• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

PSN Hack Update: FAQs in OP, Read before posting

Status
Not open for further replies.

Garjon

Member
Fireye said:
Tempy linked me to this blog on irc, and I took the time to crawl through logs and debunk it.

The linked server is a gracenote db server, related to cddb/music identification. In no way was this server compromised by the stuff the blogger highlighted, it's a fairly normal security/vulnerability scan (from the looks of it).

See my fuller responses (and amused findings) at the blog site: http://shockwavelounge.blogspot.com/2011/04/playstation-network-log-of-hacker.html
Thanks for the confirmation, though a bit of common sense was all we really needed for to debunk it. I do appreciate your work though and it's nice that we can finally put that matter to bed.

In your opinion, would you say the recent, numerous leaks of data and the current situation may be connected? Or would you say they are isolated incidents? Is it common for several companies to use the exact same encryption on all files?
 

Jackl

Member
dallow_bg said:
Yup. This is like the 4th or so company in which my personal information may or may not have been accessed.

I take care of my finances, so I'm not worried.


I wanted to post something witty, but failed miserably. I was just a dumb kid when my credit got hijacked. By the time I found out and worked to get it fixed it took the better part of a year, lots of paperwork, and arguing with creditors to clear it up.

For what its worth in Sony's defense(even though they fucked up massively)

67% of companies fail CC security standards
 

Y2Kev

TLG Fan Caretaker Est. 2009
I kind of don't care about my identity. I really want to link my steam account though so if sony could hurry that up thanks be to Ken.
 
I would imagine the initial fallout will affect PSN titles, but in due time, the wounds will heal. By the holidays, I don't think many people will be consciously thinking about the event. This is still a massive disaster for Sony though, don't get me wrong, but I'm not gonna just stop using my PS3. I might move on to prepaid cards, but I spend maybe 5 bucks a month on PSN so the use of a credit card is convenient....but I suppose I should take extra precautions if I can.
 

FINALBOSS

Banned
Vinci said:
They should have them all on file, never mind the fact that they've had six days.


...And then you crybabies would complain that the speedy e-mail didn't have ANY sort of information in it.

It obviously took this long because they were figuring out what exactly happened.
 

Blimblim

The Inside Track
Dreamgazer said:
*stare at an entire tutorial thread about how to set up fake credit card number on nextgen*BEEP*date site*

(don't believe me? google it)

RIGHTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT

Oh, I'm sorry, the kiddies at that site are probably more knowledgeable
Rebug most likely had nothing to do with the hack itself. While people used it to get games for free (and I'm sure Sony will not take this lightly, and I fully support them going after the morons who exploited this), and didn't give them any special access to anything on PSN, "just" the ability to add money to their account.
CFW firmwares on PS3 allowed people to add their own SSL CA certificate to the ones the PS3 would accept, which enabled them to have proxies who actually would decrypt the PSN https protocol. Someone more than likely found an SQL injection among some of the POST or GET parameters the PS3 sends to the PSN webservices, and exploited it.
 

Zoibie

Member
Please note that we are as upset as you are regarding this attack and are going to proceed aggressively to track down those that are responsible.

Considering this dude would most likely be behind all manner of proxies and such, how likely is it that Sony/the authorities will catch this guy?
 

user_nat

THE WORDS! They'll drift away without the _!
Morn said:
Here's the IP info for the person who apparently hacked PSN:



Either the guy is in the military, or was spoofing his IP.
If you're smart enough to hack PSN, you probably know how to spoof an IP. Or atleast not dumb enough to do the hacking from work.
 

Emitan

Member
Well, shit. Worst thing to happen this generation was consoles being online focused. Might as well buy a Stream/Cafe and never touch another console again if this is going to happen.
I would never abandon Steam, though. I'm a hypocrite, but I can admit it.
 

Mael

Member
Vinci said:
They should have them all on file, never mind the fact that they've had six days.

Hello mailing list, seriously if they're able to send junk mail for Move to every psn users they're able to send info on this.
 
Vestal said:
Ok let me give you a nice little pictorial if you will of what happend.


You have a bunch of hungry SoBs with machetes(Hackers) walking around outside your establishment, but they don't have a key to get in. You see them go into other places but hey your ok, they dont have your key. Now you find out that you missplaced your key and it might have been Duplicated, instead of taking steps to say change the locks, or add security within your establishment to guard that meat locker in the back, you go about your business.

few days later you are surprised when you find a machete attached to your skull...


worst analogy ever. seriously. anaologies should be bannable.
 

Jinfash

needs 2 extra inches
I don't understand why a lot of people keep reminding us to "HATE THE HACKER WHO DID THIS."

Something like that is a no-brainer, and denouncing identity and CC theft goes without saying, however that does not in any way lessen the disappointment and frustration people have with Sony. A major network restructuring of this size should have taken place the minute the client side, which Sony relied on in terms of security, was compromised. People calling out their incompetence are not overreacting or being "inconsiderate."
 

obonicus

Member
Y2Kev said:
I kind of don't care about my identity. I really want to link my steam account though so if sony could hurry that up thanks be to Ken.

How do we know Ken's not behind this? They took everything from the man.
 
You decide:

zL9ZD.png


9vekP.png
 

AleeN634

Member
Changed a couple of passwords and getting a new credit card... *sigh* exactly the way I wanted to spend my evening.

Man PSN is going to get hammered when everyone tries to reset their accounts.
 

Shambles

Member
Wow at the Sony defenders. So you must all be ok with storing all your money in a bank with a huge vault door, laser beams, attack dogs and sniper in front of the door and then wonder how all your money got stolen when there's a screen door half off it's hinges on the back wall of the vault.

It's dem robbers fault!
 
Hey yo son....shit just got mad real up in this punk ass bitch.



http://www.cnn.com/2011/TECH/gaming.gadgets/04/26/playstation.network.hack/index.html

It's major now...sell your stock people. Time to trade in my PS3 fighters for 360 versions now. No more PSN purchases for me, I am not taking any more chances. I'm not saying that 360 is hackproof, but until it happens then i have no other options.

If 360 gets hacked, I am freaking going portable then.
 
Zoibie said:
Considering this dude would most likely be behind all manner of proxies and such, how likely is it that Sony/the authorities will catch this guy?
I dunno but I like reading all the armchair experts who are going to come out of the woodwork along with tin foilers how he is gonna get caught or elude the law etc. should be good.
 

Glix

Member
FINALBOSS said:
...And then you crybabies would complain that the speedy e-mail didn't have ANY sort of information in it.

It obviously took this long because they were figuring out what exactly happened.

sacasam? I hope? For the sake of my sanity?
 

StuBurns

Banned
Y2Kev said:
I kind of don't care about my identity. I really want to link my steam account though so if sony could hurry that up thanks be to Ken.
You're not concerned about that now? Is there any chance it'll mean Sony have any Steam details?
 

Noshino

Member
jim-jam bongs said:
Yes, Microsoft's extensively documented security fuck ups from a decade ago are absolutely in the same realm as every PSN user's account being compromised.

Except my comment was in regards to this

"Why willingly do business with a company that is this fucking incompetent"

If he is claiming such things about this event, then certainly he musn't be doing business with Microsoft nor Apple, or using Safari, IE, Firefox, Chrome...etc.
 

Snipes424

Member
Blimblim said:
Rebug most likely had nothing to do with the hack itself. While people used it to get games for free (and I'm sure Sony will not take this lightly, and I fully support them going after the morons who exploited this), and didn't give them any special access to anything on PSN, "just" the ability to add money to their account.
CFW firmwares on PS3 allowed people to add their own SSL CA certificate to the ones the PS3 would accept, which enabled them to have proxies who actually would decrypt the PSN https protocol. Someone more than likely found an SQL injection among some of the POST or GET parameters the PS3 sends to the PSN webservices, and exploited it.

How easy is this to do?

What is the best way to fix this so it will never happen again?

Is this something that could happen to XBL?
 

Baha

Member
Jax said:
How are you guys changing passwords etc? Is the service up?

No one is changing their PSN passwords atm because they can't, they are however changing the passwords to the emails they have attached to their PSN accounts.
 

Abylim

Member
arnoldocastillo2003 said:
It is false the information about the 75,000 credit cards stolen.

Do me a favor and stop posting like you know whats going on. You were way off with your thursday info, can you just please stop?
Alot of us are pissed off at all this, we dont need this.

I personally have gone from being annoyed at all this, to being quite pissed off. I dont like some random knowing my address and secret question/answer.
I dont like the possibility of having to get a new CC because of all this. I dont like the idea of having to fuck around with Sony Australia to get my PSN id back when all this is said and done.
It's cool that you want attention and all that, but leave it alone, please.

EDIT: Basically I'm asking you to stop spreading misinformation. Sorry if I sound pissed, I just woke up to this shitty news, and I'm sick and tired of having to sift through people guessing or spreading rumours. This is important to me.
 
black_vegeta said:
Yes, No, Maybe


Yes, No, Maybe,
I don't know,
Can you repeat the question?

You're not the boss of me now
You're not the boss of me now
You're not the boss of me now
And you're not so big

You're not the boss of me now
You're not the boss of me now
You're not the boss of me now
And you're not so big

Life is unfair.........
 

evolution

Member
Shin Dynamo X said:
Hey yo son....shit just got mad real up in this punk ass bitch.



http://www.cnn.com/2011/TECH/gaming.gadgets/04/26/playstation.network.hack/index.html

It's major now...sell your stock people. Time to trade in my PS3 fighters for 360 versions now. No more PSN purchases for me, I am not taking any more chances. I'm not saying that 360 is hackproof, but until it happens then i have no other options.

If 360 gets hacked, I am freaking going portable then.
Just use psn/xbl cards like I do
 

Vestal

Gold Member
Dreamgazer said:
*stare at an entire tutorial thread about how to set up fake credit card number on nextgen*BEEP*date site*

(don't believe me? google it)

RIGHTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT

Oh, I'm sorry, the kiddies at that site are probably more knowledgeable


Ill still blame sony for that.. THATS BEYOND IDIOTIC. That should not be possible. every single tiny little aspect of credit card authorization should be handled SERVER SIDE, if anything is handled client side then sony fucking deserves it.


This is NETWORKING 101.... The client is a dummy, the Server is the master who provides all.
 

Blimblim

The Inside Track
Jackl said:
I wanted to post something witty, but failed miserably. I was just a dumb kid when my credit got hijacked. By the time I found out and worked to get it fixed it took the better part of a year, lots of paperwork, and arguing with creditors to clear it up.

For what its worth in Sony's defense(even though they fucked up massively)

67% of companies fail CC security standards
PCI-DSS compliance, even at level 2, is quite a burden, it's true. You have to change the way you work to get full compliance, and many companies simply can't afford it completely. Level 1 involves very costly 3rd party audits, but you can't normally cheat and simply say that you are compliant.
 

Mael

Member
Shambles said:
Wow at the Sony defenders. So you must all be ok with storing all your money in a bank with a huge vault door, laser beams, attack dogs and sniper in front of the door and then wonder how all your money got stolen when there's a screen door half off it's hinges on the back wall of the vault.

It's dem robbers fault!

It's not?
 

syoaran

Member
pantyhelmet said:
what they did, was 100% illegal, no matter what their motives, if one of their own went rouge and accessed that info due to what they were able to accomplish during their QUEST FOR JUSTICE *echo* , then they are ALL at fault, need i spell it out? Not too long ago about 42 claiming to be members of anonymous were arrested for similar actions. be serious.

I'm not argueing about the morality of what has happened, but I have seen 0 information since the PSN service went down that Anon. has had anything to do with it. Judging from the critique from more well informed people than myself about internet security, it sounds like Sony took down the service themselves to find out how deep the problem is and fix it (much in the same way Gabe literally pulled the plug at Valve when he found out the servers had been compromised).

Since this is the third time I've asked you to provide some sort of information to backup what your saying, I have to presume that you have no idea what your talking about. Please, I want to be proven wrong and see this proof that Sony or Anon. claim responsibility for the data theft.
 
kamorra said:
Blimblim to the rescue:
I donno dude, not trying to be a dick, ARK's points are a lot more clear and straight to the point, I couldn't really make anything out of Blimblim's..."rescue"

"hacker's with different goals"??? I donno what that means, that just sounds vague and subjective to me. Who is you or me or Blim to confirm the hacker's "goals"?

Anyway what's done is done, just let me know what will make you sleep better at night, blaming on Hackers fully or blaming Sony or half and half? let me know and I'll go with that, because you know, that will hopefully get my $55 back and cross my fingers and hope my personal info isn't being sold at a high price in some Chinese underground market :(
 

Xabora

Junior Member
jackdoe said:
Thank god I removed my card a week before this shit happened. Still, I'll monitor my cards just in case. Other than that, I am peeved at Sony for taking this long to at least share some suspicions so that users could at least make password changes.
Even still, if you bought anything there is a chance it could be in the server logs.
 
Status
Not open for further replies.
Top Bottom