*ren* PSN Down, Customer Info Compromised
- Thread starter Cheezdoodles
- Start date
Thanks, i only saw a .jp version. Couldn´t make anything out of it..
Was this discussed as well as considered:
http://www.gamespot.com/news/6310200.html
While I disagree at this report trying defend Anonymous/hackers it is still something that was caused by these guys who will never admit it.
Also I remember around 2008 or so someone attempted to sell a Sony PS3 Development kit on Ebay, I cannot provide links because the links that come up on google are hacker fansites that mainly discussed pirating games.
http://www.gamespot.com/news/6310200.html
While I disagree at this report trying defend Anonymous/hackers it is still something that was caused by these guys who will never admit it.
Also I remember around 2008 or so someone attempted to sell a Sony PS3 Development kit on Ebay, I cannot provide links because the links that come up on google are hacker fansites that mainly discussed pirating games.
IT security is funny this way... one would imagine that frequently changing everyones passwords would result in better security, for the following reasons:
1) users are being reminded of sound security practices on a regular basis
2) if a single password or even the entire pw database is lost, then it's just a single time-range of accounts/passwords lost.
In practice:
1) Users who are forced to change their passwords regularly will simply write them down, or use a password series that is sequential: mypassword1 mypassword2, etc
2) Frequent password changes makes it hard to track / audit suspicious activity, and the act of changing passwords is itself a risk if the identity vetting/assurance process isn't very good.
I suspect if they implement this, it's because some "security consultant" or auditor is advising them to do this. Not a real IT security expert. There's a difference. Too many people associate physical security concepts with IT security. Frequently changing ones locks will be more secure, because you won't have multiple copies of the same key spread around to all your friends, neighbors, contractors, etc... not the same usage model with username/passwords.
At any rate, I think it would be a potential marketing plus for Sony to take advantage of the Sony eco-system and somehow implement Googles two-step authentication option for PSN. If you want a more secure authentication experience, couple your PSN account with the Google Authenticator app on your Android powered Xperia phone...
Perhaps not practical, but Google implemented this because of the issues they had in the past. Again, even this solution isn't fool-proof, in my opinion, but it is a bit more secure.
The security you get on WoW is whatever security you have on your PC. All the "hacks" are just keyloggers from malicious websites or infected ads. As it is, authenticators are free for Android, iOS and a few other phones, or pay $6 to get a physical one.
As for the hacked authenticated accounts, that was a very narrowly distributed hack that cloned the WoW login screen, and sent your authentication code/login details to a machine waiting to login using that info.
In other words, WoW "hacks" have absolutely nothing in common with Sonys problems.
For one, they're not hacked. I've yet to see a report of anyone's account actually being "hacked" in the true sense of the word. Stolen login info, yes.. happens all the time. That's because people are stupid, and fall for scam emails or websites that install keyloggers. That's the user's fault, plain and simple, and I have zero sympathy for anyone who gets their account stolen.
Second, the reasoning behind stealing WoW accounts is completely different. These aren't black market criminals trying to sell your information.. these are gold farmers who will strip your in-game items to sell to other users for real-world cash.
I'm fairly certain that Blizzard's servers have never been hacked. That would be just as bad as PSN, really, since Blizzard collects the same type of information.
(((interference)))
Veteran
I'm quite familiar with those kind of phishing emails, this seemed genuine, no links or requests for account info. The email was from "account-alert@amazon.com" See here:
And at the same time I got this email from Amazon Payments:
And the exact same transaction showed up on my credit card pending transaction list (I have notified my bank).
I replied to that first email and told Amazon that it probably has something to do with the PSN thing and they came back with this:
I'm pretty sure it has something to do with PSN as I normally use another email address for signing up to any other subscriber sites on the net (like forums) - even my XBL account is tied to that address, with my PSN I made the mistake of tying it to my proper email address (which itself is only tied to things like Amazon, eBay, PayPal, banking, tax) and while I have different passwords for the email account and Paypal, eBay etc. the Amazon & PSN accounts share passwords.
Furthermore, this is the first time that any account tied to my proper email address has been compromised.
Yay for me. 
I have no credit card information on their server and my e-mail accounts and passwords are pretty well sectioned for different uses. The only loss for me is a week or two of online Killzone 3, but that's fine since I took the time to read certain things I like.
Basically, I'm getting extra free stuff with no loss. I'll need to find out what I can keep after the PSN+ expires and I have an account in four regions as well. I'm almost tempted to wish they get hacked again so I get more freebies.
I have no credit card information on their server and my e-mail accounts and passwords are pretty well sectioned for different uses. The only loss for me is a week or two of online Killzone 3, but that's fine since I took the time to read certain things I like.Basically, I'm getting extra free stuff with no loss. I'll need to find out what I can keep after the PSN+ expires and I have an account in four regions as well. I'm almost tempted to wish they get hacked again so I get more freebies.
Yeah it certainly looks more legit than the majority of stuff floating around. Did you try logging into your Amazon account just to check if it was indeed locked? But I'm with you as far as the conclusions go.
By the way - that sucks! I had an ATM card cloned two years ago and was *thankfully* checking my bank account right around the same time the thief was active (I am not checking my accounts daily, that's for sure), so I was able to stop all activity after *only* $2000 had been stolen. Luckily, the bank worked very quickly to restore the funds - I thought for sure I'd be in the midst of a months long paperwork drama.
I had just purchased a voucher from someone that didn't want it (extra maps, double point for faster rank ups etc) and I just sat down to redeem my voucher and PSN wouldn't log me in. This was lucky because certain benefits were only for the first 24hrs of redeeming the voucher, so imagine me playing 10mins then offline for 2 weeks!!!
Anyways, this has actually allowed me to go back and finish off KZ3 campaign, and also complete Uncharted 2. Now I've got my sights set on Socom 4.
Any mention on that PC about a possible end to this shutout?
(((interference)))
Veteran
Yeah, I'm not sure I couldn't log in yesterday, but was trying again now and can log in although I think i've created a new account with the same email address (due to how Amazon's login system is set up) as stuff like my past order history, addresses, credit card info etc aren't there, so it seems to be a new account unless Amazon have stripped my account of all the personal information.
I guess I'll be able to tell if it lets me successfully purchase anything or not.
My bank emailed me back saying
But I think they're confused as I can still see the following on my 'pending transactions' section of my online CC statement:
So the payment might have failed to go through (as Amazon indicated earlier) but someone was definitely trying to use my card to pay for something -
would the pending payment appear on my CC statement if they just had my CC number and did not have my correct CVC/CSC, or expiry date?
Or would they have had all my security info and the only reason the payment failed was due to Amazon or the bank spotting unauthorised activity (due to IP address monitoring etc.)?
And I read somewhere that you can send an email to a Sony address to get info on the credit card they have on file?
Last edited by a moderator:
Yes, several posts about it in this thread and more to come...
I'd be very suprised if you could send a email to get your credit card info, simply by asking them over e-mail.
What you can do however is check your email, and search for messages from DoNotReply@ac.playstation.net, those are the ones who's sending out receipts from PSN, it includes the country code of your visa (4 first numbers), and the 4 last numbers of the card used for the transaction, while the 8 middle numbers is censored, so you'll figure out what card you used.
It will also show the same way, when you go to change- or remove your card from PSN.
I watched the whole thing now. I'm pretty happy with everything that was said. I'm glad to see Sony is finally doing the right thing.
Has this been reported yet?
http://www.irwebcasting.com/110501/02/3a33cc2c90/index.html
Has this been reported yet?
http://www.irwebcasting.com/110501/02/3a33cc2c90/index.html
deathindustrial
Regular
I don't think anyone has posted this yet:
http://maintenance.station.sony.com/
As an aside, someone needs to tell Sony's web staff to disable default indexes in Apache.
http://maintenance.station.sony.com/images/
Cheers
http://maintenance.station.sony.com/
As an aside, someone needs to tell Sony's web staff to disable default indexes in Apache.
http://maintenance.station.sony.com/images/
Cheers
It`s now in the blog as well, plus some info on the rumored CC list: http://blog.us.playstation.com/2011/05/02/playstation-network-security-update/
I think my 8 digit password will be safe enough to change it in time.
Last edited by a moderator:
That is an extremely important communication error that made Sony look more incompetent than they were. Hackers could still pass on the hash instead of the password, but they don't have straightforward access or use of the password, and Sony have not used any system less secure than any other system out there. It would appear that Sony weren't particularly insecure, or arrogant as some would like to suggest, but just got hacked by a new attack vector as can happen with any system - there is no perfect security (other than not being online!).
Finally, some normal explanations. I'm really thrilled that we had to wait a week for such simple clarification, really what press were asking in emails to Sony?
Well and there it is - no surprise at all, and reinforces my own feelings that the Sony execs and PR folks in charge of these PR releases and such *really* need to sit down with the technical folks. That even after this debacle had reached the post-FAQ "plain text" outcry level, Hirai himself still didn't seem to have a grasp of what needed to be said and himself needed correcting... ugh.
Similar threads
