Good News On SOE Front, Sony To Answer Congress
We learned earlier that Sony Online Entertainment suffered a security breach, which resulted in the exposure of 24.6 million accounts and 12,700 credit card numbers.
But in addition to the facts that the card info was taken from an out-of-date database circa 2007, and that no American card data appeared to have been stolen, there's another piece of good news: according to GamesIndustry.biz, only about 900 of those 12,700 cards were active at the time of the theft. That makes the breach significantly less damaging and allows most consumers to breathe easier. We should mention we've seen a lot of nightmare predictions and erroneous reports online concerning the SOE (and PSN) breach, and it has resulted in a lot of alarmist reactions. Perhaps it's best to stick to the facts; otherwise, we'll gain absolutely no respect from a journalistic standpoint. Now is the time to be professional.
On a side note, Sony has agreed to answer questions from Congress concerning the Network hack; those questions can be seen through that link and were listed in the New York Times. Congress imposed a May 6 deadline for responses and Sony will hit that deadline; they will offer answers to questions like, "When did you become aware of the illegal and unauthorized intrusion?" and "How did you become aware of the breach?"
And by the way, the Network isn't back up just yet.
Tags: soe, sonly online entertainment, psn, psn outage
5/3/2011 8:43:01 PM Ben Dutka
Put this on your webpage or blog:
Email this to a friend
Follow PSX Extreme on Twitter
Comments (97 posts)
AcHiLLiA
Wednesday, May 04, 2011 @ 9:39:37 AM
TheAgingHipster
Tuesday, May 03, 2011 @ 9:37:48 PM
Reply
TheAgingHipster
Tuesday, May 03, 2011 @ 9:40:27 PM
maxpontiac
Wednesday, May 04, 2011 @ 9:49:50 AM
BikerSaint
Wednesday, May 04, 2011 @ 4:32:54 PM
Plus look how many have been outed over the years, as thieves, adulterers, & scamming kick-back artists.
NoOneSpecial
Tuesday, May 03, 2011 @ 9:51:02 PM
Reply
On a side note, I turned on my PS3 today to play some GT5 and was beyond excited when I saw it was actually attempting to log in, instead of the same error message....but it ended up being a false alarm :( sadface.
Last edited by NoOneSpecial on 5/3/2011 9:51:22 PM
WorldEndsWithMe
Tuesday, May 03, 2011 @ 9:57:24 PM
Reply
Jawknee
Tuesday, May 03, 2011 @ 10:01:16 PM
WorldEndsWithMe
Tuesday, May 03, 2011 @ 10:03:03 PM
tes37
Tuesday, May 03, 2011 @ 10:21:03 PM
Highlander
Tuesday, May 03, 2011 @ 11:08:54 PM
Qubex
Wednesday, May 04, 2011 @ 12:24:45 AM
Jawknee
Tuesday, May 03, 2011 @ 10:04:11 PM
Highlander
Tuesday, May 03, 2011 @ 11:12:13 PM
Sadly, lawmakers are the best we have. The FCC was supposed to make regulations in the communications sphere, and that should cover the Internet, but they have no teeth and no power to make it happen. The library of Congress and Copyright office have the power to help content providers protect their wares, but generally decline to get involved and instead defer to Congress.
You sure don't want the law made by judges setting precedent. The law as it stands doesn't apply well to the digital future, and court decisions based on that law will suffer the same problem.
Congress must step in and review the entire digital economy and how it needs to me regulated, because without regulation, it's essentially a virtual wild west, and the number of hacks will continue to climb.
Jawknee
Tuesday, May 03, 2011 @ 11:40:04 PM
Last edited by Jawknee on 5/3/2011 11:41:07 PM
Jawknee
Tuesday, May 03, 2011 @ 11:56:38 PM
Last edited by Jawknee on 5/3/2011 11:57:50 PM
Highlander
Wednesday, May 04, 2011 @ 1:44:09 AM
Highlander
Wednesday, May 04, 2011 @ 10:52:24 AM
On specific issues, I will disagree completely with one or other (or both) parties in the US, and it would be true to say that in terms of the US political landscape I might be considered centerist. Funnily enough, in the UK, my views were considered somewhat right of center, and in the US the same views are considered by many to be left of center. I don't really care which they are, they are my views, and nothing else. I was excited when Obama got elected because it was/is a truly historic event. In some ways it says that this country has finally broken from it's past, but that does not make me a supporter of his party.
I want this to be clear because in a previous thread it was suggested that I make posts that are political in motivation. I do not, and will not. That doesn't mean I will never comment on a topical issue, nor does it mean that I support one or other political grouping even if my view happens to coincide with theirs. Before anyone jumps all over this post, consider this, stating one's personal opinion on an issue is *not* the same as making a political opinion, or offering support to a given political group.
Our society has become so politically charged and polarized that a person can't offer a simple opinion without being labelled with some politically charged name. Whatever happened to people being able to have and express their own personal views without that leading to a full scale debate over their voting preferences?
Jawknee
Wednesday, May 04, 2011 @ 11:43:47 AM
Highlander
Wednesday, May 04, 2011 @ 12:33:55 PM
The whole net neutrality thing is the horse that bolted and the stable door is swinging in the wind. There's no point worrying about it now. ;)
Jawknee
Tuesday, May 03, 2011 @ 10:02:28 PM
Reply
NoOneSpecial
Tuesday, May 03, 2011 @ 10:32:19 PM
SayWord
Tuesday, May 03, 2011 @ 10:41:47 PM
WorldEndsWithMe
Tuesday, May 03, 2011 @ 10:47:13 PM
SayWord
Tuesday, May 03, 2011 @ 10:56:59 PM
Highlander
Tuesday, May 03, 2011 @ 11:13:35 PM
Jawknee
Tuesday, May 03, 2011 @ 11:22:40 PM
Highlander
Tuesday, May 03, 2011 @ 11:26:26 PM
Jawknee
Tuesday, May 03, 2011 @ 11:37:07 PM
Jawknee
Tuesday, May 03, 2011 @ 11:59:59 PM
WorldEndsWithMe
Wednesday, May 04, 2011 @ 12:04:08 AM
Qubex
Wednesday, May 04, 2011 @ 12:27:29 AM
Highlander
Wednesday, May 04, 2011 @ 1:45:29 AM
Highlander
Wednesday, May 04, 2011 @ 1:45:29 AM
tes37
Tuesday, May 03, 2011 @ 10:12:19 PM
Reply
Has anyone received their playstation shirt yet? Mine showed up Monday. The shirt is better quality than some that I spent money on, like the Red Dead Redemption shirt I bought.
Last edited by tes37 on 5/3/2011 10:17:21 PM
Jawknee
Tuesday, May 03, 2011 @ 10:26:21 PM
tes37
Tuesday, May 03, 2011 @ 10:30:33 PM
johnld
Tuesday, May 03, 2011 @ 11:01:22 PM
tes37
Tuesday, May 03, 2011 @ 11:43:15 PM
frylock25
Wednesday, May 04, 2011 @ 1:50:17 AM
Killa Tequilla
Wednesday, May 04, 2011 @ 3:02:24 AM
Ultimate_Balla
Tuesday, May 03, 2011 @ 10:42:14 PM
Reply
Qubex
Wednesday, May 04, 2011 @ 8:23:59 AM
SayWord
Tuesday, May 03, 2011 @ 11:04:30 PM
BIGRED15
Tuesday, May 03, 2011 @ 11:03:50 PM
Reply
Jawknee
Tuesday, May 03, 2011 @ 11:45:22 PM
Last edited by Jawknee on 5/3/2011 11:46:58 PM
PharaohJR
Wednesday, May 04, 2011 @ 12:37:17 AM
Reply
i jus dont get it if one is capable of stuff like this why not work with a company & show them there weak spot dont they know how much they can get paid legally rather than taking these chances & when caught be in prison with some real evil konvicts.... i jus wanna know why in they world would 1 choose a corporation like sony rather then a bank or another field that generates more money than sony.
i dunno man alotta of things in life lately just dont add up no more.
Excelsior1
Wednesday, May 04, 2011 @ 2:56:54 AM
Reply
i just hope the new psn rollout goes smoothly becuase there are a lot of upset people out there. not everyone is hardcore sony fans like us. many are just hardcore online gaming addicts. they seem to be the group who have been complaining the loudest. if psn goes up smoothly they might move on. i just hope that's what happens, but i'm a little nervous about it. sony is vulnerable now.
hell, i just noticed an advertisement at the top of this page for a class action lawsuit against soe.
Last edited by Excelsior1 on 5/4/2011 3:03:09 AM
frylock25
Wednesday, May 04, 2011 @ 3:33:14 AM
___________
Wednesday, May 04, 2011 @ 4:58:11 AM
Reply
why the @%$# $onys using apache is beyond me!
i mean come on!
sony have become so phucking tight a$$ed this gen, cutting corners everywhere they can and its come back to haunt them!
$onys the new Mercedes Benz!
both use to be names for fastidious quality, now there as reliable as a 20 year old alfa!
Last edited by ___________ on 5/4/2011 4:59:01 AM
Beamboom
Wednesday, May 04, 2011 @ 5:04:33 AM
___________
Wednesday, May 04, 2011 @ 9:58:46 AM
the accounting company i work for have been using windows server for years now, never had a single problem with it!
using apache for servers is like using norton 360 for antivirus security!
a pain in the ass, and more holes then swiss cheese!
Beamboom
Wednesday, May 04, 2011 @ 10:31:15 AM
Add to this the fact that most skilled "hackers" (hate that word) are Linux users that will find every single potential hole, and you got an environment who will expose, *and fix* holes extremely fast.
But, I'm willing to buy a claim that the MS server, out of the box and in the hands of non professionals, may prove a safer solution. Maybe.
Regarding the number of reported vulnerabilities, in addition to the market dominance that also come into effect here, keep in mind that Apache is an open system with no secrecy. All discovered holes *will* get exposed.
Last edited by Beamboom on 5/4/2011 10:37:23 AM
Highlander
Wednesday, May 04, 2011 @ 10:32:08 AM
When I looked at the Apache vulnerability lists, it looked like thy take a good 9 months to fix vulnerabilities, and it wasn't entirely clear whether said fixes re backported to earlier versions that share the issue. I'm not saying MS is much better, but I am wondering whether the existence of a known vulnerability does more than raise a neon sign over the versions of Apache with that vulnerability for several months before a patch even becomes available. I mean, from what I could see, the process would be something like, vulnerability reported and published, 6-9 months pass, affected system run and run, patch created to fix vulnerability in current version(s), over the next 1-3 months responsible users of Apache upgrade, vulnerability patched - except for users running older versions not patched, or users who don't give a fig.
Microsoft is not a great deal better considering the number of vulnerabilities that have existed for a long time before being patched in their software. But that discovery/reporting/fix/patch cycle for vulnerabilities does appear to be lengthy for Apache. I'm not a user of Apache so I'm not really in a good position to know if what I'm seeing is the case in practice. Would you care to comment?
Regarding Anon Cowherd, his views are generally somewhat skewed. In all honesty I laughed at his claims of having used Windows server for years without a problem. That certainly runs counter to my own experience, but hey, depending on the environment it could be correct - for him. He could be among the lucky minority...
Last edited by Highlander on 5/4/2011 10:35:12 AM
Beamboom
Wednesday, May 04, 2011 @ 10:44:07 AM
Note that a lot of the reported issues are purely performance related, ie not "errors" to the degree that MS would call errors.
But again, if it was a serious hole directly related to the apache core (as opposed to vulnerabilities related to eg. ssh or perl), then I gotta say I will be very surprised, disappointed even.
Regarding mr underscore here, I think he's got some good posts, agree with a lotta stuff he say. He just got a... Uhm... Exotic way of expressing himself. But I dig that.
Last edited by Beamboom on 5/4/2011 10:48:42 AM
Highlander
Wednesday, May 04, 2011 @ 10:57:11 AM
Mr Underline/Anonymous Cowherd does have good things to say, but he also goes off the deep end on a regular basis, and more than occasionally contradicts himself. That said, I've agreed with him on more than one occasion and even posted in agreement with him, it probably shocks the living daylights out of him when I do, but I believe in giving credit were it is due.
Beamboom
Wednesday, May 04, 2011 @ 11:33:31 AM
Very typical of reported issues is that they are related to Apache in relation to other software, and as such affect only a very small segment of the Apache servers. If you are a system admin for an advanced server park you will join several security related mailing lists that will flag issues also related to your servers *immediately* when discovered, along with workarounds until patch. Many of them are extremely well moderated with low noise ratio.
Regarding backports: No, I do not really know. Not even sure if it applies, I mean it's at version 2 now after all these years...
Also, I can't really see any reason not to upgrade if still running Apache 1. It's *amazingly* easy on the system. If you got a really old box collecting dust, say a 75mhz pentium or even a 486, try installing the server version of Ubuntu (if you are unfamiliar with linux that's an easy distro to set up), minimal install + Apache and see how it performs. You'll be surprised.
Regarding mr underline, he's a specie of his own in this jungle we call PSXE :)
Last edited by Beamboom on 5/4/2011 11:40:11 AM
Highlander
Wednesday, May 04, 2011 @ 12:36:35 PM
The one and only real explanation I want from Sony in all of this is why their network team permitted known vulnerabilities to persist, and which vulnerability it was that was used. Whoever was the decision maker that either permitted an exception to the patching of this vulnerability, or simply didn't direct that it bet patched, needs to be held accountable.
Beamboom
Wednesday, May 04, 2011 @ 3:36:27 PM
It's also a tad strange with that old credit card backup(?) file on the soe server. a) Why was the file there at all, and b) Why was the content stored in a unencrypted format (how did it get unencrypted in the first place, since other cc data are encrypted on their servers?).
It's easy to be a clever SOB in hindsight, of course. Easiest in the world. And maybe all above has good, rational answers. It just would have been interesting to know.
Highlander
Wednesday, May 04, 2011 @ 4:43:52 PM
Beamboom
Wednesday, May 04, 2011 @ 5:18:59 PM
animefan
Wednesday, May 04, 2011 @ 6:36:46 AM
Reply
the P-O-B
Wednesday, May 04, 2011 @ 7:30:40 AM
Reply
ANOTHER THING - you do drill for ethylol ( CORN DONT GROW IN CAVES ) you drill for OIL.... if u dont think the oil companies , or not running the show ..... who gets 40 billion in tax breaks, oil companies or is it sony ..... oh , another point gas is allmost $5 a gallon , right !!!! you dont see them coming to congress to explain it ethier ..... l knew gas was going to go up alot last summer , when the gulf oil disaster .... NOW WHO IS PAYING FOR CLEAN UP?
Highlander
Wednesday, May 04, 2011 @ 9:35:01 AM
Underdog15
Wednesday, May 04, 2011 @ 10:19:22 AM
Beamboom
Wednesday, May 04, 2011 @ 10:39:00 AM
Highlander
Wednesday, May 04, 2011 @ 10:57:50 AM
Jawknee
Wednesday, May 04, 2011 @ 11:57:52 AM
1) Congress does hassle "big oil". Maxine Waters (D) Congresswoman from California, in a totalitarianesque tone threaten to nationalize the oil industry and take away their companies. You want to talk about "4Billion" dollar tax breaks? The big oil companies have already said they will be fine without them and have told congress to go ahead and take them away. Its the smaller oil companies, just starting up oil companies that will be hurt most by the loss of those so called "tax breaks." Learn something about the oil industry before commenting on it please.
2) The reason gas is going up is because of A) A weak dollar which is a result of the Fed printing green backs on a daily basis, B) Ever since the BP oil spill, there has been a ban on drilling in the Golf despite numerous court orders to lift the ban. Oil companies are packing up and leaving. So we are producing less oil. Less oil on the market with a higher demand forces prices to go up. It's econ 101. and C) Turmoil in Lybia is causing less production over there. Again econ 101. Simple supply and demand.
3) Food price are going up because A) its costing more to transport because Gas is up and B) Instead of using corn and corn based products to feed people, they are burning it and trying to convert it into ethanol fuel which has now been proven to damage internal combustion engines. i.e. gasoline powered cars.
You want oil companies to explained why gas has gone up to congress, these are the reasons and it's all a result of misguided and irresponsible policies put in place BY government.
Please do yourself a favor, educate yourself and think about what and how your going post it so we can A) read what you're saying without getting a headache and B) so you don't make a fool of yourself talking about subjects you obviously know nothing about.
Underdog15
Wednesday, May 04, 2011 @ 12:51:54 PM
We are feeling insane gas prices up here in Canada too... $1.38 per liter up here right now... (Which equates to about $5.22 per gallon... and our dollar is stronger than the US dollar, too!)
Jawknee
Wednesday, May 04, 2011 @ 1:29:31 PM
I wish people would stop demonizing the oil companies and really look at all the real causes as to why were are paying so much for our food and energy resources. These politicians can bark all they want about "obscene" profits and how the oil companies are ripping us off, doesn't change the fact much of what we're paying for is a result of these politicians misguided policies that shackle these companies from getting the oil out of the ground and getting it to market. There is plenty of oil out there and there will be risks getting to it but it must be done. Battery powered cars and public transit systems are not good enough. Especially in larger nations like Canada and the US. Plus its not practical. People are struggling paying for gas and our Presidents solution is "go buy a new car". He's a joke! Paying higher prices is a mere inconvenience to people of a modest living but it greatly hurts the poor and lower income people as well as developing nations.
Last edited by Jawknee on 5/4/2011 1:34:18 PM
Jawknee
Wednesday, May 04, 2011 @ 1:46:34 PM
BikerSaint
Wednesday, May 04, 2011 @ 4:51:00 PM
maxpontiac
Wednesday, May 04, 2011 @ 9:53:05 AM
Reply
BIGRED15
Wednesday, May 04, 2011 @ 10:38:29 AM
Reply
@Jawknee... You would think that if (and that is a BIG if) Congress is asking these types of questions that it would warrant the common sense to understand the severity of the issue and who is truely at fault. You would like to think that. I too have reviewed the questions and in my opinion a lot of them have been answered and a lot of them demand an answer. The question is will they be the RIGHT answer? I agree with you that regulations will be more of a burden than being helpful. What I would propose to congress in this situation is how would you have wanted Sony to handle this? Because i feel sony is going to answer those questions the way they have been the whole time and congress will dismiss them becuase they didn't get the response from sony that they wanted to hear. I am fairly educated in politics and business... enough to know what it looks like when a company's ethics are compromised, and from what i have reviewed, sony did everything as "by the book" as possible. I think when sony sends congress it's responses, that congress simply must regulate in a way that makes it easier for sony to keep us safe, not in a manner that blames sony. If congress doesn't come to their aid, then their no better than fanboy journalists or Xbots who chastize sony for this so called incompetance. If the outcome becomes less than ideal, then it is clear that the people elected into those positions should have no say on the matter of network security.
Highlander
Wednesday, May 04, 2011 @ 11:08:07 AM
But, as even Kotaku had to admit today in a piece reporting comments by a leading system security expert; Sony is not to blame, hacks are going to happen. The point being that networks are going to be hacked, they are hacked every day. Sony's security really wasn't worse than the norm, and apparently was sufficient to fend off a sustained attack on their credit card information. That's not been the case even for financial institutions in the past.
The point though is that attacks of this nature, hacks of networks, cyber-crime, data leaks and breaches are all going to continue to happen for the foreseeable future. Sony is not the first and will *not* be the last major network to be hacked. So people need to be aware of the security of their information. People need to act more wisely with their credit card information. However in the day and age of Facebook and other social networking sites, I don't see much of that happening.
Still, the future is likely to go with a digital economy of sorts. For that to happen, service providers, network operators, content providers and regulators have to come up with a coherent approach that works and mitigates the effects of cyber crime. They also need to put in place regulatory and legal structures that make it possible to define cyber-crime in that future, and to combat it.
At this point though, I'm not confident that will happen, and instead Ill continue being careful about my details. One thing that would be great is for my card provider to offer me one time use card numbers that I can use to charge my PSN wallet...I need to investigate that option.
Jawknee
Wednesday, May 04, 2011 @ 12:26:08 PM
There's your first mistake. You're assuming Congress has commonsense. By their actions of the last 6 years, it is obvious they do not. Otherwise we wouldn't be staring the threat of default and bankruptcy in the face now.
@Highlander, oh how that must of pained Kotaku to post that article.
Last edited by Jawknee on 5/4/2011 12:27:32 PM
Jawknee
Wednesday, May 04, 2011 @ 7:10:49 PM

See Full Image









Excelsior1
Reply
Tuesday, May 03, 2011 @ 9:24:56 PM
i thoght psn was coming up today. does anybody know anything?