Sony Offline Entertainment (Hacking of PSN and SOE)

[sruon]

The tears are delicious.

[Cephius]

It is 100% possible.

http://www.h-online.com/security/new...on-734010.html

The three digit security code (Credit Card Validation Number, CVN) on credit cards clearly offers insufficient protection from abuse, according to a report on german television channel ZDF's WISO business magazine program yesterday (Monday). The security code is intended to ensure that the card can only be used by its owner. According to the report, however, possession of a credit card's card number and expiry date is all a fraudster needs to be able to make purchases online. In tests, security services provider Syss found that at 80 percent of online shops it was in fact possible to simply try out every possible security number online, using, for example, an automated brute force attack.

Neither shops nor credit card associations, such as VISA or Mastercard, have prevented this by blocking further attempts after a certain number of failures, as is the case when using a cash card at a cash machine. Syss executive director Sebastian Schreiber confirmed the existence of the problem to heise Security. He stated that, in his opinion, the credit card associations had to take responsibility for resolving the problem. After a certain number of failed attempts, further attempts or even the card itself should be blocked. He noted that the credit card industry advertises on the basis of its multi-layered fraud prevention system, but that this is in fact mere window dressing - these systems were invisible during testing and did not block access.

In his opinion, in order to prevent cards from being blocked by malicious individuals, both the credit card number and the expiry date should be used. If both are correct, then you can probably assume that you are dealing with the owner of the card or a fraudster, and not just a prankster.

This article was published in 2007 and things have improved a bit since then, so I doubt the figure of 80% is accurate anymore. Obviously Visa and Mastercard have increased security. But saying CVVs 100% can not be cracked is just erroneous.

[Kerberoz]

Quit panicking, ffs. Credit card fraud? 5 minute call and it's over. It's not your problem. Welcome to 2011.

[Cephius]

Quit panicking, ffs. Credit card fraud? 5 minute call and it's over. It's not your problem. Welcome to 2011.

No one is panicking. It's simply something to be aware of.

[Sonomaa]

my parents have been complaining about netflix for the past week

[richardd]

my parents have been complaining about netflix for the past week

yeah, my brothers and sisters too. otherwise i would've never known this outage existed lol

[Moridam]

Netflix should work just fine, just gotta let the PSN login fail a few times and it should dump you right into netflix np. unless you're referring to some problem specific to the service itself (i.e. independent of the PSN issue), in which case i have no clue.

[Isiolia]

I dunno, it gave me a message that logging in to PSN was required for it to work - so I just said screw it and swapped over to my HTPC. Maybe retrying a bunch more would let it work.

What's annoying me is that I need to log into PSN so I can link it to my Steam account and get my PC copy of Portal 2. Or play the game on PS3...but I really hate playing first person games with a controller.

[SephYuyX]

Calling BS.
Sony just trying to safeface and trying to put more blame on the 'hackers'.
Why are companies still putting these things in plain text anyway.

[Hyan]

Sony's PR strategy:
http://i53.tinypic.com/35mi891.gif

I lol'd.

[blck]

Way to screw over the other millions of users who use PSN daily just to satisfy your personal greed to "show" sony you mean business.

I like how they didn't take anyone else into consideration and say "fuck em all" not just "fuck sony"

[Cephius]

Way to screw over the other millions of users who use PSN daily just to satisfy your personal greed to "show" sony you mean business.

I like how they didn't take anyone else into consideration and say "fuck em all" not just "fuck sony"

It's not 100% that Anon is behind this you know. A lot them seem to think it's some other group that's just using Anon as a scapegoat since they're "known" by the MSM these days

[Ragnell]

Sony's PR strategy:
http://i53.tinypic.com/35mi891.gif

I lol'd.

You sir, have won my fucking heart

[6souls]

Netflix should work just fine, just gotta let the PSN login fail a few times and it should dump you right into netflix np. unless you're referring to some problem specific to the service itself (i.e. independent of the PSN issue), in which case i have no clue.

I wish I had figured that out before the weekend. I was so fucking annoyed at first.

[*Shinzon*]

Oh Joy

Brian Crecente — Sony Comes Clean: PlayStation Network Hackers Have Stolen Personal Data A security breach in the Playstation Network by still unidentified hackers resulted in stolen personal information, Sony confirmed today.

Sony says while personal information was likely stolen they don't believe credit card numbers were and that they hope to have the Playstation Network service back up within a week.

The news comes more than nine days after the intrusion and six days after Sony shut down both the Playstation Network and Qriocity services in reaction to the breach. Sony says they've hired a "recognized security firm" to conduct a complete investigation into what happened and have taken steps to enhance security and strengthen network infrastructure.

"We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network," Patrick Seybold, senior director of corporate communications for Sony Computer Entertainment of America, wrote on the official Playstation Blog today.

Among the possible information stolen:

* Name
* Address (city, state, zip)
* Country
* Email address
* Birthdate
* PlayStation Network/Qriocity password and login and handle/PSN online ID.

"While there is no evidence at this time that credit card data was taken," writes Seybold, "we cannot rule out the possibility."

"If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained," Seybold continues.

Sony is encouraging users to be especially aware of potential phishing scams from people using email, phone calls and mail to try and extract more personal or sensitive information from you. Sony also is strongly recommending that you change you password once you're able to log back into the Playstation Network.

"To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports," Seybold wrote

"We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at 1-800-345-7669 should you have any additional questions."

updated from Engadget this time:

It's looking like things are just as bad as we feared and that "external intrusion" got a little deeper than we might have liked. In an update on its PlayStation.Blog, Sony just confirmed that the ongoing PSN outage was caused by "malicious actions," which we already knew, but continues by indicating that there has also been "a compromise of personal information." Exactly what that means Sony isn't saying, and it stops short of saying that credit card data for PSN and Qriocity users has been exposed, but the company does say "your credit card number (excluding security code) and expiration date may have been obtained." Yes, it may have been obtained -- even Sony isn't sure. There's no further ETA for when PSN may be back up online or when you might be able to finally sample Portal 2's delicious online co-op mode, but at least you can still watch Netflix.

Update: Our friends at Joystiq are reporting that Connecticut Senator Blumenthal is rip roarin' mad about the situation, "demanding answers" from SCEA president Jack Tretton. Right now, we're more curious what Kevin Butler has to say about things.

Update 2: Sony UK is shedding more light on just what data has been exposed, and frankly we were happier when it was dark. By the sound of things, everything Sony had about you has been accessed. There's a full list after the break, so only click on through if you dare.

[Thanks to everyone who sent this in]

Here's what Sony UK indicates was exposed:

* Name
* Shipping address
* Billing address
* Country
* E-mail address
* Birthdate
* PSN/Qriocity ID
* PSN/Qriocity password
* PSN/Qriocity security question and answer
* Purchase history

Assuming they got your god damn purchase history and psn pw and security information, safe to assume they got your CC number.

[6souls]

Read about both of those parts on the Inside Gaming blog earlier today. Bad week to be a Sony fanboy.

[Elcura]

Bad week to be Sony.

[Takedown3]

http://www.joystiq.com/2011/04/26/so...o-hopes-to-ha/

[6souls]

you img tagged the link

[Ragnell]

http://www.joystiq.com/2011/04/26/so...o-hopes-to-ha/

fix