Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

MGS4 Pushes PS3 Up 300%MGS4 Pushes PS3 Up 300%

Metal Gear Solid 4 was a solid release for the PlayStation 3, the exclusive title that gives Sony an edge over the competition. This was Sony’s Halo 3 title and it needed to be a big success in order to keep gamers confident in the Sony brand.

Sony is reporting a 300% increase in PlayStation 3 sales over last month, mainly due to the desire for people to own Metal Gear Solid 4. Remember, this isn’t an increase in game sales, this is an increase in console unit sales, providing evidence that MGS4 sold consoles.

While Grand Theft Auto 4 seemed to sell a few consoles but, overall, didn’t impact console statistics during its release, this exclusive PS3 title has done just the opposite. Perhaps because of its exclusivity? Xbox 360 consoles have been in the hands of the consumer for a few years now, most of those consumers actually purchased GTA IV (as expected and reflected in sales) but not a lot went out to purchase the console. They already had it or didn’t care to own it for a game like GTA IV.

While many people purchased Metal Gear Solid 4 because it’s “Metal Gear,” you can see from the trailers that the game looked impressive, felt complete and contained a lot of great action. You’ll get a great sales pop the first few days on a title with a huge fan base but to sustain the growth and sell consoles you’ve got to provide a well known title that doesn’t suck.

MGS4 doesn’t suck by any reviewers score; it’s not perfect, but what game is? MGS4 delivered what it was said to deliver with very few bad experiences and that’s all you can ask for a console moving title.

So, what next? Sony has promised us that MGS4 is just the first of many titles to blow our minds. Resistance 2, Little Big Planet and what of that MAG game they showed off at E3? 256 players? We won’t hold our breath for that title, but Resistance 2 and Little Big Planet, combined, may move a few more units.

It may not be about the games today that move the next round of PlayStation 3 consoles, it’s about the promise of the games tomorrow with titles like MGS4 to hold us over until then.

(more…)

Episode 440: Wasteland 3 AnnouncedEpisode 440: Wasteland 3 Announced

This episode is late due to Jonah having to do some film work, but this show also has some huge news items as well.

The news items this week includes:

  • inXile announces Wasteland 3 – and it’s got multiplayer
  • No Man’s Sky is being investigated by the Advertising Standards Authority
  • Destiny 2 rumored to be coming to PC
  • PlayStation 3 was way overpriced and still lost money on each unit, former Sony exec says

Let us know what you think in the comments section.

Are You An Okami Fan?Are You An Okami Fan?

PlayStation 2 fans may recall a little title called Okami, it’s an action adventure game developed by Clover Studios and published by Capcom. The original Okami title received fairly high reviews by many popular game sites, although there were a few flaws, the receiption seemed well received.

Clover Studios was closed after the release and all the intellectual properties went back to Capcom, the company that funded the studio, leaving Capcom responsible for future sequels.

Christian “Sven” Svensson said “I think we need a lot more people buying the current version before we seriously consider a sequel”. A harsh statement on the game’s combined sales figures, perhaps, but also probably an accurate one. (Kotaku)

This is the sound of a developer not so happy with prior performance and finding it too risky to try for a second title. Although many sequels outshine their parents there is some truth to the fact that slow selling parents will create slow selling sequels, there is something to be said about learning form past experiences.

The game had good reviews, isn’t it worth trying to make a second game based on that? Maybe people just aren’t jazzed about Japaense folklore, myths and legends as the basis for a game.