PSN Compromised (Euro Hack)

[6souls]

Check your e-mail

===================================

PlayStation(R)Network

===================================

Valued PlayStation(R)Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full
and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly and
efficiently as practicable.

Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state, zip), country,
email address, birthdate, PlayStation Network/Qriocity password and login,
and handle/PSN online ID. It is also possible that your profile data,
including purchase history and billing address (city, state, zip),
and your PlayStation Network/Qriocity password security answers may
have been obtained. If you have authorized a sub-account for your
dependent, the same data with respect to your dependent may have
been obtained. While there is no evidence at this time that credit
card data was taken, we cannot rule out the possibility. If you have
provided your credit card data through PlayStation Network or Qriocity,
out of an abundance of caution we are advising you that your credit
card number (excluding security code) and expiration date may have
been obtained.

For your security, we encourage you to be especially aware of email,
telephone and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security number or other
personally identifiable information. If you are asked for this information,
you can be confident Sony is not the entity asking. When the PlayStation
Network and Qriocity services are fully restored, we strongly recommend that
you log on and change your password. Additionally, if you use your PlayStation
Network or Qriocity user name or password for other unrelated services or
accounts, we strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss, we
encourage you to remain vigilant, to review your account statements and
to monitor your credit reports. We are providing the following information
for those who wish to consider it:
- U.S. residents are entitled under U.S. law to one free credit report annually
from each of the three major credit bureaus. To order your free credit report,
visit www.annualcreditreport.com or call toll-free (877) 322-8228.

- We have also provided names and contact information for the three major U.S.
credit bureaus below. At no charge, U.S. residents can have these credit bureaus
place a "fraud alert" on your file that alerts creditors to take additional steps
to verify your identity prior to granting credit in your name. This service can
make it more difficult for someone to get credit in your name. Note, however,
that because it tells creditors to follow certain procedures to protect you,
it also may delay your ability to obtain credit while the agency verifies your
identity. As soon as one credit bureau confirms your fraud alert, the others
are notified to place fraud alerts on your file. Should you wish to place a
fraud alert, or should you have any questions regarding your credit report,
please contact any one of the agencies listed below:

Experian: 888-397-3742; www.experian.com; P.O. Box 9532, Allen, TX 75013
Equifax: 800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
TransUnion: 800-680-7289; www.transunion.com; Fraud Victim Assistance Division,
P.O. Box 6790, Fullerton, CA 92834-6790

- You may wish to visit the website of the U.S. Federal Trade Commission at
www.consumer.gov/idtheft or reach the FTC at 1-877-382-4357 or 600 Pennsylvania
Avenue, NW, Washington, DC 20580 for further information about how to protect
yourself from identity theft. Your state Attorney General may also have advice
on preventing identity theft, and you should report instances of known or
suspected identity theft to law enforcement, your State Attorney General,
and the FTC. For North Carolina residents, the Attorney General can be
contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; telephone
(877) 566-7226; or www.ncdoj.gov. For Maryland residents, the Attorney
General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202;
telephone: 888 743-0023; or www.oag.state.md.us.

We thank you for your patience as we complete our investigation of this
incident, and we regret any inconvenience. Our teams are working around the
clock on this, and services will be restored as soon as possible. Sony takes
information protection very seriously and will continue to work to ensure that
additional measures are taken to protect personally identifiable information.
Providing quality and secure entertainment services to our customers is
our utmost priority. Please contact us at 1-800-345-7669 should you have any
additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment

===================================

LEGAL
"PlayStation" and the "PS" Family logo are registered
trademarks and "PS3" and "PlayStation Network" are
trademarks of Sony Computer Entertainment Inc.
(C) 2011 Sony Computer Entertainment America LLC.

Sony Computer Entertainment America LLC
919 E. Hillsdale Blvd., Foster City, CA 94404

[Eticket]

Knowledge Center| System Software Updates| Manuals| Warranties| Service| Contact Customer Service
Questions and answers regarding PlayStation®Network/Qriocity Outage
Answer ID: 2356

PSN/Qriocity Network Outage FAQs

1. When did the PSN/Qriocity become unavailable?
PSN/Qriocity services have not been available since April 20 (US time) in all regions.



2. Why did the PSN/Qriocity become unavailable?
An external intrusion on our system has affected our PlayStation Network and Qriocity services.



3. Why was Sony not prepared for a compromise of its network?
We are currently conducting a thorough investigation of the situation. Since this is an overall security related issue, we cannot comment further at this time.



4. Is the attack by “Anonymous” or another party?
We are currently conducting a thorough investigation of the situation. Since this is an overall security related issue, we cannot comment further at this time.



5. Why is it taking so long to restore network services?
As soon as we learned of this issue, we temporarily turned off PlayStation Network and Qriocity services in order to conduct a thorough investigation and to verify the smooth and secure operation of our network services. Our efforts to resolve this matter involve re-building our system to further strengthen our network infrastructure. Though this task is time-consuming, we decided it was worth the time necessary to provide the system with additional security.



6. How serious is this compromise? How will Sony prevent this from happening again?
Because there is an on-going investigation we cannot comment further at this time, but we are working to restore and maintain and strengthen the services, including incorporating additional countermeasures to ward against future intrusions.



7. When will service be restored?
We have a clear path to have PlayStation Network and Qriocity systems back online, and expect to restore some services within a week.

We will keep the service down to allow us to conduct a thorough investigation to ensure smooth operation of our network services when they return; we are working hard to resume the services as soon as we can be reasonably assured our security concerns have been addressed.



8. Did SOE experience an attack due to the same reason?
SOE’s services are currently available, but they did experience a service interruption due to an external attack. An investigation is ongoing.



9. Have you had such a long PSN/Qriocity service termination like this one in the past?
No.



10. Does PSN/Qriocity get attacked very often?
We cannot make any comments regarding this matter at this time.



11. I want my money back (subscription fee, content) since the PSN/Qriocity was not available.
While we are still assessing the impact of this incident, we recognize that this may have had financial impact on our loyal customers. We are currently reviewing options and will update you when the service is restored.



12. There seems to be some games that cannot be played even offline?
Some games may require access to PSN for trophy sync, security checks or other network functionality and therefore cannot be played offline.



13. Why are Sony Online Entertainment services available while PSN and Qriocity are still down and you (SCE/Sony) are not able to even tell us when it will come back again?
As our investigation in this matter is ongoing, we cannot comment further on this matter.



14. What personally identifying information do you suspect has been compromised?
Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information provided by PlayStation Network/Qriocity account holders: name, address (city, state, zip), country, email address, birth date, PlayStation Network/Qriocity password, login, and handle/PSN online ID. Other profile data may also have been obtained, including purchase history and billing address (city, state, zip). If an account holder has authorized a sub-account for a dependent, the same data with respect to that dependent may have been obtained. If an account holder provided credit card data through PlayStation Network or Qriocity, it is possible that the credit card number (excluding security code) and expiration date may also have been obtained.



15. How will I know if my personal information has been compromised?
We have provided notices to consumers at the email addresses associated with their PlayStation Network/Qriocity accounts. You may also visit www.us.playstation.com/support and www.qriocity.com for notices regarding this issue. In addition, we have taken steps to disseminate information regarding this issue to media outlets so that consumers are informed. To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your credit card account statements and to monitor your credit reports.



16. What steps have you taken to investigate this compromise?
We have engaged an outside, recognized security firm to investigate this incident and to assist us in our ongoing efforts to protect your personally identifiable information.



17. I got an email from you asking for my PSN/Qriocity sign-in ID and password. Is it really you asking for this information?
Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking.



18. What should I do to avoid having my personal information compromised?
For your security, we encourage you to be especially aware of email, telephone, postal mail or other scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. Additionally, if you use the same user name or password for your PlayStation Network or Qriocity service account for other


19. Why did Sony wait until now to tell PSN users that their personal information may have been compromised?
The nature of the intrusion required that we undertake an extensive and thorough investigation of the matter, which took considerable effort and time. We needed to make sure that we knew and understood the facts before providing the appropriate notice to PlayStation Network users.


http://us.playstation.com/support/an....htm?a_id=2356

[Kaisha]

I'm curious now, does anyone know if all of PSN operates on the one set of servers, or are they regional based? Mainly wondering if the leak was perhaps just on the US side of things.

[6souls]

Dtoid posted the Senator's complete letter;

April 26, 2011

Mr. Jack Tretton

President and CEO

Sony Computer Entertainment America

919 East Hillsdale Boulevard

Foster City, CA USA 94404

Dear Mr. Tretton:

I am writing regarding a recent data breach of Sony's PlayStation Network service. I am troubled by the failure of Sony to immediately notify affected customers of the breach and to extend adequate financial data security protections.

It has been reported that on April 20, 2011, Sony's PlayStation Network suffered an "external intrusion" and was subsequently disabled. News reports estimate that 50 million to 75 million consumers – many of them children – access the PlayStation Network for video and entertainment. I understand that the PlayStation Network allows users to store credit card information online to facilitate the purchasing of content such as games and movies through the PlayStation Network. A breach of such a widely used service immediately raises concerns of data privacy, identity theft, and other misuse of sensitive personal and financial data, such as names, email addresses, and credit and debit card information.

When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised. Additionally, PlayStation Network users should be provided with financial data security services, including free access to credit reporting services, for two years, the costs of which should be borne by Sony. Affected individuals should also be provided with sufficient insurance to protect them from the possible financial consequences of identity theft.

I am concerned that PlayStation Network users' personal and financial information may have been inappropriately accessed by a third party. Compounding this concern is the troubling lack of notification from Sony about the nature of the data breach. Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised. Nor has Sony specified how it intends to protect these consumers.

PlayStation Network users deserve more complete information on the data breach, as well as the assurance that their personal and financial information will be securely maintained. I appreciate your prompt response on this important issue.

Sincerely,

/s/

Richard Blumenthal

United States Senate

http://www.destructoid.com/sony-psn-...s-199715.phtml

[Katlan]

http://farm6.static.flickr.com/5110/...5e47245274.jpg

I laughed soo hard

[Insanecyclone]

From 2 months ago

http://arstechnica.com/gaming/news/2...d-security.ars

Report: PSN hacked, custom firmware could pose security risk to users (UPDATED)

Update: A document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection. So far so good; this is all safe, and your web browser depends on the same mechanisms for online purchases.

The concern raised by the hackers is that custom firmwares could subvert this system. A custom firmware can include custom certificates in its trusted list. It can also use custom DNS servers. This raises the prospect of a malicious entity operating his own proxies to snaffle sensitive data. He would distribute a custom firmware that had a certificate corresponding to his proxy, and that used a DNS server that directed PSN connections to the proxy. His proxy would decrypt the data sent to it, and then re-encrypt it and forward it to the real PSN servers.

Such a scheme would be transparent to PSN users (except for any potential performance reduction caused by the proxying), and would give the attacker access to all the information that the PS3 sends to Sony. This information is shown to be extensive, but apart from the credit card data, probably not too sensitive or unreasonable.

As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk. Essentially the same risk could be faced by anyone downloading a pirated version of Windows: extra certificates could be added to those normally trusted, along with suitable DNS entries, to allow interception of any traffic destined for, say, amazon.com. In practice, the risk of either of these is slight, and in any case, trivially avoided: don't use custom firmware.

The original story is below, but note that the claims originally made by the hacker quoted in the article are unsubstantiated.

Original story: Sony has officially stated that anyone using hacked firmware or any sort of circumvention technology will have their console banned for life from the PlayStation Network, but how does the company know when such a console logs in? One person claims to have broken into the PlayStation Network, and what he has found is rather shocking. If his findings are accurate, your credit card information is being sent to Sony as an unencrypted text file, and Sony is watching every single thing you do with your system, keeping detailed records all the while.

"Sony is the biggest spy ever... they collect so much data. All connected devices return values sent to Sony's servers," the hacker said. He claims that Sony knows what controllers you're using, what USB devices are plugged in, what sort of television you're using—everything. Here's another section of the chat log:

user2: another funny function i found is regarding psn downloads
user2: its when a pkg game is requested from the store
user2: in the url itself you can define if you get the game free or not. requires some modification in hashes and so on tho
user3: ..
user2: is like
user8: :D
user3: my god
user2: drmff
That's not all: your credit card information is apparently being sent as an unencrypted text file. This is how the code is being sent to Sony:

creditCard.paymentMethodId=VISA&creditCard.holderN ame=Max&creditCard.cardNumber=45581234567812345678 &creditCard.expireYear=2012&creditCard.expireMonth =2&creditCard.securityCode=214&creditCard.address. address1=example street%2024%20&creditCard.address.city=city1%20&cr editCard.address.province=abc%20&creditCard.addres s.postalCode=12345%20

This information is allegedly being stored online and is updated every time you turn on your system. We've been receiving reports from various sources that e-mails are being sent to those with hacked firmware even before they log back into the PlayStation Network, which is even more evidence that Sony is grabbing information from your system just from being connected to your wireless network.

The ability to enable free downloads is likewise unsurprising, as there may be a way for some users, such as press and developers, to access the PlayStation Network without needing to pay for content. While other console manufacturers may keep free, pre-review content in a separate, closed-off network, it's possible Sony keeps everything in one place, and controls who pays and who doesn't via a simple toggle. That would be unsafe from a security standpoint, but when has that stopped anyone from stupid mistakes in the past?

It's also very possible this is all fake, but much of what the unnamed hacker is saying links up with what we know from other sources about the behavior of the PlayStation Network. It's worth treating this as a very real threat: use PSN cards instead of credit cards on the PlayStation Network, and make sure you don't share any passwords or login information between your PSN account and other accounts.

We've contacted Sony for comment, but have not received a reply at time of publication. The hackers joked that the next update will remove the PlayStation Network, just as Sony removed the Other OS feature when it became compromised.

Personally. I just want this back up and done with. 360 is basically taking up dust, is useless to me.

[Pikarya]

So I wonder if Black ops servers are going to go down permanently in the near future? Back in Jan. it was suggested they were fed up with service quality. I wonder what they think now.

[Pikarya]

http://www.ubergizmo.com/2011/04/mic...ghs-in-secret/

In light of Sony’s ongoing PlayStation Network issues, including the confirmation that it was shut down because of an external intrusion, Microsoft’s come out to chuckle at Sony.

According to a Microsoft representative:

“Of course it’s regretful that Sony is encountering issues at such a busy time, and Microsoft takes no joy in the problems gamers are having playing their favourite games online.”

The rep goes on to say that Microsoft expects Xbox Live usage to increase as a result of Sony’s woes.

“That being said, we are expecting Microsoft’s robust online network to see an increase of traffic from those gamers who own both systems. Being able to play their games via the Xbox Live network could make all the difference for some gamers.”

Gamers who are left in the cold as Sony works on re-securing its PSN will likely turn to Xbox Live to get their fix of online gaming. I know there are a lot of Call of Duty: Black Ops addicts out there and waiting for PSN to go back up (which could be days) isn’t going to fly with them.

There’s also a lot of chatter about whether or not Sony should compensate gamers for the PSN downtime. Given that PSN is free, unless you subscribe to PlayStation Plus, Sony’s not really obligated to owe gamers anything. We’ll see how this whole thing ends up. But as of right now Anonymous says it wasn’t them.

Few days old but you know Microsoft is eating it up.

[Shojin]

Only reason MS isn't going all out against Sony is because XBL was down for a number of weeks a few years ago. Sony talked a lot of shit about MS and their RROD issue, so I guess it only make sense to jab back at them for this huge fuck up.

There’s also a lot of chatter about whether or not Sony should compensate gamers for the PSN downtime. Given that PSN is free, unless you subscribe to PlayStation Plus, Sony’s not really obligated to owe gamers anything. We’ll see how this whole thing ends up. But as of right now Anonymous says it wasn’t them.

While true that it's free (excluding PS+ for the sake of this comparison), they fucked up big, and the big breach of personal information, which customers now have to go through the hassle of changing passwords, security answers, and possibly CC info I'd think a PSN game or something wouldn't be totally unexpected as some sort of compensation. When XBL went down a few years back, people were compensated with a free game although this is a lot more understandable seeing as it's a paid service.

[Tekki]

PSN isn't free. PS3's and their respective games cost a pretty penny, especially for EU/JP users and built in is PSN costs. This take a pretty solid dump on games that are primarily played online. I feel real bad for the 50+ people that showed for my midnight for Mortal Kombat but worse for the 10+ that picked up SOCOM.

Face it, a nice margin of gamers buy their games primarily to play online and that margin is deeper for shooters. Many simply don't even give a shit for single player and pay $60 to play a game online. So to say PSN is free is a bit misleading.

Customers are not happy. I have a college store in my district and many students tend to blow things out of proportion with their actions and this event is not unique. We have seen a huge spike in swaps for 360s and its ironic we are tagging an extra $50 to system trades with our card members.

This shit sucks, a good 30-40% of my phone calls have been "my ps3 isn't working online"...

[Tomiko]

While true that it's free (excluding PS+ for the sake of this comparison), they fucked up big, and the big breach of personal information, which customers now have to go through the hassle of changing passwords, security answers, and possibly CC info I'd think a PSN game or something wouldn't be totally unexpected as some sort of compensation. When XBL went down a few years back, people were compensated with a free game although this is a lot more understandable seeing as it's a paid service.

Preferably something decent and not a Mini or something would be nice. Optimally, giving everyone $10 credit would satisfy most since they wouldn't be given something they don't want or already have.

[Zeb]

This shit sucks, a good 30-40% of my phone calls have been "my ps3 isn't working online"...

Do those tards have a PS3 and no computer or something? You need a way to use let me google that for you over the phone for those mouth breathers.

[Guitarman]

Do those tards have a PS3 and no computer or something? You need a way to use let me google that for you over the phone for those mouth breathers.

You've never worked customer service, have you? People are beyond fucking retarded. They can't do a damn thing for themselves.

[jmc]

You've never worked customer service, have you? People are beyond fucking retarded. They can't do a damn thing for themselves.

Just work 911 calls, and you will give up all hope on humanity.

[BadKarma]

Just work 911 calls, and you will give up all hope on humanity.

Hello 911?

:::Yes mam how can I assist you?

My cat is on fire.

:::Excuse me?

My pussy has burst into flames! You gotta help me!

:::*click*

[blindSharingan]

Check your e-mail

Are people receiving this email?

I have a PSN account, have a card on it, and have purchased stuff off of PSN but haven't received any email notification. As unlikely as it is maybe I'm in the clear?

[Mjd]

Are people receiving this email?

I have a PSN account, have a card on it, and have purchased stuff off of PSN but haven't received any email notification. As unlikely as it is maybe I'm in the clear?

No

[Correction]

Are people receiving this email?

I have a PSN account, have a card on it, and have purchased stuff off of PSN but haven't received any email notification. As unlikely as it is maybe I'm in the clear?

All PSN accounts were compromised so you're not 'in the clear' even if you didn't get that email. You will still have to change your PSN password when it comes back up to prevent the hackers from locking you out of your own account, and it will still be wise to get your CC number changed.

[blindSharingan]

I was planned on getting my CC taken care of and my password changed regardless. I was just more so curious why I hadn't received an email yet.

[Ragnell]

To my notice, no one has gotten an Email from Sony