Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Episode 338: Movie TalkEpisode 338: Movie Talk

Sorry for the delay – last week Jordan had a medical emergency, but he’s all better now. In this episode, he and Jonah get sidetracked at one point talking about movies and the film At World’s End.

The actual videogame news they discuss include:

  • Nintendo evaluating new business, “studying” smart devices
  • Microsoft paying YouTubers for Xbox One mentions
  • Star Wars 1313 trademark abandoned
  • Sony creating new PS3 hardware for PS Now

This and a little Listener Feedback. This week, we’re looking for you to ask us questions.

Rock and a Hard Place: Sony’s Japanese DilemmaRock and a Hard Place: Sony’s Japanese Dilemma

What a dilemma it is, Sony’s PlayStation 3 isn’t as hot as the Nintendo Wii in Japan. Even the Xbox 360 has had some minor success stories in Japan while Sony sits back saying “wtf?”

President, SCE Worldwide Studios, Shuhei Yoshida is pointing the finger at the publishers saying, “What’s happening is that lack of support from the Japanese publishers – not necessarily from intentions but from development capabilities.” (kotaku) Why, though, would publishers push to produce games on the console that’s currently losing market share?

Sony’s position is very tough to deal with because they’re not market leader so publishers are looking for the biggest bang for their proverbial “buck” and that’s not the PS3 right now. You can produce an expensive game for an expensive console or a cheaper game for a cheaper console and make more money.

How, then, can Sony get out of this situation? They must find a way to promote an incentive for publishers to create Sony exclusives or, at least, a Sony “port” of a game to build up their library of must-have titles. Perhaps Sony’s punishment at the hands of Nintendo and Microsoft in the States has a bit to do with their global marketplace issues — they need to put a concerted effort into one of their regions and champion themselves in one realm before trying for all of them. Right now, they’re a watered down expensive console with very few exclusive titles.

Metal Gear Sold 4, Home and Little Big Planet are great reasons to own a PlayStation 3 if the price was a bit more reasonable. Looking at the future, we’ve got Resistance 2 and a few other titles that may make some waves in the industry, at least in the United States, but it’s going to be an uphill battle in which they are the second best this time.

It’s always easy when you’re on the top. PlayStation 3 is not on the top so it’s time to start struggling, cutting prices or enticing publishers to build good exclusive titles.

PlayStation 3’s Wireless Keyboard AttachmentPlayStation 3’s Wireless Keyboard Attachment

This is a prototype of the keypadSony’s done it, they’ve announced a wireless keyboard adapter to plug onto the stock PlayStation 3 controller. This isn’t the first time we’ve heard of this, Microsoft pushed out a keyboard for their Xbox 360 controller last year to provide faster chat abilities and, overall, smooth the interface when needing to type.

Now, Sony’s following up with a few more advancements, “the wireless keyboard also features a touchpad mode to allow for mouse input. David Reeves, president of SCEE, said that this touchpad control mode may be used in future game development.” (kotaku)

Is there any chance our next-generation consoles will be more “PC like” out of the box? With these complex user interfaces featuring web browsers, online marketplaces and areas to enter your credit card information (and addresses) you’re really heading towards needing this type of interface. Now, they’re all starting to include chat and messenger services making it more important… if it catches on.

Perhaps the next console hitting the market will come with a keyboard as an in-the-box solution. Please note, the above image is Sony’s prototype image.