PlayStation Network | Kashif Ali

Category: PlayStation Network

Apr 28 2011

Sony says credit card details were encrypted, but questions still remain

Sony has published a new blog entry, confirming that credit card details which could have been stolen in the recent hack of the PlayStation Network were encrypted.

Sony reassured users of the PlayStation Network that “all credit card information stored in our systems is encrypted”, but underlined that it cannot rule out the possibility that the credit card data was stolen.

The fact that encryption was being used on the credit card data is to be welcomed – as it reduces the chances of stolen information being used for fraud.

Credit card details were encrypted

However, there still remains the question about just how strong the encryption is that Sony used on the credit card data.

Sony sign Sony has once again missed an opportunity to reassure its customers. They should have said in the first announcement of the data loss that the credit card data was encrypted, and they should – in this latest communication – have provided details of the nature of the encryption that was used.

No-one outside of Sony knows how feasible it would be to decrypt the credit card information if it had been accessed by the hackers.

Maybe they’ll post more information tomorrow. If I were a user of the PlayStation Network I` wouldn’t be enjoying waiting for the answers..

Meanwhile, don’t forget that we do know that the personal information of the PlayStation Network’s customers was not encrypted – which means that hackers may have accessed your name, address, email address, birthday, password, and so on.

"The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack."

Not sophisticated enough it seems.

Learn more on the PlayStation Network’s blog.

And don’t forget, you are strongly recommended to change your passwords elsewhere on the net, if you were using your PlayStation Network password on other sites.

Share/Save

Tags: credit card, Data loss, Featured, hack, Law & order, password, Sony

encryption, Naked Security, PlayStation, PlayStation Network, Security | Sophos | Comments (0)

Apr 27 2011

Sony PlayStation data breach fiasco: what bugs me about it

I have been skimming the glut of news stories covering the PlayStation hack following Sony’s statement yesterday.

The issues that keeps coming back to me are these:

1. Sony, like any company who keeps customer account details, is responsible for keeping this sensitive data safe.

So the question is, How could these details, potentially including credit card details, of a whopping 70 million users not be encrypted? It baffles the mind.

Perhaps the data was indeed encrypted, but if it was, how come Sony haven’t stated this?

Let’s say I accidentally leave my front door ajar, leave the house for a few days, and return to find that I was robbed. People will say I am a bit of an dodo brain, but I will still get sympathy from friends and family and we will all blame the thief.

But, if I convince all my friends and family to trust me with their prized possessions, pile their valuables on my coffee table, and then leave the front door open, I doubt they will be very supportive when I meekly approach them saying, “whoopsie – someone took them. These things happen, right?”

So it is no wonder that so many people are annoyed. They have a right to be.

2. What the F*** happened at PSN?

Having read Sony’s statement, they thank their “valued” customers for patience/goodwill/understanding (annoying in itself since I doubt many feel patient, generous or understanding). They also tell you to be wary of scams, which is all well and good.

But they don’t tell us what happened.

I really REALLY want Sony to stand up and explain how the company screwed up, how the bad guys got into their system, why the data wasn’t properly stored: a clear and concise explanation and, where appropriate, a straight-up apology for their oversights/misplaced bets/mistakes/etc

(Shall we place a bet on whether an APT was responsible? – sorry, couldn’t help it…)

It won’t get your data back, but at least we’ll all have some idea of how this happened. And it might do wonders to repair the trust issues it is bound to face with its stakeholders. More importantly, it will help other companies learn from Sony’s mistakes.

True, it can take some time to sort through all the bits and bobs before you provide a detailed explanation. But Sony set a rather slooooooow pace by waiting a week between its first announcement and yesterday’s statement.

So what can you do?

Read advice on your next steps, including changing your passwords and credit cards, from fellow Naked Security writer Graham Cluley.

Affected users have also been invited to get in touch directly with Sony if you have any questions.

Why not ask for a public explanation and apology? Feel free to share the response with Naked Security.

Share/Save

Tags: Data loss, hack, privacy, Sony

Naked Security, PlayStation, PlayStation Network, Security | Sophos | Comments (0)

Apr 26 2011

PlayStation Network hacked: Personal data of up to 70 million people stolen

Users of Sony’s PlayStation Network are at risk of identity theft after hackers broke into the system, and accessed the personal information of videogame players.

The implications of the hack, which resulted in the service being offline since last week, are only now becoming clear as Sony has confirmed that the hackers, who broke into the system between April 17th and April 19th, were able to access the personal data of online gamers.

In a blog post, Sony warns that hackers have been able to access a variety of personal information belonging to users including:

Sony statement

In addition, Sony warns that profile information – such as your history of past purchases and billing address, as well as the “secret answers” you may have given Sony for password security may also have been obtained.

As if that wasn’t bad enough, Sony admits that it cannot rule out the possibility that credit card information may also have been compromised:

While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

The fact that credit card details, used on the network to buy games, movies and music, may also have been stolen is obviously very worrying, and affected users would be wise to keep a keen eye on their credit card statements for unexpected transactions. Questions clearly have to be asked as to whether Sony was ignorant of PCI data security standards and storing this and other personal data in an unencrypted format.

So how could hackers exploit the information stolen from the Sony PlayStation Network?

1. Break into your other online accounts. We know that many people use the same password on multiple websites. So if your password was stolen from the Sony PlayStation Network, it could then be used to unlock many other online accounts – and potentially cause a bigger problem for you.

So you should always use unique passwords.

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

Oh, and you better be sure that you have changed your “secret answers” too.

2. Email you phishing scams or malware attacks. If they stole your email address from Sony, they can now email you. And it wouldn’t be difficult for the cybercriminals to create an email which pretended to be a legitimate organisation (perhaps Sony themselves?) to steal more information or carried a Trojan horse designed to infect your computer. The fact that they know your name and snail-mail address could make the email even more convincing.

3. Hit you in the wallet. If your credit card details have been exposed by the Sony PlayStation Network hack then you could find fraudsters begin to make purchases from your account – if you notice that money is missing, you’ll have to go through the rigmarole of claiming the money back from your credit card company.

Sony controller This security breach is not just a public relations disaster for Sony, it’s a very real danger for its many users.

If you’re a user of Sony’s PlayStation Network now isn’t the time to sit back on your sofa and do nothing. You need to act now to minimise the chances that your identity and bank account becomes a casualty following this hack.

That means, changing your passwords, auditing your other accounts, and considering whether you should keep a closer eye on those credit card statements or simply telling your bank that as far as you’re concerned the card is now compromised.

Should you cancel your credit card?

Look at it this way.

Cancel credit card

If I lost my credit card in the back of a taxi I would cancel my card. I wouldn’t wait for a fraudster to sting it for cash. If Sony has lost your credit card details then it’s worse as the credit card information is now being held digitally, right in the hands of people best placed to exploit it.

So, yes. I would cancel my credit card.

More information can be found in Sony’s blog post and in their FAQ.

Update: Sony has now said that the credit card data was encrypted, but questions still remain about the strength of that encryption.

Share/Save

Tags: Data loss, hack, Malware, Sony, Spam, Vulnerability

Naked Security, PlayStation, PlayStation Network, Security | Sophos | Comments (0)

Apr 25 2011

PlayStation Network hacked: five days and counting..

The Sony PlayStation Network, used by millions of online videogame players around the world, has been offline since Wednesday 20th April.

PlayStation Network maintenance message

You can still play games offline, but if you want to connect your PlayStation to play online games, stream movies, or go shopping you’re out of luck.

According to Sony, who have been updating their blog with developments regarding the outage, the company decided to bring the network down after an “external intrusion”.

Sony blog post

The company clearly isn’t planning to bring the network back until it is confident that its infrastructure is secure – and although inconvenienced, game players should be grateful that Sony appears to want to make sure it’s done the job properly and that any vulnerabilities are fixed.

PlayStation Precisely how much longer those game players will have to wait, and whether their trigger-happy fingers and patience will be able to bear it, remains to be seen.

Patrick Seybold, Sony’s Senior Director of Corporate Communications, says:

"Our efforts to resolve this matter involve re-building our system to further strengthen our network infrastructure. Though this task is time-consuming, we decided it was worth the time necessary to provide the system with additional security.."

"Unfortunately, I don’t have an update or timeframe to share at this point in time. As we previously noted, this is a time intensive process and we’re working to get them back online quickly."

Although Sony is doing a good job on its blog of reassuring players that they are working on securing and bringing back the network, they do not seem to have addressed the issue of whether any personal information (such as credit card details) might have been compromised by whoever attacked the PlayStation network.

The spectre of data loss is a worrying one – let’s hope that nothing so sensitive has been lost, and that Sony will be able to share good news that may reassure its customers soon.

Update: Bad news – it appears that personal information has been stolen from the Sony PlayStation Network’s users.