6 ms·

IRC chat log of PSN hackers

163 points by ssclafani 16y ago

dsteinweg 16y ago
They seemed to be concerned about the lack of security they were witnessing, and they also alluded to "this could be bad in the hands of a spammer". If this log is real, is it truly the conversation of those that took the data?
- bcrescimanno 16y ago
  I'm with you on all points; however, what I find interesting is that these guys talk explicitly about the credit card data being available via the path they took. If these are the same people--or if perhaps it was someone lurking in the channel--the suggestion is that the technique used would have exposed the credit card data of these users--despite Sony claiming that they felt it was unlikely. I'm not sure there's a lot of "news" to this post; my feeling is that if Sony, "isn't ruling out the possibility" that my credit card information was stolen, I'm working under the assumption that it was. I'd encourage everyone else who was subscribed to PSN to do the same.
  - marshray 16y ago
    Right, so what changed in mid-April then to prompt Sony to pull their own plug? All I can figure is either Sony saw evidence that someone was sniffing their decrypted SSL traffic, or Sony is exaggerating a little (or passive-aggressively erring on the side of it) to bring the heat of financial crimes down on the console/PSN hackers. The latter seems like a reeely expensive and painful way to combat a few console hackers. I glanced at some PSN domains and noticed that their certs were fairly old and not revoked, and they were being served by some kind of 3rd party DDoS mitigation service. They're likely using some form of SSL offload hardware, which might provide more opportunity for the unencrypted (now plain HTTP) traffic to pass in view of a compromised node.
  - uxp 16y ago
    They only talk about the unencrypted credit card data available to the console, not to PSN. This chat happened weeks before whoever gained access into PSN's network. Basically the same thing as pointing out the flaws in someone storing their passwords in a plain text file on their desktop. It isn't secure, but you'd have to get access to the single machine before you could get anywhere else. I agree. This isn't much for "news". I am, however, curious on the repercussions of the current hack of other services tied to the PSN network, like Netflix, that aren't directly gaming related. Do you think it will make companies give pause to developing dedicated clients for 3rd party services on game consoles that rely on the manufacturer of the console to maintain a network outside of the 3rd parties control?
- marshray 16y ago
  Looks to me like guys trying to get banned PS3s back on the game network, not steal user info and credit card numbers. [user12] know this, sony in realtime, monitors all messages over psn [user12] I verified that, its part of my privacy threats thing I am doing [user5] ok too bad id like the psn messenger on pc [user12] the realtime monitoring is a bit bothersome to me It seems plausible though that people were using this info to do things which violated Sony's security model and that their security model also didn't effectively separate credit card info from the game data. For example, there were claims a few weeks ago (Wired or ARS I think) that they were all mixed together in the same SSL stream.
calpaterson 16y ago
Could someone please provide a précis?
- tomjen3 16y ago
  Please there is no reason to use words that most people here don't know. Plenty of people who frequent HN are non native speakers of English. To save others the trouble, calpaterson asked for a resume.
  - sachinag 16y ago
    Um, no. A précis is a summary. Also, we all have Google to look up words we don't know.
  - bcrescimanno 16y ago
    Actually, I think what he was more accurately asking for was a summary--or "Cliff's Notes Version"
  - mcav 16y ago
    Which isn't much better. "summary" is clearer.
  - deleted 16y ago
    [deleted]
  - skorgu 16y ago
    I think I would have gone with "summary" personally. Resume is rarely used (in the US anyway) as describing anything but a summary of credentials and work history for the purposes of applying for employment. Or, given that this is the internet, perhaps a "tl;dr" would be more appropriate.
  - re_chief 16y ago
    Not quite; I believe calpaterson was asking for a summary. Also, I understand your point, but it isn't terribly difficult to Google "precis" and figure out the definition -- and once you do, you've added a new word to your vocabulary, which is hardly ever a bad thing.
uxp 16y ago
This is old. Here is the same pastie, but posted on February 16, 2011 http://pastie.org/private/97oth9v5tspkiztwwdmnga http://pastie.org/private/97oth9v5tspkiztwwdmnga They aren't talking about the PSN Hack that brought down the network this time, they are going back and forth about how PSN stores the user's CC information in plain text on the console and that a shady/grey custom firmware has the potential to skim that information off the hardware and onto a bad guy's server. The only slightly frightening thing about this is how they allude to the idea that this plain text CC information and security codes are transmitted over plain text, but that information is false. All transactions done between your PS3 console and the PSN network were done over SSL.
- incant 16y ago
  I don't think "user2" is claiming that the credit card information was sent in plaintext: normally you ATLEAST enccrypt the securtity code, even if its ssl That seems to refer to encrypting the CC security code before sending it over SSL using public key encryption, which is good practice if you subscribe to defence in depth. But it's nothing I'd get upset about.
  - marshray 16y ago
    Right, it's just how HTML forms work.
    - deleted 16y ago
      [deleted]
deleted 16y ago
[deleted]
- tezmc 16y ago
  Anyone in the channel could have posted it from their own IRC logs - most IRC programs will allow you to log everything you see. That they've censored the nicknames of the people talking before posting gives me the feeling that it was probably one of the people talking in the channel that posted it.
mikle 16y ago
This is fascinating. As a developer, I enjoy reading such logs and stories. I like the thought that if you make something good, popular or interesting, there will be someone that will admire your work, play with it and try to break it.
rkon 16y ago
"#define rand() 4" Pure genius -- fool the hackers by making your "random" number static, they'll never guess! Now that PSN users are actually seeing money ciphered from their debit accounts, it's only a matter of minutes until the class action lawyers are all over this.
- damncabbage 16y ago
  From the context, this appears to be a joke (see http://xkcd.com/221/ http://xkcd.com/221/), not a serious accusation.
  - rkon 16y ago
    It's also a reference to when the PS3 was first cracked, which was possible because they weren't really using random numbers to generate keys. So yes, it is a serious accusation that points out their consistently lax programming techniques when it comes to security.
    - mukyu 16y ago
      No. The problem was that one of the parameters they used in their ECDSA signatures, k, was the same at least once. This allowed the key to be computed with simple math, but the generation of the key itself was not the issue.
eof 16y ago
http://pastebin.com/8YNDuFCw http://pastebin.com/8YNDuFCw line 177 fixed for new lines

163 points by ssclafani 16y ago

They seemed to be concerned about the lack of security they were witnessing, and they also alluded to "this could be bad in the hands of a spammer". If this log is real, is it truly the conversation of those that took the data?

bcrescimanno 16y ago
I'm with you on all points; however, what I find interesting is that these guys talk explicitly about the credit card data being available via the path they took. If these are the same people--or if perhaps it was someone lurking in the channel--the suggestion is that the technique used would have exposed the credit card data of these users--despite Sony claiming that they felt it was unlikely. I'm not sure there's a lot of "news" to this post; my feeling is that if Sony, "isn't ruling out the possibility" that my credit card information was stolen, I'm working under the assumption that it was. I'd encourage everyone else who was subscribed to PSN to do the same.
- marshray 16y ago
  Right, so what changed in mid-April then to prompt Sony to pull their own plug? All I can figure is either Sony saw evidence that someone was sniffing their decrypted SSL traffic, or Sony is exaggerating a little (or passive-aggressively erring on the side of it) to bring the heat of financial crimes down on the console/PSN hackers. The latter seems like a reeely expensive and painful way to combat a few console hackers. I glanced at some PSN domains and noticed that their certs were fairly old and not revoked, and they were being served by some kind of 3rd party DDoS mitigation service. They're likely using some form of SSL offload hardware, which might provide more opportunity for the unencrypted (now plain HTTP) traffic to pass in view of a compromised node.
- uxp 16y ago
  They only talk about the unencrypted credit card data available to the console, not to PSN. This chat happened weeks before whoever gained access into PSN's network. Basically the same thing as pointing out the flaws in someone storing their passwords in a plain text file on their desktop. It isn't secure, but you'd have to get access to the single machine before you could get anywhere else. I agree. This isn't much for "news". I am, however, curious on the repercussions of the current hack of other services tied to the PSN network, like Netflix, that aren't directly gaming related. Do you think it will make companies give pause to developing dedicated clients for 3rd party services on game consoles that rely on the manufacturer of the console to maintain a network outside of the 3rd parties control?
marshray 16y ago
Looks to me like guys trying to get banned PS3s back on the game network, not steal user info and credit card numbers. [user12] know this, sony in realtime, monitors all messages over psn [user12] I verified that, its part of my privacy threats thing I am doing [user5] ok too bad id like the psn messenger on pc [user12] the realtime monitoring is a bit bothersome to me It seems plausible though that people were using this info to do things which violated Sony's security model and that their security model also didn't effectively separate credit card info from the game data. For example, there were claims a few weeks ago (Wired or ARS I think) that they were all mixed together in the same SSL stream.

calpaterson 16y ago

Could someone please provide a précis?

tomjen3 16y ago
Please there is no reason to use words that most people here don't know. Plenty of people who frequent HN are non native speakers of English. To save others the trouble, calpaterson asked for a resume.
- sachinag 16y ago
  Um, no. A précis is a summary. Also, we all have Google to look up words we don't know.
- bcrescimanno 16y ago
  Actually, I think what he was more accurately asking for was a summary--or "Cliff's Notes Version"
- mcav 16y ago
  Which isn't much better. "summary" is clearer.
- deleted 16y ago
  [deleted]
- skorgu 16y ago
  I think I would have gone with "summary" personally. Resume is rarely used (in the US anyway) as describing anything but a summary of credentials and work history for the purposes of applying for employment. Or, given that this is the internet, perhaps a "tl;dr" would be more appropriate.
- re_chief 16y ago
  Not quite; I believe calpaterson was asking for a summary. Also, I understand your point, but it isn't terribly difficult to Google "precis" and figure out the definition -- and once you do, you've added a new word to your vocabulary, which is hardly ever a bad thing.

uxp 16y ago

This is old. Here is the same pastie, but posted on February 16, 2011 http://pastie.org/private/97oth9v5tspkiztwwdmnga http://pastie.org/private/97oth9v5tspkiztwwdmnga They aren't talking about the PSN Hack that brought down the network this time, they are going back and forth about how PSN stores the user's CC information in plain text on the console and that a shady/grey custom firmware has the potential to skim that information off the hardware and onto a bad guy's server. The only slightly frightening thing about this is how they allude to the idea that this plain text CC information and security codes are transmitted over plain text, but that information is false. All transactions done between your PS3 console and the PSN network were done over SSL.

incant 16y ago
I don't think "user2" is claiming that the credit card information was sent in plaintext: normally you ATLEAST enccrypt the securtity code, even if its ssl That seems to refer to encrypting the CC security code before sending it over SSL using public key encryption, which is good practice if you subscribe to defence in depth. But it's nothing I'd get upset about.
- marshray 16y ago
  Right, it's just how HTML forms work.
  - deleted 16y ago
    [deleted]

deleted 16y ago

[deleted]

tezmc 16y ago
Anyone in the channel could have posted it from their own IRC logs - most IRC programs will allow you to log everything you see. That they've censored the nicknames of the people talking before posting gives me the feeling that it was probably one of the people talking in the channel that posted it.

mikle 16y ago

This is fascinating. As a developer, I enjoy reading such logs and stories. I like the thought that if you make something good, popular or interesting, there will be someone that will admire your work, play with it and try to break it.

rkon 16y ago

"#define rand() 4" Pure genius -- fool the hackers by making your "random" number static, they'll never guess! Now that PSN users are actually seeing money ciphered from their debit accounts, it's only a matter of minutes until the class action lawyers are all over this.

damncabbage 16y ago
From the context, this appears to be a joke (see http://xkcd.com/221/ http://xkcd.com/221/), not a serious accusation.
- rkon 16y ago
  It's also a reference to when the PS3 was first cracked, which was possible because they weren't really using random numbers to generate keys. So yes, it is a serious accusation that points out their consistently lax programming techniques when it comes to security.
  - mukyu 16y ago
    No. The problem was that one of the parameters they used in their ECDSA signatures, k, was the same at least once. This allowed the key to be computed with simple math, but the generation of the key itself was not the issue.

eof 16y ago

http://pastebin.com/8YNDuFCw http://pastebin.com/8YNDuFCw line 177 fixed for new lines