Sony PlayStation Network hacked again, user passwords compromised !

With Sony's PlayStation Network freshly back online, attackers have once again breached the system, this time going for a vulnerability with the system's password reset.

This is getting (more) ridiculous. Not even two days after Sony restored its embattled PlayStation Network for most users worldwide, cyber criminals have once again launched an attack, this time going after the PSN’s password reset system. In order for users to reconnect to the PSN, they were required to reset their passwords. You know, for security reasons…

News of this third, most recent attack were originally reported on Nyleveia.com, which warned PSN users that “accounts are still not safe.”

“I want to make this clear to ALL PSN users. Despite the methods currently employed to force a password change when you first reconnect to the PlayStation network, your accounts still remain unsafe,” writes Nyleveia. “A new hack is currently doing the rounds in dark corners of the internet that allows the attacker the ability to change your password using only your account’s email and date of birth. It has been proven to me through direct demonstration on a test account, so I am without any shadow of a doubt that this is real.”

Following the Nyleveia post there was, in fact, some doubt that this was real. But further tests by Eurogamer proved that the breach was real, which caused prompt action from Sony. In response, the company has blocked PSN login access to a number of its site, and the PSN password reset site has also been taken offline.

Sony responded to the new attack, saying: “Unfortunately this also means that those who are still trying to change their password via Playstation.com or Qriocity.com will be unable to do so for the time being.”

“This is due to essential maintenance and at present it is unclear how long this will take,” Sony added. “In the meantime you will still be able to sign into PSN via your PlayStation 3 and PSP devices to connect to game services and view Trophy/Friends information.”

Fortunately, this round of breaches isn’t actually a “hack” in the true sense of the word — at least not if you want to be a stickler about it. The previous attacks on the PSN were true hacks in that someone broke into Sony’s network, and stole nearly 13 million credit cards, and the personal data of about 100 million people. This time, they just used some of the data that was already stolen to break into people’s accounts. Big difference, we know.

Still, this proven vulnerability is sure to give Sony more grief. Just yesterday, Sony CEO Howard Stringer defended his company’s handling of the April attacks, which resulted in the being turned off for a week before users were alerted to the data theft.

On Monday, Sony released the details of its user “Welcome Back” program, which includes free games, like ModNation Racers and Killzone Liberation, and free movie rentals. Perhaps this most recent breach will prompt them to toss in a few more options, just to keep users happy. Just a suggestion.

Source: The Hacker News

Read More

Sony to Resume PlayStation Network Services, Says “No Evidence” Credit Card Info Stolen

Sony will resume some PlayStation Network services and beef up its security nearly two weeks after a hacker attack forced Sony to shut it down.

The company made the announcements during a press conference in Tokyo. Kaz Hirai, Sony’s executive deputy president and the likely successor to CEO Howard Stringer, started by offering “our deepest and sincerest apologies” for the outage of the PlayStation network, as well as apologizing to customers whose personal information has been compromised. Hirai and two other Sony executives bowed deeply, a Japanese custom for apologizing.

Hirai confirmed that lots of users account information was stolen as the result of a hacker attack that has forced Sony to shut down PSN and Qriocity services for the last two weeks. Sony says that it was first alerted to the attack on April 20 and has been working with authorities and two security firms to investigate.

“This criminal act against our network had a significant impact not only on our consumers but our entire industry,” Hirai said. “These illegal attacks obviously highlight the widespread problem with cyber-security.”

The big question though is whether or not credit card data was stolen, a possibility that has raised questions from the U.S. Congress. Hirai and two other Sony executives repeatedly asserted that they have found “no evidence” that credit card data or billing information has been stolen. Hirai wouldn’t rule out the possibility, however, which likely explains why Sony is asking customers to check their credit card statements just in case.

To prevent an attack like this one from happening again, Sony says it has moved PSN and Qrioicity services to a new data center and implemented new security measures, including additional firewalls, enhanced encryption and automated software monitoring. The company has also created a new position: Chief Information Security Officer, a senior executive who will report to Sony Chief Information Officer Shinji Hasejima. In addition, Sony will require all users to change their passwords, but with additional security measures to verify identity.

Sony says it will resume some PlayStation Network services in the next week as a result. This includes restoration of online gameplay, Qriocity music services, friend lists, chat functionality and movie rental services. It is also launching a “Welcome Back” campaign as an apology to users for what has transpired. Sony is offering affected users a 30-day subscription to PlayStation Plus and some free software downloads. Qriocity customers will be receiving 30 additional days of service for free.

Source: mashable

Read More