4 ms·

The article says there is no evidence credit card information was accessed.

by ansy 15y ago

mrcharles 15y ago
And it also says "we cannot rule out the possibility."
- joezydeco 15y ago
  Sounds like lawyer-speak for "yeah, they got it".
  - estel 15y ago
    To me it sounds like lawyer-speak for "We don't think they do but we're covering our arses"
    - contextfree 15y ago
      Why can't it just mean "we don't have a clue whether they do or not?"
      - sukuriant 15y ago
        Because then there wouldn't be a conspiracy theory, of course! (I'm not taking any chances, either way)
lotusleaf1987 15y ago
I absolutely do not trust them at this point. Why would I?
wewyor 15y ago
It also says it might have been, which is much more worrying to me than the lack of evidence; because before this sony had no evidence that their network was compromised. This whole thing seems like a great example of incompetence.
- iloveponies 15y ago
  It doesn't mean they either know, or don't know. It means their PR isn't willing to fully disclose the exact nature because if they confirm customer data was nicked, class actions will start off rather promptly, and if they say it certainly wasn't, they're seen as over-reacting.
- ansy 15y ago
  This compromise happened DAYS ago. Google was hacked by China in mid-December 2009 they didn't publicly announce what happened until January 12, 2010. What started to look like a harmless intrusion turned into compromised gmail accounts turned into a highly sophisticated attack on Chinese dissidents turned into a full scale assault on their infrastructure. People were still figuring out the extent of that attack a couple months later. While this is a bad security breach, if you follow security news at all you'd know computer security is a joke. The Rustock botnet operated for FIVE years with impunity on as many as 2.4 million rooted machines. People didn't even know they were owned; their computers worked perfectly fine like nothing was wrong. Every system at pwn2own gets owned in seconds and you can bet the black hats were there first. Everyone gets compromised. The only thing stopping a crippling cyber attack is whether someone feels it is beneficial to do so. I do not especially fault Sony for this. Google gets hacked. Microsoft gets hacked. The NSA gets hacked. The DoD gets hacked. JP Morgan Chase gets hacked. Just add another multi-national to the list. It's a systemic problem that nobody really cares enough about nor can we do much about it if we did care. EDIT: Just to give you another idea of how screwed we are from a security perspective. To paraphrase George Carlin[1], some programmers are really stupid. Did you ever notice how much stupid software you see? Think of how stupid the average programmer is, and realize half the programmers are stupider than that. And that bottom half? They probably work in IT, managing over engineered address books and accounting ledgers of the world while smarter people worry about cooler problems. [1] http://www.youtube.com/watch?v=8rh6qqsmxNs http://www.youtube.com/watch?v=8rh6qqsmxNs
  - daeken 15y ago
    Being a security guy, I agree that no amount of planning and intelligence will keep out a significantly determined attacker. However, this doesn't give you carte blanche to not think about security. All the evidence presented around this shows that they simply didn't make it difficult at all; as soon as the console fell, so did their system. They seem to have violated every rule in security. That is simply unacceptable. It's one thing to be attacked by determined people and fail eventually -- given enough time, everyone does -- but it's a completely different matter to give the keys to the castle to anyone with a rooted PS3.
Zakuzaa 15y ago
When credit cards are involved you really need to prepare for the worst case scenario.
- dedward 15y ago
  Thankfully that's what's great about credit cards (and let's not forget that) - you just ask the bank to deactivate the old one and no more transactions can go through. Also, you should in general not be liable for any fraudulent use of the number. Just dispute it. (my contract said I could be held liable for up to $50 of fraudulent use only in the case where the CARD was stolen and used prior to my reporting it.)
  - allwein 15y ago
    Right, but it's those poor schmucks who used their debit cards online as if they're credit cards that can get really screwed by this.
jordan0day 15y ago
Not to be trite, but as they say, absence of evidence is not evidence of absence. Especially considering the sentences immediately after the "there is no evidence..." statement, I'd be wary. I might just be jaded and they're really just trying to be forthcoming and helpful, but all that CYA-type-speak after that line makes me at least a little bit dubious that they're revealing all the details just yet.
- wnoise 15y ago
  I've always hated that saying. Absence of evidence is indeed evidence of absence, in situations where you would expect such evidence. It's absence of proof that isn't proof of absence.
  - lotusleaf1987 15y ago
    That was a c-c-c-combo breaker. Bravo at articulating that.
  - deleted 15y ago
    [deleted]

The article says there is no evidence credit card information was accessed.

by ansy 15y ago

The article says there is no evidence credit card information was accessed.

mrcharles 15y ago

And it also says "we cannot rule out the possibility."

joezydeco 15y ago
Sounds like lawyer-speak for "yeah, they got it".
- estel 15y ago
  To me it sounds like lawyer-speak for "We don't think they do but we're covering our arses"
  - contextfree 15y ago
    Why can't it just mean "we don't have a clue whether they do or not?"
    - sukuriant 15y ago
      Because then there wouldn't be a conspiracy theory, of course! (I'm not taking any chances, either way)

lotusleaf1987 15y ago

I absolutely do not trust them at this point. Why would I?

wewyor 15y ago

It also says it might have been, which is much more worrying to me than the lack of evidence; because before this sony had no evidence that their network was compromised. This whole thing seems like a great example of incompetence.

iloveponies 15y ago
It doesn't mean they either know, or don't know. It means their PR isn't willing to fully disclose the exact nature because if they confirm customer data was nicked, class actions will start off rather promptly, and if they say it certainly wasn't, they're seen as over-reacting.
ansy 15y ago
This compromise happened DAYS ago. Google was hacked by China in mid-December 2009 they didn't publicly announce what happened until January 12, 2010. What started to look like a harmless intrusion turned into compromised gmail accounts turned into a highly sophisticated attack on Chinese dissidents turned into a full scale assault on their infrastructure. People were still figuring out the extent of that attack a couple months later. While this is a bad security breach, if you follow security news at all you'd know computer security is a joke. The Rustock botnet operated for FIVE years with impunity on as many as 2.4 million rooted machines. People didn't even know they were owned; their computers worked perfectly fine like nothing was wrong. Every system at pwn2own gets owned in seconds and you can bet the black hats were there first. Everyone gets compromised. The only thing stopping a crippling cyber attack is whether someone feels it is beneficial to do so. I do not especially fault Sony for this. Google gets hacked. Microsoft gets hacked. The NSA gets hacked. The DoD gets hacked. JP Morgan Chase gets hacked. Just add another multi-national to the list. It's a systemic problem that nobody really cares enough about nor can we do much about it if we did care. EDIT: Just to give you another idea of how screwed we are from a security perspective. To paraphrase George Carlin[1], some programmers are really stupid. Did you ever notice how much stupid software you see? Think of how stupid the average programmer is, and realize half the programmers are stupider than that. And that bottom half? They probably work in IT, managing over engineered address books and accounting ledgers of the world while smarter people worry about cooler problems. [1] http://www.youtube.com/watch?v=8rh6qqsmxNs http://www.youtube.com/watch?v=8rh6qqsmxNs
- daeken 15y ago
  Being a security guy, I agree that no amount of planning and intelligence will keep out a significantly determined attacker. However, this doesn't give you carte blanche to not think about security. All the evidence presented around this shows that they simply didn't make it difficult at all; as soon as the console fell, so did their system. They seem to have violated every rule in security. That is simply unacceptable. It's one thing to be attacked by determined people and fail eventually -- given enough time, everyone does -- but it's a completely different matter to give the keys to the castle to anyone with a rooted PS3.

Zakuzaa 15y ago

When credit cards are involved you really need to prepare for the worst case scenario.

dedward 15y ago
Thankfully that's what's great about credit cards (and let's not forget that) - you just ask the bank to deactivate the old one and no more transactions can go through. Also, you should in general not be liable for any fraudulent use of the number. Just dispute it. (my contract said I could be held liable for up to $50 of fraudulent use only in the case where the CARD was stolen and used prior to my reporting it.)
- allwein 15y ago
  Right, but it's those poor schmucks who used their debit cards online as if they're credit cards that can get really screwed by this.

jordan0day 15y ago

Not to be trite, but as they say, absence of evidence is not evidence of absence. Especially considering the sentences immediately after the "there is no evidence..." statement, I'd be wary. I might just be jaded and they're really just trying to be forthcoming and helpful, but all that CYA-type-speak after that line makes me at least a little bit dubious that they're revealing all the details just yet.

wnoise 15y ago
I've always hated that saying. Absence of evidence is indeed evidence of absence, in situations where you would expect such evidence. It's absence of proof that isn't proof of absence.
- lotusleaf1987 15y ago
  That was a c-c-c-combo breaker. Bravo at articulating that.
- deleted 15y ago
  [deleted]