Expert: Sony Negligent In PSN Security

An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.

Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”

Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.

The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.

Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.

Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.

C-Span posted the video of the testimony here.

(Thanks, GameSpot.)

0 thoughts on “Expert: Sony Negligent In PSN Security”

  1. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

  2. One of the better pieces on the PSN fiasco that I’ve read, congrats Jonah!

    I had two jobs as a programmer; in both cases, interacting with the IT department felt more like interacting with Dilbert’s “Information prevention department”, ran by Catbert. They even wanted (and succeeded in one place) to push a “Service Level Agreement”: it’ll take two days to create a new password for this, seven days to do that etc.
    They just don’t put enough heart in it.

    To be fair, my very first job though was … in the IT department of my college! IT work is hard. If you screw up (and we did screw up sometimes), you could kiss your weekend goodbye . Usually, we’d investigate the issue that very evening, then tried to implement it either during the next day, or, at worst, if the computers we’d want to alter were being in use, in the weekend.
    The lessons I learned there is that: (1) you must react quickly and (2) if you put a bit of your heart into your work, you can get surprisingly good results.

    Nice find on the “depressing the price of such information by a “factor of five or 10? on the black market”. I guess the PSN issue is the equivalent of flooding the market with products 🙂

    @” limit the amount of data kept by companies such as Sony and to “age the data””
    This is security basics. If you don’t want to be responsible for safekeeping secret information, then don’t store secret information on your servers. Period.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

Episode 646: Late April Fool’sEpisode 646: Late April Fool’s

[This episode has been re-uploaded due to technical issues]

This week’s episode deals with the fact it was published on April Fool’s Fool’s Day, and discussion of the games that have been floating the hosts’ boats. This week’s Gaming Flashback is the magnum opus of Telltale Games: The Walking Dead. The guys also discuss the upcoming Kingdom Hearts 4 and whether anyone cares about it.

The news includes:

  • Digital games on PS3 and Vita are reportedly “expiring” and becoming unplayable
  • Ubisoft ends its NFT experiment in Ghost Recon Breakpoint
  • Konami details eFootball 2022 v1.0 update due next week
  • Blue Box: Abandoned has not been canceled

Let us know what you think.

Sony Says Competition is GoodSony Says Competition is Good

It seems the console maker who’s trailing in sales typically says how great competition is and how it’s great for the consumer. Sony’s not leading the console race, as of now, and Sony Computer Entertainment Europe president David Reeves stated in a recent interview:

The winner, he said, is the consumer. “That’s why we are not going to slag off Microsoft or Nintendo at all,” he said, “because again it’s rather like the trainer market: one year it’s Reebok, next year it’s Nike, and then suddenly it’s Adidas; it’s cyclical, but in the end everyone wins in five to ten years.”

Sony continues to speak towards their “10 year plan” and how they’re increasing momentum in the market. They’re not winning in sales but with a ten years to go, this is just the beginning. Had this statement come from Microsoft it would be a chance to worry, but Sony has proof to backup their statements.

The PlayStation 2 is going strong as a nine year-old and doesn’t seem to be letting up in game releases. Sony’s press conferences always cover the PlayStation 2 in their talks with the PSP and PlayStation 3 for three big reasons: it’s worth bragging about, it distracts from lower PS3 sales and it separates them from the competition.

Where is the GameCube or classic Xbox in Nintendo and Microsoft’s press conferences and number crunch reports? The fact is, the companies have given up on both products retiring them as “last generation” (translation: poor sales). What better reason to buy a PlayStation 3 than knowing the company is in the game for the long haul?

It might be bit cheaper to buy an Xbox 360 but who’s to say Microsoft isn’t going to announce their next generation console tomorrow and kill off the Xbox 360? Obviously, Microsoft will deny those claims but there will always be doubt without a proven track record.

On the other hand, Microsoft hasn’t seen the success in the classic Xbox and Nintendo hasn’t seen nearly the fervor over the GameCube as compared to their current generation consoles. So, that begs the question, why would they halt all that for new console announcements?

Until they’ve had more time in the market, we cannot be 100% certain what Nintendo and Microsoft are going to do when it comes to next-generation announcements while Sony’s been very clear in each press conference. As Kaz Hirai said to Eurogamer earlier:

“We certainly don’t do the consumer the disservice of basically saying that the consoles have gone by the wayside because we have a new one. Right now, a prime example? PS2 is nine years into it. Where’s the Xbox? Where’s the GameCube?”

If one console maker is looking for a way to stand out and explain their slow sales figures, Sony’s got the PS2 and its long history in their back pocket.

Now, if we could only get those game designers to continue to take it seriously and not put all their eggs into the PS3 basket.

Xbox 360 Kicking PlayStation 3 Two-to-One In EuropeXbox 360 Kicking PlayStation 3 Two-to-One In Europe

Xbox 360‘s been seeing success in Europe, but nothing compares to the success they’ve seen since the recent price cuts. Sales for the 360 are up 214% which is pushing them past the two-to-one sales ratio against the more expensive PlayStation 3.

We’re assuming this 214% increase is due to the cheaper price combined with a large selection of great game titles. No doubt Microsoft is happy to hear the news that their price cut went over so well in all countries. Unfortunately, we’re not so sure a straight PlayStation 3 price cut would drastically change the sales ratio because the PS3 still has very few exciting games when compared to the Xbox 360 which has a year head start on its bigger competitor.

Microsoft’s new to console success, being the odd duck last generation. They’ve learned a lot and has kicked up the competitive nature of console gaming, giving PlayStation 3 a run for its money. Competition is wonderful and is probably making Sony’s exec’s wonder what tactic to chooes next.

Of course, the Wii is a sales rampage and has been for a few years now. At this point, it’s not even fair to compare the two. However, we’re sure Microsoft will eventually come out and boast their recent European victories as sales figures solidify and become “official.”

Can Sony put up any Resistance to this market domination?

Read on for more press release information from ChartTrack.

(more…)