Support NeoGAF

[beast786]

I've got Mortal Kombat lying on my tv stand still in its wrap. If they do not have PSN up by the time my exams are finished next week, I'll return it and buy the Xbox version. Sorry Kratos.

so you werent gonna play till your exams are finished anyway. and you want a free game.

 

[Fourth Storm]

so you werent gonna play till your exams are finished anyway. and you want a free game.

Yes. My personal information is now in the possession of criminals. I'm done. I'm not about to get dragged into an idiotic argument and wind up banned before E3.

 

[lucius]

If the free game is a good one I might give them my info again if not one free month of PSN plus won't do it should be at least 3 months.

 

[USC-fan]

Doesn't matter what any ones says Anonymous fuck up attacking sony.

I love how someone is sending out press releases from "Anonymous" saying we didnt have anything to do with this. How the fuck can you say this when you have no control over anyone? They found the Anonymous files planted on Sony's servers.

Funny this is real first successful attack Anonymous has done. You only fucked over millions of the consumer you been fighting for....FBI going to be all over 4chan but really they been there the whole time.

 

[beast786]

Yes. My personal information is now in the possession of criminals. I'm done. I'm not about to get dragged into an idiotic argument and wind up banned before E3.

I am not dragging anything. Just asked you a simple question.

You said you had exams and couldnt play. Now you are talking about for the first time regarding personal information. But free game would have fixed all that?

 

[bigtroyjon]

I am a Sony supporter, but I in no way feel they are perfect in the way they handled this. I do however feel they have done what the majority of big companies would have done. Nothing will ever please everyone....best you can hope for is "good enough"

If the majority of the big companies have Sony's security then everyone in the civilized world has their info in serious trouble right now.

 

[babyghost853]

The Wise Old Man[/B]]Bleh, I can't even remember the last game I bought & played for the PS3. Maybe KZ2? I dunno. Assuming some hacker isn't using my credit card to purchase ten metric tons of fruit by the foot, I'm really OK with what's going on here. Wait, I didn't even enter a credit card into my PS3 system, so what's the problem here?

Sony rushed to release a machine that they didn't fully understand the fully workings of or it's vulnerabilities. Developers couldn't figure it out and hackers were quick to exploit it.

Wait, what?

 

[sonikokaruto]

Doesn't matter what any ones says Anonymous fuck up attacking sony.

I love how someone is sending out press releases from "Anonymous" saying we didnt have anything to do with this. How the fuck can you say this when you have no control over anyone? They found the Anonymous files planted on Sony's servers.

Funny this is real first successful attack Anonymous has done. You only fucked over millions of the consumer you been fighting for....FBI going to be all over 4chan but really they been there the whole time.

1. Anonymous is not 4chan
2. Anonymous really is not doing it.
3. Anonymous already has a lot of enemies
4. Congress wants to restrict net access
5. Anonymous helped wikileaks (supposedly)
6. Anonymous is a threat to government

If you can't or are not able to connect the damn dots, Sony is te least of all the troubles. Why the fuck does the FBI and congress and shit want to defend Sony? They just want to find leads to get rid of threats to them.

Also, any service is open to any attack, so, you guys almost making death threats are only creating more lulz

Plz, look at the bigger picture. I don't want this Sony incident to be a cause to restrict and track all net traffic. Open your eyes, they want to control you. Remember the interactive music cd's. Anonymous is only trying to make a point, and this whole mess is just turning into a giant honeypot. Open your eyes. It's your console. It's your games. You're not renting them or lending them. Open your eyes.

 

[USC-fan]

1. Anonymous is not 4chan
2. Anonymous really is not doing it.
3. Anonymous already has a lot of enemies
4. Congress wants to restrict net access
5. Anonymous helped wikileaks (supposedly)
6. Anonymous is a threat to government

If you can't or are not able to connect the damn dots, Sony is te least of all the troubles. Why the fuck does the FBI and congress and shit want to defend Sony? They just want to find leads to get rid of threats to them.

Also, any service is open to any attack, so, you guys almost making death threats are only creating more lulz

Plz, look at the bigger picture. I don't want this Sony incident to be a cause to restrict and track all net traffic. Open your eyes, they want to control you. Remember the interactive music cd's. Anonymous is only trying to make a point, and this whole mess is just turning into a giant honeypot. Open your eyes. It's your console. It's your games. You're not renting them or lending them. Open your eyes.

Anonymous is a threat to government.

How the fuck do you come up with that?

Simple fact sony been using the same server for years. Who would want to hack them and steal info? No one was even looking at it until Anonymous went on the attack. From what everyone saying it wasnt that hard to hack bc they were using old stuff with no firewalls...

 

[sonikokaruto]

Anonymous is a threat to government.

How the fuck do you come up with that?

Simple fact sony been using the same server for years. Who would want to hack them and steal info? No one was even looking at it until Anonymous went on the attack. From what everyone saying it wasnt that hard to hack bc they were using old stuff with no firewalls...

Read what I posted. Anonymous is just an excuse. It may even be planted.

 

[Dedication Through Light]

Well I hope CNET learns to stop using irc chats and etc as sources

Still coping with the aftereffects of a pair of attacks that has compromised as many as 100 million accounts and which caused two online gaming services to be taken offline, Japanese electronics giant Sony is considering offering a reward for information leading to the arrest and prosecution of the attackers, people familiar with the matter say.

Meanwhile, Sony denied assertions by computer security expert Gene Spafford during a Congressional hearing Thursday that it had been running outdated versions of Web server software and had not been using a firewall on its servers. In a statement from Patrick Seybold, Sony's senior director, Corporate Communications and Social Media, that's expected to be published on Sony's PlayStation blog, the company was using updated software and had "multiple security measures in place." Here's the statement in full:

"The previous network for Sony Network Entertainment International and Sony Online Entertainment used servers that were patched and updated recently, and had multiple security measures in place, including firewalls."


Read more: http://news.cnet.com/8301-1009_3-20060661-83.html#ixzz1Ld8BVi5P

 

[Kaako]

Separately, Sony President Kaz Hirai sent a letter to Connecticut senator Richard Blumenthal containing a detailed timeline of the attack and Sony's response to it. The letter contains previously undisclosed details about the attack and the hardware Sony uses to run its gaming services.

The letter, which is embedded below, says that the systems involved use 130 servers and 50 distinct software programs. Sony first noticed the attack on April 19, when its network team discovered that several PlayStation Network servers had rebooted themselves unexpectedly. Four servers were immediately taken offline in order to figure out what was going on. By the next day, it was clear that another six had been attacked, and they were taken offline as well. By April 23, computer forensic teams confirmed that intruders had used what Sony describes as "very sophisticated and aggressive techniques to obtain unauthorized access to the servers and hide their presence from the system administrators" and had deleted log files showing the footprints of where in the system they had been. By April 24, Sony had hired three different computer security firms to investigate the attack.

Read more: http://news.cnet.com/8301-1009_3-20060661-83.html#ixzz1LdAyEUJl

I said damn. So they were using updated/patched software and firewalls?

 

[heyf00L]

I said damn. So they were using updated/patched software and firewalls?

Well of course they had firewalls. Any household with a router and XP SP2 is behind 2.

But anyway, yeah it's not weird for them to be fully-updated and get hacked. That's exactly what "zero-day" means. So this was likely a zero-day exploit.

 

[RedSwirl]

this is why local splitscreen is necessary.

Damn straight. Thank God I bought the PS3 version of Portal 2 and registered the Steam version on day one. Had some great splitscreen co-op with a cousin in the time PSN has been down.

 

[WickedAngel]

you have an overblown perception of how safe anything in this world truly is.

No. I do this sort of thing for a living; I do not practice network security on the scale that Sony would but the fundamental approach to it is the same whether you're working with SMBs or Enterprise-class clients.

Simply put, there are things you just don't do no matter how big or small you are (For instance, they stored critical data in plaintext format). Compare/contrast that with the LastPass breach this week, which resulted in the possible leak of encrypted blob files and salted hashes that are nigh uncrackable with a good password.

I'm glad that you don't really care at all about the rest of this forum and their desires to actually play most of the games they've bought recently.

Though... I'm not even surprised at your stance.

On the "Bad Shit that Can Happen in Your Life" scale of 1-10, with 1 being indigestion and 10 being a slow, painful death, a lack of access to one's videogames ranks around .2. Identity theft ranks at about an 8, but Sony is offering credit monitoring services that should ease that problem.

 

[Bregor]

On the "Bad Shit that Can Happen in Your Life" scale of 1-10, with 1 being indigestion and 10 being a slow, painful death, a lack of access to one's videogames ranks around .2. Identity theft ranks at about an 8, but Sony is offering credit monitoring services that should ease that problem.

It's no good telling people that being unable to play videogames is inconsequential when the subject of discussion is how well people trust and like the company that is providing them access to online play. Sony's ability to provide their customers with reliable, trust-able online play is the very core of the issue, and there is no reason for customers to have a (business) relationship with Sony if Sony cannot satisfy them.

 

[WickedAngel]

It's no good telling people that being unable to play videogames is inconsequential when the subject of discussion is how well people trust and like the company that is providing them access to online play. Sony's ability to provide their customers with reliable, trust-able online play is the very core of the issue, and there is no reason for customers to have a (business) relationship with Sony if Sony cannot satisfy them.

There isn't even a discussion to be had on the issue as they've proven themselves untrustworthy. Knowing what we know now, there is no reason to ever trust Sony again with critical data.

You're free to be bought off with some paltry token like a free game; I will forgo said trinket and vow to never provide them with any data of consequence that belongs to me. PS3 stays offline henceforth.

 

[arnoldocastillo2003]

Ok i have to say this, about this article: http://news.cnet.com/8301-1009_3-20060661-83.html#ixzz1LdAyEUJl

In this part:

By April 25, it had determined that the attack had involved some credit card accounts. Consumers were notified the next day, though Sony did not know initially that the credit card accounts had been compromised.

Read more: http://news.cnet.com/8301-1009_3-20060661-83.html#ixzz1LdgPAiPb

This is false SONY knew or at least were suspicious about the CC being lost by the 24th and maybe by 23, maybe by 25 it was a confirmed action by SONY with the 3 security firms.

 

[cpp_is_king]

Simply put, there are things you just don't do no matter how big or small you are (For instance, they stored critical data in plaintext format).

People keep saying this, but I haven't seen any proof that it's true.

 

[Averon]

People keep saying this, but I haven't seen any proof that it's true.

It's not true. Nothing was in plain text format. The passwords were hashed, and the CC info was encrypted.

 

[itxaka]

It's not true. Nothing was in plain text format. The passwords were hashed, and the CC info was encrypted.

just hashing make it a bit difficult to crack. Also probably 90% of the accounts have an easy to crack password (hashes computed, top 100 passwords) so its basically like if they had them in plain text actually. You gotta salt them man!

 

[TTP]

People keep saying this, but I haven't seen any proof that it's true.

People keep being misinformed. Not their fault tho.

 

[cpp_is_king]

It's not true. Nothing was in plain text format. The passwords were hashed, and the CC info was encrypted.

Well, just to be clear, I haven't seen any proof that it's not true either. For example, there were some anecdotal reports of people saying that when they changed their password it would complain if the password was the same or similar to your old one. Certainly this could be made secure by by encrypting the plaintext password, although you'd have to store the key somewhere, and as such the key is vulnerable to being compromised / discovered.

 

[arnoldocastillo2003]

just hashing make it a bit difficult to crack. Also probably 90% of the accounts have an easy to crack password (hashes computed, top 100 passwords) so its basically like if they had them in plain text actually. You gotta salt them man!

Thats not true, you need SONY algorithm to crack´em! it maybe not as easy as you say.

 

[WickedAngel]

It's not true. Nothing was in plain text format. The passwords were hashed, and the CC info was encrypted.

People keep being misinformed. Not their fault tho.

Sony must be misinformed then:

http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/

I consider any information of a personal nature to be "critical". I didn't say that all data was in plaintext, nor did I specifically mention credit card/passwords. Having access to massive amounts of personal data can provide other venues of accessing accounts (Social engineering, account recovery manipulation, etc.)

Actually, Sony is misinformed as any system that doesn't recognize massive amounts of data being siphoned off is anything but "sophisticated". Any of the common Enterprise-class IDS' would have raised a red flag on that.

 

[PJV3]

PS4- PS camera and full retina scan become mandatory, or maybe some kind of PSanal probe.

 

[PJV3]

oops!

 

[cpp_is_king]

Thats not true, you need SONY algorithm to crack´em! it maybe not be easy as you say.

It's safer to use a well-known hashing algorithm than try to invent your own. Ironically, hashing is trivially defeatable on anything less than 9 or so characters. These days your password needs to be at least 10 characters with a mix of letters, numbers, and symbols, and it needs to be completely unintelligible and not even related to any spoken / written language.

 

[arnoldocastillo2003]

PS4- PS camera and full retina scan become mandatory, or maybe some kind of PSanal probe.

OMG! LOL! insanity level coming back!

 

[Kaizer]

While I do miss PSN, I just got Star Ocean 4 and I'm loving it so far, so I can bare the wait.

 

[arnoldocastillo2003]

It's safer to use a well-known hashing algorithm than try to invent your own. Ironically, hashing is trivially defeatable on anything less than 9 or so characters. These days your password needs to be at least 10 characters with a mix of letters, numbers, and symbols, and it needs to be completely unintelligible and not even related to any spoken / written language.

Well, that sucks, nevermind, shit is pointless really.

 

[Psi]

PS4- PS camera and full retina scan become mandatory, or maybe some kind of PSanal probe.

Suddenly the Move design makes a lot more sense.

 

[Nakiro]

People keep being misinformed. Not their fault tho.

If we didn't have the information out in the open I would agree that it's not their fault, but eating up everything that's been told to you like a sheep will just spread more false information around.

If there is one thing I've learned about this whole debacle is that 90% of the people don't check their sources, and believe everything that the media throws at them.

Every time I see an article saying that 77 million people have had their credit card numbers exposed makes my eyes roll.

 

[itxaka]

Thats not true, you need SONY algorithm to crack´em! it maybe not as easy as you say.

as far as I know all hashes are easily cracked if they are not salted. I don't think Sony did their own hash implementation.

And there is also the hash tables.

 

[Stuggernaut]

If the majority of the big companies have Sony's security then everyone in the civilized world has their info in serious trouble right now.

I didn't realize that we knew that the majority of big companies had better security than Sony. I missed the chart that showed Sony security vs the rest. My bad.

Hackers have been targeting all those other companies specifically as well, and just could not get through, luckily they finally tried Sony!!

 

[Synth_floyd]

How can they blame "anonymous?" Anonymous is anyone who claims to be anonymous. If I run down the street and snatch some woman's purse and then say "I'm anonymous!" then suddenly anonymous is a bunch of purse snatchers.

 

[bigtroyjon]

I didn't realize that we knew that the majority of big companies had better security than Sony. I missed the chart that showed Sony security vs the rest. My bad.

Hackers have been targeting all those other companies specifically as well, and just could not get through, luckily they finally tried Sony!!

you gotta be trollin here right? I refuse to believe that a fully functioning adult could think that a MAJORITY of major companies out there have similar vulnerabilities yet have never been touched by commercial hackers.

 

[babyghost853]

you gotta be trollin here right? I refuse to believe that a fully functioning adult could think that a MAJORITY of major companies out there have similar vulnerabilities yet have never been touched by commercial hackers.

Really now. http://www.google.com/search?hl=en&...ys+hacked+in+the+last+year&btnG=Google+Search
http://krebsonsecurity.com/2011/04/epsilon-breach-raises-specter-of-spear-phishing/

 

[Vagabundo]

How can they blame "anonymous?" Anonymous is anyone who claims to be anonymous. If I run down the street and snatch some woman's purse and then say "I'm anonymous!" then suddenly anonymous is a bunch of purse snatchers.

Exactly, that's how they can blame Anonymous.

"I'm Anonymous"

"No your not, I am, and so is my wife!"

 

[bigtroyjon]

Really now. http://www.google.com/search?hl=en&...ys+hacked+in+the+last+year&btnG=Google+Search
http://krebsonsecurity.com/2011/04/epsilon-breach-raises-specter-of-spear-phishing/

I'm about to go to sleep but when I wake up I look forward to reading your response on how those two links had any connection to what I wrote.

 

[Stuggernaut]

you gotta be trollin here right? I refuse to believe that a fully functioning adult could think that a MAJORITY of major companies out there have similar vulnerabilities yet have never been touched by commercial hackers.

lol

So by that logic you are assuming that Sony is the only company out there that is/was hackable because for some reason they don't use proper security? Right.

What about the password site that was hacked last week? Considering what they do, they should have some serious security no???

What about that marketing company that was hacked just 2 weeks before Sony? Millions of users personal info at risk, companies as well.

What about the Google Image manipulation crap that is going on right now? Not a hack in the sense of the rest, but still an intrusion.

My point is now, and has been in all these threads. If Hackers want you, they will hit you.

Sony painted a big target on their back and they are being repeatedly kicked in the groin for it.

Do they deserve it? Hell no.

Hopefully Sony will get back on track, and other companies will take a hard look at their own security and beef things up. And I hope as well that other hackers are not empowered by the success of their brethren to become more bold with their attacks.

I just want all this shit to end.

 

[low-G]

How can they blame "anonymous?" Anonymous is anyone who claims to be anonymous. If I run down the street and snatch some woman's purse and then say "I'm anonymous!" then suddenly anonymous is a bunch of purse snatchers.

It's Anonymous's fault they don't have security measures against people using their name!

 

[PJV3]

Suddenly the Move design makes a lot more sense.

Yes, i have just experimented, and with enough lube it goes up quite nicely. fit some kind of DNA detector on the end, and we can play games in the secure environment of the future.

 

[bigtroyjon]

lol

So by that logic you are assuming that Sony is the only company out there that is/was hackable because for some reason they don't use proper security? Right.

What about the password site that was hacked last week? Considering what they do, they should have some serious security no???

What about that marketing company that was hacked just 2 weeks before Sony? Millions of users personal info at risk, companies as well.

What about the Google Image manipulation crap that is going on right now? Not a hack in the sense of the rest, but still an intrusion.

My point is now, and has been in all these threads. If Hackers want you, they will hit you.

Sony painted a big target on their back and they are being repeatedly kicked in the groin for it.

Do they deserve it? Hell no.

Hopefully Sony will get back on track, and other companies will take a hard look at their own security and beef things up. And I hope as well that other hackers are not empowered by the success of their brethren to become more bold with their attacks.

I just want all this shit to end.

2 hacking examples, neither of which were major companies, is your reply? Once again, you either trollin or have gone full retard. Take your pick. You yourself said the MAJORITY of major companies are in Sony's shoes. waiting for evidence that even a minority are in the same bout.

 

[hey_it's_that_dog]

2 hacking examples, neither of which were major companies, is your reply? Once again, you either trollin or have gone full retard. Take your pick. You yourself said the MAJORITY of major companies are in Sony's shoes. waiting for evidence that even a minority are in the same bout.

The fact that Sony were hacked merely suggests that their security might have been sub-par. It is not proof that it was.

 

[Rich!]

This all fucking sucks. But I'm finding some aspects funny. Take Howard Stringer's latest apology letter, for example. So many parallels with the BP 'sorry' video in South Park.

image: http://www.neowin.net/forum/uploads/monthly_10_2010/post-645-12882877717224.jpg

Linked because well, having a man's ass on show isn't really worksafe even if it is South Park.

 

[Stuggernaut]

2 hacking examples, neither of which were major companies, is your reply? Once again, you either trollin or have gone full retard. Take your pick. You yourself said the MAJORITY of major companies are in Sony's shoes. waiting for evidence that even a minority are in the same bout.

For the record, the word "majority" was used by the person I quoted....oh that was you ;P

I also don't consider the company I mentioned being hacked a small one. I think they are one of the largest (if not the largest) mail marketer going. Lots and lots of big businesses used them. Look it up yourself, it's a big list. So they should have had better security as well.

And while the password site may not be a major company, their whole world is security.

We can talk circles all day if you like but when people imply assumptions are facts, I like to comment. Not necessarily what you did in that specific case, but close enough.

 

[Phife Dawg]

So apparently some information (2500 data sets) was publicized on the internet, whether or not this is linked to the CNET rumors remains to be seen.

These threads go so fast so apologies if it was already posted.

German link:
http://www.spiegel.de/netzwelt/games/0,1518,761227,00.html

 

[Dreamgazer]

2500 data sets from a 2001 database.
Nothing related to PSN directly, despite the FUD news that is now passing around on some sites.


Better source:
http://www.msnbc.msn.com/id/42937749/ns/technology_and_science-games/

 

[distrbnce]

Sony has more than enough power and resources to properly secure their network infrastructure and the fact that they hadn't up until this point tells us two things; it tells us that they're negligent and it tells us that we should not be doing business with them.

If losing data is what it takes to properly invest in network security, they don't deserve to be in business.

wtf kind of logic is this? Like if they don't have super network security our info is prone to attack by wild animals?

No, they'd be attacked by the same fucking douche-nozzles you're praising. They wouldn't need any security if these nerds would spend their time doing something worthwhile instead of stealing innocent peoples private information. No matter who we do business with, there's always a chance that some random decision will get some dorky panties in a wad.

"If losing data is what it takes to properly invest in network security, they don't deserve to be in business."

Wow, that's some juicy drama right there.

There isn't even a discussion to be had on the issue as they've proven themselves untrustworthy. Knowing what we know now, there is no reason to ever trust Sony again with critical data.

Another example of very little logic being put forth.

It seems to me, with just minor consideration, that Sony will be just about the safest company to do business with once they're back up.