Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

New Castlevania Title For 360 and PS3: 2D or 3D?New Castlevania Title For 360 and PS3: 2D or 3D?

The Castlevania series was born in Japan on September 26th back in 1986. That knowledge in hand, you can imagine the demographic of 30+ year old gamers who would kill to get an old school franchise title on a new graphic intensive console.

We’ve had many new Castlevania releases since 1986 including releases on the Nintendo DS in 2006 with more titles arriving with the Castlevania branding. However, we’ve not seen a true “full blown” Castlevania title in some time. As a retro style gamer, I’d love to hear news that this would be a 2D game with “next generation” graphics.

There are far too few really great 2D side scrolling platformers for this generation of consoles. Outside of Nintendo, most side scroller systems become “arcade” titles in XBLA or PSN. Over the last fifteen years we’ve had plenty of 3D games with jumping and crazy camera work. Lately, we’ve had some new titles arriving that are 2D platformers like Little Big Planet and the recently released Mega Man 9.

More than likely, Konami will follow the flow and design yet another old franchise with new 3D graphics. Given the demographic for this franchise it would almost seem like a selling point to jump back to a 2D world view.

What would you like? A 3D or 2D Castlevania title on the Xbox 360 and PlayStation 3?

Nintendo Takes Yet Another Month in United StatesNintendo Takes Yet Another Month in United States

The holiday season is over, the NPD sales data for January 2008 is in and we see a common theme: Nintendo rules the show. While Sony continues to try and persuade gamers that the PlayStation 3 is in a completely different gaming category, statistic gathering companies like NPD put ’em all in one big basket.

wiifitIt makes sense for Sony to try to push themselves away from being classified with the Wii console because it makes them look bad. We’re all equal gamers here, there is no need to break into more sub-categories when only three consoles vying for top spot. Many folks (including us) criticize the slow adoption rate of Wii games, yet they steal top software sales spots as well.

  • Wii — 679,200
  • Nintendo DS — 510,800
  • Xbox 360 — 309,000
  • PlayStation 3 — 203,200
  • PlayStation Portable — 172,300
  • PlayStation 2 — 101,200

Thankfully Sony’s PlayStation 3 product took top spot on their hardware list, so that’s not so bad. Sadly, combining all Sony’s hardware still doesn’t meet the units of the Wii.

On the software sales front, Nintendo took six of the top ten positions including position’s one, two and three. Wii Fit takes number one position with an insane 777,000 units sold. The only closest product to Wii Fit was Wii Play (still!) with 415,000 units sold. Place four was held by a 360 title, Left 4 Dead sold 243,000 units.

Although many gamers haven’t turned on their Wii in ages, there is no doubt the market is red hot for Wii. At this point, we’re all wondering how long it will last — any predictions? It’s already been a long time.

Episode 230: Zombie Nazi MonkeysEpisode 230: Zombie Nazi Monkeys

This week, Jonah Falcon rants about the bosses in Deus Ex: Human Revolution while Jordan Lund expresses a desire for cold, rainy weather. This week’s Gaming Flashback is The Elder Scrolls II: Daggerfall, with the following news items:

The guys also read more reader mail, and pose this week’s Question of the Week: What was the worst game mechanic you ever dealt with in a game you liked?