PSN Hack Update: FAQs in OP, Read before posting

Status
Not open for further replies.
whalleywhat said:
It's just not my first instinct to take circumstantial anecdotes from random forum posters as evidence of anything. I have less than zero interest in defending Sony or the way they've handled this, but I'm also not going into a panic before anything solid emerges.
Click to expand...


It's also nothing on those who wish to be extra safe and do what they feel is right. Though the level of panic I think is way overboard.
 
holy shit YES I got my email

eKRM1.gif


we're in the clear
 
Raistlin said:
We know this explicitly?


Again, do we know this? I'm seriously asking, as this thread is huge and I haven't followed everything.

If the point is simply that it's 'out of date software' (assuming this is even known), all I can say is I used to work at one of the big 3 defense contractors. You'd cry if you know what we were running. Still haven't moved past XP for client machines ... IE6 didn't go away all that long ago ... many of the server OS's are 'out of date'.

Shit, you should see what the gov uses. Many times though, this is actually on purpose. There's a difference between jumping to the newest and the best, and actually maintaining security. The reality is it's a devil you know sort of game. Jumping to the newest typically means new unknown security flaws. Large-scale systems and big companies with important data purposely wait a while until a lot of the issues have been rung out and patched.

Now if there is verifiable evidence that they were not patching known flaws that have released updates ... that's a very different argument and would certainly make accusations of negligence more realistic. If however they were keeping those sorts of things up-to-date, then it's likely they were keeping their system more protected, not less.
Click to expand...

When people refer to "out of date" OS software in this context they mean specifically that it hasn't been patched to the current secure build. And yes, the government does use ancient server software because that software is no longer being updated, so is no longer being patched for security because it's considered to be secure until someone finds a hole. We don't still run Redhat 4 on a couple of our environments for the lols dude.
 
Zombie James said:
Nice to know the credit card data was encrypted (which should be a fucking given). One less thing to worry about.
Click to expand...

it would be in 128bits encryption right? that's a huge number, and the security code wasn't even stored
 
Persona7 said:
To obtain a new card including a entirely new set of numbers linked to your information takes a phone call that only takes mere minutes. Completely automated and you will have your new card in a week or less.
Click to expand...
lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.
 
Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.

bangai-o said:
lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.
Click to expand...
Why would you close your account? You simply tell them to issue you a new credit/debit card. They will just unauthorize your old one and give you a brand new set of numbers.

Took me 2 minutes and they even let me pick up a temporary card from the bank.

I'm talking about bank cards here.
 
Persona7 said:
Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.
Click to expand...

wasn't the EA account linked to the PSN id? not to the PSN email address
 
One of my bills that comes through the mail was opened by someone yesterday and was left in my letterbox without an envelope in the newspaper/junkmail section.
Fuck Sony.
 
darkwing said:
wasn't the EA account linked to the PSN id? not to the PSN email address
Click to expand...
Nope, I thought it was that way because it seems like the perfect way to do it but I found that out the hard way and got locked out of mass effect 2 content because my old 2 emails didn't match.

When you make an EA account you enter an email (which is a bitch to change if you ever switch the email associated to your PSN or XBL account) and then it creates a Persona for whatever game service you linked it too.
 
Persona7 said:
Nope, I thought it was that way because it seems like the perfect way to do it but I found that out the hard way and got locked out of mass effect 2 content because my old 2 emails didn't match.

When you make an EA account you enter an email (which is a bitch to change if you ever switch the email associated to your PSN or XBL account) and then it creates a Persona for whatever game service you linked it too.
Click to expand...
oh i have to check my EA account too, forgot which email i used
 
Persona7 said:
Has EA made it any easier to link to a different email?

Like lets say I link my PSN account to a new email and want my EA account(linked to psn) to link to the new email as well, I had a hard time doing that simple process awhile back.


Why would you close your account? You simply tell them to issue you a new credit/debit card. They will just unauthorize your old one and give you a brand new set of numbers.

Took me 2 minutes and they even let me pick up a temporary card from the bank.

I'm talking about bank cards here.
Click to expand...

well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.
 
Vagabundo said:
We have plenty.

PSN security was lax; you have Linux servers running out of date software and a pretty shoddy network setup. We have passwords stored either in plaintext or using a hashing system without a salt. That's more than enough to label them incompetent and negligent.

However they also say that they cannot rule out that CC information may have been stolen. This is after the external security firm audit, which means their method of encrypting the information was sub-par.

With something the size of PSN all this is unforgivable, but with the advanced warning they had with all CFW/GeoHot/Anon and, they do not fix this or get an audit, it is nearly criminally negligent.

So no, Sony are not the victims here, they are lazy fucks and deserve to have all this bad PR and vitriol.
Click to expand...


The amount of misinformation in this post is insane. By the way, do you want friend code? I guess thats one way not to lose any info.
 
bangai-o said:
lol no. They are going to take you through the whole deal of making sure you are who you say you are, they are going to look at your account and try to figure why you are wanting to close the account, they are going to ask you why you think your account is compromised, they will begin asking about specific transactions and asking for confirmations. transfer to other dept etc.
You are going to be on the phone for at least 30 to 45 minutes.
Click to expand...

Have you ever even used a bank?


bangai-o said:
well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.
Click to expand...

Wat? You don't get a new account number, you keep that and just get a new card number. Why would the hackers have your account number?

Took me 5 mins to order a new card and cancel my old one if that.....
 
Vagabundo said:
Some links. I posted this earlier, but this thread is huge:

http://www.vg247.com/2011/04/27/supposed-hacker-chat-logs-reveal-stunning-psn-security-lapses/

The hashing/plaintext issue I'll have to look up, but I've read it in a few sources. There is also some chat log from Anonymous that go into more detail on the PSN network issues.


@Raistlin: Regarding the warning; Sony knew that Anon was probing PSN months ago and with the backlash from the GeoHot lawsuit they knew PSN was a target.
Click to expand...


Why are people using this as a credible source? The Credit Card info was encrypted.
 
blazinglazers said:
Does anybody downplaying this have any idea how identity theft works?

I mean, it's possible that it's not related to the PSN hack... but certainly it's also possible that it is. Right?
Click to expand...
The problem is that you can't really do much about your personal data being used against you, other than being more cautious about emails and phone calls that try to mine extra information from you. As for the credit card, it really seems unlikely at this point that it's worth the hassle replacing it over this. It was encrypted, and probably not stolen to being with, so why bother. Especially since your bank will block and refund fraudulent transactions quickly if they are worth their salt. I'll be monitoring my cc statement online more carefully in the next few weeks, but don't see a reason to do anything beyond that.
 
Kinda OT but some kind of amusing...

Was reading over at ars their small review of the game Outland.
The final segment of the text is as follows:

It has a few rough edges, but the combination of ideas and aesthetics the game displays is worth your time. Outland is out now on the Xbox Live Arcade, and will be available on the PlayStation 3 just as soon as you send Sony a copy of your house key.
Click to expand...

ouch..
 
bangai-o said:
well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.
Click to expand...
Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.

Lord Error said:
The problem is that you can't really do much about your personal data being used against you, other than being more cautious about emails and phone calls that try to mine extra information from you. As for the credit card, it really seems unlikely at this point that it's worth the hassle replacing it over this. It was encrypted, and probably not stolen to being with, so why bother. Especially since your bank will block and refund fraudulent transactions quickly if they are worth their salt. I'll be monitoring my cc statement online more carefully in the next few weeks, but don't see a reason to do anything beyond that.
Click to expand...
Well you sound like you've got a good plan. I guess where we diverge is the "why bother" part. You're making assumptions that could have consequences if you're wrong. You're choosing to be reactive to possible theft, rather than pro-actively defending yourself. Changing your credit card takes a single phone call and costs you about five minutes of your time. In exchange you don't have to hope for or assume anything. You're done. Based on my past experiences with my bank and the various forms of identity theft that I've been exposed to, it's been a hassle to deal with even if in the end nothing permanent happened. It still sucked. I fully respect your choice to play it cool, but it rubs me the wrong way to see other people in this thread belittling the situation or those who've got legit concerns.
 
blazinglazers said:
Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.
Click to expand...
i am not saying it is a big deal. But am also not going to say "mere minutes".
 
Considering Sony left the whole personal data table not encrypted I wouldn't put much faith into the encryption they used for credit cards.

Who knows, the hacker could've taken advantage of their server to decrypt the card numbers too. Obviously, there is a decrypt function, since the PSN remembers your CC data when placing future transactions.

If you are concerned at all, cancel your damn card.
 
bangai-o said:
well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.
Click to expand...
What the f has this to do with card numbers? I've had cards canceled+replaced with 5 minute phone conversations many times. But yeah, if you want to close the account, open a new one, change country, sex-change operation, etc, that may take a while.
Present situation doesnt call for any of that shit tho.
 
bangai-o said:
well for the umphteenth it has been said, closing your account and getting a new account number are the same thing.
Click to expand...
But my account isn't closed. The bank simply deauthorized my visa bank card and issued me a new card that links into my checking account.
 
blazinglazers said:
Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.
Click to expand...
No no no. The bank needs to see your original birth certificate in person, then do a DNA check, and then you have to wait 4 months for your new card. In the meantime you cannot get any money from any account, and your credit score gets reset to zero.
 
blazinglazers said:
Bro, you can call your bank and tell them that you think your credit card has been compromised. They will verify that you are who you say you are, and then they'll close your current card, open up a new one, and transfer your balance over if you have one. They'll mail you the new card. This is all free of charge. The whole process takes mere minutes. It's no biggie.
Click to expand...
You'll be out of a card for a few days to a few weeks. Not saying it's that big a deal but.....
 
cjtiger300 said:
Why are people using this as a credible source? The Credit Card info was encrypted.
Click to expand...
Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.
 
Dead Man said:
No no no. The bank needs to see your original birth certificate in person, then do a DNA check, and then you have to wait 4 months for your new card. In the meantime you cannot get any money from any account, and your credit score gets reset to zero.
Click to expand...
You're forgetting the cavity search. Conveniently forgetting i might add.
 
I seen 1 rumor that we will get Cross Game Chat / Video Chat

& another that said we would have the NGP interface when PSN returns this weekend


now I'm trying to figure out why would a rebuilt PSN give us the NGP interface? lol
 
Blimblim said:
Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.
Click to expand...
That may be true, but a chat log, which anyone could type up is not a credible source.
 
onQ123 said:
I seen 1 rumor that we will get Cross Game Chat / Video Chat

& another that said we would have the NGP interface when PSN returns this weekend

now I'm trying to figure out why would a rebuilt PSN give us the NGP interface? lol
Click to expand...
It's already been worked on for this long. if it's anything like the PSP version of the store, then the PS3 and portable stores aren't wildly different from each other to begin with.

If this is true at all, that is.
 
Yikes, first post.

I'm trying to catch up with the thread, but as a bit of potentially useful information, I contacted my CC company customer service yesterday in order to lower the threshold of the SMS warning on CC operations to 50€ (it's a very useful service for spotting CC scams and it's generally free on VISA cards).

I stated the reason was that an online service I was using had been potentially compromised. The customer service employee followed the procedure and when we were done, he asked me if this was about "the Sony issue". We discussed a bit and he told me that they had been in fact warned by Sony "prior to the Easter vacations" (which would mean before last Friday) and they had been monitoring operations tied to the Sony websites and cards since then. He in fact stated that all operations tied to Sony websites were blocked at the time.

Take it as you will (I doubt any official statement about being warned by Sony would be given consider the -unlikely- chance of class actions, in order not to join the "you knew and told nothing" bandwagon). This would on one hand confirm that Sony knew well before they told us, but on the other hand, also that they took action immediately to try and prevent any CC scam issue.

I had sent this info to the staff in case it was possibly relevant to the discussion, so ignore the double post in case it was already reported.

Sure it's nice to be able to post finally!
 
Blimblim said:
Contrary to passwords where one way hashes are a basically perfect way to securely store it (as long as you know what you are doing), credit cards numbers have to be encrypted in a way that allows for a way to decrypt them too, otherwise there is no point in storing them in the first place. This decryption has to be done somewhere in PSN's code before calling the credit card payment system, and it's very much possible that the hacker(s) managed to get to the decryption keys, since they have to be available one way or another to do the actual payment.
Hopefully Sony was storing the CC numbers on a highly secured and separate network of servers that the PSN front servers would only call to do the actual payment, it's the sanest way to do such thing.
Click to expand...
Hey Blimblim, any chance you can elaborate further on the above point?

While it's been stated that existing CC data was being stored in encrypted fashion (and I fully believe that's the case), when does that encryption process take place? Does it happen immediately upon the PI being associated to the customer's account via the console, PSP, PSN/Qriocity website? Or does that process happen further down the road? Furthermore, what rationale would there have been from a cost effectiveness standpoint for Sony to not have encrypted other customer information in their database?

I've been trying to wrap my head around a scenario where the hackers "may have had access to credit card information" yet did not have access to decryption keys. Understanding whether or not unencrypted credit card details could have been accessed if transactions took place from April 17-19 when the network was compromised would shed some light on the situation.
 
SoccerGoaliePro said:
I hope sony goes after those hackers and send them to jail for life.
Click to expand...
no, sony has to pay them a lot of money, because those hackers help sony closing security hole.
those hackers are the best thing happened to sony.
 
CurlySaysX said:
One of my bills that comes through the mail was opened by someone yesterday and was left in my letterbox without an envelope in the newspaper/junkmail section.
Fuck Sony.
Click to expand...

My dog just pooped in my sink and I have to clean it up
Fuck Sony.
 
Combichristoffersen said:
My grandfather found out he has cancer last summer.
Fuck Sony.
Click to expand...

My iTouch's battery life is dying quickly.
Suck Fony.
 
dzukela said:
no, sony has to pay them a lot of money, because those hackers help sony closing security hole.
those hackers are the best thing happened to sony.
Click to expand...
While you may be onto something (and will kind of be correct to be honest, if they finally enable voice chat like that rumor is suggesting) that's not how it works in legal system. This is considered a criminal activity, and if person(s) who did this are found, they will go to jail. Last example was that guy who over the past few years stole millions of CC numbers from a few banking institutions, but eventually got caught and got 20 years in jail.
 
Status
Not open for further replies.

Similar threads

PSN is down (Update: Back up)
19 20 21 22 23
1K
64K
Negotiator replied
Buying Switch Lite x2 for kids RIGHT NOW (read the damn OP before telling me to buy Switch 2)
2
77
3K
64gigabyteram replied
IGN “ Spooked by the 2011 PSN Hack, Some PlayStation Customers Want Sony to Say Exactly What Went Wrong With PSN Over the Weekend”
2
72
4K
Topher replied
Rumor: Microsoft plans price increase for Game Pass in March 2025; Update: Not a global change, see updated OP
Rumor Business Hardware  2 3
149
9K
RoboCain replied
Today’s update for Black Ops 6 is nearly 100GB
34
3K
coffinbirth replied
Top Bottom