An expert has given testimony to the US House of Representatives Subcomittee on Commerce, Manufacturing, and Trade during its commencement on hearings on the “unauthorized intrusion” on Sony’s PlayStation Network and Qrocity service, stating Sony knew that their security software was dated and lacked any sort of firewall against hacking.
Cybersecurity expert Dr. Gene Spafford’s testimony stated that security experts discovered discussions on forums that talked about how the PSN’s security was lacking. The threads revealed that the network was using old versions of the Apache Web server software, which “was unpatched and had no firewall installed.”
Worse, two to three months before the attack, the vulnerability was reported “in an open forum monitored by Sony employees,” but the company took no action to rectify the situation. If the testimony is accurate, Sony could be slapped with a serious criminal negligence charge.
The Sony intrusion alone compromised 100 million accounts both on the PSN and its Qriocity service, according to Spafford. He also cited the total cost of the breach to Sony, credit card companies, and other outfits, at $21 billion. Thieves in credit-card theft forums actually complained that the PSN breach was so great that it was depressing the price of such information by a “factor of five or 10” on the black market.
Spafford didn’t reserve his accusations for Sony, either. He stated that law enforcement is ill-equipped to handle cyberterrorism and cyberthieft. Additionally, most companies are not equipped with enough security measures because “investing in security measures affects the bottom line. They don’t understand the risks involved by not investing in security. … So when they are hit, they pass that cost along to their customers, and to the rest of society.” In other words, a classic case of being penny wise and pound foolish.
Spafford’s proposed solution to future security is to limit the amount of data kept by companies such as Sony and to “age the data” so it expires after a certain time.
C-Span posted the video of the testimony here.
(Thanks, GameSpot.)
Hi guys, great show again. 🙂
I like the idea of turning in a CD or just even having the old DRM code to get a digital version of the game. This is what Blizzard does with their library. I was able to get digital versions of Warcraft III and StarCraft because of my old DRM codes I had been holding on to. I think more companies should do that since we did buy the game, why should we have to pay again for a digital version?
@Steambox: I thought there was only going to be one but apparently there are going to be 13 of them priced from cheap to VERY expensive. This may be a good and easy way for people to find the steambox that will be suited to their needs.
@Sony streaming old games: I agree that I want this and that they should make their entire library available. The fact that Jordan still has a functioning backwards compatible Ps3 didn’t go unnoticed. I’d love to get one myself but the issue is they stop making these consoles so it isn’t easy to get an old console to play an old game. Much easier to just get an emulator (at least for PS1 and PS2).
@QOTW: I am most looking forward to Pillars of Eternity, it promises to be a great RPG game. Among other Kickstarter games like Wasteland 2 and Shadowgate.