Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Sony, What Doesn’t Kill Them Makes Them StrongerSony, What Doesn’t Kill Them Makes Them Stronger

David Reeves, Sony Europe’s President said, “we simply have to suffer a little” when talking about the PS3, Europe and the competition. He was talking specifically about Sony’s loss of market share, mind-share and overall performance in the latest competitive console arena. While Sony’s president dismisses Nintendo as in a separate market, David Reeves said, “we’ve learned from Nintendo how to grow the market and move from hand-held device to device – they’ve done it brilliantly.”

Buster Douglas Takes Down Mike TysonWhat Sony may be dealing with is the fact that they’re not top dog in the latest battle for consoles. Europe has taken to the PlayStation 3 better than the United States and they’ve got plenty of fans in the region. There has been a recent upside to it all, some light at the end of the tunnel:

“PS3 games sales are up 53% and there’s a healthy 1.1m pre-order book for Killzone 2, the first of a new batch of IPs that Sony will be counting on.” (guardian.co.uk)

Although it’s reported the PSP says are down 15% and PS2 software sales are down 51%, at least the PlayStation 3 is filling in the gap for some of those losses. At some point you’d expect the PlayStation 2 to decline, gamers are probably migrating over to the new hardware.

They’ve got some things to be proud of:

  • PlayStation Network increases revenues by 200% in 2008
  • 55% of all PlayStation owners are on PSN
  • 17.5 million PSN subscribers
  • 53% rise in software sales on PS3
  • Won HD format war

Unfortunately PS3 sales were down last quarter by about 9%, perhaps a response to the harsh economic times. And, of course, the fact that Sony’s VP’s are constantly defending their position in the market is a bit disconcerting. As David Reeves said:

“It’s like Ali v Foreman – go eight or nine rounds and let him punch himself out. We’re still standing, we’re still profitable and there’s a lot of fight in us. I don’t say we will land a knockout blow, but we’re there and we’re fighting.” (guardian.co.uk)

Sony is playing the defensive, guarding themselves against the punches of the competition. Nintendo making headlines for sales, Microsoft coming out of nowhere to try to build market share, while Sony holds out for the tenth round to win it in the end? We’re not yet sure if it’s Ali vs. Foreman or if Microsoft is the next Buster Douglas.

(Thanks, Guardian)

July NPD Unit Sales: Wii On Top… AgainJuly NPD Unit Sales: Wii On Top… Again

Believe this, Nintendo and their Wii console takes another month as top seller. The only product that moves more hardware than the Wii is the DS. As a gamer, it’s hard to understand how the Wii product continues to sell like this with the least supported game library on the planet.

The DS is completely understandable as it has a huge library of games, is more cost effective, comes in pretty colors and can save you tons of arguments and fighting from your kids on a long trip. In many ways the DS is synonymous with peace and quiet. What does the Wii offer us? Wii Sports and a new control scheme along with a few hit titles from Nintendo but little else for now.

I’ll be the first to admit, I thought this would be Nintendo’s chance to turn it all around and get the third parties involved. They have everything going for them in terms of sales, third party developers should be pushing out games each month considering the craze factor of the hardware. This just isn’t true.

(more…)

Mega Man 9, Xbox 360 and PlayStation 3 ConfirmedMega Man 9, Xbox 360 and PlayStation 3 Confirmed

Capcom has finally come out and stated Mega Man 9 will indeed be available on the PlayStation 3 (PSN) and Xbox 360 (Xbox Live). Capcom may be making a great move by providing everyone the ability to play their new retro title in download form. The game is definitely going to be a smaller title with a niche appeal, you really want to gain as much access to gamers as possible.

Although WiiWare is a great staging point for a new/old franchise there is absolutely nothing wrong with expanding it to the other consoles, even the PlayStation 3, giving all gamers the choice of which platform to purchase the title for.

In many ways, a console gamer with all consoles can chose the version of Mega Man 9 which will provide them the best “controller” experience. You want to play on an Xbox 360 controller? Great! Perhaps the Wii classic controller is more your style? Fine! Wanna stick with the proven PlayStation controller? Excellent!

Hopefully we’ll get a sense of which console moves the most downloads for Mega Man 9, as this will define who gets great gaming DLC in the future. Oddly enough, it might be the Xbox 360 because of its console sales count and total attach rate, even though the Wii has huge volume of users they don’t purchase very many games (if any).

(Thanks, Kotaku)