Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Sony’s E3 Conference: Fairly ImpressiveSony’s E3 Conference: Fairly Impressive

We’re all used to Sony falling on their face at E3 in the last few years, but, this year, things were different. They’re information was delivered well, they had a great presentation medium using Little Big Planet‘s game engine as a presentation platform over the standard PowerPoint slides and everything went smoothly.

The format for displaying their facts, figures and sales numbers was well played. Nobody wants to sit in front of a chart and listen to an executive blab on about what they did and where they’re going. But, when you add some Little Big Planet flair, such as having the graphs built within their game engine and Sack Boy hopping around on the statistics things smooth over well.

I was confused on why they chose to display the Little Big Planet graphic engine followed by Resistance 2 and then taper into talk about the PlayStation 2 with game previews. It seems more appropriate to bring in the PlayStation 2 product line first, then blow the crowd away with the current generation graphics. Instead, we were awed by the epic Resistance 2 graphics and then presented with old generation stale game engines… silly.

They went on to show off the wide array of PSP games arriving and a little trailer for Resistance Retribution for the PSP. The game system is definitely more mature than their DS competitor but seems to have a bit less sales momentum.

Overall, Sony did one right by talking about their three tiered solution to gaming instead of focusing too much on a single system. PlayStation 3 numbers are good but not mind boggling (like Wii) and their PSP product is doing much better than it used to and the PlayStation 2 numbers are high but falling compared to last year (as would be expected).

By focusing on the full suite of products they’ve put their eggs into many baskets rather than rely on their bleeding edge flagship product which still needs time to grow.

Well done Sony.

Rhythm Gaming Saturation Point?Rhythm Gaming Saturation Point?

Rhythm Gaming is all the rage, or is it? Turns out Guitar Hero: World Tour didn’t meet or exceed the figures they hit with Guitar Hero III. Where GH3 brought in $115 million in the first week, GHWT brought in $67 million in the same time frame.

Why?

There are plenty of factors that could cut down the sales units, considering those that can purchase Guitar Hero World Tour don’t have to purchase additional instruments to play the game like they played GH3.

  • Rock Band 2: This game arrived before Guitar Hero 3 and folks went for this game instead because it was first to launch. Some gamers have to make a choice on which to purchase because they can’t buy both.
  • Hot Games: Although Rhythm gaming can be fun, a lot of great games are arriving this season so gamers have to make some big decisions.
  • Economics: The economy isn’t exactly thriving right now and retail outlets are already predicting less than stellar numbers.
  • Saturation: Since the original Guitar Hero game, we’ve had a number of titles from Activision including their Aerosmith edition and Harmonix pulling out Rock Band and Rock Band 2. There is talk of a Hendrix version and a Metallic release – how much is too much?

We know people love charts, so here is another to toss at you via Kotaku:

Guitar Hero World Tour Sales, via Kotaku

The break down from Guitar Hero 3 to World Tour is obvious, also apparent is the shift in console when buying into the rhythm gaming franchises. The Wii has started taking more market share, odd considering the DLC isn’t there, and the PS3 is showing its lackluster sales of the console by growing in proportion but not excelling to grab huge share (PS3 fanboys attack!). Sony kicked ass by taking control of the share using their PlayStation 2 with Guitar Hero 3, but has lost that lead for the World Tour.

Will these lower sales figure change the future roadmap for Activision in their Guitar Hero franchise or are they satisfied taking home $67 million in the first week of the launch. That is still a lot of money and probably doesn’t even consider any money they could (or will) potentially make on the World Tour hardware.

Luckily, the rhythm gaming content doesn’t get old with age, it just gets more classic. No doubt Guitar Hero World Tour will be landing in homes over the holidays and into 2009.

Episode 371: This Podcast Is ExtremeEpisode 371: This Podcast Is Extreme

This week is another short one as the news is pretty light. However, there is another Gaming History as The Super Mario Bros. Super Show! is examined.

This week’s news includes:

  • Destiny‘s PVP mode now breaks up teams if they’re too good
  • Xbox One sold over 720K Black Friday week in the US
  • Godzilla The Game heading to North America this Summer
  • Street Fighter V revealed as a PS4, PC exclusive (from GameSpot)

The Question of the Week: “What is your favorite giant monster?”