Support NeoGAF

[Feorax]

Wow at the misinformation, FUD spreading and general ignorance in this thread.

Way to turn a bad situation into the apocalypse guys...

 

[darkwing]

Nope, but still pretty big.

http://wikibon.org/blog/the-11-largest-data-breaches-in-recent-history/

yikes! to think most , if not all of the data there are valid, wonder how much of the 77M PSN ids are valid lols

 

[obonicus]

I can guarantee you that there were, are, and will be meetings, amongst publishers, as well as shareholders, discussing whether or not if Sony's network security, including their overall ability to do business, is at all sound.

Publishers will use this to try and leverage better contracts, no doubt. But they will continue to do business with Sony, full stop. The RNG number debacle this year was probably a bigger concern to them, since it directly affects their IP. This doesn't; the real harm for publishers here is that the store has been down for so long.

And for them being 'fucking incompetent', they're not, not any more than any other corporation is (so, okay, they're pretty fucking incompetent). Is this a big deal? Yep. Will it blow over way before it should? Oh, definitely.

 

[Kuraudo]

I see. This is probably what the majority of posts in here mean, closing an account does seem drastic. Looks like I've learned something today

If you cancel your card, the account is closed. All the relevant details are copied across to a new account, so the effect to the customer it that they just have a new PAN number, but in reality you are closing that account.

 

[IchigoSharingan]

where were they caught? what information has come out? Surely you are not refering to my post where I just explained why CFW more than likely played a role in this and why packet sniffing on data between PSN and a PS3 would be pointless. Nowhere in there did I or anyone else say they were using client side validation, etc.

the amount of hyperbole in this thread is ridiculous. Sony will never recover. No one will ever buy a PS3. Strike that, no one will ever buy a SONY product, etc.

in six months almost no one will care. This type of leak has never brought down a company before and it certainly isn't going to bring down or irreparably damage a $30B+ corporation. Settle down people.

If you are worried about your credit cards, cancel them and get new ones issued. If you are worried about your passwords, change them. If you are truly pissed about this, hop aboard the inevitable class action lawsuit. But let's at least try and tone down the hyperbole and conclusion jumping that is making up like 99% of this thread now.

rebug revealed all the client side vulnerabilities of the psn system.
Because so much was put on client side (PS3), they were able to make headway in hacking. That is obvious by now, that it was massive flaw #1. Massive flaw #2 was incompetent server side security. Like I said, this is stuff that's been known to create problems since 2003. And it explains why they are overhauling the network. It will most likely be heavily server sided from now on, the way it should have been since day 1.

CFW should have only played a tiny role in this server side debacle. May this be the end of Sony's security through obscurity.

 

[jax (old)]

Its really interesting. Even with this level of ineptitude from Sony, some people will nonchalantly shrug it off as no big deal, and continue to do business with them. Sure, the sky isn't falling. It's not the end of the world. But to completely not give a shit is odd. Why willingly do business with a company that is this fucking incompetent?

Are you insane? Inept? Fucking incompetent? It took the hackers ages to break PS3 and even then that was was the stolen key. Non of this would have happened without the geohot hack to begin with.

They couldn't have forseen any of this.

 

[Hawk269]

My biggest issue as many of you passionately put it is that it took Sony this long to figure out our data was compromised. I am sure they knew this very early on, but for some reason witheld reporting this to it's users.

 

[A.R.K]

I don't understand the "I'm done with you" statements here. If you don't trust Sony anymore, don't buy stuff from the PSN with your credit card.

Online play is still free.

its just GAF being GAF...blowing every little story/rumor to hyperbole and fueling the fire for the ignorant

never change!


Edit: Online play is still free ... and they are fantastic

 

[sphinx]

I don't understand the drama about the the CC.

In most cases, you can call your bank and simply put a lock in your credit card and call them back to unlock the credit line when you are about to use it.

in THIS particular situation, I'd lock the card and wait at least 2 weeks before using it again.

 

[TheJollyCorner]

I'M NOT GONNA TAKE THIS ANYMORE!!!!!!!!





...who am I kidding? JOURNEY was one of my most anticipated games of the year. I'm still getting it

Spoiler

just with a Sony Pre-Paid card!

.


I just hope us consumers get through this without too many casualties beyond simply not having online access for two + weeks. It happened. It's been a week. I just hope these were some of those... umm... 'noble' hackers (not condoning!) that just wanted to teach Sony a very big lesson and not fuck over all of us smaller folk.

Then again... if it's one of these basement dwelling 'fuck the system and everyone involved in it' douchbags that just "doing it for the lulz" we could be in some deep shit.

Damn...

 

[kvn]

I can't imagine that Sony is so incompetent that the hackers actually got your passwords. MD5 hashing with a random salt per user is the minimum of security that I'd expect.

There you have it.

 

[Arklite]

Shitty situation indeed, but it's been a week. If credit card info was well and truly fucked I think there would have been news about people losing thousands already. Why would hackers wait?

 

[-Amon-]

Its really interesting. Even with this level of ineptitude from Sony, some people will nonchalantly shrug it off as no big deal, and continue to do business with them. Sure, the sky isn't falling. It's not the end of the world. But to completely not give a shit is odd. Why willingly do business with a company that is this fucking incompetent?

You really look as if you hope to see sony bankrupt you know ?

Oh, im still interested in NGP too.

 

[-viper-]

only need to change it if it was similar to the PSN one

They're similar but it's not like there is anything they can do on FORUMS and shops which require CC details?

 

[darkwing]

poor Under Siege

 

[Ferrio]

rebug revealed all the client side vulnerabilities of the psn system.
Because so much was put on client side (PS3), they were able to make headway in hacking. That is obvious by now, that it was massive flaw #1. Massive flaw #2 was incompetent server side security. Like I said, this is stuff that's been known to create problems since 2003. And it explains why they are overhauling the network. It will most likely be heavily server sided from now on, the way it should have been since day 1.

CFW should have only played a tiny role in this server side debacle. May this be the end of Sony's security through obscurity.

Exactly, they put all their eggs in one basket thinking the PS3 was bulletproof. It wasn't. Soon as they found out it wasn't they should of rebuilt the network then and there. Instead they went all anti-hacker crazy and chasing after these people. They're priorities were wrong, they're getting burned for it now.

 

[Vestal]

This needs to be repeated. ANY secure transaction depends on both sides being secure. CFW caused this, plain and simple.

SSL should just be 1 small layer in a larger Picture of security. Not to mention that if they felt that SSL was compromised due to CFW then they could change how SSL was implemented on both server and client side.


You can't depend on SSL being your only defense.. Firewall, connection monitoring, and regular Security changes are the norm in the Corporate world to keep them guessing.

 

[Zenith]

Are you insane? Inept? Fucking incompetent? It took the hackers ages to break PS3 and even then that was was the stolen key. Non of this would have happened without the geohot hack to begin with.

They couldn't have forseen any of this.

random number generator that isn't random.

 

[Four_Chamber]

http://www.bbc.co.uk/news/technology-13192359 (BBC)

http://www.npr.org/blogs/thetwo-way...-data-might-have-been-compromised?ft=1&f=1006 (NPR)

http://ingame.msnbc.msn.com/_news/2...-credit-cards-as-playstation-outage-continues (MSNBC)

http://www.nytimes.com/2011/04/27/technology/27playstation.html?src=me&ref=technology (NY Times)

http://news.cnet.com/8301-31021_3-20057577-260.html?part=rss&tag=feed&subj=CircuitBreaker (CNET)

http://www.cnbc.com/id/42769019 (CNBC)

Etc., etc.- this is the first piece of gaming news in a while that has captivated the mainstream media to this extent.

 

[-PXG-]

Publishers will use this to try and leverage better contracts, no doubt. But they will continue to do business with Sony, full stop. The RNG number debacle this year was probably a bigger concern to them, since it directly affects their IP. This doesn't; the real harm for publishers here is that the store has been down for so long.

And for them being 'fucking incompetent', they're not, not any more than any other corporation is (so, okay, they're pretty fucking incompetent). Is this a big deal? Yep. Will it blow over way before it should? Oh, definitely.

Sounds about right.

 

[gofreak]

DLC isn't so why tie yourself into an untrusted platform?

Because it has content you want?

I'm not sure I get the 'who would do business with Sony' thing... if they have stuff you want, why would you forgo that? There are safe ways to buy things on PSN, i.e. prepaid cards.

It is a big fucking deal, I am annoyed, I'm probably going to be changing my CC, I've been changing passwords on some accounts etc. But as long as Sony has content I want I will "do business with them". It won't change my consumption behaviour, to do that would just be to punish myself really. It'll change HOW I purchase that content - I just won't tie a CC to my Sony/PSN account in the future.

 

[TheSeks]

The PSN logs of the hacker are now on the net.

Link the copypasta of the intrusion from pastebin (because we know that's what all hackers do) to me via PM then.

 

[Doc Evils]

PSN hack log:

http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html

 

[jergrah]

Also to the people saying the Sony has done nothing to notify its customers, there has been a new post on the blog every day since April 20th.

Joke post?

How many common users do you think even know that Sony PS has a gaming blog? Since they have your email address, they should have sent updates that way to inform users.

 

[Griffin]

Its really interesting. Even with this level of ineptitude from Sony, some people will nonchalantly shrug it off as no big deal, and continue to do business with them. Sure, the sky isn't falling. It's not the end of the world. But to completely not give a shit is odd. Why willingly do business with a company that is this fucking incompetent?

http://forums.sarcasticgamer.com/showpost.php?p=645846&postcount=734

Please read up.

 

[KennyLinder]

All of this because Sony took out Other-OS?

 

[Dipswitch]

What a shit show this has turned out to be. There's enough info out in the wild about every user for scumbags to go on a social engineering binge. Thank Christ SSN's weren't part of the mix - then we'd be well and truly fucked.

Now can someone please refresh my memory about PSN and credit card info, as I've only bought two or three items on there over the course of the last few years. I seem to recall adding funds to a "wallet", and then using the wallet to buy the items I wanted. I dunno if that's different from having the CC number permanently on file, but I can't recall if that wallet fund transfer was done via the Playstation or via PC online. Or if that even makes a difference.

In short, are my CC details exposed either way?

 

[Plinko]

http://www.bbc.co.uk/news/technology-13192359 (BBC)

http://www.npr.org/blogs/thetwo-way...-data-might-have-been-compromised?ft=1&f=1006 (NPR)

http://ingame.msnbc.msn.com/_news/2...-credit-cards-as-playstation-outage-continues (MSNBC)

http://www.nytimes.com/2011/04/27/technology/27playstation.html?src=me&ref=technology (NY Times)

http://news.cnet.com/8301-31021_3-20057577-260.html?part=rss&tag=feed&subj=CircuitBreaker (CNET)

http://www.cnbc.com/id/42769019 (CNBC)

Etc., etc.- this is the first piece of gaming news in a while that has captivated the mainstream media to this extent.

The day after Nintendo announces their new console (which got mainstream media coverage), too.

 

[LiK]

http://www.bbc.co.uk/news/technology-13192359 (BBC)

http://www.npr.org/blogs/thetwo-way...-data-might-have-been-compromised?ft=1&f=1006 (NPR)

http://ingame.msnbc.msn.com/_news/2...-credit-cards-as-playstation-outage-continues (MSNBC)

http://www.nytimes.com/2011/04/27/technology/27playstation.html?src=me&ref=technology (NY Times)

http://news.cnet.com/8301-31021_3-20057577-260.html?part=rss&tag=feed&subj=CircuitBreaker (CNET)

http://www.cnbc.com/id/42769019 (CNBC)

Etc., etc.- this is the first piece of gaming news in a while that has captivated the mainstream media to this extent.

identity theft is juicy news. especially at this scale.

 

[Phreaker]

Ugh, going on a password changing spree.

 

[SyNapSe]

Shitty situation indeed, but it's been a week. If credit card info was well and truly fucked I think there would have been news about people losing thousands already. Why would hackers wait?

Nobodies stealing 77 million accounts and CC's for personal use. They're going to have to resell it

 

[bangai-o]

is Guerilla using this time to fix their shit?

 

[Vamphuntr]

PSN hack log:

http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html

OH SNAP. It was easy to hack sony.

 

[darkwing]

All of this because Sony took out Other-OS?

who knows how the hacker mind works

 

[-viper-]

Changing your email password should be enough if you see no suspicious login activity (you can check with gmail by clicking the details link at the bottom of the page next to last activity). Aside from any credit or debit fraud, if your email is still secure then your other accounts should be fine.

Thanks. I feel a relieved man now.

BTW, what is "Atom feed"? It lists up every hour in my Gmail account. It's from the United Kingdom (my locale).

 

[test_account]

My biggest issue as many of you passionately put it is that it took Sony this long to figure out our data was compromised. I am sure they knew this very early on, but for some reason witheld reporting this to it's users.

I wonder what good it would do to hold back the information if they knew for sure very early on. Seeing what happened, surely they knew they would have to mention this publically some time, so what good reason could it be to wait?

 

[60_gig_PS3]

why do they even store your credit card info in the first place?

i dont even know which CC I have on file and PSN is down. great F U Sony.

 

[gokieks]

People seem to be making the assumption that the passwords were stored in plain text (or easily decryptable form) based on the wording of the announcement. But while certainly Sony hasn't proven themselves to be masters of security, I find it a little difficult to believe that a breach hasn't occurred sooner (and likely from the inside) if they truly were plain text. It seems rather more likely that it was the PR side lacking enough technical prowess to differentiate between passwords and password hashes when drafting the announcement. That being in the hands of the intruders still wouldn't be good, obviously, but not nearly as catastrophic as if they really were plain text.

 

[Rewrite]

that letter from the senator is great.

 

[MechaX]

PSN hack log:

http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html

That's amazing.

That is absolutely amazing.

 

[Dr. Zoidberg]

You can buy pre-paid Steam cards.

You can? Where?

 

[Dr. Malik]

PSN hack log:

http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html

If this is true, then Sony needs to be sued for being reckless

 

[Mama Robotnik]

They couldn't have forseen any of this.

It seems that all of their decisions were based on the assumption that the client-side security was indestuctable. In this day and age, to build a system that houses so much personal data on such a flawed assumption, is at best lazy and at worst deranged.

They could have foreseen such a scenario by simply looking around and seeing how easily other personal data exploits have occured. They did not do this, and combined with their incompetent delay in informing their customers, rightly deserve to be vilified.

 

[Guardian Bob]

People are quick to slam Sony, but they are doing something about it. Give them some credit.

 

[Plinko]

PSN hack log:

http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html

If true, anyone still want to defend Sony?

 

[pantyhelmet]

this was genius, even though i have my credit card on there..not gonna change it..i was never the target ..the damage has been done, this was never to "steal credit card info" this was to try to bring down a company a particular community has a beef with, not a single person will come forward saying their info has been used.


This attack will show that Hackers are the most dangerous people to big business right now. and for that they will be treated with extreme predjudice from here on. It started with sony going after Geohat(sp..?), its only going to get worse for them from here..

 

[brucewaynegretzky]

Etc., etc.- this is the first piece of gaming news in a while that has captivated the mainstream media to this extent.

3DS? Kinect? (I'll agree with non-hardware related news)

 

[LiK]

that letter from the senator is great.

that senator probably just bought SOCOM and is pissed.

 

[Antagon]

There you have it.

Allright, got me there.

But even if they use a salt that's not random your password will still be safe on other sites, just not on PSN.

 

[TheBaldEmperor]

Wonder how Fox news will report on this.....

Spoiler

Wish i didn't think of that

Surely Obama will be at fault.