Support NeoGAF

[Abylim]

Now that everything is cleared up on my end, I'm just waiting for psn to come back up.

To those mocking us who got new CC's... why? Better safe than sorry? It took me a few minutes to call up my bank and tell them what was up. She told me I'm better off just getting a new card and they disable my current one. I'm without a card for a week, but I'd rather that then deal with someone charging Hungarian foot rubs to my account 3 months from now.

Cant wait to play Crysis2 online again, working towards rank 50 xD

 

[fistwell_old]

So almost all CC transactions on the internet which us HTTPS are bogus then?
Seriously, give it a rest. Your earlier post was full of assumption and hyperbole as well...

To be fair, that's not what he's saying. That's what he says the person in that chat was saying.

You are on the verge of opening another Pandora's box, gofreak!

That box has been opened a good long while ago... along the lines of "a little bird told me..."

 

[ChryZ]

Damnit.

Still can't play my PC version of Portal 2. That's the biggest tragedy of all.

Gotta second this

 

[Vagabundo]

You can't encrypt on the client when it's a SSL transaction done with a web browser (well technically you could do it with JS, but there is no point in doing that), which is about 99% of the CC transactions you'll ever see over the internet. So no, it's not a problem under normal circumstances.

Double Encryption is fairly standard in the industry.

Examples from a random search:

We prefer that you use the website to place your orders. We use double encryption to pass credit card information using SSL technology. We can assure you that all of your information will be safe. You can also purchase select cars at your participating Chevron station.

http://www.chevroncars.com/store/index.php?target=pages&page_id=help_placing_an_order

Advice from a webhosting forum:

1 Take care.
2 Think if you really have to store these.
3 Think about "30 days".
4 Encrypt - preferably double encryption using a key supplied through a browser over an SSL connection periodically.
5 If you're only "thinking about" getting a private SSL I'd put all this on hold until you've got a good scheme.

http://www.webhostingtalk.com/showthread.php?t=137724

 

[BeeDog]

Seeing as how the e-mail addresses and PSN passwords leaked out, it's safe to assume that hackers/criminals try to hijack the e-mail accounts by retrying the passwords. But what about other websites, e.g. big webstores like Amazon, eBay and so on? Is it common that criminals try to pair up passwords and e-mail addresses in other places, or is it almost always restricted to hijacking e-mail accounts only? Probably a stupid question, but I have no idea about how these hackers operate, and I'm curious.

 

[Vagabundo]

You just kind of need to Shut the fuck up already.

I've no problem with people disagreeing with me. What's up with this? You have a personal beef or something?

Did I hurt your feelings? I'm very sorry. Here:

Sony is great, poor Sony. I feel so bad for them. Those bad bad nasty hackers, sigh....

 

[darkwing]

Seeing as how the e-mail addresses and PSN passwords leaked out, it's safe to assume that hackers/criminals try to hijack the e-mail accounts by retrying the passwords. But what about other websites, e.g. big webstores like Amazon, eBay and so on? Is it common that criminals try to pair up passwords and e-mail addresses in other places, or is it almost always restricted to hijacking e-mail accounts only? Probably a stupid question, but I have no idea about how these hackers operate, and I'm curious.

supposing they cracked the PSN password, they could try the PSN email/password in Amazon, eBay etc... since these sites use your email as your login

 

[spats]

Now that everything is cleared up on my end, I'm just waiting for psn to come back up.

To those mocking us who got new CC's... why? Better safe than sorry? It took me a few minutes to call up my bank and tell them what was up. She told me I'm better off just getting a new card and they disable my current one. I'm without a card for a week, but I'd rather that then deal with someone charging Hungarian foot rubs to my account 3 months from now.

Cant wait to play Crysis2 online again, working towards rank 50 xD

A Hungarian foot rub sounds delightful.

 

[nofi]

Seeing as how the e-mail addresses and PSN passwords leaked out, it's safe to assume that hackers/criminals try to hijack the e-mail accounts by retrying the passwords. But what about other websites, e.g. big webstores like Amazon, eBay and so on? Is it common that criminals try to pair up passwords and e-mail addresses in other places, or is it almost always restricted to hijacking e-mail accounts only? Probably a stupid question, but I have no idea about how these hackers operate, and I'm curious.

Absolutely.

Obviously emails are the first port, as that's where 'reset my password' attempts will go, but yeah, they'll test anything with financial possibilities, I'd imagine.

 

[BeeDog]

Absolutely.

Obviously emails are the first port, as that's where 'reset my password' attempts will go, but yeah, they'll test anything with financial possibilities, I'd imagine.

Logical enough. I seriously wish for the bigger websites to implement security measures like Gmail has to be able to sense if IP's from other countries try to use the accounts. I mean, wouldn't stores be suspicious if someone from, let's say, Brazil starts using an account made in Europe? And then changes shipping addresses and whatever to this other country?

 

[darkwing]

Logical enough. I seriously wish for the bigger websites to implement security measures like Gmail has to be able to sense if IP's from other countries try to use the accounts. I mean, wouldn't stores be suspicious if someone from, let's say, Brazil starts using an account made in Europe? And then changes shipping addresses and whatever to this other country?

yup Gmail got it right

 

[Vagabundo]

Seeing as how the e-mail addresses and PSN passwords leaked out, it's safe to assume that hackers/criminals try to hijack the e-mail accounts by retrying the passwords. But what about other websites, e.g. big webstores like Amazon, eBay and so on? Is it common that criminals try to pair up passwords and e-mail addresses in other places, or is it almost always restricted to hijacking e-mail accounts only? Probably a stupid question, but I have no idea about how these hackers operate, and I'm curious.

That's actually a good point. I need to go do some clean up on my passwords for a few websites.

 

[nofi]

Logical enough. I seriously wish for the bigger websites to implement security measures like Gmail has to be able to sense if IP's from other countries try to use the accounts. I mean, wouldn't stores be suspicious if someone from, let's say, Brazil starts using an account made in Europe? And then changes shipping addresses and whatever to this other country?

Gmail's brilliant, especially if you use it with the 2-step authentication.

 

[carlos]

This probably has nothing to do with it, but for months I've been getting emails saying "someone has requested a password reset of your EA account".
I remember having to make an EA account for burnout paradise, and this uses the same email as the psn login....completely unrelated, I hope.

 

[Vagabundo]

The only people who will know if there has been a breach of the CC data is Visa/Mastercard. They should see a significant statistical bump and, with a little research, could find out if those cards had ever been used on PSN.

I don't think they release that kind of data though.

 

[darkwing]

This probably has nothing to do with it, but for months I've been getting emails saying "someone has requested a password reset of your EA account".
I remember having to make an EA account for burnout paradise, and this uses the same email as the psn login....completely unrelated, I hope.

its not very hard to activate this kind of warning, just find an email address on the web and try to guess the password on the email site or any other site that uses the email as the login

 

[itxaka]

I got a call from my bank last week telling me that they suspected my credit card was stolen.

Now, I use linux which rules out a lot of trojans/Hijackers/keyloggers and pay with paypal so I don't use my credit card numbers on the internet.

Soooo...it could come from this? I was waiting until they releasing more info as I was almost sure that no CC info could have been stolen as it would be heavily encrypted and someone must took my numbers from a dinner in a restaurant or something like that (old methods never die) but now that they aren't even sure if they got them...

Of course I can't be sure of this so don't take it as proof that they stole anything. As fas as I know the card numbers could have been stolen 2 years ago and just recently used.

 

[VisanidethDM]

The only people who will know if there has been a breach of the CC data is Visa/Mastercard. They should see a significant statistical bump and, with a little research, could find out if those cards had ever been used on PSN.

I don't think they release that kind of data though.

As I posted on the last page, I've spoken with a VISA representative yesterday who told me VISA was informed by Sony last week before the Easter break, and they took whatever measure they take in this cases (they've been monitoring the cards who had operations tied to PSN ever since).

In short, I called to activate security/potentially cancel the card and was told that they got it covered. Take it as you will.

 

[Katana_Strikes]

This probably has nothing to do with it, but for months I've been getting emails saying "someone has requested a password reset of your EA account".
I remember having to make an EA account for burnout paradise, and this uses the same email as the psn login....completely unrelated, I hope.

I'm pleased you brought that up actually because, I the other day, had an email from Blizzard about a password reset for Battle.net. I didn't think anything about it until now. Co-incidence or more to it, I don't know but I couldn't log in under my original set up, but I've changed it back now.

 

[Hanmik]

ok don´t know if this is "old"...

But Geohot has commented on the situation..

here are some quotes:

To start, I sure am glad I don't have a PSN account about now. And, as a onetime victim of identity theft, I feel for everyone who's data has been stolen. I'm not going to make cracks at Sony for flipping a shit when /their/ data is compromised, and not even having the decency to apologize when it's your data that's misappropriated.

And to anyone who thinks I was involved in any way with this, I'm not crazy, and would prefer to not have the FBI knocking on my door. Running homebrew and exploring security on your devices is cool, hacking into someone elses server and stealing databases of user info is not cool. You make the hacking community look bad, even if it is aimed at douches like Sony.

Also, let's not fault the Sony engineers for this, the same way I do not fault the engineers who designed the BMG rootkit. The fault lies with the executives who declared a war on hackers, laughed at the idea of people penetrating the fortress that once was Sony, whined incessantly about piracy, and kept hiring more lawyers when they really needed to hire good security experts. Alienating the hacker community is not a good idea.

To the perpetrator, two things. You are clearly talented and will have plenty of money(or a jail sentence and bankruptcy) coming to you in the future. Don't be a dick and sell people's information. And I'd love to see a write up on how it all went down...lord knows we'll never get that from Sony, noobs probably had the password set to '4' or something. I mean, at least it was randomly generated.

more here:

http://geohotgotsued.blogspot.com/2011/04/recent-news.html

 

[Magnus]

As I posted on the last page, I've spoken with a VISA representative yesterday who told me VISA was informed by Sony last week before the Easter break, and they took whatever measure they take in this cases (they've been monitoring the cards who had operations tied to PSN ever since).

In short, I called to activate security/potentially cancel the card and was told that they got it covered. Take it as you will.

Oh. So Sony actually communicated the issue to Visa back before Easter, like on Thursday? Sorry if this is old news; haven't been into the thread in awhile.

 

[Vagabundo]

As I posted on the last page, I've spoken with a VISA representative yesterday who told me VISA was informed by Sony last week before the Easter break, and they took whatever measure they take in this cases (they've been monitoring the cards who had operations tied to PSN ever since).

In short, I called to activate security/potentially cancel the card and was told that they got it covered. Take it as you will.

Hmmm, so they knew there was a possible CC breach on the 21th and told Visa. When did they tell the rest of the world? Wasn't it the 26th?

 

[darkwing]

i doubt anyone would want to take credit for this one

Q: Are you working with law enforcement on this matter?
A: Yes, we are currently working with law enforcement on this matter as well as a recognized technology security firm to conduct a complete investigation. This malicious attack against our system and against our customers is a criminal act and we are proceeding aggressively to find those responsible.

 

[Shao Kahn Brewing a Stew]

The credit card information - from tat chat log - is sent in plain text over the SSL channel (which itself is encrypted). The poster comments that this not usually sufficient and that the CC info is usually encrypted on the client and then sent over SSL. This has nothing to do with how the CC info may have been stored on the PSN servers.

I think you forgot to read the "fake" part in that chat log:

[user2] [redacted plain text code, includes false credit card number]
[user2] sent as plaintext
[user3] uh
[user3] did you censor that card?
[user2] ya its fake
[user3] good
[user1] wow, plaintext :S
[user5] plaintext wow
[user3] im never putting in my details like that
[user2] ya is all fake lol

 

[Darkman M]

Damn im just hearing about all this as of 10 minutes ago.....

 

[BeeDog]

Hmmm, so they knew there was a possible CC breach on the 21th and told Visa. When did they tell the rest of the world? Wasn't it the 26th?

While Sony HAVE handled this poorly, people need to realize they're handling a major money-making business, and every decision to inform people about potentially compromised information is costly. They will, for obvious reasons, want to make sure they can cover their asses as much as possible before putting out a PR statement that will inevitably do major damages to their treasure chests.

Since an intrusion occurred last week, they might have pre-emptively contacted VISA to give them a heads-up, which, if true, is a pretty good move all the same.

 

[kamorra]

I think you forgot to read the "fake" part in that chat log:

[user2] [redacted plain text code, includes false credit card number]
[user2] sent as plaintext
[user3] uh
[user3] did you censor that card?
[user2] ya its fake
[user3] good
[user1] wow, plaintext :S
[user5] plaintext wow
[user3] im never putting in my details like that
[user2] ya is all fake lol

The card number he posted was fake/edited.

 

[Vagabundo]

I think you forgot to read the "fake" part in that chat log:

[user2] [redacted plain text code, includes false credit card number]
[user2] sent as plaintext
[user3] uh
[user3] did you censor that card?
[user2] ya its fake
[user3] good
[user1] wow, plaintext :S
[user5] plaintext wow
[user3] im never putting in my details like that
[user2] ya is all fake lol

I believe they are talking about the actual CC information. He is unlikely to use a real card information in a test.

 

[Jburton]

No these servers were suppose to be part of PSN.

PSN is huge:

The IRC chat log you are referencing is bullshit.

That's your source?

 

[Vagabundo]

While Sony HAVE handled this poorly, people need to realize they're handling a major money-making business, and every decision to inform people about potentially compromised information is costly. They will, for obvious reasons, want to make sure they can cover their asses as much as possible before putting out a PR statement that will inevitably do major damages to their treasure chests.

Five days is a long time to craft a statement. I commend them for at least contacting Visa, but I'd bet that it was a legal requirement for them to do so.

Criminals had that data for at least six days (probably more) before Sony decided to tell the people affected. Inexcusable IMO.

The IRC chat log you are referencing is bullshit.

That's your source?

Source please.

 

[BeeDog]

Five days is a long time to craft a statement. I commend them for at least contacting Visa, but I'd bet that it was a legal requirement for them to do so.

Criminals had that data for at least six days (probably more) before Sony decided to tell the people affected. Inexcusable IMO.

I'm not trying to defend them, I'm trying to look at it from their point of view. 5 days is not just crafting a PR statement, they're looking at the situation from all possible economical and legal angles. As said, they're trying to cover their sides as much as possible before dropping the bombshell. It is poor form for the affected customers, that's entirely true, but it's also a matter of actually finding out if the stuff leaked or not. For what it's worth, the heads-up to VISA could be a matter of "there MIGHT be a potential CC leak", but "mights" are weak in a business world. They will want to make it perfectly certain that stuff may have leaked before issuing statements that will cost them enormous amounts of money. The uncertainty that can be seen in the big PR statement is most likely pressure from people and various outlets; if it wasn't for that, they probably would've withheld the information even more.

 

[get2sammyb]

God, the amount of bullshit being spread regarding this is terrifying. It's Sony's fuck up really for letting rumours people don't even understand take hold.

The amount of comments I've seen damning Sony for "storing credit card information in plain text" is annoying at best. Particularly when they've confirmed otherwise. People also keep citing the Kotaku story on an Australia charge as evidence that "all credit cards have been stolen".

Worse still, people believe it.

 

[Relaxed Muscle]

God, the amount of bullshit being spread regarding this is terrifying. It's Sony's fuck up really for letting rumours people don't even understand take hold.

The amount of comments I've seen damning Sony for "storing credit card information in plain text" is annoying at best. Particularly when they've confirmed otherwise. People also keep citing the Kotaku story on an Australia charge as evidence that "all credit cards have been stolen".

Worse still, people believe it.

I think, people meant CC info stored locally in any PS3 is stored in plain text and then send encrypted through SSL to PSN servers.

No one thinks actual CC info was stored in PSN servers in plain text.

Edit: http://twitter.com/Mathieulh

Wow if just half of the things is telling this guy is true....

 

[Vagabundo]

I'm not trying to defend them, I'm trying to look at it from their point of view. 5 days is not just crafting a PR statement, they're looking at the situation from all possible economical and legal angles. As said, they're trying to cover their sides as much as possible before dropping the bombshell. It is poor form for the affected customers, that's entirely true, but it's also a matter of actually finding out if the stuff leaked or not. For what it's worth, the heads-up to VISA could be a matter of "there MIGHT be a potential CC leak", but "mights" are weak in a business world. They will want to make it perfectly certain that stuff may have leaked before issuing statements that will cost them enormous amounts of money. The uncertainty that can be seen in the big PR statement is most likely pressure from people and various outlets; if it wasn't for that, they probably would've withheld the information even more.

I agree with you. It is just business.

However, my opinion of Sony as a company has dropped off the charts in recent years. This year they have been particularly shit.

4000+ news articles on Google news is a nice little PR storm they have brewed for themselves.

 

[iapetus]

While Sony HAVE handled this poorly, people need to realize they're handling a major money-making business

Not if they carry on like this, they're not.

 

[test_account]

About the CC being sent in plaintext, this was debunked many weeks ago:

http://arstechnica.com/gaming/news/...ing-stunning-lack-of-credit-card-security.ars

A document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection. So far so good; this is all safe, and your web browser depends on the same mechanisms for online purchases.

As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk. Essentially the same risk could be faced by anyone downloading a pirated version of Windows: extra certificates could be added to those normally trusted, along with suitable DNS entries, to allow interception of any traffic destined for, say, amazon.com. In practice, the risk of either of these is slight, and in any case, trivially avoided: don't use custom firmware.

 

[BeeDog]

I agree with you. It is just business.

However, my opinion of Sony as a company has dropped off the charts in recent years. This year they have been particularly shit.

4000+ news articles on Google news is a nice little PR storm they have brewed for themselves.

I'm not here to judge your loyalties to Sony, if you feel they don't do stuff well then who am I to object. I personally don't care about their extracurricular activities (e.g. fights with hackers, stupid statements etc.) as long as it doesn't affect me, which cannot be said about the PSN woes. I'm an egoistic consumer, and only care about the entertainment the PS3 games provide me, which, out of the three major console makers, I find the best. The PSN was fair game up until now, and I'm eager to see how well it recovers by next week. If my purchase list is wiped out for one reason or another, I'll write off Sony's service and won't look back if I find myself strong enough.

Anyway, from one thing to another, this just came in:

http://www.eurogamer.net/articles/2011-04-28-ms-xbl-security-our-highest-priority

Not if they carry on like this, they're not.

lulz

 

[get2sammyb]

I think, people meant CC info stored locally in any PS3 is stored in plain text and then send encrypted through SSL to PSN servers.

No one thinks actual CC info was stored in PSN servers in plain text.

Edit:http://twitter.com/#!/Mathieulh

Wow if just half of the things is telling this guy is true....

No. People genuinely do. Because it gives them a much needed excuse to vent about "how shit Sony is".

 

[Luckyman]

http://pastie.org/private/wlesnpatnf8fwdnhx3gqq

 

[butter_stick]

God, the amount of bullshit being spread regarding this is terrifying. It's Sony's fuck up really for letting rumours people don't even understand take hold.

The amount of comments I've seen damning Sony for "storing credit card information in plain text" is annoying at best. Particularly when they've confirmed otherwise. People also keep citing the Kotaku story on an Australia charge as evidence that "all credit cards have been stolen".

Worse still, people believe it.

Poor Sony

 

[Vagabundo]

I'm not here to judge your loyalties to Sony, if you feel they don't do stuff well then who am I to object. I personally don't care about their extracurricular activities (e.g. fights with hackers, stupid statements etc.) as long as it doesn't affect me, which cannot be said about the PSN woes. I'm an egoistic consumer, and only care about the entertainment the PS3 games provide me, which, out of the three major console makers, I find the best. The PSN was fair game up until now, and I'm eager to see how well it recovers by next week. If my purchase list is wiped out for one reason or another, I'll write off Sony's service and won't look back if I find myself strong enough.

I'm the same to some extent. I only care if it effects me.

I'll probably continue to use PSN, but I've modified my behaviour wrt the PS3. I'm more care about what data I put on it. I keep personal photos, and the like, off it. I will probably use prepaid cards for PSN from now on.

I'm looking forward to getting a nice freebie from Sony too.

 

[statham]

http://pastie.org/private/wlesnpatnf8fwdnhx3gqq

?

 

[get2sammyb]

Poor Sony

Not really. I can't understand why they didn't mention stuff like credit card encryption during the initial announcement. Very odd.

I'm looking forward to getting a nice freebie from Sony too.

Can we start speculating about what this might be now? Obviously they are going to extend PlayStation Plus, DC Universe Online subscriptions by a week/two weeks/maybe a month?

But what else can they offer? I wouldn't be surprised if they handed out a selection of free first party games (Fat Princess, Super Stardust, Calling All Cars) while also putting on a bumper sale to remind people, "Hey, we used to buy things through PSN and it was fine!"

Technically they don't have to do anything of course, but that would be madness in my opinion. They need to get people back into the flow of buying stuff again (points cards or not).

 

[Metalmurphy]

Not if they carry on like this, they're not.

I wonder if you actually believe that...

Reminds me of those 2006 "Sony going bankrupt!! Jump ship!" Doom-sayers. As stupid as it was, it was still a bigger reality then this is.


And what exactly do you mean by "carry on like this" btw? Pretty sure that getting hacked is not something within their control so they can carry on or not.

 

[xbhaskarx]

Hmmm, so they knew there was a possible CC breach on the 21th and told Visa. When did they tell the rest of the world? Wasn't it the 26th?

That would be quite fucked up if true, what possible reason could they have had to wait that long before informing consumers?


Also, questions for the don't blame Sony crowd...

Would you only be angry at the thief and not at the airline if your luggage was stolen?
Would you only be angry at the thief and not your home security system if your house was cleaned out?

Can the blame only be placed only on one party, is there really not enough here to spread it out between both?

 

[snap0212]

Why didn't Sony encrypt the personal information as well? Is there any reason for this?

 

[Wazzim]

I wonder if you actually believe that...

Reminds me of those 2006 "Sony going bankrupt!! Jump ship!" Doom-sayers. As stupid as it was, it was still a bigger reality then this is.


And what exactly do you mean by "carry on like this" btw? Pretty sure that getting hacked is not something within their control so they can carry on or not.

People keep saying this.. It's Sony's FULL responsibility, they are a multi billion dollar company and it's fully their fault if they lose control over server attacks.

 

[darkwing]

That would be quite fucked up if true, what possible reason could they have had to wait that long before informing consumers?


Also, questions for the don't blame Sony crowd...

Would you only be angry at the thief and not at the airline if your luggage was stolen?
Would you only be angry at the thief and not your home security system if your house was cleaned out?

Can the blame only be placed only on one party, is there really not enough here to spread it out between both?

the hacker is not known, however everyone knows Sony

 

[Metalmurphy]

People keep saying this.. It's Sony's FULL responsibility, they are a multi billion dollar company and it's fully their fault if they lose control over server attacks.

It is, but that doesn't say anything about being able to prevent it or not. You can't. You can try as best as you can though. These things happen, ALOT. There's no such thing as a secure network.

 

[Hanmik]

People keep saying this.. It's Sony's FULL responsibility, they are a multi billion dollar company and it's fully their fault if they lose control over server attacks.

so it was JFK´s own fault he got murdered.. not the guy who shot him..