Is PSN under attack? - PSN now back up 15/05

Frozo said:
This is probably a really stupid question but, is it still safe to use the PS3?
Click to expand...
Not that silly, I wont be putting my card details ever again (will anyone?) and hopefully Sony are investigated enough by the likes of the ICO to reduce the level of information required to make a PSN account (do they really need our address details) as Ill be removing as much as possible...

But for day to day nothings gonna change for me - its given me an overdue wakeup call with regards to what personal information is out there...

ps3ud0 :cool:
 
Last edited:
It is better to be safe than sorry, that's always true, but I don't think that unencrypted CC/DC details haven't been pilfered, as for unencrypted password, it's possible but I wouldn't think that would give them access to your bank account, it would allow them to purchase things through PSN with your CC/DC/Credits of some kind but as PSN is switched off, they can't.

So, here is all the pertinent information that you're all stressing about:

It's more than likely that the details of every single PSN account have been taken, including login credentials. No one can login with those credentials as PSN is switched off (with a big red off-switch somewhere in PSN HQ), CC/DC details will almost certainly be encrypted, it's unlikely they'll be able make use of that encrypted data.
We don't know who did it or why, speculation is pointless.

If you used your PSN password or security questions for anything else, change that, now. Especially if it was for the associated email account.

Yes they have your name/address/D.O.B, will they use it? No one knows. What can they do with it? Not much.

It is perfectly safe to use your PS3, I've barely had mine off :D

Despite the GeoHotz settlement, Anon won't be satisfied, however they may be satisfied with the utter humiliation of Sony. The GeoHotz settlement essentially places a restraining order on George Holtz restricting him from ever modifying any Sony product, which isn't likely to win them any friends.
 
Energize said:
That's exactly what I've been saying all this time, they didn't implement basic cryptographic hashing of passwords. They couldn't even use a random number generator properly.
Click to expand...

I'm confused, where have Sony stated that all the information wasn't encrypted? From what I have read, they haven't said that at all, people seem to be taking the word of the "original" hackers or just stretching the truth.
 
Homer-Simpson said:
I'm confused, where have Sony stated that all the information wasn't encrypted? From what I have read, they haven't said that at all, people seem to be taking the word of the "original" hackers or just stretching the truth.
Click to expand...

Erm, because Sony have been quite clear about the information that may have been compromised in the press release which includes 'PlayStation Network/Qriocity password and login, and handle/PSN online ID'

Obtaining a list of md5 password hashes would be entirely useless since the algorithm is one way. The point is, it is BASIC security that you store a hash of the password not the password itself. Flabbergasted is the correct term.
 
Ahh so its your inference rather than Sony actually stating that as fact? Many ways to read that vague sentence and is easily coloured by an individuals point of view...

ps3ud0 :cool:
 
BunnyKillBot said:
Erm, because Sony have been quite clear about the information that may have been compromised in the press release which includes 'PlayStation Network/Qriocity password and login, and handle/PSN online ID'

Obtaining a list of md5 password hashes would be entirely useless since the algorithm is one way. The point is, it is BASIC security that you store a hash of the password not the password itself. Flabbergasted is the correct term.
Click to expand...

They didn't say it was unencrypted. If someone stole the encrypted information, they will still have your username/password etc. People should still know that the information is out there.

Also obtaining a list of md5 passwords wouldn't be useless, it would all depend on how it was hashed. If key stretching/key strengthening/salting wasn't used you could use rainbow tables etc to brute force the passwords. Obviously you would hope they did know what they were doing. :)
 
Last edited:
From thesixthaxis.com whos source is MCV
The Internet is awash with people demanding compensation as their personal data is now in the hands of hackers but they may be in for a shock if they take legal action against Sony. MCV has noted the following statement in the Sony Online Terms & Conditions:

We exclude all liability for loss of data or unauthorised access to your data, Sony Online Network account or Sony Online Network wallet and for damage caused to your software or hardware as a result of using or accessing Sony Online Network.

Sony may be liable to a fine from Information Commissioners Office (ICO) of up to £500,000 if they are found to have broken the UK Data Protection Act but it appears that individual PSN users will not be able to claim any financial compensation.

Source: MCV
Click to expand...

Now surely that isn't legal? This data loss is far different from lets say losing your OS/images/videos etc and blaming it on the shop if for example your pc was returned and it went dodgey.

I never noticed that in their terms and conditions but thats just horrible so again adds fuel to fire imo did they know security was half assed and it might happen so that was in their for safe keeping bah, Also first lawsuit has been filled against them too but with that being in their T&C i cant see it succeeding.
 
If the IOC was to find that sony has broke the UK data protection act then surely that nullifies the terms and conditions?
 
No, it isn't legal, not even worth mentioning really, don't know why they put that nonsense in there.

I'm confused, where have Sony stated that all the information wasn't encrypted?
Click to expand...

They've said the hackers have got peoples passwords. Passwords shouldn't be stored on the server full stop, any competent system stores hashes of the password instead. A hash of the password is not the same thing as the password encrypted.
 
Anybody had this email?
Valued PlayStation Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, to be on the safe side we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your account statements and to monitor your credit or similar types of reports.

We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at www.eu.playstation.com/psnoutage should you have any additional questions.

Sincerely,
Sony Network Entertainment and Sony Computer Entertainment Teams

Sony Network Entertainment Europe Limited (formerly known as PlayStation Network Europe Limited) is a subsidiary of Sony Computer Entertainment Europe Limited the data controller for PlayStation Network/Qriocity personal data
Click to expand...
I've no idea at all what other sites i've got with the same password as PSN. I use a few different passwords but I can't use different ones for every single site I go on.
Luckily there's sod all money in my bank account if they've got my debit card details!
 
biron_w said:
Anybody had this email?

I've no idea at all what other sites i've got with the same password as PSN. I use a few different passwords but I can't use different ones for every single site I go on.
Luckily there's sod all money in my bank account if they've got my debit card details!
Click to expand...

Yep, Sony are sending those out to all 70+ million accounts :). It's naturally taking a while to get to all of them.
 
Strife212 said:
They've said the hackers have got peoples passwords. Passwords shouldn't be stored on the server full stop, any competent system stores hashes of the password instead. A hash of the password is not the same thing as the password encrypted.
Click to expand...

Try explaining what cryptographically secure hashing is to 90% of the PSN community and I am sure you will just get a glazed look on their face. It might just be poor wording. You never know, the passwords might have been hashed and encrypted. A lot of people seem to be making guesses on what happened. Until the details come out we are all in the dark.

Put it this way, with the information that has been released would you put your own life on the line to backup what you are saying? There are just too many possibilities.
 
So when are we supposed to change our credit card details/passwords? Without being able to log into PSN I can't even tell which card(s) I should consider cancelling, or what my PSN password was (I can't remember).
 
Durzel said:
So when are we supposed to change our credit card details/passwords? Without being able to log into PSN I can't even tell which card(s) I should consider cancelling, or what my PSN password was (I can't remember).
Click to expand...

If you're unsure of what card you used, check your emails if you have a wallet funding email from PSN, it should have the last 4 digits of the card used, or the type maybe. :)
 
You must log in or register to reply here.
Back
Top Bottom