PSN Status Update: Stolen Information Detailed, more

[Tanthias]

I wanted to take this opportunity to clarify a point and answer one of the most frequently asked questions today.

There’s a difference in timing between when we identified there was an intrusion and when we learned of consumers’ data being compromised. We learned there was an intrusion April 19th and subsequently shut the services down. We then brought in outside experts to help us learn how the intrusion occurred and to conduct an investigation to determine the nature and scope of the incident. It was necessary to conduct several days of forensic analysis, and it took our experts until yesterday to understand the scope of the breach. We then shared that information with our consumers and announced it publicly this afternoon.

For those who were looking there’s also an FAQ with some more frequently asked questions

Thank you for your continued patience and support.

Newest update. So yeah, seems my reasoning may not have been too far off the mark

[lordrand11]

damn sony. I recall the ps3 hack groups sending a message that psn could be compromised along with cc#'s and personal info.

[JKDarkside]

Sony is winning.

Like an F-18, bro.

[Bennieboi20]

So im sure that you have all heard by now about Sony's PSN being hacked into by an 'unauthorised person' well my question is how do you feel Sony are coping with the attack? And do you feel that they are doing enough?

for thoes of you who dont know here is an article from http://www.wired.com

Spoiler warning:

Sony thinks an “unauthorized person” now has access to all PlayStation Network account information and passwords, and may have obtained the credit card numbers of the service’s 70 million users.
The PlayStation maker said it believes hackers now have access to customers’ vital information, including names, birthdates, physical and e-mail addresses, and PlayStation Network/Qriocity passwords, logins, handles and online IDs.
Credit card information, purchase histories and other profile data stored on the PlayStation Network servers also could be compromised, the Japanese company said in a lengthy blog post Tuesday afternoon.
“While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility,” reads the post, which Sony says it will e-mail to all PlayStation Network account holders, as well as users of its Qriocity streaming-media service. “If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.”
The PlayStation Network, which provides online gameplay and digital game shopping for owners of PlayStation 3 and PSP devices, has been down since Wednesday, following what Sony called an “illegal intrusion” on its servers. The company says it expects to restore “some services” within a week’s time.

Sony said it has temporarily shut down the PlayStation Network and Qriocity services and hired an outside security firm “to conduct a full and complete investigation into what happened,” but refused to offer details on the hack.
When the services go back online, Sony suggests users change their passwords. But until then, the company warned about phishing scams.
“For your security, we encourage you to be especially aware of e-mail, telephone, postal mail or other scams that ask for personal or sensitive information,” the company said in an Update on PSN Service Outages FAQ posted Tuesday. “Sony will not contact you in any way, including by e-mail, asking for your credit card number, Social Security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking.”
In a letter to Sony, Sen. Richard Blumenthal called for the company to provide users of the networks with free financial data-security services, including two years of credit-reporting services.
“When a data breach occurs, it is essential that customers be immediately notified about whether and to what extent their personal and financial information has been compromised,” Blumenthal wrote Tuesday, dinging Sony for what he labeled a “troubling lack of notification from Sony about the nature of the data breach.”
“Although the breach occurred nearly a week ago, Sony has not notified customers of the intrusion, or provided information that is vital to allowing individuals to protect themselves from identity theft, such as informing users whether their personal or financial information may have been compromised,” he wrote.
In its FAQ, Sony said, “If you use the same user name or password for your PlayStation Network or Qriocity service account for other unrelated services or accounts, we strongly that you change them.”
However, there is currently no way a user can find out what password he or she was using for PlayStation Network if it’s been forgotten, Sony told the website Giant Bomb.

[cOcO!]

[Chocobolicious]

You know, if Sony had half a brain, they'd do what a lot of cell phones do and simply store the account info user side, and have it produce a OTP style verification string when making purchases based on stored info, send that, and never have to store sensitive info on their own servers.

Of course, Sony doesn't have half a brain. As has been proven during this entire incident. Regardless, my account has been on fraud alert since a day or two after this all started. Actually changing the card# would take too much effort, so I'll wait on that til either I get more info out of sony or something happens to my card. Overturning fraudulent charges takes like 2 minutes, having to figure out just where and how to change all those dozens of automatic payments I have going every month sounds like far more work.

lazy.

Also, at least in the area I live, there have been at least 6 instances of various stores like Walmart, Target, TJMaxx and such having their in-store systems taken and accounts stolen, or people working at stores simply looking at and taking peoples CC info. No transaction outside of straight cash is 'safe' in any sense of the word. Even then you could get mugged and all your cash taken.

[Wolf the Knight]

You know what I think? This is what we get for wanting to pirate and use homebrew.

[Chocobolicious]

Except to gain access to actual servers would require something more than a PS3. If you seriously think a devbox has access to that kind of thing, you either think Sony is the most retarded company in the world who was willfully ignoring every known security protocol, or that hackers are some mythical creatures capable of bending the fabric of reality.

Point is, this was probably done with a plain old PC, just like all the other breaches in other services. I cant even begin to fathom how one could think the root keys on a PS3 would help with breaking into a user database, unless Sony has the weirdest server structure in existence. Thats like saying jailbreaking your iphone lets you hack the gibson and get into the itunes database. It just doesnt happen that way.

[Wolf the Knight]

I don't recall anyone saying it required a PS3, or that the hacker used a PS3 system do such a thing, but I know if I was Sony, and my expensive ass hardware got compromised by hackers I wouldn't really care too much about your security either.

[Tanthias]

PSN within the week!

SOME PLAYSTATION®NETWORK AND QRIOCITY™ SERVICES TO BE AVAILABLE THIS WEEK
Phased Global Rollout of Services to Begin Regionally;
System Security Enhanced to Provide Greater Protection of Personal Information

Tokyo, May 1, 2011 – Sony Computer Entertainment (SCE) and Sony Network Entertainment International (SNEI, the company) announced they will shortly begin a phased restoration by region of PlayStation®Network and Qriocity™ services, beginning with gaming, music and video services to be turned on. The company also announced both a series of immediate steps to enhance security across the network and a new customer appreciation program to thank its customers for their patience and loyalty.

Following a criminal cyber-attack on the company’s data-center located in San Diego, California, U.S.A., SNEI quickly turned off the PlayStation Network and Qriocity services, engaged multiple expert information security firms over the course of several days and conducted an extensive audit of the system. Since then, the company has implemented a variety of new security measures to provide greater protection of personal information. SNEI and its third-party experts have conducted extensive tests to verify the security strength of the PlayStation Network and Qriocity services. With these measures in place, SCE and SNEI plan to start a phased rollout by region of the services shortly. The initial phase of the rollout will include, but is not limited to, the following:

•Restoration of Online game-play across the PlayStation®3 (PS3) and PSP® (PlayStation®Portable) systems
-This includes titles requiring online verification and downloaded games
•Access to Music Unlimited powered by Qriocity for PS3/PSP for existing subscribers
•Access to account management and password reset
•Access to download un-expired Movie Rentals on PS3, PSP and MediaGo
•PlayStation®Home
•Friends List
•Chat Functionality
Working closely with several outside security firms, the company has implemented significant security measures to further detect unauthorized activity and provide consumers with greater protection of their personal information. The company is also creating the position of Chief Information Security Officer, directly reporting to Shinji Hasejima, Chief Information Officer of Sony Corporation, to add a new position of expertise in and accountability for customer data protection and supplement existing information security personnel. The new security measures implemented include, but are not limited to, the following:

•Added automated software monitoring and configuration management to help defend against new attacks
•Enhanced levels of data protection and encryption
•Enhanced ability to detect software intrusions within the network, unauthorized access and unusual activity patterns
•Implementation of additional firewalls
The company also expedited an already planned move of the system to a new data center in a different location that has been under construction and development for several months. In addition, PS3 will have a forced system software update that will require all registered PlayStation Network users to change their account passwords before being able to sign into the service. As an added layer of security, that password can only be changed on the same PS3 in which that account was activated, or through validated email confirmation, a critical step to help further protect customer data.

The company is conducting a thorough and on-going investigation and working with law enforcement to track down and prosecute those responsible for the illegal intrusion.

“This criminal act against our network had a significant impact not only on our consumers, but our entire industry. These illegal attacks obviously highlight the widespread problem with cyber-security. We take the security of our consumers’ information very seriously and are committed to helping our consumers protect their personal data. In addition, the organization has worked around the clock to bring these services back online, and are doing so only after we had verified increased levels of security across our networks,” said Kazuo Hirai, Executive Deputy President, Sony Corporation. “Our global audience of PlayStation Network and Qriocity consumers was disrupted. We have learned lessons along the way about the valued relationship with our consumers, and to that end, we will be launching a customer appreciation program for registered consumers as a way of expressing our gratitude for their loyalty during this network downtime, as we work even harder to restore and regain their trust in us and our services.”

Complimentary Offering and “Welcome Back” Appreciation Program
While there is no evidence at this time that credit card data was taken, the company is committed to helping its customers protect their personal data and will provide a complimentary offering to assist users in enrolling in identity theft protection services and/or similar programs. The implementation will be at a local level and further details will be made available shortly in each region.

The company will also rollout the PlayStation Network and Qriocity “Welcome Back” program, to be offered worldwide, which will be tailored to specific markets to provide our consumers with a selection of service options and premium content as an expression of the company’s appreciation for their patience, support and continued loyalty.

Central components of the “Welcome Back” program will include:

•Each territory will be offering selected PlayStation entertainment content for free download. Specific details of this content will be announced in each region soon.
•All existing PlayStation Network customers will be provided with 30 days free membership in the PlayStation Plus premium service. Current members of PlayStation Plus will receive 30 days free service.
•Music Unlimited powered by Qriocity subscribers (in countries where the service is available) will receive 30 days free service.
Additional “Welcome Back” entertainment and service offerings will be rolled out over the coming weeks as the company returns the PlayStation Network and Qriocity services to the quality standard users have grown to enjoy and strive to exceed those exceptions.

SNEI will continue to reinforce and verify security for transactions before resuming the PlayStation®Store and other Qriocity operations, scheduled for this month.

For more information about the PlayStation Network and Qriocity services intrusion and restoration, please visit http://blog.us.playstation.com. or http://blog.eu.playstation.com/

About Sony Corporation
Sony Corporation is a leading manufacturer of audio, video, game, communications, key device and information technology products for the consumer and professional markets. With its music, pictures, computer entertainment and on-line businesses, Sony is uniquely positioned to be the leading electronics and entertainment company in the world. Sony recorded consolidated annual sales of approximately $78 billion for the fiscal year ended March 31, 2010. Sony Global Web Site: http://www.sony.net/

About Sony Computer Entertainment Inc.
Recognized as the global leader and company responsible for the progression of consumer-based computer entertainment, Sony Computer Entertainment Inc. (SCEI) manufactures, distributes and markets the PlayStation® game console, the PlayStation®2 computer entertainment system, the PSP® (PlayStation®Portable) handheld entertainment system and the PlayStation®3 (PS3®) system. PlayStation has revolutionized home entertainment by introducing advanced 3D graphic processing, and PlayStation 2 further enhances the PlayStation legacy as the core of home networked entertainment. PSP is a handheld entertainment system that allows users to enjoy 3D games, with high-quality full-motion video, and high-fidelity stereo audio. PS3 is an advanced computer system, incorporating the state-of-the-art Cell processor with super computer like power. SCEI, along with its subsidiary divisions Sony Computer Entertainment America Inc., Sony Computer Entertainment Europe Ltd., and Sony Computer Entertainment Korea Inc. develops, publishes, markets and distributes software, and manages the third party licensing programs for these platforms in the respective markets worldwide. Headquartered in Tokyo, Japan, SCEI is an independent business unit of the Sony Group.

[crusher]

So I heard that all PS1 games are free with PS+? And you get to keep them even after those 30 days are over? Right? Awesome.

[Drageuth]

I would say sweet, but I honestly don't use the online services that much, other than the occasional Black Ops match with guys from work, or downloading a demo of a game I'm curious about trying.
Mostly it's just there so I can see what everyone else is playing.

It's the same reason I have Facebook, really.


/stalker

[David Pridemore]

This may sound good on paper but......what does this mean for signed PSP games that are online compatable? Like N+ & Fat Princess Fistful Of Cake, for example.

[Cookie Monster]

Good news, indeed.

So I heard that all PS1 games are free with PS+? And you get to keep them even after those 30 days are over? Right? Awesome.

Not really a PSX game per month is free and you keep it for as long as you are a PS+ member, if your subscription expires you won't be able to play the PSX game (same goes for the PSN games and some DLCs; other DLCs, the avatars, themes and discounted items you purchase are the exception to the rule) until you renew it. But still is a good chance to try the service.

[Chocobolicious]

That press conference was the most humiliating thing I've watched in quite a while. I almost feel bad for them. They had so little to actually say and the people who asked questions pretty much just re-asked the same thing over and over.