The PSN [censored] Sandwich

[Balls]

www.bbc.co.uk/news/technology-13192359

Yeah, if you haven't heard, PlayStation Network was hacked last Wednesday, Sony took it down and it hasn't returned. Now the hackers have all of your credit card details and have already used them to buy everything in the world.

And in this time where 70 million people's financial security are compromised, the worst thing about this is that we can't play Mortal Kombat online.

[Warped‽‽‽]

Not to some. For some it's your precious trophies.

[ShayMay]

Apr 27, 2011 14:36:13 GMT Warped‽‽‽ said:

precious trophies.

I couldn't help but be reminded of this guy.


I went around all the important stuff of mine (e-mail, etc.) and changed some passwords, just in case. Doubt anything'll come of it (indeed, nothing has as of yet), but because I bought Mega Man: Maverick Hunter X for the PSP about a year ago, I have to change all my passwords?
I know it wasn't intended by Sony or anything, but jeez, had I known, I'd just not have bothered.

[Alex]

This was a great comment on Kotaku that really sums up just how bad Sony has [censored]ed up here:

For all of you Sony apologists, here is why this is a big deal.

Lets put everything into perspective.

December 2010: failOverflow/George Hotz hack the PS3.
January 2011: Sony files a lawsuit against failOverflow and George Hotz.
February 2011: PSN's network traffic is detailed. Personal information is stored locally and sent unencrypted to Sony via PSN.
April 2011: PSN is breached.

As a credit card merchant, Sony has some obligations. As defined in the Payment Card Industry Data Security Standard (PCI DSS) Sony is supposed to do the following:

1) Build and Maintain a Secure Network
2) Protect Card holder Data
3) Maintain a Vulnerability Management Program
4) Implement Strong Access Control Measures
5) Regularly Monitor and Test Networks
6) Maintain an Information Security Policy

[en.wikipedia.org]

They failed to do this.

The biggest weakness is Sony assumed that PSN was a private network. A network between a secure PS3 and PSN. How do we know this is Sony's assumption? Because in a detailed analysis of the network transmissions between a PS3 and PSN a hacker discovered that user credit card data was transmitted to PSN unencrypted.

[pastie.org] (See line 66)

Once the PS3 was hacked, PSN became an open/public network. With credit card information being sent unencrypted, it was only a matter of time before, on a limited basis, private data would be stolen. But the fact that Sony didn't encrypt the data was in violation of the PCI DSS agreement with credit card companies.

Sony knew in January what was at stake, we know this because when they filed the lawsuit against failOverflow and George Hotz, Sony invoked the Computer Fraud and Abuse Act. The act is exclusively used by financial institutions and the government to protect against hacking of banks, atms, credit card merchants and transaction processors, or government systems. It further defined the relationship between the PS3 and PSN in such a way by implying specific provisions of the law that George Hotz broke.

I know it's easy to sit there and say every network is hackable. While that's true to some degree, some networks are more difficult to breach than others. The fact that Twitter or Gawker got hacked is meaningless compared to a company that does financial transactions. Again, the whole idea of a company that follows the PCI DSS properly is that they won't get breached. In fact, since the release of the PCI DSS no company found in compliance with the PCI DSS has been breached.

Sony knew since January that user data was at risk, but it did little to nothing to secure that data. It knew that it couldn't close the hole that was created by failOverflow and George Hotz, that cat was let out of the bag despite "assurances" from hackers that it was secure with FW 3.56. The changes Sony is making to PSN today are changes Sony should have made to PSN months ago. The fact that they didn't was either negligence or wishful thinking on their part.

If the breach was only a breach of personal information, then Sony got lucky. However, if this was a breach of financial information and Sony clearly understood what was at stake back in January, then they have to explain why for three months they did nothing to secure their customers personal and private data.

kotaku.com/#!5796027/sony-didnt-know-severity-of-ps3-breach-until-monday?comment=38702582:38703365

The information that comes from the chatlog is especially troubling. The complete lack of a [censored] that Sony gave in securing their customers' details is terrifying.

[Arch_one_zero_one]

I've changed a few passwords (amazon, facebook), but my e-mail addresses have a completely unique password anyway, so I'm not too worried about that.
Tempted to call my bank to cancel my card and issue a new one just in case though.

...And all because I got a bit nostalgic a few years back and downloaded Crash Bandicoot 3. :/

[Alex]

Class action lawsuit filed against Sony for neglecting to protect user's data to the level they are legally required and taking a week to inform anyone that their data was at risk.

Class action lawsuits are won on behalf of everyone affected, so if this case wins, all PSN account holders will be able to claim against it.

[Balls]

Wait, I could get money from this?

[Arch_one_zero_one]

I'd very surprised if Sony's army of lawyers let it get that far, unfortunately.

[Alex]

Even if they settle, it's still a class action suit - that settlement is due to everyone affected.

Also, Sony has now said that the credit card data stored on their database -was- encrypted, but... um, everything else wasn't - which seems to include passwords.

I mean... seriously... what?! Good lord.

I honestly don't see why Sony should be trusted with anyone's data again after this fiasco. I hope the lawsuit gets this incompetent negligence out in the open for the public to see so Sony can feel some real punishment for this.

It's almost astonishing that nothing like this has happened before now given how little they gave a care to securing their customers' information on the network.

[MentalAnalysis]

Apr 28, 2011 2:35:42 GMT Alex said:

I honestly don't see why Sony should be trusted with anyone's data again after this fiasco. I hope the lawsuit gets this incompetent negligence out in the open for the public to see so Sony can feel some real punishment for this.

After this, who would want to trust Sony?

also makes me think if Sony's PSN could be hacked, what's to stop them from hacking your Xbox Live accounts (that's if they could)?

[Baron Canier]

They bothered to encrypt their customers' personal data, keep it secure and conduct regular checks, presumably.

[Arch_one_zero_one]

You get what you pay for, I suppose.

[Balls]

Apr 28, 2011 17:30:53 GMT Baron Canier said:

They bothered to encrypt their customers' personal data, keep it secure and conduct regular checks, presumably.

Presumably being the key word. No doubt they'll do it now if they hadn't already.

You get what you pay for, I suppose.

Now we're just being silly. As a PSN account holder/customer, I'm as annoyed as anyone right now and I'm not one of the ones dashing to defend Sony with my own life, but to suggest that added security is the selling point of XBox Live is downright ridiculous.

Let's not forget, for a second, that there are more online game services that are free beyond PSN, and this hasn't happened to them. This isn't a case of Sony not caring because they aren't charging us anyway; it's just a royal [censored] up. An unforgivable, ridiculous, rage-inducing, outrageous [censored] up. But to say that "you get what you pay for" with XBox Live when you likely have no idea of the level of Microsoft's security is either fanboyism or just random word spewing.

[Arch_one_zero_one]

I was being facetious.

[Balls]

And I was being a dick >=D

[Juliett. Bravo. Alfa.]

And I'm wondering if I had my credit card details on my PS3.