PSN down thread

[Haggis and tatties]

Sony didn't wait a week to tell customers about stolen data...

There's a difference in timing between when we identified there was an intrusion and when we learned of consumer's data being compromised. We learned there was an intrusion April 19th and subsequently shut the services down. We then brought in outside experts to help us learn how the intrusion had occurred and to conduct an investigation to determine the nature and scope of the incident.

It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly this afternoon.

http://uk.ps3.ign.com/articles/116/1164186p1.html

And it is possible something very good may come of all this...

In what would appear to be a bid to appease consumers over the service's outage, the platform holder may be planning to introduce cross-game chat and even in-game video chat "to name a few" new features.

That's according to an Engadget forum poster claiming to be a Sony Computer Entertainment employee.

"As we are rebuilding the network, we are taking into consideration in implementing features such as cross game chat and in-game video chat to name a few," they wrote on the site in response to user queries about the PSN down time.

"I cannot confirm any new features at this time but expect a massive update when the network is restored."

While this should be taken with a pinch of salt for now, the forum user in question has been posting reliable PlayStation news and info on Engadget for a number of months.

http://www.computerandvideogames.co...turn-with-cross-game-chat-in-game-video-chat/

Well I'm very much of the opinion that you learn best from your mistakes....so i hope your right, on the "Only good can come of this" part......and the "Xchat" thing........although easy as to the Xchat.

 

[Mr. Adventure]

I have never bought anything on the PSN - so I can't even remember if you *had* to register a card when you registered for the service?

I'm in the same boat as far as remembering. Anyone know if there's any way to check without getting on PSN? The not being able to check part has been really annoying.

 

[gh4chiefs]

There's also the inconvenience factor. I have several accounts that auto-bill to my CC monthly such as Netflix. Once you change card numbers, you have to reset all that. Now for me it's like, 3 things so no big deal. However, if you bill tons of stuff every month to it I can see getting annoyed really quick..

I just "killed" my CC out of caution even though I've not yet seen any evidence of fraudulent activity. That was pretty painless, but yeah the autobill thing is kind of pain. One of my co-workers is ROYALLY hacked off at Sony this morning, and I'm like OK, it's annoying but JFC it's not the end of the world IF you step up and take care of business right away.

He sent me some article about how supposedly Sony was advising people to change all their passwords on ALL of their credit cards, yada, yada. And I'm like, I've NEVER given Sony that information, how could this breach have gotten that information? Especially for cards I don't use on PSN. They don't even have my CC password for the CC that I do use on the PSN.

Now that I think about it, I hope I killed the right card.

 

[Haggis and tatties]

Its getting really complicated over on the official PS3 forums, so many people stating so many different things, CC info was not compromised, only CC info from those with CFW was compromised, CC info has always been encrypted, CC info was sent in plain text.......I cant seem to find anything that nails down just what CC wise is happening.

 

[gh4chiefs]

I have never bought anything on the PSN - so I can't even remember if you *had* to register a card when you registered for the service?

I'm in the same boat as far as remembering. Anyone know if there's any way to check without getting on PSN? The not being able to check part has been really annoying.

I'm kind of shooting from the hip here, and I may be wrong, but this advice is free, so take it FWIW. But I think you can go into account management and see that information. Not sure if you have to be online or not for that. I'm not where I can check it right at the moment, but I'm suddenly curious too as I may have killed the wrong cc.

 

[Jax]

I hope PSN is back up soon because I am near the end of Uncharted 2 single player (Chapter 24 of 26) and I really would like to play online after . Only rumors I hear are some services up next week maybe but that could be just PSN store and not online play.

 

[Owain Taggart]

Only rumors I hear are some services up next week maybe but that could be just PSN store and not online play.

I'm playing through the game for the first time as well. As for the services, I heard they could be letting people play online sooner than the PSN store.

 

[Robert Maxwell]

Its getting really complicated over on the official PS3 forums, so many people stating so many different things, CC info was not compromised, only CC info from those with CFW was compromised, CC info has always been encrypted, CC info was sent in plain text.......I cant seem to find anything that nails down just what CC wise is happening.

If Sony was storing full credit card numbers or transmitting them in plaintext then they were flat-out breaking the law.

 

[gh4chiefs]

Its getting really complicated over on the official PS3 forums, so many people stating so many different things, CC info was not compromised, only CC info from those with CFW was compromised, CC info has always been encrypted, CC info was sent in plain text.......I cant seem to find anything that nails down just what CC wise is happening.

Well yeah it is confusing. I probably overreacted, but I figure better safe than sorry.

 

[gh4chiefs]

Its getting really complicated over on the official PS3 forums, so many people stating so many different things, CC info was not compromised, only CC info from those with CFW was compromised, CC info has always been encrypted, CC info was sent in plain text.......I cant seem to find anything that nails down just what CC wise is happening.

If Sony was storing full credit card numbers or transmitting them in plaintext then they were flat-out breaking the law.

Would that have anything to do with the "Data Protection Act?" My co-worker sent me this e-mail, with no source, that said Sony could face "heavy fines for breaching the Date Protection Act."

 

[Robert Maxwell]

Its getting really complicated over on the official PS3 forums, so many people stating so many different things, CC info was not compromised, only CC info from those with CFW was compromised, CC info has always been encrypted, CC info was sent in plain text.......I cant seem to find anything that nails down just what CC wise is happening.

If Sony was storing full credit card numbers or transmitting them in plaintext then they were flat-out breaking the law.

Would that have anything to do with the "Data Protection Act?" My co-worker sent me this e-mail, with no source, that said Sony could face "heavy fines for breaching the Date Protection Act."

Yeah. A few years ago it became illegal to store actual credit card numbers due to the risk of data theft. What most companies have done instead is have "merchant authorization codes." Basically, you enter your CC# once, and that generates a merchant auth code, which can then be used to charge your card in the future without actually using your card number. If you ever wonder how sites like Amazon and Google remember your CC#, that's how. They only show the last 4 digits because that's all they're allowed to retain. They can't actually give you the whole number because they don't have it!

Now, it is possible that these authorization codes are what got stolen, in which case it's still a significant breach but Sony was not necessarily in violation of the law. However, if such data was being transmitted unencrypted they might still be on the hook. I just find it hard to believe a company as big as Sony would do something as boneheaded as store actual CC numbers in plain text in a database connected to the PSN itself. That is so many levels of reckless and stupid as to defy belief.

 

[gh4chiefs]

Well as Haggis wrote, it's not clear cut exactly what they did get. Here's an excerpt from an e-mail that I received from Sony today:

While there is no evidence at this time that credit
card data was taken, we cannot rule out the possibility. If you have
provided your credit card data through PlayStation Network or Qriocity,
out of an abundance of caution we are advising you that your credit
card number (excluding security code) and expiration date may have
been obtained.

So does that mean they stored cc numbers in plain text, or is it possible somebody broke the encryption as well as hacking into the PSN?

 

[Robert Maxwell]

Yeah, it's hard to know how they were storing it, but given that we're talking about internal systems that were never meant to be accessed from outside, it's quite possible security was very lax.

 

[gh4chiefs]

I have never bought anything on the PSN - so I can't even remember if you *had* to register a card when you registered for the service?

I'm in the same boat as far as remembering. Anyone know if there's any way to check without getting on PSN? The not being able to check part has been really annoying.

I'm kind of shooting from the hip here, and I may be wrong, but this advice is free, so take it FWIW. But I think you can go into account management and see that information. Not sure if you have to be online or not for that. I'm not where I can check it right at the moment, but I'm suddenly curious too as I may have killed the wrong cc.

OK, I need to correct the record. Just got home and fired up the PS3 and I'm not finding an "Account Management" option, so it must require that you be logged into the PSN. Which I guess upon reflection, makes sense. So DUH, ignore what the dummy wrote earlier.

 

[Haggis and tatties]

^^Yeah unless your logged into the PSN you cant access your account details.....we will all have to wait till its back up before we can change our log-in passwords and the likes.

And just found out that CC info was indeed encrypted after all.

PS3 blog

Q: Was my personal data encrypted?
A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system.

 

[gh4chiefs]

Meanwhile there are scattered reports of actual cc fraud going on. But I don't think it can be conclusively proved to be because of this.

The number of Ars Technica readers who have had issues with their credit cards in the past few days, and have commented, e-mailed, or Tweeted about the issue, is alarming. We may be dealing with a coincidence in timing, but when your inbox is heavy with people saying they're fighting fraudulent credit card charges, it may be the first signs of fire somewhere in the smoke.

http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars

Meanwhile, lawyers and politicians are lining up to take their shots at Sony.

http://www.pcworld.com/article/226501/legal_troubles_heat_up_for_sony_after_psn_breach.html#tk.hp_fv

 

[Haggis and tatties]

Seeing as the CC info was indeed encrypted and the 3 digit security number has never been stored or recorded at all, i think its no doubt coincide, especially considering the amount of CC fraud that's attempted on a daily basis round the world.

I don't know what to think of the law suits because i have no in depth idea of just how much security Sony had in place on the PSN, apart from the said mentioned CC and 3 digit security bits.

I just hope the law is as quick to deal with the idiot hackers who caused all this.

 

[137th Gebirg]

Bye bye Sony! Their consumer electronics suck, their Blu Ray format sucks and now this. Good riddance...

 

[gh4chiefs]

Well that didn't take long.

 

[Haggis and tatties]

Bye bye Sony! Their consumer electronics suck, their Blu Ray format sucks and now this. Good riddance...

I don think they are going anywhere.