6 ms·
Sony loses 12,700 credit card numbers
- vipivip 15y agoWhat's going on Sony?
- JonnieCache 15y agoThey were forced to do an audit, and lo and behold, they'd been hacked and hadn't noticed. The same thing would no doubt be true of most large corporations.
- shareme 15y agoI have a feeling there might be more, as they refused to participate in the US Senate hearing..
- Almaviva 15y agoCredit card numbers were lost? Do they know that you can "take" data from computers without destroying it?
- potatolicious 15y agoSemantics. We all know what they meant, and the colloquial usage of "lost" is valid here - (i.e., "lost" as in lost control. You can "lose control" of your car without the steering wheel disappearing on you).
- cube13 15y agoOr the hard drives were actually stolen.
- huntero 15y agoThe scary part here is that this intrusion was only found because of a security review due to the PSN intrusion. If that hadn't of happened, who knows when/if they would have figured it out. How often does this type of thing happen and no one has ANY idea?
- lawnchair_larry 15y agoSpeaking as a "security person", it is really difficult to get anyone to care about security until it is too late. My estimate is that 999 or more of the Fortune 1000 are either owned, or just really lucky.
- deleted 15y ago[deleted]
- hammerdr 15y agoWhy do you have the 'text file hidden away which contains hundreds of CC numbers' if you found that source, communicated the issue and saw that the issue was resolved?
- deleted 15y ago[deleted]
- dfwefasd 15y agoYou are completely insane. Why do you care if anyone thinks that you're making up stories? And if someone did accuse you of making up stories, what are you going to do? Decrypt and show them the file with hundreds of credit card numbers? This is why well-meaning hackers end up with jail time whenever they're pulled over for a broken taillight.
- georgemcbay 15y agoThe whole line of thinking here is very odd to me. I mean, what good is evidence that you keep to prove you aren't lying if the evidence is never meant to be shown? And if it is meant to be shown you'd be committing a crime by doing it, which would be especially silly just to prove to someone you wouldn't make up such a mundane story. Either way you should just delete that file. It serves no useful purpose (eg. you can't show it to me to prove you're not a liar) and despite all the good intentions you have shown in the past in getting the issue fixed you are likely committing a crime simply by keeping a copy of it around.
- viraptor 15y ago> 12,700 non-US credit or debit card numbers and expiration dates [...] apparently from "an outdated database from 2007" Fortunately that means ~100% of those numbers are expired by now. Can expired numbers be used for anything evil?
- Cushman 15y agoCredit cards expire, but frequently the number remains the same. It's quite possible to just add four years to the expiration date and have a valid card. You still wouldn't have CCV, of course.
- viraptor 15y agoThanks for that info. So far I got a new number every time - but I'll have to pay attention in the future. Never knew it's allowed to recycle the number.
- Cushman 15y agoThis may be most common with debit cards— as we've noticed before that debit card numbers frequently include your account number (http://news.ycombinator.com/item?id=1939699 http://news.ycombinator.com/item?id=1939699)
- kmfrk 15y agoI suddenly begin thinking that there's a reason that my credit cards are worn down and have to be replaced once in a while.
- mirkules 15y agoI was recently looking up some guidelines on storing credit card information, and according to section 3.2 of the official PCI guidelines (https://www.pcisecuritystandards.org/documents/PCI%20SSC%20Quick%20Reference%20Guide.pdf https://www.pcisecuritystandards.org/documents/PCI%20SSC%20Q...), CCV is not allowed to be stored, along with PIN or Full Magnetic Stripe data. Hopefully, Sony didn't do that or they will also face hefty fines in addition to bad PR and lawsuits.
- robotmachine 15y agoCan someone please remind me to only deal with Sony in cash from here on out? If they 'lose' that it isn't my problem.
- kmfrk 15y agoTime to pass around those redeemable voucher card Amazon affiliate links. I think that's going to be the only way I'll by something from there.
- umjames 15y agoI wonder if they could make rechargeable PSN gift cards. You could put money on it via PayPal, and the only thing Sony stores is how much money is on the card instead of actual credit card info.
- Ideka 15y agoOh, come on. It's not like Sony LOST them. I mean, they got copied, but Sony still has them, right?
- zacharycohn 15y agoI don't think anyone is particularly concerned about whether or not Sony still has access to them. "Lost" in this case means "no longer has control of them." They have a copy, but so does someone else.
- kmfrk 15y agoLet this be a reminder to always check your monthly credit card statements.
- tailrecursion 15y agoWhat's happened here is that Sony has discovered a previously undetected attack that occurred in April. So this second attack is not as new as one might think.
- kennymeyers 15y agoJust to clarify Sony was just clarifying the initial attack's results. This isn't a second attack.
- cies 15y agoi never understand why we all so easily trust creditcards. i also do it. a system that basically needs an attacker to just see'n'remember both sides of your card (that you need to keep with you and not is safe) in order be able pay with your money until the card gets disabled or expires. i noticed in the US people use it to pay by phone, and shops tend to keep that data for convenient repeat purchases. i need a card for payments online and visits outside europe (especially visits to the US). i'm glad that i have one for those occasions, but i cannot say i think it is a safe system -- it is also constantly under attack. in the netherlands there's a payment system that most-if-not-all webshops are subscribing to. it redirect you from the shop to the internet banking app of your own bank, there you pay (with some 2-factor kind of authentication), after which you're redirected back. i cannot help feeling a lot safer. :)
- nialo 15y agoIt turns out that most of the security of credit cards takes place after the actual transaction. It's largely done by using software to look for transactions that look somehow wrong, or by reversing charges when you look at your bill at the end of the month and see an obviously incorrect charge. The point is that the system has effectively figured out that they can't make a system that is both sufficiently secure and sufficiently convenient in just a card, so it instead accepts that numbers will be stolen and tries to minimize the damage.
- daxelrod 15y agoIn the US, at least, it's largely a matter of incentives. By law, consumers are liable for at most $50 if their credit card info is used fraudulently by someone else. Credit card companies validate transactions against statistical models in an attempt to head off anything suspicious. EDIT: Thanks for reminding me of this, nialo. But often, it's the merchants who bear the cost of a fraudulent transaction. They have the least power to encourage more secure alternatives, because everyone already expects to be able to buy online with a credit card. Card companies in the US do have something similar to the system you mention called 3-D Secure[1], but it hasn't gained wide traction. The interface is implemented so badly and inconsistently that it looks like a phishing scam. But more fundamentally, consumers have no incentive to use it, since it shifts more liability onto them. [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
- dotBen 15y agoSony has repeatedly stated that its PSN servers and SOE servers are not part of the same network, so it remains unclear just how these two attacks are tied together then Sony says: "While the two systems are distinct and operated separately, given that they are both under the SONY umbrella, there is some degree of architecture that overlaps." This my friends is back-peddling 101. Also known as "Sony can't give a straight answer on whether their PSN and SOE networks are connected or not"
- derefr 15y ago"Overlapping architecture" is not the same thing as "same network." They might just mean that the two networks are built out of the same brands of hardware and same versions of the same software, which gives them similar vulnerability profiles.
- iuguy 15y ago> Also known as "Sony can't give a straight answer on whether their PSN and SOE networks are connected or not" Are you sure it's not just "Sony can't give a straight answer"? Take your pick from: * SOE Scandal * PSN Scandal * OtherOS removal * GeoHot Scandal * The BMG Rootkit Scandal * The Master Key Scandal And many, many more. I don't think they've been straight with their customers or the general public even once unless they've been caught out.
- geophile 15y agoSony has just never got the hang of digital. They used to have great radios, TVs, and decent audio equipment. You young'uns probably don't remember the Walkman but it was revolutionary. It was a highly portable cassette player, basically the ipod of its day. It's been downhill for Sony since then. To wit: - Minidisc - Memory stick - The 2005 audio CDs with bonus rootkit - PSN breach - SOE breach
- kenver 15y agoThere are a few negatives there for sure, but I think you're missing a couple of the ups too. The playstation for example was very successful, and is often credited as making gaming more popular and cool with 'normal' people. They've messed up a few things, but they still make good consumer products. I purchased a SONY TV and Blu Ray a year or two ago and I'm very happy with it. They're clearly not perfect, but to say everything they've done since the walkman has been a disaster isn't really fair.
- cypherpunks 15y agoOh come now. Their products mostly suck. Their support sucks. The Playstation, they did okay on, only now it turns out that if you bought one, crooks have your personal information. They cut corners on consumer security. Their laptops have tremendous numbers of mechanical failures. Their eReaders are slow, have glare, and have serious usability issues -- e.g. the page turn buttons are located in a spot where you can't comfortably press them. They bought Minolta, and ran it into the ground -- they've been promising a successor to the a700 for close to 5 years now without being able to ship. The lower-end cameras are innovative, but have serious, serious usability issues. The Minolta 5D was a wonderful camera. The early Sony successors copied and improved on it (a700 was the most usable camera ever made -- and the only one with a useful auto mode). The current ones made a new, broken interface. The support is gone -- warranty issues don't get fixed, and if you buy from Sony direct, heaven help you if you want a return. Your TV and Blu Ray aren't bad, but a bit overpriced and slightly lower quality relative to the competition. But that's not the point. 20 years ago, Sony was like Apple or Trader Joes. You couldn't go wrong buying from them. The quality was spectacular. Sony products didn't break. Today, you go wrong buying from them 95% of the time. 5% of their products are market-leading. They ship known defective products. It's a very different company. In terms of bringing gaming to the masses, you're thinking of the Nintendo, first with the NES, and many years later with the Wii.
- speleding 15y agoUpdate, 9:03PM EST: "This is NOT a second attack; new information has been discovered as part of our ongoing investigation of the external intrusion in April."
- wakeup 15y agoThis is major goodness...
- deleted 15y ago[deleted]
- MikeHo 15y agoSort of off topic, but is there anyone else getting a lot of telemarketed automated calls recently --- any correlation with the sony attack?