y ago
Funny, Jim Cramer's thestreet.com upgraded it from hold to buy on the 25th. http://www.thestreet.com/story/11093134/1/sony-corporation-stock-upgraded-sne.html http://www.thestreet.com/story/11093134/1/sony-corporation-s...
- Mrdev4 16y ago
  I suspect Sony's stock is getting hammered tomorrow, and the lack official email to PSN users,makes me think it's gonna be more bad news.

ares2012 16y ago

So it is as bad as we feared. The only silver lining I can see is that Sony made the difficult business decision to turn off the network until they were sure it was secure. While that doesn't make me feel better as a PSN user I do respect their honesty and commitment to fixing it. Time to get a new identity! =)

Groxx 16y ago
I doubt turning off the PSN was a "difficult business decision". More like their lawyers said "KILL IT NOW" and pointed out the ramifications of not actively preventing such wholesale personal information theft. There will already be a lawsuit of some sort. Imagine how bad it would be for them if they hadn't shut it down.
Timothee 16y ago
Time to get a new identity! =) That's what I was thinking: in most cases of user accounts being compromised, the solution is "change your passwords on this and other sites". Here you need to change your birthday, cancel your credit card, move out, change your name… kind of a hassle.
- there 16y ago
  no problem! http://www.fakenamegenerator.com/ http://www.fakenamegenerator.com/
  - nitrogen 16y ago
    How do they claim to own the MX for example.com? Aren't the example.* domains supposed to be reserved?
    - xp84 16y ago
      From the "click here to use it" page: "Fake Mail Generator changes the domain frequently in order to prevent the address from being banned, a problem which plagues other disposable email services." Sounds like they added "example.com" into the list by mistake... It has no MX from what I can tell.

OmarIsmail 16y ago

This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards. This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death. I don't think this will kill PSN or the PS3, but it's going to significantly dent things. I'm curious to see how much media attention this gets and if we'll see a macro shift towards the Xbox 360 and Wii. If I was Nintendo and particularly evil I would leverage this opportunity to tout the new system and emphasize the cutting-edge online modes with rock solid security. And MS can also talk about their great track record in the online world.

dman 16y ago
You can diss your competitor for poor security practices only if you have some confidence in your own.
- deleted 16y ago
  [deleted]
  - esrauch 16y ago
    He's not saying that the grandparent comment was "dissing the competitor". The grandparent comment suggested that Nintendo and Microsoft could use this opportunity to flaunt their own systems as superior, and the person you replied to was simply stating that Nintendo can't do that without having a lot of confidence in their own networks.
  - deleted 16y ago
    [deleted]
- cooldeal 16y ago
  >You can diss your competitor for poor security practices only if you have some confidence in your own. Nope, companies usually don't leave any chance to point to the competition's faults and laugh, even if they themselves are worse in that regard.

wilschroter 16y ago

I can't even begin to fathom the magnitude of this considering how many people likely use the same login credentials for all of their sites. The problem you run into is that communicating both the nature of the breach and convincing people to respond accordingly is incredibly hard. This will continue to happen across many sites. I think after enough of these breaches, though, people will start to think about the protection of their online identities a lot differently, which is good, albeit at a painful cost.

Florin_Andrei 16y ago
This is a good time to purchase a password-vault app - AND USE IT!
- reginaldo 16y ago
  No need to purchase. Just put the "Password Gorilla"[1] binaries for Windows, Linux and Mac on your Dropbox be done with it. [1] https://github.com/zdia/gorilla/wiki/ https://github.com/zdia/gorilla/wiki/
- brown9-2 16y ago
  Keepass is great, easy, and free.
  - notJim 16y ago
    <3 <3 <3 keepass. It has clients for Linux, Windows and OS X, not to mention many smartphones (stick to the 1.x version for this.) This, along with dropbox makes for an awesome way to keep track of passwords securely.
- technoweenie 16y ago
  Have you ever entered one of those passwords with a playstation controller?
  - Florin_Andrei 16y ago

norova 16y ago

FTA: we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login... I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.

rhizome 16y ago
Frankly I'm more concerned with their words about changing credit cards if you've made a purchase through PSN. This seems to be an admission that they were storing CC#'s in plain text.
- ak217 16y ago
  How do you use stored credit card info if the cc# is not stored? Unlike passwords, the encryption for the cc#s has to be reversible. That's part of the reason why they introduced CVCs, right?
  - jimktrains2 16y ago
    You could at least have them encrypted on disk with a key only stored in memory, i.e.: when the system is turned on. Alternatively a dedicated crypo device where you feed it cipher text and it gives you plain text would also help as the attack wouldn't be able to get the key (even if they have the physical box (for good crypto devices)) While only marginally better depending on the type of attack and permissions gained by the attacker, if all they got was static data on disk, then it would be secure.
    - cookiecaper 16y ago
      And what if that server needs to be rebooted some day? What if there's a hardware failure and it has to be powered off? Something as big as PSN has multiple servers reading the same DB and must be able to tolerate failures without forcing everyone to re-enter their CC #. The keys must be stored persistently somewhere.

rkon 16y ago

Payback for GeoHot or what? Haven't heard anything about the source of the attack since the DDoS that Anonymous took credit for...

retroafroman 16y ago
Anon actually didn't do the DDoS attack. From the press release-"For once we didn't do it" http://anonnews.org/?p=press&a=item&i=848 http://anonnews.org/?p=press&a=item&i=848
- rkon 16y ago
  I thought Anonymous apologized to PSN users for the collateral damage? Makes me wonder if they're just trying to save face after realizing the users were turning against them too... "We realize that targeting the PSN is not a good idea. We have therefore temporarily suspended our action, until a method is found that will not severely impact Sony customers." -- Anonymous Then they went on to say something about how Anonymous is a diverse group and they can't control everyone, blah blah blah.
  - originalgeek 16y ago
    Maybe it's all about the lulz until the lulz are about them.
- elliottcarlson 16y ago
  Quoting Anonymous on their involvement is a moot point. The lack of hierarchy and completely radical differing opinions of members within the "group" allows for confusion and varying ideologies. Since a press release, in the mindset of Anon, is released by an individual or a group of individuals, they may not be aware that a separate member did perform the hack. In the end no one really knows until someone pretty much steps forward.
  - xp84 16y ago
    Quoting Anonymous on their involvement is a moot point. a moot point? moot? really? i like your choice of words. Heh.

lotusleaf1987 16y ago

Thanks for waiting a week to tell me my credit card info has been stolen Sony. I am not a big fan of MSFT usually, but the next time I am buying a console I'm not buying a PS4.

ansy 16y ago
The article says there is no evidence credit card information was accessed.
- mrcharles 16y ago
  And it also says "we cannot rule out the possibility."
  - joezydeco 16y ago
    Sounds like lawyer-speak for "yeah, they got it".
    - estel 16y ago
      To me it sounds like lawyer-speak for "We don't think they do but we're covering our arses"
      - contextfree 16y ago
        Why can't it just mean "we don't have a clue whether they do or not?"
        sukuriant 16y ago
        Because then there wouldn't be a conspiracy theory, of course! (I'm not taking any chances, either way)
- lotusleaf1987 16y ago
  I absolutely do not trust them at this point. Why would I?

dman 16y ago

Holy Cow! This has to be one of the most serious breaches I remember in recent times. While I dont work in security and my security foo is weak it appears that they did not have a strong layered security apparatus in place? Is it just a coincidence that this breach and geohotz exploit happened around the same time?

orangecat 16y ago
It really looks like the PSN architecture assumed that the clients were trustworthy. If so, that's an epic Security 101 fail.
- marshray 16y ago
  And they used the same servers for development as for production. Isn't that non-PCI-compliant?
  - brown9-2 16y ago
    What is the source for the claim in your first question? I don't see this mentioned in the linked post.
    - marshray 16y ago
      I got this link from Slashdot: http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_... But don't hold that against me. :-) I clicked around a bit in the linked psx-scene forums and it looked like there was a decent basis for it.
    - deleted 16y ago
      [deleted]
- rbanffy 16y ago
  That would explain why they were so nervous about PS3 jailbreaking.

jasonneal 16y ago

How could they have gained access to passwords? Do they mean, rather, gained access to your secure password hash, or did they simply store passwords in an unencrypted format? Being a member of PSN, this has me concerned. I'm making it a point to change all of my security questions and passwords all throughout all websites I use.

marshray 16y ago
Not as easy as it sounds. You wouldn't believe the reaction I got from Mom when I asked her to change her maiden name.
- joeyh 16y ago
  Makes me wonder how many people just punch in "Maiden". Of course those security questions are nearly useless anyway.

hebejebelus 16y ago

There were sixty million[0] PSN accounts. This is impressive, and amounts to (judging by a quick search) the largest-scale ID (and possibly credit-card) theft ever [Not so, see child comment]. Not even factoring in credit card details, the usernames, emails, addresses, ages, passwords, mother's maiden names, favourite pets, of sixty million people is worth a hell of a lot. I have to wonder how much data that is, in terms of storage. How could you even take that without someone noticing? Hats off to whoever it was. Now, I'm off to change my passwords. Thank Christ I had the sense not to use a credit card to buy from PSN. [0] http://www.derangedshaman.com/2011/01/06/sonys-60-million-psn-users-means-zero-zilch-nada/ http://www.derangedshaman.com/2011/01/06/sonys-60-million-ps... [edit] On a related note, paypal refuses to let my change my password to something longer than 20 characters - or have spaces in my password. Why is this the case? Surely the only thing that an upper limit on the length of a password does is help the attacker.

samlevine 16y ago
fwiw the Heartland incident involved 130,000,000 records: http://datalossdb.org/ http://datalossdb.org/ Not to lessen the extent of this, but it's not nearly the biggest dataloss incident ever.
c2 16y ago
TJ Maxx data theft involved 45 million confirmed credit card/debit card numbers stolen, which I believe was more serious then this: http://www.msnbc.msn.com/id/17853440/ http://www.msnbc.msn.com/id/17853440/ Fact is people put most of that other information on Facebook anyway, so for 500 million people, you can quite easily find someone's age, birthday, pets, and much more just from their FB account.
joeyh 16y ago
Overestimating 100k per user, it would only be 6 terabytes. And all those low-entropy passwords etc should compress quite well.
- fragsworth 16y ago
  They would only compress well if you stored them in plaintext...

Hominem 16y ago

I haven't really been following this but there have been rumblings all week that a hacked firmware was released that allowed anyone who installed it, and twiddled with some other things, access to the PSN development and testing network. Anyone know more?

milkshakes 16y ago
you might be looking for rebug: http://rebug.me/ http://rebug.me/
bxr 16y ago
I personally don't know any more, but this might be a good starting point if you're interested: http://news.ycombinator.com/item?id=2482679 http://news.ycombinator.com/item?id=2482679 is a link to a post on reddit from a moderator of a forum that deals in ps3 modding. He outlines the situation, and his forum probably has some more information.
kmfrk 16y ago
There was a reddit thread on this that explains the gist of it: http://news.ycombinator.com/item?id=2482679 http://news.ycombinator.com/item?id=2482679.

parfe 16y ago

What the hell Sony? I just tried logging into http://us.playstation.com/psn/playstation-home/ http://us.playstation.com/psn/playstation-home/ the SSL connection to https://store.playstation.com https://store.playstation.com gave Error code: sec_error_unknown_issuer. It's like you're actively trying to make me never trust you again.

marshray 16y ago
Looks OK in my Firefox, says it's signed by Comodo UTN-USERFirst-Hardware. I am not making this up.
- gedaxiang 16y ago
  Isn't Comodo the CA that was compromised recently?
  - marshray 16y ago
    Yep, through the usertrust sub-CA even. https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho...

mrcharles 16y ago

This seems like a really big argument for never allowing your data to be stored by a 3rd party. Does anyone see any reason why these companies should do anything other than store the data locally on your system, encrypted/obfuscated, and then only ever send once, via encrypted connection, and then immediately delete the info remotely? I mean, if someone breaks in to my house and steals my PS3, they already have access to all of that information.

brudgers 16y ago
>"This seems like a really big argument for never allowing your data to be stored by a 3rd party." iTunes comes to mind: http://isc.sans.edu/diary.html?storyid=9136 http://isc.sans.edu/diary.html?storyid=9136 http://news.ycombinator.com/item?id=1488956 http://news.ycombinator.com/item?id=1488956 http://news.ycombinator.com/item?id=948757 http://news.ycombinator.com/item?id=948757
falcolas 16y ago
Much of ecommerce would go down the drain, if they got rid of remote storage of your details. No recurring billing, no "One-Click", no address books, etc...
- _delirium 16y ago
  It should at least be an option for me not to store it, if I prefer not to use "one-click" and similar features. I understand why stores prefer to save the information without giving me a choice (reduces friction for future purchases), but I'm not sure that's a good enough reason given the prevailing security track records. Either that, or perhaps there could be statutory penalties for data breaches. For example, if there was mandatory compensation of, say, $100/person for a data breach, companies might be incentivized to better think about whether they really need to store this data, and whether they're storing it safely.
  - dedward 16y ago
    Online retailers who handle their own CC processing tend to keep credit card information around if only for fraud/chargeback tracking in the future - being online opens you up to massive abuse if you don't keep it in check. A big player like sony should have been complying with PCI standards - but from what I've seen, that's not so difficult to pass and then forget about - people take shortcuts - and how many companies out there have ever had their processing revoked for NOT complying with PCI? That would be an interesting statistic.

vipivip 16y ago

Sad day, what's next for playstation owners Sony?

marshray 16y ago
Ordinarily I'd just say reformat it and install Linux, but....
- vipivip 16y ago
  Linux installation is easy piece of cake to HN audience, but nightmare to normal people.
  - deleted 16y ago
    [deleted]
  - ilconsigliere 16y ago
    Sony yanked linux support from PS3s after thousands of users had already paid for it. Tally that in the "Reasons to no longer support Sony" column.
    - chrischen 16y ago
      Somewhat untrue. You could still use linux, but just not in combination with continued (free) PSN access.
      - marshray 16y ago
        That was the theory anyway. Now we don't have PSN access either. We kept the family PS3 patched-up in good faith. Is there now a reasonable way for me to install Linux? Seriously, the kids are probably moving to Xbox and I have some supercomputing I'd like to do.
        ra 16y ago
        I'd like to know this too... I assume that now the keys have been discovered, PS3 should be fully retaskable?

maximilianburke 16y ago

I'm disappointed but not surprised. When I had to change my password a few months ago on the Sony developer's network site I was told that my new password was too similar to the last ones. I was wondering how they knew that, aside from storing the passwords in plain-text, something I'd assume they'd be too smart to do. I guess I gave them too much credit.

phaylon 16y ago
Genuine Question: They let you change your password without having you supply the old one?
- jimktrains2 16y ago
  Password reset link?
  - phaylon 16y ago
    That might explain it.
caf 16y ago
Well, they could try permuting your new password in a few different ways and seeing if any of those permutations match the old hash.
- JoachimSchipper 16y ago
  That's not practical. Password hashes should be slow, to stop dictionary attacks; and it's easy to imagine a couple thousand "similar" passwords (flip case of some characters? 256 possibilities for an 8-character password. Add year of birth? 20-50 possibilities. And so on.)
  - caf 16y ago
    Presumably the ratio between the rate of normal logins (each of which requires a single execution of the password hash) and the rate of password changes is at least a few thousand.

sdkmvx 16y ago

They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database. How many times does this have to happen before people realize that passwords are never to be stored in plaintext? The only exception is a client-side program that needs to log you in and in an ideal world that would be handled by a Kerberos-like ticket system.

marshray 16y ago
They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database. It could also mean that the attacker was in a position to observe the plaintext supplied by the user after it was decrypted (from SSL) but before it was authenticated (with a password hash algorithm). Or it could be that they're just not being too particular about the details, on the side of being overly conservative.

Splines 16y ago

It's too bad we don't know what's going on inside the sausage factory. It'd make for a very interesting post-mortem.

blhack 16y ago

Wow this sounds really really bad. As much as I dislike sony's actions in the Geohot case, and as much as "this is what you get for failing at security", I feel pretty bad for them right now (and even worse for all of their customers) >To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports. >We have also provided names and contact information for the three major U.S. credit bureaus below. At no charge, U.S. residents can have these credit bureaus place a “fraud alert” on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name.

r00fus 16y ago
I fail to see why Sony should be pitied, unless the details of the attack are laid out, and Sony shows that it was following good security practice. I see neither disclosure happening any time soon.
- blhack 16y ago
  It's probably too much of my mother and not enough of my father, but I can't stand watching people fail, no matter how much I hate them. I hate sony, but I still feel bad for them.

deleted 16y ago

[deleted]

unexpected 16y ago

This is unreal. What bothers me the most, is that when this happened to me one time before, that particular company paid for a year of credit monitoring services. In this case, Sony is too cheap to do even that, pointing you towards where you could download your credit report online. Ridiculous.

marshray 16y ago
It's too soon. I don't think anyone knows what Sony's going to end up paying here (Sony included).
lancepantz 16y ago
I believe they are obligated to by US law.
lawnchair_larry 16y ago
Lifelock is a scam that you are better off without anyway, but yeah, they definitely should provide some compensation. Unlikely though. They would rather sue people that want to run linux.

alexknight 16y ago

While I don't know the details of how this happened, it's a sure fire bet that they were not doing something right when it came to securing their infrastructure. How many times have we heard of big name companies running un-patched operating systems and SQL databases or even weak passwords? From the consumer end, this really sucks. Especially if their personal data was compromised.

aeontech 16y ago

Does anyone else find it odd that they "strongly recommend that you log on and change your password" instead of just force-resetting everyone's password and sending them an email with an activation link? Out of 60M subscribers, I'm certain that a large proportion will never see this message.

amackera 16y ago
Methinks that 99% of PSN users can't remember their own passwords.
deleted 16y ago
[deleted]
thenduks 16y ago
Agreed, not only that but you can't even login right now, so in another week all 60M users are supposed to remember to go and futz around with the PS3's clunky account UI to change their password? Personally, I have a couple passwords in use for low-risk services (like PSN) and just went and changed all my other passwords :)

michaelchisari 16y ago

So how do we sign up for the class action lawsuit?

rorrr 16y ago
You can do it right here. All you need is what, 30 people to get the class action status.

estel 16y ago

Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: http://www.giantbomb.com/news/good-news-psn-back-maybe-within-a-week-bad-news-everything-else-updated/3084/ http://www.giantbomb.com/news/good-news-psn-back-maybe-withi...

seiji 16y ago
Salt is bad for you: http://news.ycombinator.com/item?id=1209254 http://news.ycombinator.com/item?id=1209254
- cookiecaper 16y ago
  Salted hashes are better than unsalted hashes.
  - seiji 16y ago
    Against a GPU that can calculate five million hashes per second your salt isn't worth the paper it's printed on.
    - jbri 16y ago
      I don't know about you, but personally I think "crack one person's password in one day" is a much better situation than "crack everyone's password in one day".
    - ceejayoz 16y ago
      That's why you use a different salt per user.
    - perlgeek 16y ago
      Who prints out password salts anyway?
    - phsr 16y ago
      So we should just store the password in plain text then!! Or we could use the honor system, with no password!!

GrandMasterBirt 16y ago

Wait, "Password" was stolen? WTF they store unencrypted passwords?!?!?!!?! I sure hope they meant password hashes otherwise upset many people should be.

nuclear_eclipse 16y ago
Even if hashes are stolen, you should consider the original password stolen as well, because it's only a matter of time and effort to brute force the original password from the hash. Even if you use a really good password with a really good hash (like bcrypt), it still doesn't mean that they can't find the password, just that it will take more time to do so.
- derobert 16y ago
  A really good password with a really good hash takes more time for values of time exceeding far exceeding any human's lifespan. Assuming a 10-character random alphanumeric, that'd be 62¹⁰ possibilities (26 uppercase + 26 lowercase + 10 numbers = 62). Even given an insanely fast brcypt of 1µs, that's over thirteen thousand years to get to a 50% chance. Now, if your hash is a bad one, say MD5, then you're in trouble. GPUs could brute force that ten-character password within a year.

dirtbox 16y ago

Interesting fact for the day: 75 million accounts is a new world record for information theft.

guelo 16y ago

We've seen several examples recently of Japanese corporate culture's secrecy and lack of candor. Toyota, TEPCO nuclear plant and now Sony same pattern of not wanting to admit to the problem. I wouldn't bet on their long term competitiveness.

wmf 16y ago
I think corporate ass-covering is pretty pan-cultural. See RSA's recent "we're answering every question other than the one that everyone is asking" PR about the SecurID thing.
- yuhong 16y ago
  I know, there was a previous article on the cover-up culture that once made it to the top at HN.
  - alecco 16y ago
    For the lazy http://news.ycombinator.com/item?id=2088469 http://news.ycombinator.com/item?id=2088469
alecco 16y ago
Let's hold the asian bashing for a moment. Howard Stringer is Sony emperor... I mean Chairman, President and CEO. And he comes from Sony Entertainment (US) . He was the one pushing stuff like the Audio CD rootkit, DRM everything and BluRay in all PS3 consoles to force a format war. Some people consider this last trick as the move that got the previous admin gutted, I mean restructured, back in 2005. And he got the top job. Amazing guy. http://en.wikipedia.org/wiki/Howard_Stringer http://en.wikipedia.org/wiki/Howard_Stringer

moondowner 16y ago

Notice how they never apologize? The closest thing to apology, but it's not an apology, is: > "We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience." Sony apologizes only to Chuck Norris.

pero 16y ago
That is very standard legal. If they did so, the impending class action would already be over. I wouldn't be surprised if that blog post cost them well into 6 figures for legal fees. And that it took the full week to draft and approve--it is probably the reason this announcement took so long to emerge.
- moondowner 16y ago
  True. Big incidents like this require for companies, in this case Sony, to carefully choose their words. They are obliged to inform their customers.
jswanson 16y ago
The Japanese announcement is full of apology: "2011年4月21日よりPlayStation®NetworkおよびQriocity™の障害が継続しており、お客様および関係各位に多大なるご迷惑をおかけしておりますことを深くお詫び申しあげます。" Which is a polite and flowery way of apologizing for the ongoing interruption of service. http://cdn.jp.playstation.com/msg/sp_20110427_psn.html http://cdn.jp.playstation.com/msg/sp_20110427_psn.html
- moondowner 16y ago
  True, they are different probably because this (the Japanese announcement) is from Sony Corporation, and the link in English is probably from Sony Corporation of America.
  - ramchip 16y ago
    In Japan lawsuits are less common, and an apology is expected even if it's not your fault, so it shouldn't hurt their legal defense if they apologize. I think it won't be interpreted as an admission of guilt like it could be in America.

chrischen 16y ago

Any idea who's behind the data theft? I'm much more interested in that...

romland 16y ago
The REAL anonymous.
- Raphael 16y ago
  Well any criminal would not want to be identified.

famousactress 16y ago

These malicious actions have also had an impact on your ability to enjoy... Interesting. Is it not fair to also say the negligent actions that made these malicious ones possible had an impact? I'm completely sick of the way these press releases sound.

keithburgun 16y ago
Reminds me of 9/11 and no one in government taking any responsibility. Except Richard Clarke.

idheitmann 16y ago

For many folk who may not use PSN much or recently, the first concern I imagine would be to recall whether they ever provided Sony with the most sensitive things on that list. A quick gmail search tells me that they had my mailing address and full name, but I have no idea if I ever gave them my CC or DOB or SSN or Gitmo prisoner bar code or whatever else. I'm glad I use lastpass because I have a nice list of sites to update password info, but I imagine this process is going to take quite a while. Too bad I repeated that password so many times.

nwatson 16y ago

This is case-in-point for centralized log-archival-and-analysis tools like SenSage. No matter how secure you make your infrastructure, in situations like this you want evidence of all activity on your networks, computers, DB's, app servers, apps, etc. Storing log data related to this activity can consume petabytes over a multi-year span. I don't know what kind of forensic tools Sony's using, hopefully they have something like SenSage.

redthrowaway 16y ago

"Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: ... PlayStation Network/Qriocity password and login," Seriously? Even Sony is keeping passwords in plaintext? There wasn't a single competent person involved in the design of PSN who might have mentioned that was a terrible idea?

AndyKelley 16y ago
It could be that they simply obtained a hash and salt, from which it is still possible to obtain plaintext.
eneveu 16y ago
Sometimes, you explain why storing a password in plaintext is a terrible idea, but the business executives simply do not care, or think it's better to keep them available, in case somebody forgets it...

rickdale 16y ago

Thats ridiculous. Sony should feel in debt to their customers for such a security breach. I hope they catch the people responsible and give them jobs!

neilalbrock 16y ago

Frankly I'm in shock. That a company as large and experienced as Sony would allow this to happen, well it beggars belief. The contempt shown to customers, not just by Sony but by other large tech companies (I'm looking at you Apple) is disgusting. I choose not to be part of Facebook because I'd rather they didn't know every detail of my life. Now I have to consider if I want to use products from Sony because of concerns that they can't even protect my private data, which they force me to give them in order to use their services. Unbafuckinglievable.

pdenya 16y ago

"We greatly appreciate your patience, understanding and goodwill" - I'm all out of good will for Sony. I already canceled the credit card I had on file with them, hopefully nothing happens with my personal info.

dfischer 16y ago

http://psx-scene.com/forums/f177/sony-has-been-bad-boy-ridiculous-levels-spying-81093/ http://psx-scene.com/forums/f177/sony-has-been-bad-boy-ridic... "A well known hacker i don’t want to reveal here had all the Sony PlayStation Network functions 100% decrypted as well as providing some nice info about how Sony dealing with PSN members privacy in their online servers. Apparently, Sony server gathered everything they can from the PSN connected PS3 console. When i said everything, i meant it. Here, i make all the list of what they squeezed from the IRC chat logs conversation between the hackers. Sony monitors all messages over PSN. All connected devices return values sent to Sony server returns TV, Firmware version, Firmware type, Console model They also collects data in your USB attached device. Credit card sent as plain text, example: creditCard.paymentMethodId=VISA&creditCard.holderN ame=Max&creditCard.cardNumber=4558254723658741&cre ditCard.expireYear=2012&creditCard.expireMonth=2&c reditCard.securityCode=214&creditCard.address.addr ess1=example street%2024%20&creditCard.address.city=city1%20&cr editCard.address.province=abc%20&creditCard.addres s.postalCode=12345%20 *The best part of all, the list is stored online and updated when u login PSN and random. But, that’s not all, with the PSN functions fully decrypted, this hacker can use the function to get all games, DLC, you name it, from PSN store without paying anything."

swaits 16y ago
> Credit card sent as plain text This was debunked. It's encrypted on the wire.
- Natsu 16y ago
  What's your source on that?
  - swaits 16y ago
    It's talked about right in these very comments: http://news.ycombinator.com/item?id=2487412 http://news.ycombinator.com/item?id=2487412 The data is POSTed over SSL. C'mon, do you really think Sony sends credit card data across the wire in plaintext? If so, it would have been discovered the day the PS3 launched, like five years ago. And, its discovery wouldn't have required any system hacking, as described above. Is it amateur hour here?

edtechre 16y ago

"Wait, ENCRYPT credit numbers? I thought you said decrypt!"

ams6110 16y ago

I think that what we're seeing here is evidence that there's just too many ways to screw up handling personal information on line. The sane stance is to now assume that any profile you provide to any website will eventually become public, and proceed accordingly.

allending 16y ago

"+ OreoPoptart on April 26th, 2011 at 12:58 pm said: JUST STOP! FIX THE GOD DAMN PSN FIRST THEN POST THIS CRAP UP GEEZ" Heh.

deleted 16y ago

[deleted]

Osiris 16y ago

I'm just glad I got my Steam PC code from my Portal 2 disc activated just before PSN went offline.

rhdoenges 16y ago

This brings back memories of the Gawker breach, but Sony seemed so much more legitimate. It can happen to the best of companies, I guess. This is the worst security hack I've ever witnessed. This spells for Sony, yes, but even worse for the uncountable people whose credit card numbers just got nabbed. One hacker on the loose... The worst part is that this public breach is only a single event. All the companies that have our information could be hacked and Sony is only a visible example. It's similar to the BP oil spill: what other oil companies weren't running tight rigs? The disasters happened to BP and Sony, yes, but it is a reflection on their industries.

touchstone 16y ago

I think a lot of us are missing the big picture; thankfully not Tgebbs (see comment 22).

kristopher 16y ago

This appears to also have affected Sony in Japan, as well. It is interesting how this announcement differs from the Japanese announcement[0]. Japanese people are so paranoid about their identity that this cannot go well for Sony in Japan. It does not seem like Sony is preparing people for any sort of identity theft in Japan other than calling the card companies. They apologized and remarked at how they are gearing-up to better protect their users when the service reopens. [0] http://cdn.jp.playstation.com/msg/sp_20110427_psn.html http://cdn.jp.playstation.com/msg/sp_20110427_psn.html

touchstone 16y ago

an interesting update: http://torrentfreak.com/playstation-network-shut-down-to-end-piracy-free-for-all-110426/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Torrentfreak+%28Torrentfreak%29 http://torrentfreak.com/playstation-network-shut-down-to-end...

gildur 16y ago

Well, seeing it from a positive perspective, I did (finally) get the password changed on some sites =)

rbanffy 16y ago

While it's a big deal, let's be reasonable with our expectations of privacy. I know my street addresses, home and work, my e-mail addresses, significant URLs, credit cards, expired credit cards, buying habits, posts, messages, family relationships (mother, wife, ex-wife, kids, ex-girlfriends) etc are stored in a lot (probably more than a hundred) places. I have no expectation all that data will be kept secret for any length of time. I seriously doubt much of that data could be kept form a dedicated googler with lots of free time, much less from a determined criminal who wanted that data.

deleted 16y ago

[deleted]

D3lt4 16y ago

Damn it, Sony.

millerc 16y ago

I haven't seen this point mentioned anywhere yet, but... How many of you are willing to bet Sony will use the intrusion as an argument for material damages in court against GeoHot, somehow linking his exploit with the mode of intrusion? This is pure speculation of course. But I'm willing to bet serious money that Sony's "outside, recognized security firm" has been "requested (hint-hint, wink-wink)" to be on special lookout for any sign the exploit was a vector for the intrusion.

gorm 16y ago

> For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Am I the only one reacting on this? It's like they make it sound like YOU need to take care when it's they are the one to blame. Same with Skype on Android when they sent you an messaging telling you that YOU should be careful to install software because they have made a security hole for that software.

danparsonson 16y ago
I think what they mean is that the information harvested may now be used to perpetrate such scams - imagine receiving an email specifically addressed to you, containing information that you thought only Sony knew about. Would be pretty convincing (and people fall for less convincing emails all the time). Or a phone call? "Hi it's Bob from PSN here, we need to update your account with new card details following the recent security breach" etc.

tibbon 16y ago

Any idea if they properly Salted/Hashed the passwords, or if they just stored everything in the plain?

benhebert 16y ago

Poor Sony.

igorgue 16y ago

I like the first comment on the post: "Hope it come back quickly" And ultimately that's what people care about, that information most of them already share it via Facebook for FREE, funny thing, is that we already get spam deliver to our homes in shape of publicity. About the credit cards, these days most credit card issuers have pretty good security so they'll let you know and block your credit card if people used it in a weird way and believe me, I was a "victim" a couple of times already and it works very well. I join the 1st commenter. I wont be changing my credit cards because of this and I just care about playing my online games again... really I already got bored of Gran Turismo, Final Fantasy offline ;-).

shareme 16y ago

Japan Nuke Apology Two..same delayed response, same non-statement, same lack of transparency.. Where is Godzilla to stomp Sony's ass when we need him?