Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

First PlayStation 3 Greatest Hits GamesFirst PlayStation 3 Greatest Hits Games

It’s that time in the life-cycle of the PlayStation 3 where a few of their hit titles go into “classic” game mode, which translate to a price drop. We saw this with a few games like Kameo on the Xbox 360 a year or so after the launch of the console.

The first games said to be going “classic” or, as Sony calls it, “Greatest Hits” will be: Motorstorm, Warhawk and Resistance: Fall of Man. The rumored date is July 27th, as it’s part of a print ad which boasts the new price tag of USD $30.00 for the titles, these games, currently, are USD $59.99.

More than likely this will be one of the minor E3 announcements to spread a bit more love for the PlayStation 3. The games are too expensive considering the console investment, having a few games you can buy for a nice price makes the console a bit more attractive. They are also the games the PS3 is best known for which doesn’t hurt either.

(Thanks, PS3Fanboy)

Gaming Podcast 148: Games I Don’t Like PlayingGaming Podcast 148: Games I Don’t Like Playing

This weeks gaming podcast covers a few top news stories that inspire tons of discussion, we tackle some user feedback and comments, answers of the week and flashback to Archon: The Light and the Dark. We’re also going to review Netflix for the PlayStation 3 for those thinking of ordering the disc from Netflix. This weeks news includes:

This week’s question of the week: what was the best game you played that after playing it, you thought to yourself, “That was good. I’m never playing it again”?

The PSN FiascoThe PSN Fiasco

It’s now the US government’s turn to question Sony about its online security, which follows the UK government’s scrutiny into the company’s affairs.

In a letter addressed to PlayStation executive deputy Kaz Hirai, the Subcommittee on Commerce, Manufacturing, and Trade has prepared a list of questions related to the intrusion; the list can be downloaded from the New York Times here. The letter asks several questions that Sony has not disclosed to the public, such as:

  • How many PSN users had a credit card on file
  • Why Sony cannot determine if credit card was stolen.
  • What are Sony’s plans towards increasing its security in the future.

The Subcommittee’s press release states:

“Given the amount and nature of personal information known to have been taken, the potential harm that could be caused if credit card information was also taken would be quite significant. The Subcommittee on Manufacturing, and Trade has a longstanding interest in consumer privacy, identity theft, and industry efforts to address threats posed by unauthorized access to consumers’ personal information resulting from a data breach.”

The Subcommittee is requiring a reply by no later than May 6, as part of a privacy driven effort “to protect consumer information.”

Meanwhile, Kaz Hirai will be holding a press conference tomorrow from Sony Japan, to address the PlayStation Network hacking crisis.

(more…)