Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

PlayStation 3’s Wireless Keyboard AttachmentPlayStation 3’s Wireless Keyboard Attachment

This is a prototype of the keypadSony’s done it, they’ve announced a wireless keyboard adapter to plug onto the stock PlayStation 3 controller. This isn’t the first time we’ve heard of this, Microsoft pushed out a keyboard for their Xbox 360 controller last year to provide faster chat abilities and, overall, smooth the interface when needing to type.

Now, Sony’s following up with a few more advancements, “the wireless keyboard also features a touchpad mode to allow for mouse input. David Reeves, president of SCEE, said that this touchpad control mode may be used in future game development.” (kotaku)

Is there any chance our next-generation consoles will be more “PC like” out of the box? With these complex user interfaces featuring web browsers, online marketplaces and areas to enter your credit card information (and addresses) you’re really heading towards needing this type of interface. Now, they’re all starting to include chat and messenger services making it more important… if it catches on.

Perhaps the next console hitting the market will come with a keyboard as an in-the-box solution. Please note, the above image is Sony’s prototype image.

PlayStation 3: Not About Quantity, About ProfitabilityPlayStation 3: Not About Quantity, About Profitability

The Xbox 360 price drop rumors flow like water and it’s all but officially been announced at this point. What about PlayStation 3 and their price? No.

Nobuyuki Oneda, the Sony’s chief financial officer said, “our plan is not to reduce the price. Our strategy is not to sell more quantity for PS3 but to concentrate on profitability.” (gamespot) This makes complete sense coming from their chief financial officer, as their motivation is to make money, not lose it.

The question remains, how will they actually make money if they’re no longer in the race for competitive market prices? Considering game licensing must Net them some amount of profit Sony’s idea seems to be the exact opposite of their original PlayStation method: saturate the market and sell them all games.

So far we’ve seen very few “need to have” games for the PlayStation 3 console while Xbox 360 continues to build a substantial library and Wii continues to break sales records for apparently no reason. When a game publisher has to decide on a platform to launch a new game, why would they choose the one that doesn’t care to be competitively priced in the market? The one that doesn’t care about quantity of sales?

Sony intends to reverse the entire razor blade philosophy where one sells a cheap razor and charges users for the blades over and over again. Their take on this concept is to sell really expensive razors and put out small half-quality blades. Is that a good market strategy at this point?

Sony’s PS3 Real 10 Year Plan: Home Entertainment TakeoverSony’s PS3 Real 10 Year Plan: Home Entertainment Takeover

The PlayStation 3 is the slow seller in the United States but Sony still holds belief in their “10 year plan.” Many of us consider this to be the same style of plan Sony used with the PS2, sell your console through multiple generations and own the market share. The PS2‘s launch was much more graceful when compared to its 7th generation counterpart. Perhaps the PS3 has a different destiny… perhaps they want to remove all other media boxes from your living room.

Imagine a life without a cable box or Tivo and you’re probably envisioning Sony’s road map for a media distribution empire. First, remove Tivo from the situation with a DVR style box using their PlayTV technologies, wired up to the PlayStation 3 using a USB connection. The United States hasn’t seen a launch of PlayTV, more than likely because the PS3 isn’t a huge console here yet and Tivo is partnered with many cable and satellite providers already.

Senior director of the PlayStation Network, Susan Panico said Sony “looks aspirationally at HBO, the way they have Sex and the City and other shows” (gamespot) after admitting Sony wants to replace cable boxes in the home. Tivo has already done a great job removing the need for a cable box, allowing you to rent a “cable card” to insert into a Tivo and gain access to all their content for your DVR needs. DirectTV offers (or has in the past) a Tivo or Tivo-like DVR solution. Cable and DirectTV offer the ability to rent their DVR or offer a solution to purchase your own at a retail outlet What if Sony decides to partner with one or more of these providers to offer an all-in-one solution. PS3 owners wouldn’t have to purchase additional equipment and could be up and running immediately with hard disks big enough to handle HD content.

Sony could offer you a graphically appealing gaming experience, a high definition BluRay solution, media distribution for renting movies, an iTunes style online store for purchasing and playing music all wrapped up in a DVR solution. All this content for a $400 price tag is a value when all the offers are combined into one tiny black box.

Looking at today’s Tivo Series3 HD DVR you’ll notice the ability to play music directly from iTunes, browse and play Youtube shows, watch Disney offerings and even high definition NetFlix playback. The Tivo DVR’s can also talk with other DVR’s in the household making it easy to share TV records across systems. The only thing missing in the Tivo solution is a high definition gaming platform and the BluRay hardware.

We’re all sitting here poking fun at the small PS3 game library and telling people that BluRay is going to lose out to HD downloads yet we may be missing the bigger picture: an all-in-one media empire solution. The PS3 may not carry the largest game library compared to the Xbox 360 or the sales records of the Wii but if Sony finds a way to become a reliable and required media set top box they may realize their true “10 year plan.”