-
Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.
Sony had an exploit on their PSN password recovery page and is now fixed
- Thread starter Metalmurphy
- Start date
- Status
lowrider007
Licorice-flavoured booze?
http://sony.nyleveia.com/2011/05/17/warning-all-psn-users-your-accounts-are-still-not-safe/
"UPDATE 3: To clarify the situation, we had confirmed ourselves the method used last night, and contacted SCEE, SCEE have acted upon this information, we felt the information previously provided in our tweets and this article may have been a little too revealing to the vulnerability, thus we dumbed down the explanation of the security hole. We have provided SCEE with a detailed description of the security hole.
While its unclear at this time if they will actually patch the flaw while they have the system taken down, I can also confirm that the system went down approximately 15 minutes after I received a response from SCEE on the matter."
"UPDATE 3: To clarify the situation, we had confirmed ourselves the method used last night, and contacted SCEE, SCEE have acted upon this information, we felt the information previously provided in our tweets and this article may have been a little too revealing to the vulnerability, thus we dumbed down the explanation of the security hole. We have provided SCEE with a detailed description of the security hole.
While its unclear at this time if they will actually patch the flaw while they have the system taken down, I can also confirm that the system went down approximately 15 minutes after I received a response from SCEE on the matter."
toythatkills
Member
Some actual proof that the account has been accessed?lowrider007 said:
Metalmurphy
Member
How else would I have gotten those emails?toythatkills said:
TTP said:
Japanese account, servers are offline.
^^^^^^Hanmik said:
toythatkills
Member
I don't know. I'm not a hacker and I don't know how easy it would be to make an email appear to have come from somewhere else.Metalmurphy said:
If it's literally, totally impossible, then fair enough. If there's any chance at all that it's possible then you're making some quite major accusations here which may not be based in truth.
Combichristoffersen
Combovers don't work when there is no hair
Rubenov said:
Burn PSN to the ground and start from scratch
toythatkills said:
he is not making something up.. it was allready news yesterday..
http://gamerpunch.net/2011/05/18/so...ign-in-amidst-rumors-about-password-security/
I just want to know how he could change the password for a japanese account via the internet.. I tried and got the maintenance message everytime..
Metalmurphy
Member
They can fake the address you see on the "sender" field, but they can't fake the actual sender once you see the message details, which I posted already. They came from Sony.toythatkills said:
kurtrussell
Banned
luxarific said:
Didn't Geohot ask them for a job a few months ago?
This part would be forgeable, but it would not be placed where it is in the headers of the mail.toythatkills said:
Received: from lvp-sys-prdmx03.sonynei.net (mx3.sonynei.net [173.230.215.35])
by mx.google.com with ESMTP id x9si4116720pbj.255.2011.05.18.02.43.44;
Definitely not a fake.
Metalmurphy
Member
Hanmik said:
Honestly I don't know. I don't even remember if I changed it my self back when PSN came online for the first time. But it's possible that this exploit also allowed them to skip some of those checks. Lets face it, all accounts are saved on the same place, independent of region.
And another thing, if it was fake, how would they even known it was a Japanese account? I never said it was anywhere.
VGChampion
Member
kurtrussell said:
Sony would be pretty stupid to hire Geohot. I know companies do this but it seems he pretty much started the whole mess indirectly.
Tricky I Shadow
Banned
kurtrussell said:
Yeah. Too bad he withdrew his "application" after they sued him. Thank goodness the Store isn't back up. This hack could have been much worse if hackers had changed passwords and then gotten access to accounts whose rightful owners had funded PSN wallets, like mine. (I used prepaid cards, but the money is still in there. At least it better be.)
arnoldocastillo2003
Member
Yeah it happen to a co-worker of mine, someone else changed his password, he contacted SONY to see if they can reset his account.
The_Darkest_Red
Member
Uh oh.arnoldocastillo2003 said:
nofi said:
I meant to link to yesterdays News...
http://www.neogaf.com/forum/showpost.php?p=27889738&postcount=1873
you know... neogaf-> internet -> negoaf..
XeroSauce said:
There was a verification email, but he never clicked on the verification link and yet got the password change confirmation email afterwards.
I guess this "hack" somehow allows to intercept the confirmation email being sent to the user requesting a password reset, hence allowing someone else to confirm the password reset.
lowrider007
Licorice-flavoured booze?
http://sony.nyleveia.com/2011/05/17/warning-all-psn-users-your-accounts-are-still-not-safe/
"UPDATE 4: Last update on the topic most likely, i notice a lot of people are saying that we should not have posted this information and simply contacted Sony, and youre right in thinking this, however we contacted SCEE as soon as we had confirmed that the exploit was in fact real, the problem was that at the time there was a good 8-9 hour stretch where SCEE would not see our messages and given the rate at which the exploit method was spreading in the dark corners of the internet, we felt as though we needed to publicise the exploit advising users to change the emails used for their PSN accounts to secure them until Sony could patch the security hole.
Originally we posted rough details on how the exploit operated, to give further evidence to users that it was a valid reason for them to change their passwords, as with most news like this on the internet, people tend not to believe something until hoards of users have been affected, we posted an article on N4G advising PSN users to switch their email addresses which was promptly reported as spam/lame/fake by several users who refused to believe the news due to our site just being a small news outlet.
All along our main priority and focus has been to assist Sony and PSN users in keeping their accounts safe. If the current downtime for the web based forms results in the exploit being patched then our job is done and the potential thief of countless user accounts has been nipped in the bud as early as humanly possible.
Thank you to everyone that has taken our warnings seriously and acted upon it, and to SCEE for their swift response to the matter."
"UPDATE 4: Last update on the topic most likely, i notice a lot of people are saying that we should not have posted this information and simply contacted Sony, and youre right in thinking this, however we contacted SCEE as soon as we had confirmed that the exploit was in fact real, the problem was that at the time there was a good 8-9 hour stretch where SCEE would not see our messages and given the rate at which the exploit method was spreading in the dark corners of the internet, we felt as though we needed to publicise the exploit advising users to change the emails used for their PSN accounts to secure them until Sony could patch the security hole.
Originally we posted rough details on how the exploit operated, to give further evidence to users that it was a valid reason for them to change their passwords, as with most news like this on the internet, people tend not to believe something until hoards of users have been affected, we posted an article on N4G advising PSN users to switch their email addresses which was promptly reported as spam/lame/fake by several users who refused to believe the news due to our site just being a small news outlet.
All along our main priority and focus has been to assist Sony and PSN users in keeping their accounts safe. If the current downtime for the web based forms results in the exploit being patched then our job is done and the potential thief of countless user accounts has been nipped in the bud as early as humanly possible.
Thank you to everyone that has taken our warnings seriously and acted upon it, and to SCEE for their swift response to the matter."
Zoe said:
Yeah... when I saw the article about it, I actually tried to see if I could do the exploit w/ my own account.
Then I realized that if and when Sony fixes the exploit, they might come under the assumption that I was some hacker trying to break into my account, so I pretty much stopped after a few minutes of trying.
HaRyu said:Yeah... when I saw the article about it, I actually tried to see if I could do the exploit w/ my own account.
Then I realized that if and when Sony fixes the exploit, they might come under the assumption that I was some hacker trying to break into my account, so I pretty much stopped after a few minutes of trying.
Can you elaborate a bit about the procedure without giving too much away? I'm just curious about it.
- Status
Similar threads
- Locked