PSN Compromised (Euro Hack)

[BadKarma]

http://kotaku.com/5803619/report-pla...th-new-content

Report: PlayStation Store Reopens May 24, Quickly Flooded with New Content

Michael McWhertor — Sony's PlayStation Store has been offline for almost a month following an attack on the company's PlayStation Network, leaving PlayStation developers without a digital storefront to sell their wares. That should changes next week, according to new memo from Sony.

The PlayStation Store is scheduled to return starting May 24, according to a report from Gamasutra which cites an e-mail from PSN content manager Jack Osorno to development partners. On May 24, content previously scheduled for April 26 will go live, with Sony attempting to catch up with rapid updates to the store.

New content is reportedly coming quickly, with updates continuing on May 27, May 31 and June 3, doubling the typical weekly update schedule.

Sony is expected to have its "Welcome Back" content available soon after the PlayStation Store comes back online, offering a handful of free games, movie rentals and membership to its PlayStation Plus subscription service.

Link Chevron Sony Tells Dev Partners PlayStation Store To Return May 24 [Gamasutra]

Sony fans everywhere rejoice.

Spoiler: show

Shuts off again May 26th for severe security flaw

Spoiler: show

http://i178.photobucket.com/albums/w.../Trollface.png

[6souls]

Following further PSN-related issues, Sony-operated internet service provider So-Net has been breached by a hacker, the company reports, resulting in virtual currency being stolen from some of its customers.

Around 100,000 yen (approximately $1,224) worth of "virtual points" were stolen from 128 So-Net customers in Japan, it was reported Friday, before the hack was discovered.

According to representatives, it does not appear that any other accounts were compromised in the attack, nor does any personal information appear to have been stolen.

"At this point in our investigations, we have not confirmed any data leakage," the company said in a statement to its customers. "We have not found any sign of a possibility that a third party has obtained members' names, address, birth dates and phone numbers."

So-Net operates out of Japan, and provides consumer internet connection services, as well as a portal website featuring news and entertainment.

Reports have also come in that a hacked page on a Sony-operated website in Thailand redirected users to a fake website posing as an Italian credit card company.

The phishing site, as discovered by Finnish internet security company F-Secure, does not appear to be related to the PSN attacks from last month.

"I think it's now 'I'm a hacker and I'm bored, let's go after Sony,'" security expert Josh Shaul told Reuters.

"Sony is going through a pretty rigorous process and finding the holes to fill."

http://www.gamasutra.com/view/news/3...y_Continue.php

[Zeb]

http://www.freeworldgroup.com/games9...nprotector.htm

[Doombard]

I'm wondering if they are going to add games for PS+ that would have been added during the outage because if they don't then I don't really give a shit about the extra 30 days they are giving for free*. Not that it really matters because last I remember they were milking some sega genesis collection a game at a time.

[6souls]

Really is Sony-anything that is getting hacked now.

In yet another attack on Sony property, a hacker has taken information from the Greek Sony BMG site and posted it online, including real names and email addresses of registered users.

As reported by security site Sophos, the hacker, under the alias b4d_vipera, used an automated SQL injection tool to uncover the flaw in the security system.

The stolen details were then posted up on pastebin.com. SonyMusic.gr users are advised to change their passwords on the site in light of the attack.

The breach comes after a month of issues for Sony, in which the company saw its PlayStation Network hacked and details of its users stolen, including names, addresses and other personal infomation.

Sony revealed earlier in the week that it estimates the unauthorized PSN intrusion and subsequent taking down of the network will cost around ¥14 billion ($171.7 million) in total for the next fiscal year.

http://www.gamasutra.com/view/news/3...ontent=Twitter
http://nakedsecurity.sophos.com/2011...ked-sony-site/

[Brimah]

So much for the reports of the store being up today.

PlayStation Network Scheduled Maintenance Today
+ Posted by Jeff Rubenstein // Social Media Manager

PlayStation Network is scheduled to undergo maintenance today, from about 8am until approximately 5pm Pacific time. During this time, registration and Account Management will be inaccessible, including the password reset process. While some users may experience difficulty signing in to PSN, the majority of consumers will be able to play online as well as sign in to external sites that require PSN authentication (like this one).

For those asking about the PlayStation Store, we’re still targeting restoration of all services by the end of this month. Contrary to reports, the Store will not be publishing today.

Stay tuned to the PlayStation Twitter feed for updates and a notice when maintenance has concluded.

We apologize for any inconvenience this may cause.

http://blog.us.playstation.com/2011/...tenance-today/

[ArchDizzle]

I want my B2TF episode 3 fuckers!


Sent from my iPhone using Tapatalk

[TacoTaru]

So much for the reports of the store being up today.



http://blog.us.playstation.com/2011/...tenance-today/

Huh, that's weird. I didn't think you could redeem codes because of the Store being tied to code redemption, but I redeemed a code through my browser today so I assumed the store was up.

[shidobu]

blah.. gdamnit i cant download DLC.. for MW2 and SSF4 on my new ps3.. bleh... playing without my classy dudely costumes is getting annoying

[Weltall]

Dudley...and class? Have you seen the real life individuals who select Dudley? (Not even talking about Marn) lol

You can do better than that Shid!

[Qalbert]

Xbox marketplace is down atm, although there is no evidence it's hacking related. Might be related to the new paypal feature, or new update in general, or something else entirely. Figured I'd post it here since it isn't a big enough deal to merit its own thread yet

[Oravis]

It was something about the current update causing 'overheating' issues in older PS3 models.

Sounds like a bunch of bullshit to me like that one time when FFXIII supposedly was doing the same thing. Read: false cause.

Just saw you guys talking about this. It probably is unrelated but my ps3 did die 2 days after psn came back.

[Elesirdur]

Has anyone been able to download any of the "Welcome Back" free games yet? If so, are they available through the PSN Store? PSN Store in Canada hasn't come up yet and the PSN blog is absolutely unclear about how users can download those free games.

[BadKarma]

Has anyone been able to download any of the "Welcome Back" free games yet? If so, are they available through the PSN Store? PSN Store in Canada hasn't come up yet and the PSN blog is absolutely unclear about how users can download those free games.

DERP

[Elesirdur]

Sorry, I didn't read the entire 22 pages of the thread.

[Brimah]

PSN store is not up yet. No word on when it will be up except for Sony saying it will be by the end of the month. Welcome back games will be released a week or 2 after that.

[Elesirdur]

Thanks, news on Canadian network has been pretty limited to the recent additional security breech.

[6souls]

Sony Corp., besieged by hackers since April, considered its PlayStation Network an unlikely target even after threats by the online collective Anonymous and three separate security incidents in 2008.

The hacker group declared in April that it would wage a cyber war against Sony for trying to stop people from tinkering with the PlayStation 3. Three years earlier, the company faced three breaches in Europe, including one in which Sony said some PlayStation Network user data might have been stolen.

The repeated incidents should have warned Sony its online network was vulnerable, said Eugene Spafford, a computer science professor at Purdue University in West Lafayette, Indiana. The failure to enact safeguards such as appointing a single chief of security may show Sony misunderstands the risks inherent in Chairman and Chief Executive Officer Howard Stringer’s networked strategy, he said.

“The evidence we’ve seen so far speaks to a lack of a good data management plan and a good security plan,” said Spafford, who specializes in information security, computer crime investigation and information ethics.

Japan’s Ministry of Economy, Trade and Industry said today it told Sony to carry out preventive measures against data breaches, instructed the company to ease customer concerns over misuse of credit cards and share more information among affiliates.

Spreading Attacks

Sony has struggled to keep up with the barrage that started in mid-April. The Qriocity and PlayStation Network entertainment services were knocked out for almost a month, compromising data in more than 100 million accounts.

In the past week, the Tokyo-based company has been hit with smaller intrusions -- a breach at online-service unit So-net Entertainment Corp. (3789) led to the misuse of user names and passwords of 128 customers. This week, Sony shut web pages that were targeted in Greece, Canada, Thailand and Indonesia.

The PlayStation Network will resume in Japan, Taiwan, Singapore, Malaysia, Indonesia and Thailand tomorrow, while services in South Korea and Hong Kong will remain suspended until further notice, Sony said today.

“Obviously our network security didn’t stop the attack and we’re trying to understand why, and we’ve made big strides in bolstering our security,” Stringer said in a May 17 interview, before the most recent incidents.

Sony believed it had “good, robust security,” Stringer said. He rejected suggestions that the company is paying for a lack of vigilance and said he was unaware of the 2008 intrusion on the PlayStation Network.

‘New Experience’

Since most users of PSN don’t pay, and most threats focus on stealing credit card information, the theft of passwords and other personal data from those services appeared less likely, Stringer said.

“We have a network that gave people services free,” Stringer said. “It didn’t seem like the likeliest place for an attack.”

When the April incursion first started, he didn’t know how serious it was, Stringer said. “I really don’t think I could apologize for not knowing,” he said. “It’s a whole new experience for everybody at this scale.”

Anonymous Vow

There were warning signs. Sony was singled out for retaliation by Anonymous, the hacker group that brought down the websites of MasterCard Inc. (MA) in December, after the company sued 21-year-old George “GeoHot” Hotz for posting information on how to modify the PlayStation game console. The case was settled on March 31.

Anonymous announced its revenge campaign, “Operation Payback,” on the website anonnews.org. In an early May statement, the group denied involvement in the PlayStation and Qriocity breaches, while saying some members of the loosely organized collective may have been behind it.

Sony, Japan’s largest consumer-electronics exporter, must connect its televisions, Blu-ray players, game consoles and digital cameras via the Internet to music, movies and video games, Stringer has said. Unconnected devices rapidly become commodities as rivals compete for customers, he has said.

Sony’s investigation into the cause and search for suspects in the mid-April attack is ongoing, the company said. In a letter to U.S. lawmakers today, the company said it believes it knows how the network was penetrated. The company said it doesn’t know who was responsible or precisely how much information was taken.

‘Failure of Trust’

On May 23, Sony said it may spend more than $170 million related to the hack. The company also said it discovered personal data may have been stolen from 8,500 user accounts in a music entertainment site in Greece.

The company erred in “thinking of these incidents in terms of a breach of systems” and communicating with its customers based on the severity of the failure, said Kevin Kosh, a partner at Waltham, Massachusetts-based Chen PR, which represents technology companies.

“When you’re a consumer-facing organization, that’s not the way you should think,” Kosh said. “It’s first and foremost a business failure and a failure of trust.”

In March 2008, Sony informed users in Europe that an unauthorized person may have gained access to personal data on PSN through personal computers. There is no evidence that personal information or credit-card data was taken, and the security flaw, which is unrelated to the recent attack, was fixed, the company said in response to questions for this story.

2008 Probes

London Metropolitan Police questioned a teenager about a separate, September 2008 hacking attack into Sony’s developer network, according to three people familiar with the incident.

The network has no identifying information about customers and isn’t attached to the PlayStation Network, Sony said in the statement provided by Dan Race, a spokesman.

In December 2008, a user revealed a flaw in Sony’s PlayStation Home virtual-world game for the PS3 that let him manipulate pictures and videos on his own device. That person never had access to Sony’s servers, the company said.

“The one incident that related to PlayStation Network, once we identified what it was, they went in and fixed it,” Race said. The April attacks were much more sophisticated than 2008 and appear to be unrelated, Sony said.

In the weeks leading up to the April 16 breach, Sony missed key opportunities to plug holes in its system, said Bret McDanel, a security expert who monitored publicly available server logs.

Navy Server

The company’s network security should have seen a sustained probing of its systems from a Navy medical computer in Southern California, which may have been used as a proxy server by potential attackers, McDanel said.

The company hasn’t turned up evidence of such a probe of its servers, said a person with knowledge of Sony’s efforts to trace the cause of the security break.

“The truth is that people test for vulnerabilities on network systems on a daily basis, and Sony is constantly monitoring for unauthorized activity, conducting our own vulnerability tests and making constant enhancements,” Race said.

He declined to say whether Sony found evidence of a probe from the Department of Defense server. Justin Cole, a spokesman for the U.S. Navy, didn’t return a call requesting comment.

The attack in April was launched through a server rented from Amazon.com Inc. (AMZN)’s cloud-computing service, a person with knowledge of the matter said this month. The account was shut and Amazon’s servers weren’t compromised, the person said.

Security Chief

Companies should consider carefully what data belongs on open servers, put one person in charge of administrative rights and keep track of how and when the network is accessed, said Yuichi Uzawa, a Tokyo-based senior consultant in charge of investigative response at Verizon Business. Nevertheless, determined hackers can often find ways to break in, he said.

“In the end, it’s extremely difficult to defend a network from an organized, targeted attack,” Uzawa said. “Early discovery of signs of intrusion through monitoring of key assets is the best defense.”

Sony said it takes network security and the protection of personal information seriously. There are multiple layers of protection and the company constantly monitors for unauthorized activity, including testing for vulnerabilities, it said.

Even so, Sony’s chief information officer oversaw network security as part of his duties until after the April attacks. A chief information-security officer was then appointed, reporting to the CIO, to provide an additional layer of security, the company said.

Failing to take such a step earlier was a critical shortcoming, according to Chen PR’s Kosh.

“Adding a CISO after the fact is like hiring a bodyguard after you’ve been fatally wounded,” Kosh said. “It creates an impression that there’s a lack of accountability.”

http://www.bloomberg.com/news/2011-0...to-attack.html

Not what you wanted, but worth the read.

[6souls]

Sony has confirmed that its Sony Network Entertainment International division will fully restore all PlayStation Network services in the Americas, Europe/PAL territories and Asia - excluding Japan, Hong Kong, and South Korea - by the end of this week.

According to an official release from Sony, "The company implemented considerable security enhancements to the network infrastructure, as well as conducted testing of the payment process and commerce functions."

The first phase of PlayStation Network and Qriocity restoration, following a hack-related outage in late April, began on May 15 in the Americas and Europe/PAL territories, followed by Japan and Asian countries and regions on May 28, when the company brought partial services back online.

With this partial restoration users were able to access to some of the services such as online game play, account management, friend lists and chat functionality were restored.

The full restoration of PlayStation Network as well as part of services to become available on Qriocity will include:

- Full functionality on PlayStation®Store
- In-game commerce
- Ability to redeem vouchers and codes
- Full functionality on Music Unlimited powered by Qriocity for PS3, PSP, and compatible PCs

"We have been conducting additional testing and further security verification of our commerce functions in order to bring the PlayStation Network completely back online so that our fans can again enjoy the first class entertainment experience they have come to love," said Kazuo Hirai, Executive Deputy President, Sony Corporation. "We appreciate the patience and support shown during this time."

http://www.gamasutra.com/view/news/3...ontent=Twitter

tl:dr - May 31st becomes June 4th/5th.

[Tymon]

They almost have to have it up by E3. I mean, come on. If they don't, you know it's just going to be a total lambasting.