Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Sony, Next Big Software Company?Sony, Next Big Software Company?

Every day we’re hearing of a company running through a round of layoffs or going out of business, it’s really not a happy time. Sony is not immune to the economic troubles either. Sony is talking restructuring and that involves a potential head count reduction of 16,000 jobs due to plant closings.

floppyThis leaves Sony with some hard decisions. Restructuring can mean drastic changes that effect all their product lines. The PlayStation 3 isn’t currently a shining example of high profit margins. The console needs time to reduce its overall cost, chip sizes and bring profitability. Is it in danger?

“Sony’s not in a position to halt all domestic production but it has to do something that drastic,” said Mitsushige Akino, chief fund manager at Ichiyoshi Investment Management. “If it announces plans to move production overseas while keeping only planning and development functions in Japan, that would be a positive.” (gamestooge)

The yen is losing value in our global economy making it more difficult to export the product and build any type of profitability plan. “A source said this month the company will likely suffer an annual operating loss of about $1.1 billion, its first such loss in 14 years” (news.yahoo.com) All this noise is making CEO Howard Stringer contemplate Sony’s involvement as a “software only” company, making us recall the changes at SEGA to this same result.

The Financial Times reported Sony will unveil details of its restructuring steps on Wednesday or Thursday. It said Chief Executive Howard Stringer was meeting with resistance from some executives to shifting the company’s focus to software from hardware and cutting jobs in Japan. (news.yahoo.com)

Is this just a case of a fearful executive trying to lay plans for a more stable future? Software is easier to develop, pays for itself quickly and becomes pure profit as it ages. Hardware requires constant upkeep at manufacturing facilities, chip reductions and a boat load of quality planning for first shipment. Would Sony go full software?

Let’s face it, Sony isn’t SEGA, they’ve been developing hardware for consumers since anyone can remember and they’ve been doing it with quality and market penetration. It seems absurd to think they’d forgo hardware designs in replacement of a full software solution to the problem. In addition, Sony has already invested a large amount of cash into seeing PS3 through it’s 10-year plan and letting that die now is realizing a huge loss on investment.

If Sony pushes through the economic and maintenance course, the PS3 will become highly profitable, much like the PS2 last generation (with a slower ramp up for sales). Even if they break even after ten years it seems a lot better than throwing all the effort away.

Perhaps Howard Stringer is talking “software” for the next generation home console? You think Sony will create a PlayStation 4?

July NPD Unit Sales: Wii On Top… AgainJuly NPD Unit Sales: Wii On Top… Again

Believe this, Nintendo and their Wii console takes another month as top seller. The only product that moves more hardware than the Wii is the DS. As a gamer, it’s hard to understand how the Wii product continues to sell like this with the least supported game library on the planet.

The DS is completely understandable as it has a huge library of games, is more cost effective, comes in pretty colors and can save you tons of arguments and fighting from your kids on a long trip. In many ways the DS is synonymous with peace and quiet. What does the Wii offer us? Wii Sports and a new control scheme along with a few hit titles from Nintendo but little else for now.

I’ll be the first to admit, I thought this would be Nintendo’s chance to turn it all around and get the third parties involved. They have everything going for them in terms of sales, third party developers should be pushing out games each month considering the craze factor of the hardware. This just isn’t true.

(more…)

Xbox 360 Kicking PlayStation 3 Two-to-One In EuropeXbox 360 Kicking PlayStation 3 Two-to-One In Europe

Xbox 360‘s been seeing success in Europe, but nothing compares to the success they’ve seen since the recent price cuts. Sales for the 360 are up 214% which is pushing them past the two-to-one sales ratio against the more expensive PlayStation 3.

We’re assuming this 214% increase is due to the cheaper price combined with a large selection of great game titles. No doubt Microsoft is happy to hear the news that their price cut went over so well in all countries. Unfortunately, we’re not so sure a straight PlayStation 3 price cut would drastically change the sales ratio because the PS3 still has very few exciting games when compared to the Xbox 360 which has a year head start on its bigger competitor.

Microsoft’s new to console success, being the odd duck last generation. They’ve learned a lot and has kicked up the competitive nature of console gaming, giving PlayStation 3 a run for its money. Competition is wonderful and is probably making Sony’s exec’s wonder what tactic to chooes next.

Of course, the Wii is a sales rampage and has been for a few years now. At this point, it’s not even fair to compare the two. However, we’re sure Microsoft will eventually come out and boast their recent European victories as sales figures solidify and become “official.”

Can Sony put up any Resistance to this market domination?

Read on for more press release information from ChartTrack.

(more…)