The Great 2011 PSN Outage Megathread Post 1 updated

MrVestek · 12-05-2011 11:46am

SeanQCitizen wrote: »

I don't know much* about web security but it strikes me that if Sony did have Apache and if Apache was such hot sh!t then everyone who runs Apache would be bricking it because that would suggest that Apache didn't stop the hack. Obviously there was something that as yet is specific to Sony's format of security protocals that was weak that enabled this to happen. Or else there is a suggestion that if you are targeted by dedicated hackers all you can do is delay but eventually they will get through even if you stay current with the best(at least considered in the market place) software.

*anything

You kinda have the gist of it. Just simply running Apache doesn't make a server secure but most companies out there have the good grace to hire a competent team to ensure that their networks are secure with various access control lists, firewalls and a bunch of other stuff that I'm not going to go into here as most don't seem to understand the complexitiy of it anyway.

Case in point is... the hackers bypassed apache and there was NOTHING on the network to stand in their way.

Hell some of the customer data was found on Sony's servers with a simple but specific Google search!!!!! (This is why access control lists are a good idea.)

You can read the blow for evidence of this:
http://forums.dashhacks.com/f190/psn-hack-want-the-truth-we-have-it-t295846/

GothPunk · 12-05-2011 11:47am

Achilles wrote: »

*sigh*

Do I really need to explain the merits of network security to you? A server simply running the latest version of Apache does not a secure server make.

You should read up on the following:
http://www.linuxsecurity.com/content/view/133913/171/

As the article states just simply setting up an Apache web server doesn't make it secure. Sony hardly took any steps to secure their own servers regardless of whether they were running up to date Apache or not.

You haven't detailed how you know that Sony's servers were set up in such a dumb ass way? Do you have any proof for example, as the article you linked to advises against, that the servers were being run as root? Perhaps they had their permissions for sharing files a bit too open as the hackers were able to download such a large amount of data from several of their servers, but that's just speculation on my part - I have no proof of that. Do you?

So far in this thread you have come to the discussion with old information that has since simply been shown to be incorrect. For example, certain less than reputable websites that you and others have linked to said that Sony's servers were running an out of date version of Apache - which a Beyond3D user demonstrated is simply false. Sure you could argue that only some of their servers were running the most up-to-date version, but it still paints the websites that were reporting that all the servers were running out of date firmware etc as in a bad light. It seems like they were just capitalising on the situation, spreading FUD and making stuff up.

Secondly, they said that the credit card information was sent in plain text - it has since been confirmed that the credit card information was encrypted, which I'm sure we're all aware is a PCI standard of such large scale businesses are suggested to employ. We also haven't seen a single case of credit card fraud out of this, and seeing as how the passwords were hashed, we also haven't seen anyone's accounts, email etc being hacked. It seems all we've seen so far is an increase in spam for some people. If Sony were truly in breach of PCI requirements, we would be seeing at least some cases of fraud out of this. The report that the credit card details were being sold on the black market was also demonstrated to be false. It's all nonsense!

If you want to posit that Sony are lying, you'll need some facts to back up your claim, instead of just some speculation and FUD posted on some trashy hacker friendly website or blog. The FBI are on board to aid Sony in sorting out this mess - do you really think they're going to lie about this stuff with a federal investigation of their IT infrastructure going on? With US Congress asking for clarification of how consumers were affected?

Do I really need to explain to you that you shouldn't believe everything you read on the internet? That last link you linked to is bullshít, another FUD article - looking at their extrapolation of 77 million accounts to cost Sony $15 billion is just ludicrous! Can't you see that they're just talking out of their ass? They want hits, they don't care about fact checking. Look at their wording 'Certain sources allege...' '...the potential damage...'.

Our survey says: WRONG!

MrVestek · 12-05-2011 11:58am

GothPunk wrote: »

You haven't detailed how you know that Sony's servers were set up in such a dumb ass way? Do you have any proof for example, as the article you linked to advises against, that the servers were being run as root? Perhaps they had their permissions for sharing files a bit too open as the hackers were able to download such a large amount of data from several of their servers, but that's just speculation on my part - I have no proof of that. Do you?

So far in this thread you have come to the discussion with old information that has since simply been shown to be incorrect. For example, certain less than reputable websites that you and others have linked to said that Sony's servers were running an out of date version of Apache - which a Beyond3D user demonstrated is simply false. Sure you could argue that only some of their servers were running the most up-to-date version, but it still paints the websites that were reporting that all the servers were running out of date firmware etc as in a bad light. It seems like they were just capitalising on the situation, spreading FUD and making stuff up.

Secondly, they said that the credit card information was sent in plain text - it has since been confirmed that the credit card information was encrypted, which I'm sure we're all aware is a PCI standard of such large scale businesses are suggested to employ. We also haven't seen a single case of credit card fraud out of this, and seeing as how the passwords were hashed, we also haven't seen anyone's accounts, email etc being hacked. It seems all we've seen so far is an increase in spam for some people. If Sony were truly in breach of PCI requirements, we would be seeing at least some cases of fraud out of this. The report that the credit card details were being sold on the black market was also demonstrated to be false. It's all nonsense!

If you want to posit that Sony are lying, you'll need some facts to back up your claim, instead of just some speculation and FUD posted on some trashy hacker friendly website or blog. The FBI are on board to aid Sony in sorting out this mess - do you really think they're going to lie about this stuff with a federal investigation of their IT infrastructure going on? With US Congress asking for clarification of how consumers were affected?

Do I really need to explain to you that you shouldn't believe everything you read on the internet? That last link you linked to is bullshít, another FUD article - looking at their extrapolation of 77 million accounts to cost Sony $15 billion is just ludicrous! Can't you see that they're just talking out of their ass? They want hits, they don't care about fact checking. Look at their wording 'Certain sources allege...' '...the potential damage...'.

Our survey says: WRONG!

One simple question: If Sony were running secure servers then how was the data compromised?

Perhaps the following article will clear it up for you or is GeoHot considered too hacker friendly too?!

http://geohotgotsued.blogspot.com/2011/04/recent-news.html

GothPunk · 12-05-2011 12:02pm

Achilles wrote: »

Case in point is... the hackers bypassed apache and there was NOTHING on the network to stand in their way.

Wrong again, there were three firewalls.

Varik · 12-05-2011 12:07pm

Achilles wrote: »

One simple question: If Sony were running secure servers then how was the data compromised?

Perhaps the following article will clear it up for you or is GeoHot considered too hacker friendly too?!

http://geohotgotsued.blogspot.com/2011/04/recent-news.html

You mean the article where everything is conjunction and he even states that.

Now until more information is revealed on the technicals, I can only speculate

RedXIV · 12-05-2011 12:08pm

MarkY91 wrote: »

got a question for all of ye.............

eventually when sony get their act together and finally fix their joke of a security and alls grand up and running, then it gets hacked again for another few weeks will you have had enough and switch to xbox?

i think id end up buying a xbox is this happens again and im sure alot of people will do the same, hope it doesnt come down to this scenario though i love my playstation and besides...xbox controller is an awful thing to use just awful :P

Since PSN has gone down, i've gotten:
A dreamcast
A megadrive
A NES
A SNES
A N64
A GameCube
A Xbox

I think its just a co-incidence but who's to know?

MrVestek · 12-05-2011 12:09pm

It is speculation up to this point though.

The fact remains... if their system was so secure then how did somebody get in? Hrmmm?

We also have no info currently as to what those firewalls were, software, hardware? Were the hardware firewalls running the latest firmware patches for instance?

Nobody knows. Suffice it to say their network was NOT secure at the time and this is the issue at hand.

Sephiroth_dude · 12-05-2011 12:14pm

Any new news?

NUTZZ · 12-05-2011 12:21pm

Sephiroth_dude wrote: »

Any new news?

Nothing yet it seems!

MrVestek · 12-05-2011 12:23pm

AIR-AUSSIE wrote: »

Cool you've admitted it speculation (making shít up).

Just going on what I've come across so far. I'd say that Sony is making **** up too at this point in regards to their own internal network structure as it has been explored before but I guess nobody in here will believe me until either a Judge admits to it or Sony themselves... which will never happen.

If you'd read any of the court docs from their recent actions suing their users then you'd understand what I mean by that.

Grumpypants · 12-05-2011 12:51pm

Crikey PSN is down so long we are starting to turn on each other, fighting over server security of all things

MrVestek · 12-05-2011 12:58pm

Grumpypants wrote: »

Crikey PSN is down so long we are starting to turn on each other, fighting over server security of all things

I have an Xbox 360 too so it doesn't really bother me in the slightest.

I do have a HUGE issue with how Sony have been treating their customers though.

Benzino · 12-05-2011 1:01pm

Achilles wrote: »

The fact remains... if their system was so secure then how did somebody get in? Hrmmm?

I'm of the believe that any system is hackable. Xbox Live, Amazon, Play.com etc You name it, it can be hacked. All it takes is a group of dedicated hackers.

Why have none of the above been hacked but yet Sony have? Because none of the above have gone and pissed off a group of hackers!

MrVestek · 12-05-2011 1:05pm

Benzino wrote: »

I'm of the believe that any system is hackable. Xbox Live, Amazon, Play.com etc You name it, it can be hacked. All it takes is a group of dedicated hackers.

Why have none of the above been hacked but yet Sony have? Because none of the above have gone and pissed off a group of hackers!

That's true no system is completely 'un-hackable'.

However as has been previously demonstrated some of these details were obtained with a simple google search because they didn't have their Apache Access Control Lists in order. Some companies do make it *easier* for people to get into their system by being so arrogant to think that client side encryption was enough. It wasn't.

golfman · 12-05-2011 1:47pm

Benzino wrote: »

I'm of the believe that any system is hackable. Xbox Live, Amazon, Play.com etc You name it, it can be hacked. All it takes is a group of dedicated hackers.

Why have none of the above been hacked but yet Sony have? Because none of the above have gone and pissed off a group of hackers!

I tend to agree with that sentiment and it works for everything including cars etc. If people with the right knowledge and expertise want something and they're prepared to put in the time, they will get it.

Azure_sky · 12-05-2011 1:55pm

Still no services back yet? This is turning into a total farce. Bill Gates and Shigeru Miyamoto must be having multiple orgasms by now.

wayne040576 · 12-05-2011 2:07pm

I don't think people realise the amount of work involved in getting this back online. It's not just a case of turning a few knobs and dials. They've obviously discovered some major flaws in the system due to this and need to fix/rewrite.

They know once it goes back up that all eyes will be on them waiting for something else to happen.

AIR-AUSSIE · 12-05-2011 2:10pm

wayne040576 wrote: »

I don't think people realise the amount of work involved in getting this back online. It's not just a case of turning a few knobs and dials. They've obviously discovered some major flaws in the system due to this and need to fix/rewrite.

They know once it goes back up that all eyes will be on them waiting for something else to happen.

I wouldn't mind if they'd mentioned it up front rather than lying and giving us nothing updates, its a PR disaster.

Azure_sky · 12-05-2011 2:10pm

wayne040576 wrote: »

I don't think people realise the amount of work involved in getting this back online. It's not just a case of turning a few knobs and dials. They've obviously discovered some major flaws in the system due to this and need to fix/rewrite.

They know once it goes back up that all eyes will be on them waiting for something else to happen.

I appreciate that it takes time to do it right but it is really annoying when they give out these deadlines and keep on missing them. I just want log into PSN so I can activate my other account.

wayne040576 · 12-05-2011 2:11pm

BTW. The stories about them running an out of date Apache version seem to be untrue:

http://www.joystiq.com/2011/05/09/report-sonys-psn-servers-were-up-to-date/

AIR-AUSSIE · 12-05-2011 2:13pm

They're are some advantages to having your email freely available... I'm getting all these great business propositions from African business men..

Greeting to you

I know you may feel very surprised to receive my letter at this moment
but i am in deep pains and left with no option and that is why i am
contacting you. My name is Muhammad Arraf, an oil dealer from Libya,
within the past few weeks; I believe you must have heard or seen on
the news regarding the massacre and crisis in my country (Libya). Our
president Muammar Abu Minyar al-Gaddafi who has been ruling our
country for the past 42 years,(
http://en.wikipedia.org/wiki/Muammar_al-Gaddafi )he has refused to
step down and this has led the protectors seeking his resignation just
like it happened in Egypt.
The bad news right now is that more than 6,000 people have been killed
so far and i do not know how many that will die in the next few days.
My wife and my two children were also killed. As i am writing you now,
my life is in danger.

I want to leave this country by any means and run for my life before I
get killed also. I already transferred my business capital $US4.4
Million (Four Million, Four Hundred Thousand Dollars) to Financial
security company in England but we are not authorized to travel to UK
because the UK embassy here has been closed as a result of the crisis.
Other embassies are still open but may close anytime if they receive
instructions. I am so confused right now because i don't know where to
run to. I am writing you because i want to relocate to your country
and start a new life with my capital. I am seeking for your help
because I want to transfer my fund in UK to another country since I
cannot have a UK visa right now. I am not doing anything in this
country where my life is in danger and I have lost the only family
I’ve got.

I believe you can assist me to transfer my capital in UK to your
country while i prepare the documents here to relocate to your country
and start a new life. Please listen to my cry for help, a lot of
people have been killed now and i don't want to die. See the video
clip of the recent killings on youtube.com

I promise to reward you with 10% of my business capital in
appreciation for what you did for me as soon as i arrive your country.
Please help, I am a very rich man here but being rich is not important
to me now, what matters to me right now is my life. I hope to receive
your response and also the details on how i can know much about you.

Thanks and may Allah bless you.

Please be informed that all forms of telephone communications have
been disabled because of the crisis, email will be the only form of
communication for now.

Muhammad Arraf

weiland79 · 12-05-2011 2:21pm

^^ Sh!t never gets old

rickyjb · 12-05-2011 2:25pm

That's a once in a lifetime opportunity, I say you give him your full name, address, DOB and any credit card or bank details you have immediately. Bargain to get back 440,000 quid.

GothPunk · 12-05-2011 2:40pm

Achilles wrote: »

One simple question: If Sony were running secure servers then how was the data compromised?

Perhaps the following article will clear it up for you or is GeoHot considered too hacker friendly too?!

http://geohotgotsued.blogspot.com/2011/04/recent-news.html

I've read that post before. Note that he begins his speculation with the line:

Now until more information is revealed on the technicals, I can only speculate, but I bet Sony's arrogance and misunderstanding of ownership put them in this position.

He admits he is only guessing. I'm also inclined to agree with him -they had a secure system for so long they probably got complacent. However, as Sony's report to US Congress details, they had the firewalls, encryption and other security in place.

Achilles wrote: »

It is speculation up to this point though.

The fact remains... if their system was so secure then how did somebody get in? Hrmmm?

We also have no info currently as to what those firewalls were, software, hardware? Were the hardware firewalls running the latest firmware patches for instance?

Nobody knows. Suffice it to say their network was NOT secure at the time and this is the issue at hand.

You've admitted that no system is invulnerable to attack. That is why information is hashed or encrypted etc. Do you really expect many large scale networks to be able to withstand the large scale attack that Sony faced? On the day of the hack they were facing a large scale DDoS attack from Anonymous, together with the attack that resulted in customer information being stolen. This is Anonymous we're dealing with - I don't think any system has been able to withstand an attack from them, so to suggest that Sony's system wasn't secure enough because some of the best hackers in the business managed to break in is a bit of a stretch.

Achilles wrote: »

Just going on what I've come across so far. I'd say that Sony is making **** up too at this point in regards to their own internal network structure as it has been explored before but I guess nobody in here will believe me until either a Judge admits to it or Sony themselves... which will never happen.

If you'd read any of the court docs from their recent actions suing their users then you'd understand what I mean by that.

So you'd rather believe conspiracy theories than a long explanatory letter sent by Kazuo Hirai to the House of Representatives in the US? Do you really think they're going to lie about all this when there are so many eyes on them, and the FBI and private security firms are/were working to figure out the details of the hack?

Achilles wrote: »

That's true no system is completely 'un-hackable'.

However as has been previously demonstrated some of these details were obtained with a simple google search because they didn't have their Apache Access Control Lists in order. Some companies do make it *easier* for people to get into their system by being so arrogant to think that client side encryption was enough. It wasn't.

What are you talking about? That link you provided was in relation to some outdated file that was found on one of their FTP servers - that has nothing to so with hacking, versions of server firmware etc - plenty of companies have files accessible on FTP servers that can be found with some persistence (I for one remember a leaked Sega/Sony document a year or so ago that contained a lot of up and coming games that hadn't been announced yet).

Finding some files on an FTP server has nothing to do with the PSN hack.

Edit: I found their links to the files here (click on the pastebin links). They're not PSN related, they're not even customer related - all they are are some example script loops for what I think is for the creation of emails related to some competition. There are no (NO) customer details in those files, so their report is full of shít. They say that 2500 peoples names and city of residence are leaked in those files, but when you open them all they are are little script examples (complete with annotations). Googling that FTP server now I see that they have some other open source coding files there too. That FTP server must be used to house some example codes for some old competition or something. I wouldn't even call this news, just more scare-mongering hoping to spread more FUD.

Achilles, might I suggest you actually read through what you're linking and check up on the information presented before you declare the sky to be falling.

Beefy78 · 12-05-2011 2:55pm

Achilles wrote: »

Lest I also point out the fact that Sony have repeatedly failed to adhere to PCI Complaince which is a legal requirement of any card handlers that operate in America for instance.

These are the guidelines that they should have been following:
https://www.pcisecuritystandards.org/security_standards/getting_started.php

This article outlines how they have failed PCI compliance:
http://www.merchantprocessingresource.com/apps/blog/show/next?from_id=6874218

The article doesn't outline how though, does it? It merely mentions that the lawler suing them is speculating that they must not have been PCI Compliant.

I suspect that Sony were not PCI Compliant because otherwise the hack couldn't have happened. But I also suspect that it's going to take a long time for anyone to work out exactly how Sony weren't compliant. Heartland and TK Maxx (the two other large data compromises in recent years) were both signed off at their six monthly PCI Compliance review as being Compliant and then were breached.

Sony, Heartland, TK Maxx, Apple, Microsoft, Tescos and every other massive retailer has to have their security signed off every six months by an external QSA. If the QSA misses something then what can the company themselves do?

donalg1 · 12-05-2011 3:28pm

Is it back yet?

Xbox 360 owner here, i genuinely want to know but cant be bothered going through all these pages.

Have Sony said what they are giving each user to say sorry yet?

Motley Crue · 12-05-2011 3:29pm

Beefy78 wrote: »

If the QSA misses something then what can the company themselves do?

Sue the QSA

Leeg17 · 12-05-2011 3:31pm

AIR-AUSSIE wrote: »

They're are some advantages to having your email freely available... I'm getting all these great business propositions from African business men..

Why didn't I get any emails? You're rich now, Allah dammit

Motley Crue · 12-05-2011 3:32pm

donalg1 wrote: »

Is it back yet?

No

donalg1 wrote: »

Xbox 360 owner here, i genuinely want to know but cant be bothered going through all these pages.

Fair enough, did you jump ship when it happened or are you just a Microsoft man from day one?

donalg1 wrote: »

Have Sony said what they are giving each user to say sorry yet?

Playstation Plus for a month, a year's free personal protection security software, an update, an apology email/statement and if you're a PS3 owner you get your choice of 3 games from 5 (undisclosed currently) to download once you're back online. PSP is the same, expect it's 2 games from 4 (again nothing about the title selection yet)

Soon is not the word.

Feels like waiting for Chinese Democracy to be released:D

Varik · 12-05-2011 3:33pm

Beefy78 wrote: »

The article doesn't outline how though, does it? It merely mentions that the lawler suing them is speculating that they must not have been PCI Compliant.

I suspect that Sony were not PCI Compliant because otherwise the hack couldn't have happened. But I also suspect that it's going to take a long time for anyone to work out exactly how Sony weren't compliant. Heartland and TK Maxx (the two other large data compromises in recent years) were both signed off at their six monthly PCI Compliance review as being Compliant and then were breached.

Sony, Heartland, TK Maxx, Apple, Microsoft, Tescos and every other massive retailer has to have their security signed off every six months by an external QSA. If the QSA misses something then what can the company themselves do?

PCI is industry self-regulation.

You only need to be PCI compliant if you want to do business with these card companies, but large companies who would be doing large amounts of business can ignore it as the banks would loose out if they weren't able to sell stuff.

The Great 2011 PSN Outage Megathread *Post 1 updated*

Comments

The Great 2011 PSN Outage Megathread Post 1 updated