Support NeoGAF

[LowParry]

It's just not my first instinct to take circumstantial anecdotes from random forum posters as evidence of anything. I have less than zero interest in defending Sony or the way they've handled this, but I'm also not going into a panic before anything solid emerges.

It's also nothing on those who wish to be extra safe and do what they feel is right. Though the level of panic I think is way overboard.

 

[Zombie James]

Nice to know the credit card data was encrypted (which should be a fucking given). One less thing to worry about.

 

[Snuggles]

holy shit YES I got my email

we're in the clear

 

[jim-jam bongs]

We know this explicitly?


Again, do we know this? I'm seriously asking, as this thread is huge and I haven't followed everything.

If the point is simply that it's 'out of date software' (assuming this is even known), all I can say is I used to work at one of the big 3 defense contractors. You'd cry if you know what we were running. Still haven't moved past XP for client machines ... IE6 didn't go away all that long ago ... many of the server OS's are 'out of date'.

Shit, you should see what the gov uses. Many times though, this is actually on purpose. There's a difference between jumping to the newest and the best, and actually maintaining security. The reality is it's a devil you know sort of game. Jumping to the newest typically means new unknown security flaws. Large-scale systems and big companies with important data purposely wait a while until a lot of the issues have been rung out and patched.

Now if there is verifiable evidence that they were not patching known flaws that have released updates ... that's a very different argument and would certainly make accusations of negligence more realistic. If however they were keeping those sorts of things up-to-date, then it's likely they were keeping their system more protected, not less.

When people refer to "out of date" OS software in this context they mean specifically that it hasn't been patched to the current secure build. And yes, the government does use ancient server software because that software is no longer being updated, so is no longer being patched for security because it's considered to be secure until someone finds a hole. We don't still run Redhat 4 on a couple of our environments for the lols dude.

 

[Professor Beef]

I missed Sonic Fanfics? Damn.

 

[darkwing]

Nice to know the credit card data was encrypted (which should be a fucking given). One less thing to worry about.

it would be in 128bits encryption right? that's a huge number, and the security code wasn't even stored

 

[bangai-o]

To obtain a new card including a entirely new set of numbers linked to your information takes a phone call that only takes mere minutes. Completely automated and you will have your new card in a week or less.

lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.

 

[Persona7]

Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.

lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.

Why would you close your account? You simply tell them to issue you a new credit/debit card. They will just unauthorize your old one and give you a brand new set of numbers.

Took me 2 minutes and they even let me pick up a temporary card from the bank.

I'm talking about bank cards here.

 

[warpaint]

right all password changed, CC changed just to be safe had card cloned before

 

[darkwing]

Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.

wasn't the EA account linked to the PSN id? not to the PSN email address

 

[CurlySaysX]

One of my bills that comes through the mail was opened by someone yesterday and was left in my letterbox without an envelope in the newspaper/junkmail section.
Fuck Sony.

 

[Persona7]

wasn't the EA account linked to the PSN id? not to the PSN email address

Nope, I thought it was that way because it seems like the perfect way to do it but I found that out the hard way and got locked out of mass effect 2 content because my old 2 emails didn't match.

When you make an EA account you enter an email (which is a bitch to change if you ever switch the email associated to your PSN or XBL account) and then it creates a Persona for whatever game service you linked it too.

 

[darkwing]

Nope, I thought it was that way because it seems like the perfect way to do it but I found that out the hard way and got locked out of mass effect 2 content because my old 2 emails didn't match.

When you make an EA account you enter an email (which is a bitch to change if you ever switch the email associated to your PSN or XBL account) and then it creates a Persona for whatever game service you linked it too.

oh i have to check my EA account too, forgot which email i used

 

[bangai-o]

Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.


Why would you close your account? You simply tell them to issue you a new credit/debit card. They will just unauthorize your old one and give you a brand new set of numbers.

Took me 2 minutes and they even let me pick up a temporary card from the bank.

I'm talking about bank cards here.

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.

 

[Dreamgazer]

One of my bills that comes through the mail was opened by someone yesterday and was left in my letterbox without an envelope in the newspaper/junkmail section.
Fuck Sony.

That was me, sucker!

 

[cjtiger300]

We have plenty.

PSN security was lax; you have Linux servers running out of date software and a pretty shoddy network setup. We have passwords stored either in plaintext or using a hashing system without a salt. That's more than enough to label them incompetent and negligent.

However they also say that they cannot rule out that CC information may have been stolen. This is after the external security firm audit, which means their method of encrypting the information was sub-par.

With something the size of PSN all this is unforgivable, but with the advanced warning they had with all CFW/GeoHot/Anon and, they do not fix this or get an audit, it is nearly criminally negligent.

So no, Sony are not the victims here, they are lazy fucks and deserve to have all this bad PR and vitriol.

The amount of misinformation in this post is insane. By the way, do you want friend code? I guess thats one way not to lose any info.

 

[kitch9]

lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.

Have you ever even used a bank?

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.

Wat? You don't get a new account number, you keep that and just get a new card number. Why would the hackers have your account number?

Took me 5 mins to order a new card and cancel my old one if that.....

 

[cjtiger300]

Some links. I posted this earlier, but this thread is huge:

http://www.vg247.com/2011/04/27/supposed-hacker-chat-logs-reveal-stunning-psn-security-lapses/

The hashing/plaintext issue I'll have to look up, but I've read it in a few sources. There is also some chat log from Anonymous that go into more detail on the PSN network issues.


@Raistlin: Regarding the warning; Sony knew that Anon was probing PSN months ago and with the backlash from the GeoHot lawsuit they knew PSN was a target.

Why are people using this as a credible source? The Credit Card info was encrypted.

 

[Lord Error]

Does anybody downplaying this have any idea how identity theft works?

I mean, it's possible that it's not related to the PSN hack... but certainly it's also possible that it is. Right?

The problem is that you can't really do much about your personal data being used against you, other than being more cautious about emails and phone calls that try to mine extra information from you. As for the credit card, it really seems unlikely at this point that it's worth the hassle replacing it over this. It was encrypted, and probably not stolen to being with, so why bother. Especially since your bank will block and refund fraudulent transactions quickly if they are worth their salt. I'll be monitoring my cc statement online more carefully in the next few weeks, but don't see a reason to do anything beyond that.

 

[Maximilian E.]

Kinda OT but some kind of amusing...

Was reading over at ars their small review of the game Outland.
The final segment of the text is as follows:

It has a few rough edges, but the combination of ideas and aesthetics the game displays is worth your time. Outland is out now on the Xbox Live Arcade, and will be available on the PlayStation 3 just as soon as you send Sony a copy of your house key.

ouch..

 

[SoccerGoaliePro]

I hope sony goes after those hackers and send them to jail for life.

 

[bangai-o]

Have you ever even used a bank?

well you make a strong statement. I guess ill have to back down fro my lackluster crazy theories.

 

[-Pyromaniac-]

The new faq sounds good. Can't wait for it all to be up and running again.

 

[blazinglazers]

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.

Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.

The problem is that you can't really do much about your personal data being used against you, other than being more cautious about emails and phone calls that try to mine extra information from you. As for the credit card, it really seems unlikely at this point that it's worth the hassle replacing it over this. It was encrypted, and probably not stolen to being with, so why bother. Especially since your bank will block and refund fraudulent transactions quickly if they are worth their salt. I'll be monitoring my cc statement online more carefully in the next few weeks, but don't see a reason to do anything beyond that.

Well you sound like you've got a good plan. I guess where we diverge is the "why bother" part. You're making assumptions that could have consequences if you're wrong. You're choosing to be reactive to possible theft, rather than pro-actively defending yourself. Changing your credit card takes a single phone call and costs you about five minutes of your time. In exchange you don't have to hope for or assume anything. You're done. Based on my past experiences with my bank and the various forms of identity theft that I've been exposed to, it's been a hassle to deal with even if in the end nothing permanent happened. It still sucked. I fully respect your choice to play it cool, but it rubs me the wrong way to see other people in this thread belittling the situation or those who've got legit concerns.

 

[bangai-o]

Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.

i am not saying it is a big deal. But am also not going to say "mere minutes".

 

[x3sphere]

Considering Sony left the whole personal data table not encrypted I wouldn't put much faith into the encryption they used for credit cards.

Who knows, the hacker could've taken advantage of their server to decrypt the card numbers too. Obviously, there is a decrypt function, since the PSN remembers your CC data when placing future transactions.

If you are concerned at all, cancel your damn card.

 

[fistwell_old]

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.

What the f has this to do with card numbers? I've had cards canceled+replaced with 5 minute phone conversations many times. But yeah, if you want to close the account, open a new one, change country, sex-change operation, etc, that may take a while.
Present situation doesnt call for any of that shit tho.

 

[Choc]

it takes 30 frigging seconds

i've had to do it before when an ATM chewed my cc

 

[Persona7]

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.

But my account isn't closed. The bank simply deauthorized my visa bank card and issued me a new card that links into my checking account.

 

[Dead Man]

Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.

No no no. The bank needs to see your original birth certificate in person, then do a DNA check, and then you have to wait 4 months for your new card. In the meantime you cannot get any money from any account, and your credit score gets reset to zero.

 

[onQ123]

holy shit YES I got my email

we're in the clear

LOL where is this from?

 

[BocoDragon]

Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.

You'll be out of a card for a few days to a few weeks. Not saying it's that big a deal but.....

 

[Blimblim]

Why are people using this as a credible source? The Credit Card info was encrypted.

Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.

 

[fistwell_old]

No no no. The bank needs to see your original birth certificate in person, then do a DNA check, and then you have to wait 4 months for your new card. In the meantime you cannot get any money from any account, and your credit score gets reset to zero.

You're forgetting the cavity search. Conveniently forgetting i might add.

 

[Dead Man]

You're forgetting the cavity search. Conveniently forgetting i might add.

I didn't want to scare people off...

 

[Professor Beef]

I didn't want to scare people off...

Who said everyone would be scared?

 

[fistwell_old]

I didn't want to scare people off...

I hear some people enjoy it...

Edit: beaten with a stick.

 

[onQ123]

I seen 1 rumor that we will get Cross Game Chat / Video Chat

& another that said we would have the NGP interface when PSN returns this weekend


now I'm trying to figure out why would a rebuilt PSN give us the NGP interface? lol

 

[cjtiger300]

Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.

That may be true, but a chat log, which anyone could type up is not a credible source.

 

[Dead Man]

Who said everyone would be scared?

I hear some people enjoy it...

Edit: beaten with a stick.

The line starts over....

<------Here

 

[Professor Beef]

I seen 1 rumor that we will get Cross Game Chat / Video Chat

& another that said we would have the NGP interface when PSN returns this weekend

now I'm trying to figure out why would a rebuilt PSN give us the NGP interface? lol

It's already been worked on for this long. if it's anything like the PSP version of the store, then the PS3 and portable stores aren't wildly different from each other to begin with.

If this is true at all, that is.

 

[VisanidethDM]

Yikes, first post.

I'm trying to catch up with the thread, but as a bit of potentially useful information, I contacted my CC company customer service yesterday in order to lower the threshold of the SMS warning on CC operations to 50€ (it's a very useful service for spotting CC scams and it's generally free on VISA cards).

I stated the reason was that an online service I was using had been potentially compromised. The customer service employee followed the procedure and when we were done, he asked me if this was about "the Sony issue". We discussed a bit and he told me that they had been in fact warned by Sony "prior to the Easter vacations" (which would mean before last Friday) and they had been monitoring operations tied to the Sony websites and cards since then. He in fact stated that all operations tied to Sony websites were blocked at the time.

Take it as you will (I doubt any official statement about being warned by Sony would be given consider the -unlikely- chance of class actions, in order not to join the "you knew and told nothing" bandwagon). This would on one hand confirm that Sony knew well before they told us, but on the other hand, also that they took action immediately to try and prevent any CC scam issue.

I had sent this info to the staff in case it was possibly relevant to the discussion, so ignore the double post in case it was already reported.

Sure it's nice to be able to post finally!

 

[Speevy]

PSP Gos for everyone, someone has to take them!

 

[UberTag]

Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.

Hey Blimblim, any chance you can elaborate further on the above point?

While it's been stated that existing CC data was being stored in encrypted fashion (and I fully believe that's the case), when does that encryption process take place? Does it happen immediately upon the PI being associated to the customer's account via the console, PSP, PSN/Qriocity website? Or does that process happen further down the road? Furthermore, what rationale would there have been from a cost effectiveness standpoint for Sony to not have encrypted other customer information in their database?

I've been trying to wrap my head around a scenario where the hackers "may have had access to credit card information" yet did not have access to decryption keys. Understanding whether or not unencrypted credit card details could have been accessed if transactions took place from April 17-19 when the network was compromised would shed some light on the situation.

 

[dzukela]

I hope sony goes after those hackers and send them to jail for life.

no, sony has to pay them a lot of money, because those hackers help sony closing security hole.
those hackers are the best thing happened to sony.

 

[DoctorButt]

One of my bills that comes through the mail was opened by someone yesterday and was left in my letterbox without an envelope in the newspaper/junkmail section.
Fuck Sony.

My dog just pooped in my sink and I have to clean it up
Fuck Sony.

 

[Combichristoffersen]

My dog just pooped in my sink and I have to clean it up
Fuck Sony.

My grandfather found out he has cancer last summer.
Fuck Sony.

 

[BocoDragon]

My grandfather found out he has cancer last summer.
Fuck Sony.

Fuck Sony.
Fuck Sony.

 

[ULTROS!]

My grandfather found out he has cancer last summer.
Fuck Sony.

My iTouch's battery life is dying quickly.
Suck Fony.

 

[Lord Error]

no, sony has to pay them a lot of money, because those hackers help sony closing security hole.
those hackers are the best thing happened to sony.

While you may be onto something (and will kind of be correct to be honest, if they finally enable voice chat like that rumor is suggesting) that's not how it works in legal system. This is considered a criminal activity, and if person(s) who did this are found, they will go to jail. Last example was that guy who over the past few years stole millions of CC numbers from a few banking institutions, but eventually got caught and got 20 years in jail.