Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sony: All personal data stolen from PSN

blog.us.playstation.com

Post reply on HN
Print view View original

21–30 of 292 posts

Re: Sony: All personal data stolen from PSN

#21

Post by orangecat »

dman wrote: post #3

Holy Cow! This has to be one of the most serious breaches I remember in recent times. While I dont work in security and my security foo is weak it appears that they did not have a strong layered security apparatus in place? Is it just a coincidence that this breach and geohotz exploit happened around the same time?

It really looks like the PSN architecture assumed that the clients were trustworthy. If so, that's an epic Security 101 fail.

Re: Sony: All personal data stolen from PSN

#22

Post by wladimir »

rkon wrote: post #6

Payback for GeoHot or what? Haven't heard anything about the source of the attack since the DDoS that Anonymous took credit for...

I don't think there has been any indication that this a payback operation. It could just as well have been for financial gain.

Sony did piss off a lot of hackers, though, so maybe they had it coming...

Re: Sony: All personal data stolen from PSN

#23

Post by Timothee »

ares2012 wrote: post #4

So it is as bad as we feared. The only silver lining I can see is that Sony made the difficult business decision to turn off the network until they were sure it was secure. While that doesn't make me feel better as a PSN user I do respect their honesty and commitment to fixing it. Time to get a new identity! =)

Time to get a new identity! =)

That's what I was thinking: in most cases of user accounts being compromised, the solution is "change your passwords on this and other sites". Here you need to change your birthday, cancel your credit card, move out, change your name… kind of a hassle.

Re: Sony: All personal data stolen from PSN

#24

Post by elliottcarlson »

retroafroman wrote: post #9
rkon wrote: post #6

Payback for GeoHot or what? Haven't heard anything about the source of the attack since the DDoS that Anonymous took credit for...

Anon actually didn't do the DDoS attack. From the press release-"For once we didn't do it" http://anonnews.org/?p=press&a=item&i=848

Quoting Anonymous on their involvement is a moot point. The lack of hierarchy and completely radical differing opinions of members within the "group" allows for confusion and varying ideologies. Since a press release, in the mindset of Anon, is released by an individual or a group of individuals, they may not be aware that a separate member did perform the hack. In the end no one really knows until someone pretty much steps forward.

Re: Sony: All personal data stolen from PSN

#25

Post by Hominem »

I haven't really been following this but there have been rumblings all week that a hacked firmware was released that allowed anyone who installed it, and twiddled with some other things, access to the PSN development and testing network. Anyone know more?

Re: Sony: All personal data stolen from PSN

#27

Post by esrauch »

[deleted] wrote: post #15
dman wrote: post #5

Earlier quoted context omitted.

You can diss your competitor for poor security practices only if you have some confidence in your own.

[deleted]

He's not saying that the grandparent comment was "dissing the competitor". The grandparent comment suggested that Nintendo and Microsoft could use this opportunity to flaunt their own systems as superior, and the person you replied to was simply stating that Nintendo can't do that without having a lot of confidence in their own networks.

Re: Sony: All personal data stolen from PSN

#28

Post by mrcharles »

This seems like a really big argument for never allowing your data to be stored by a 3rd party.

Does anyone see any reason why these companies should do anything other than store the data locally on your system, encrypted/obfuscated, and then only ever send once, via encrypted connection, and then immediately delete the info remotely?

I mean, if someone breaks in to my house and steals my PS3, they already have access to all of that information.

Re: Sony: All personal data stolen from PSN

#30

Post by originalgeek »

rkon wrote: post #16
retroafroman wrote: post #9

Earlier quoted context omitted.

Anon actually didn't do the DDoS attack. From the press release-"For once we didn't do it" http://anonnews.org/?p=press&a=item&i=848

I thought Anonymous apologized to PSN users for the collateral damage? Makes me wonder if they're just trying to save face after realizing the users were turning against them too... "We realize that targeting the PSN is not a good idea. We have therefore temporarily suspended our action, until a method is found that will not severely impact Sony customers." -- Anonymous Then they went on to say something about how An…

Maybe it's all about the lulz until the lulz are about them.
Post reply on HN