PSN Compromised (Euro Hack)

[Rokku]

Yes it does. Even XBL/Nintendo Store/Steam require that for a transaction.

Color me wrong then, mine's been saved for ages so I've not had to type it in. Either way, calling bullshit, I seriously doubt that anyone would hijack that much info, then go spouting off about it and trying to sell it on a public forum with no actual evidence that they have said info. If they do, they're incredibly stupid, but this looks more like people making an incredibly poor attempt to rip off scammers that buy CC info online.

[Tekki]

They sell it on forums and yes they spout it on forums. I've seen these sold in bucket loads in IRC channels as well. That post is not outside the realm of possibility and PSX-Scene is rather reliable on the hacking scene for PS3

[Pikarya]

Color me wrong then, mine's been saved for ages so I've not had to type it in. Either way, calling bullshit.

Ok?

[Rokku]

Ok?

What part of color me wrong, and thus agreeing with you, required this in response? My calling bullshit is in regards to someone actually having the unencrypted database of CC info that Sony and a security firm claims was untouched.

[Pikarya]

If you believe what Sony feeds you, sure. Bite from the apple all you want.

[BadKarma]

If you believe what Sony feeds you, sure. Bite from the apple all you want.

http://l.yimg.com/eb/ymv/us/img/hv/p..._breslin10.jpg

[Pikarya]

More accurate depiction of me.

http://www.geekologie.com/2010/07/15/foil-room-5.jpg

[Metah]

Yeah I'm with Pikarya, Sony is trying to save face because if they don't they're going to be even worse off. I'm more inclined to believe hackers who are exposing this than Sony.

This is what I was talking about, although its slightly editted and formatted shittily because its not the original, but I can't remember where I found the original:

http://pastebin.com/m0ZxsjAb

[*Shinzon*]

Save face? They're getting investigated by every consumer agency on the planet pretty much and now the FBI cyber crime division is involved. Trust me when I tell you the last thing they wanted to do was invite the FBI to investigate their system in order to save face.

FBI Cybercrimes Joins 22 States In Sweeping PlayStation Network InvestigationThe Federal Bureau of Investigations today confirmed to Kotaku that it is looking into the security breach that brought the Playstation Network down and exposed millions of users' personal data to cybercriminals.

The FBI is joined by nearly two dozen state attorneys general and possibly the Federal Trade Commission who are looking into this month's Playstation Network hack attack which forced Sony to take their PS3 online service offline for more than a week.

Sony told Kotaku that they reported the security breach to the FBI's cybercrimes unit in San Diego. Contacted Thursday, an FBI spokesman confirmed that they were looking into the reports.

"The FBI is aware of the reports concerning the alleged intrusion into the Sony on line game server and we have been in contact with Sony concerning this matter," said FBI special agent Darrell Foxworth. "We are presently reviewing the available information in an effort to determine the facts and circumstances concerning this alleged criminal activity."

Meanwhile attorneys general from 22 states are demanding answers from Sony over the breach, asking why it took the company so long to alert customers to the attack.

That group of state attorneys general are sharing information with one another about their individual inquiries, Susan Kinsman, communications director for the Connecticut Office of the Attorney General told Kotaku.

The collection of attorneys general have also contacted the Federal Trade Commission to see if they have launched their own federal investigation, she said.

The Federal Trade Commission could have jurisdiction in a case involving loss of customer data through a security breach, FTC spokeswoman Claudia Bourne Farrell told Kotaku. But the FTC does not discuss or confirm ongoing investigations.

Kinsman also declined to say whether the FTC has launched their own investigation.

"A call has been made to the FTC and there will be discussions, but I can't comment on whether the FTC is investigating," she said.

While Kinsman was able to confirm that attorneys general from at least 22 states were looking into the Sony breach and how it might affect consumers in their states, she declined to say which states that included.

Connecticut's own attorney general sent a letter to Sony Computer Entertainment of America President and CEO Jack Tretton on Wednesday. The letter demanded answers to a number of questions including what data was stolen, who was responsible, how long the company knew and what was being done to make sure it doesn't happen again.

"The fact that sensitive information was apparently accessed without authorization makes me especially concerned about the possibility of financial fraud and targeted phishing scams," Connecticut Attorney General George Jepsen wrote. "What is more troubling is Sony's apparent failure to promptly and adequately notify affected individuals of this large-scale breach."

The letter goes on to outline a baker's dozen questions.

Kinsman said the letter was sent out Wednesday and that the office has not yet heard anything back from SCEA.

Sony officials told Kotaku that it wasn't until Monday, after an outside security group conducted an extensive investigation, that they realized customer data had been stolen. That data included names, passwords and other identifying information. Sony doesn't believe credit card numbers were stolen. If it was, that data is also encrypted when it is stored, they said.

Anyone with information concerning the breach is asked to contact the FBI at 858-565-1255 or 1-877-EZ-2-TELL. Cyber tips may be e-mailed to the Internet Crime Complaint Center.

[6souls]

As a follow-up to yesterday's Q&A #1 comes part two from Sony's Senior Director of Corporate Communications & Social Media Patrick Seybold, as follows:

Yesterday, we addressed a number of your questions relating to the malicious intrusion into our network. As we get closer to restoration of service, here are more answers to your questions, many of which are more gaming related:

Q: Will our download history/friends list/settings be affected by the PSN downtime?
A: No, they will not.

Q: Will trophies that were earned in single-player offline games during the outage be intact when the service resumes?
A: These trophies are intact and will be re-synched when the network is once again operational.

Q: Will my PS+ cloud saves be retrievable?
A: Yes, once PSN is restored.

Q: What if we have a subscription to PS3 MMOs DC Universe Online or Free Realms? Will we get compensation for that?
A: From Sony Online Entertainment: "We apologize for any inconvenience players may have experienced as a result of the recent service interruption. As a global leader in online gaming, SOE is committed to delivering stable and entertaining games for players of all ages.

To thank players for their patience, we will be hosting special events across our game portfolio. We are also working on a "make good" plan for players of the PS3 versions of DC Universe Online and Free Realms. Details will be available soon on the individual game websites and forums."

Q: Will there be a goodwill gesture for the time we haven't been able to utilize PSN/Qriocity?
A: We are currently evaluating ways to show appreciation for your extraordinary patience as we work to get these services back online. Thank you for your continued feedback.

Finally, SCEE Blog Manager James Gallagher confirmed that PlayStation Network accounts will not be reset following the outage that has last approximately 1 week. To quote:

"We're not resetting accounts or anything like that, so when PSN is restored and you log on, everything will be as you left it. When PSN is restored, friends lists, trophies and wallet funds will all be exactly as they were before."

http://blog.us.playstation.com/2011/...city-services/

Figured this was relevant, true or not.

http://psx-scene.com/forums/f6/psn-d...up-sale-85702/

MSNBC is reporting the same thing;

Eight days after Sony took the PlayStation Network offline, rumors and misinformation continue to swirl around the unprecedented shutdown and massive data breach that affected an estimated 77 million users.

Security expert Kevin Stevens of TrendMicro tweeted today, April 28, that low-level cybercriminals using "carder" online forums were offering to sell a database of 2.2 million credit-card numbers taken during the PlayStation Network breach.

Independent security blogger Brian Krebs then posted screenshots of four hackers discussing the purported database in a chat room.

"xxx: format is: fname, lnams, address, zipcode, country, phone, email, email password, dob, ccnum, cvv2, exp date," wrote user "Sutekh" in one of the screenshots.

In plain English, that's the first name, last name, address, postal code, country, telephone number, email address, email password, date of birth, credit-card number, credit-card security code and credit-card expiration date attached to each of 2.2 million accounts — including "150k german ones," as Sutekh said in a different posting.

"Sony was supposedly offered a chance to buy the DB (database) back but didn't," tweeted Stevens.

Neither Stevens nor Krebs claimed to have seen the actual database being offered, and it almost sounds too good to be true. Why, for example, would Sony have the passwords to users' third-party email accounts, such as Yahoo or Gmail accounts?

For its part, Sony dribbled out a bit more information today.

In an FAQ posted on various PlayStation websites worldwide, the company said that "your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system."

(Qriocity is a separate entertainment-delivery network owned and run by Sony, which was also affected by the PlayStation Network breach.)

Sony also stated that, "The entire credit card table was encrypted and we have no evidence that credit card data was taken."

So either the hackers selling the database are lying about having credit card security codes, or Sony is not telling the truth about having them in the first place.

The latter scenario seems far less likely, as Sony would open itself to enormous lawsuits if it were found to be less than truthful about the breach — except that, as was reported yesterday, unencrypted credit card numbers with security codes are exactly what amateur hackers claimed to have found in PlayStation Network development channels two months ago.

http://www.msnbc.msn.com/id/42806008...ence-security/
http://www.securitynewsdaily.com/son...-bazaar-0740/#
http://twitter.com/#!/killercube/sta...25145977290752
http://krebsonsecurity.com/wp-conten...011/04/dk2.jpg
http://www.securitynewsdaily.com/mas...amateurs-0736/
http://173.255.232.215/logs/efnet/ps3dev/2011-02-16

[Plow]

People trying to sue Sony over this makes me "lol." Once they confirmed their was a data breach they took the appropriate measures. I'm sure they thought it was a possibility from the start, but you can't make a public announcement like that until your 100% positive

This is a fucking company that got caught making their audio cd's secretly install rootkits in an attempt to prevent piracy, and they stored our fucking personal data in plain text.

This has virtually nothing to do with when they announced shit.

[Correction]

Can we stop regurgitating the 'stored in plain text' misinformation? Please?

[Eticket]

Just in time to save Sony's ass from angry hordes of nerds... it's the Supreme Court!

http://www.dailykos.com/story/2011/0...cess-to-Courts

You have to sign an agreement accepting arbitration. While I'm sure all companies will shoehorn that into TOS's going forward, I doubt it has any bearing on this particular situation.

[archibaldcrane]

You have to sign an agreement accepting arbitration. While I'm sure all companies will shoehorn that into TOS's going forward, I doubt it has any bearing on this particular situation.

I'd be very surprised if there isn't an arbitration agreement in the TOS. It's a very common thing to ask for in such agreements.

Sent from my Samsung Galaxy S 4G using Tapatalk

[liggy 0]

someone needs to find a way implement UCC 1-308 into E signing =/

[Doombear]

[*Shinzon*]

Man I hope Sony has all their shit together for this one: DHS joining the party

— PlayStation Network Attack Now Has the Attention of U.S. Homeland SecurityThe U.S. Department of Homeland Security has joined the FBI, Federal Trade Commission and 22 state attorneys general in investigating last week's PlayStation Network breach. That "malicious intrusion" into Sony's online network and its Qriocity service forced PlayStation owners offline and threatened the security of some 77 million accounts.

Homeland Security says it is "aware of the recent cyber intrusion" to Sony's online infrastructure, according to a report from NextGov. DHS spokesman Chris Ortman tells the site that the department's "Computer Emergency Readiness Team is working with law enforcement, international partners and Sony to assess the situation."

CERT, established in 2003, is the operational arm of the National Cyber Security Division at the Department of Homeland Security. Its purpose is to coordinate response to security threats from the Internet.

Yesterday, the FBI confirmed to Kotaku it is "presently reviewing the available information in an effort to determine the facts and circumstances concerning this alleged criminal activity."

Personal data culled from the exposure of millions of PlayStation Network and Qriocity accounts may expose external accounts, including those of government, business and financial institutions. Sony warned its customers this week to be wary of telephone and e-mail scams that may exploit personal details stolen from PSN.

Sony said in a statement earlier this week that it believes user information including names, addresses, birth dates, email addresses, login names and passwords may have been exposed, as that data was not encrypted on the company's PlayStation Network. The PlayStation maker says stored credit card data was encrypted, stressing that "there is no evidence at this time that credit card data was taken," though it could not rule out the possibility.

For PlayStation 3 owners, the one bright light in this ordeal was that Friends Lists and PlayStation Trophies are expected to remain intact when the service returns, likely sometime next week.

[Zeb]

As a side note, I hope Sony takes this opportunity to purge unused PSN IDs like Microsoft did with gamertags a couple months ago.

[Qalbert]

http://www.reuters.com/article/2011/...73R0Q320110430

Sony Corp's No.2 Kazuo Hirai will brief media on Sunday about a huge security breach of its PlayStation Network, the first time an executive of the Japanese electronics giant will publicly address the case, which could prompt global legal actions.

Hirai, in line to succeed CEO Howard Stringer, will hold a news conference in Tokyo at 2:00 p.m. (1 a.m. EDT) on Sony's investigation of the case, its information management system and the schedule to resume services, the firm said in a news release on Saturday.

Sony warned on Tuesday that hackers had stolen names, addresses, and possibly credit card details from 77 million user accounts of its online video game network, which produces an estimated $500 million in annual revenues.

The disclosure of one of the biggest ever online data infiltrations came on Tuesday, a week after Sony shut down the network. Executives made no mention of the crisis hours earlier that day when they launched its first tablet computer.

The delay prompted anger among online users, although company said it was due to a forensic investigation.

It could lead to legal action around the globe and pose a challenge for Hirai, who Stringer has said is in pole position to succeed him.

In the United States, attorneys general, who act as consumer advocates, have begun investigating the matter or reviewing it with staff in several states, while U.S. regulators such as the Federal Trade Commission could get involved as well.

The chairman of the U.S. House of Representatives' Committee on Energy and Commerce, Mary Bono Mack, on Friday sent a letter to Hirai, who also serves as the chairman of Sony Computer Entertainment America, asking why the disclosure was delayed.

In Britain, a government watchdog launched an investigation of the incident.

Sony has been mulling a potential successor for Stringer, who has been vague about his plans from the next financial year that starts in April 2012.

Hirai, who was promoted in March to executive deputy president of Sony, used to run the firm's network products and services division including Sony's game businesses.

Sony shares took a hit on Thursday, falling nearly 5 percent in Tokyo. The bourse was closed on Friday, a national holiday.

Sony said it had encrypted all credit card numbers, which would make it extremely difficult for hackers to access that data. But criminals might use other personal information that was not encrypted to launch scams.

[The Blackrose]

I half expect Kaz to go "Forget about PSN! I got something to show you! It's Ridge Racer! Riiiiiiidge Racer!"

God that guy is a joke.